Fix to allow non-root users access to storage volumes. (#3714)

manifests/local-storage.yaml

@@ -124,7 +124,8 @@ data:
             ;;
         esac
     done
-    mkdir -m 0700 -p ${absolutePath}
+    mkdir -m 0777 -p ${absolutePath}
+    chmod 701 ${absolutePath}/..
   teardown: |-
     #!/bin/sh
     while getopts "m:s:p:" opt

pkg/deploy/zz_generated_bindata.go

@@ -130,7 +130,7 @@ func corednsYaml() (*asset, error) {
 	return a, nil
 }
 
-var _localStorageYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x56\x4f\x6f\xdb\x36\x14\xbf\xeb\x53\xbc\x69\xcd\x61\x43\x69\x27\xdb\x61\x1b\x8b\x1d\xdc\xc4\xc9\x02\x24\xb6\x61\x7b\x1b\x8a\xa2\x30\x28\xea\xd9\x66\x43\x91\x04\x49\xb9\x75\xb3\x7c\xf7\x81\x94\xec\x48\x8e\x9b\xd8\xd8\x76\x9b\x2e\x02\x1f\xdf\xef\xfd\xff\x43\x66\xc4\x1f\x68\x9d\xd0\x8a\xc2\xea\x2c\xb9\x13\x2a\xa7\x30\x41\xbb\x12\x1c\x7b\x9c\xeb\x52\xf9\xa4\x40\xcf\x72\xe6\x19\x4d\x00\x14\x2b\x90\x82\xd4\x9c\x49\x62\x98\x5f\x12\x63\xf5\x4a\x04\x3c\x5a\xe2\x2a\x1c\x61\x35\xb0\x62\x77\x86\x71\xa4\x70\x57\x66\x48\xdc\xda\x79\x2c\x12\x42\x48\xd2\xd4\x6c\x33\xc6\x3b\xac\xf4\x4b\x6d\xc5\x17\xe6\x85\x56\x9d\xbb\x9f\x5d\x47\xe8\xee\xea\x2c\x43\xcf\x36\x86\x9d\xcb\xd2\x79\xb4\x63\x2d\xf1\x70\xab\x6c\xe0\xb6\xa5\x44\x47\x13\x02\xcc\x88\x2b\xab\x4b\xe3\x28\xbc\x4f\xd3\x0f\x09\x80\x45\xa7\x4b\xcb\x31\x52\x94\xce\xd1\xa5\xaf\x21\x35\xc1\x36\xe7\x51\xf9\x95\x96\x65\x81\x5c\x32\x51\xc4\x1b\xae\xd5\x5c\x2c\x0a\x66\x5c\x84\xaf\xd0\x66\x11\xba\x40\x1f\xae\xa5\x70\xf1\xff\x89\x79\xbe\x4c\x3f\xbc\xac\x12\x55\x6e\xb4\x50\x7e\xaf\xda\x8a\xa8\xf3\x1d\x5d\xdf\x1f\x24\x78\x85\x41\x6a\x0b\xc8\x2d\x32\x8f\x51\xe8\x7e\xfb\x9c\xd7\x96\x2d\xb0\x8e\xff\x53\xa1\xf5\x3d\x97\xcc\x39\x3c\x30\x02\xff\x3c\xdb\x6f\x85\xca\x85\x5a\x1c\x9e\xf4\x4c\xa8\x3c\x09\x99\x1f\xe3\x3c\x30\x6f\x7c\x7c\x46\x7b\x02\xf0\xb4\xca\x0e\xa9\x2d\x57\x66\x1f\x91\xfb\x58\x5e\x7b\x1b\xe8\xbf\x6a\x1b\x66\x8c\xeb\x6e\xbb\xf6\x02\x8d\xd4\xeb\x02\x8f\xe8\xd8\xaf\xab\x72\x06\x39\x8d\xb9\x37\x52\x70\xe6\x28\x9c\x25\x00\x0e\x25\x72\xaf\x6d\xb8\x01\x28\x42\x7e\x6f\x58\x86\xd2\x55\x84\x10\x66\xf3\x8c\x2e\x8f\x85\x91\xcc\x63\x0d\x6f\x18\x19\x3e\xd9\x92\xf4\x92\x2c\x80\x8d\x89\xe1\x33\x56\x68\x2b\xfc\xfa\x3c\x94\xe5\x20\x7a\x9c\x56\x9e\x90\xd0\xd1\x84\x5b\xe1\x05\x67\x32\xad\xf9\x5d\x2b\x41\x83\xe3\xb2\x13\x3e\xaf\x25\xda\x58\x3d\x0d\x8b\x01\x08\xdc\xe1\x9a\x42\x7a\x5e\xeb\xeb\xe5\xb9\x56\x6e\xa8\xe4\x3a\x6d\x70\x01\x68\x13\xd0\xda\x52\x48\xfb\x9f\x85\xf3\x2e\xdd\x23\x24\x5a\x1e\x2a\xac\x13\x32\x63\x15\x7a\x8c\x5d\xc2\xb5\xf2\x56\x4b\x62\x24\x53\x78\x84\x5c\x00\x9c\xcf\x91\x7b\x0a\xe9\x40\x4f\xf8\x12\xf3\x52\xe2\x31\x8a\x0b\x16\xfa\xe2\xdf\xd2\x18\xdc\x60\x42\xa1\xdd\x46\x90\xbc\x54\xac\xd5\x27\x0a\xb6\x40\x0a\x27\xf7\x93\x77\x93\x69\xff\x76\x76\xd1\xbf\xec\xfd\x7e\x33\x9d\x8d\xfb\x57\xd7\x93\xe9\xf8\xdd\xc3\x89\x65\x8a\x2f\xd1\x76\xf7\x0b\xa2\xab\xd3\xce\x69\xe7\xec\x97\xb6\xc0\x51\x29\xe5\x48\x4b\xc1\xd7\x14\xae\xe7\x03\xed\x47\x16\x1d\x6e\x13\x1e\xec\x2d\x0a\xa6\xf2\xc7\x74\x93\x97\x0c\x25\xe0\x3c\xb3\xbe\x71\x26\xa4\xda\x1e\x0d\x52\x17\x3d\xef\x56\xd4\xfa\xd7\xf9\xe8\xb4\xda\x72\x54\x7b\xe0\x36\xd4\x9e\x6b\xea\xae\x42\x55\x21\x48\xc5\xd4\x88\x7c\x11\xf8\x47\xcc\x2f\x69\x4b\xc1\x96\x03\xd5\xea\xa9\xb0\xd1\xf0\x62\x36\xe8\xdd\xf6\x27\xa3\xde\x79\xbf\x21\x6c\xc5\x64\x89\x97\x56\x17\xb4\x95\xdb\xb9\x40\x99\xd7\xf3\xf5\x09\xbd\xd2\xbd\xe9\xf1\xce\x76\xcc\x24\x4d\xaf\x8e\x70\xa8\xa2\xdf\x32\xd3\xd6\xf6\xa4\x60\xea\xf8\xee\x8e\xca\xf6\x5a\x7b\x1c\x9a\x93\x8a\x1e\xe7\xc6\xb3\x63\x33\xec\x10\xa5\xb4\x6f\xf6\x7c\x73\x17\xee\xb4\x8a\x70\x24\xc7\x39\x2b\xa5\x27\xf1\x9a\x42\xea\x6d\x89\x69\xd2\xac\x43\xa8\xeb\x34\x00\x1a\x9a\x2a\xdf\xeb\x95\x77\xab\x73\xa4\xf0\x27\x13\xfe\x52\xdb\x4b\x61\x9d\x3f\xd7\xca\x95\x05\xda\xc4\x56\x8f\x92\x4d\xd1\x5e\xa0\x44\x8f\xd1\xf3\x7a\x8f\x6d\x42\x96\xec\xbc\xf2\x9e\x5d\x0f\xdb\x02\xfd\xca\x66\xd8\x00\x1b\xb5\x4a\xe1\x2f\x12\x03\x72\x5f\xe7\x26\x4e\x90\x50\x01\xb7\xcc\xa4\xf4\x7d\x4d\xbd\xdf\x66\x2e\xde\xa7\x34\xdd\x74\xee\xa8\x37\xfd\x6d\x76\x39\x1c\xcf\x06\xc3\xc1\xec\xe6\x7a\x32\xed\x5f\xcc\x06\xc3\x8b\xfe\x24\x7d\xfd\x88\x09\xd6\xb9\x94\xbe\x4f\x4f\xee\x37\xb8\x9b\xe1\x79\xef\x66\x36\x99\x0e\xc7\xbd\xab\x7e\x94\xf2\x70\x12\x9f\x24\xe1\x7b\xa8\xff\xd5\xf9\x21\xae\x2f\x1f\x5e\x00\xb5\xb1\xdf\x7e\xd3\xcd\x84\xea\xba\x65\x3c\x7d\x5a\x0a\x89\xb0\x40\xaf\x8d\x77\x90\x16\xd4\x51\x43\x53\xd0\xa6\x6a\xdf\x5c\x3f\xce\x01\xe6\x10\x5e\x69\xe3\x41\xa8\x56\x2d\x9a\xef\x5a\x47\x96\x39\x2d\x4b\x1f\xe3\xf0\xeb\xab\xe1\x68\xda\x1b\x5f\xb5\x18\xde\xbc\x69\x1d\x5d\x1b\xee\xc4\x17\xbc\x56\x6f\xd7\x1e\xdd\x21\xe8\xa2\x8d\x5e\x69\x19\x2a\xe7\x25\x24\x3a\xc6\x6b\xff\x54\xd5\x6d\xc5\x5d\x2e\x2c\x90\x02\x4e\x7f\x3a\x3d\x05\x62\xe0\xd5\x7d\xd3\x91\x87\xb8\xc6\x99\xcd\xf5\x27\xf5\x7f\x24\x9f\x8d\xa4\x2d\x80\xd8\xf9\x9e\xf8\x2d\x51\x1a\xb4\x23\x9d\x77\xd6\xac\x90\xdb\x28\xee\x34\x69\x20\x55\x7d\x3c\xd2\xf9\xde\x07\x53\xd5\xba\x95\x34\x62\x6a\xa6\xe6\xab\xe8\xeb\x1b\x76\x07\x04\xc7\x6d\x55\x91\x59\x66\xd7\x24\x2b\xdd\x3a\xd3\x9f\xe9\x59\xe7\xc7\x1f\x3a\x67\xc9\xdf\x01\x00\x00\xff\xff\x7b\xbf\x50\x37\x4b\x0e\x00\x00")
+var _localStorageYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x56\x5b\x6f\xdb\xb6\x17\x7f\xd7\xa7\x38\x7f\xfd\x9b\x87\x0d\xa5\x1c\x6f\x0f\xd9\x58\xec\xc1\x4d\x9c\x2c\x40\x62\x1b\xb6\xb7\xa1\x28\x0a\x83\xa6\x8e\x63\x36\x14\x49\x90\x94\x5b\x37\xcb\x77\x1f\x28\xca\x8e\xe4\x38\x17\x63\xdb\xdb\xf4\x22\xf0\xf0\xfc\xce\xfd\x42\x66\xc4\xef\x68\x9d\xd0\x8a\xc2\xaa\x9b\xdc\x0a\x95\x53\x98\xa0\x5d\x09\x8e\x3d\xce\x75\xa9\x7c\x52\xa0\x67\x39\xf3\x8c\x26\x00\x8a\x15\x48\x41\x6a\xce\x24\x31\xcc\x2f\x89\xb1\x7a\x25\x02\x1e\x2d\x71\x11\x47\x58\x0d\x8c\xec\xce\x30\x8e\x14\x6e\xcb\x39\x12\xb7\x76\x1e\x8b\x84\x10\x92\x34\x35\xdb\x39\xe3\x19\x2b\xfd\x52\x5b\xf1\x8d\x79\xa1\x55\x76\xfb\x93\xcb\x84\xee\xac\xba\x73\xf4\x6c\x63\xd8\xa9\x2c\x9d\x47\x3b\xd6\x12\x5f\x6f\x95\x0d\xdc\xb6\x94\xe8\x68\x42\x80\x19\x71\x61\x75\x69\x1c\x85\x8f\x69\xfa\x29\x01\xb0\xe8\x74\x69\x39\x56\x14\xa5\x73\x74\xe9\x5b\x48\x4d\xb0\xcd\x79\x54\x7e\xa5\x65\x59\x20\x97\x4c\x14\xd5\x0d\xd7\x6a\x21\x6e\x0a\x66\x5c\x05\x5f\xa1\x9d\x57\xd0\x1b\xf4\xe1\x5a\x0a\x57\xfd\xbf\x30\xcf\x97\xe9\xa7\x97\x55\xa2\xca\x8d\x16\xca\xef\x55\x1b\x89\x3a\xdf\xd1\xf5\xfd\xab\x04\xaf\x30\x48\x6d\x01\xb9\x45\xe6\xb1\x12\xba\xdf\x3e\xe7\xb5\x65\x37\x58\xc7\xff\xb1\xd0\xfa\x9e\x4b\xe6\x1c\xbe\x32\x02\x7f\x3f\xdb\xef\x85\xca\x85\xba\x79\x7d\xd2\xe7\x42\xe5\x49\xc8\xfc\x18\x17\x81\x79\xe3\xe3\x33\xda\x13\x80\xc7\x55\xf6\x9a\xda\x72\xe5\xfc\x33\x72\x5f\x95\xd7\xde\x06\xfa\xb7\xda\x86\x19\xe3\x3a\xdb\xae\x3d\x43\x23\xf5\xba\xc0\x03\x3a\xf6\x69\x55\xce\x20\xa7\x55\xee\x8d\x14\x9c\x39\x0a\xdd\x04\xc0\xa1\x44\xee\xb5\x0d\x37\x00\x45\xc8\xef\x15\x9b\xa3\x74\x91\x10\xc2\x6c\x9e\xd1\xe5\xb1\x30\x92\x79\xac\xe1\x0d\x23\xc3\x27\x5b\x92\x5e\x92\x05\xb0\x31\x31\x7c\xc6\x0a\x6d\x85\x5f\x9f\x86\xb2\x1c\x54\x1e\xa7\xd1\x13\x12\x3a\x9a\x70\x2b\xbc\xe0\x4c\xa6\x35\xbf\x6b\x25\x68\x70\x58\x76\xc2\xe7\xb5\x44\x5b\x55\x4f\xc3\x62\x00\x02\xb7\xb8\xa6\x90\x9e\xd6\xfa\x7a\x79\xae\x95\x1b\x2a\xb9\x4e\x1b\x5c\x00\xda\x04\xb4\xb6\x14\xd2\xfe\x57\xe1\xbc\x4b\xf7\x08\xa9\x2c\x0f\x15\x96\x85\xcc\x58\x85\x1e\xab\x2e\xe1\x5a\x79\xab\x25\x31\x92\x29\x3c\x40\x2e\x00\x2e\x16\xc8\x3d\x85\x74\xa0\x27\x7c\x89\x79\x29\xf1\x10\xc5\x05\x0b\x7d\xf1\x4f\x69\x0c\x6e\x30\xa1\xd0\x6e\x23\x48\x5e\x2a\xd6\xf8\x89\x82\xdd\x20\x85\xa3\xbb\xc9\x87\xc9\xb4\x7f\x3d\x3b\xeb\x9f\xf7\x7e\xbb\x9a\xce\xc6\xfd\x8b\xcb\xc9\x74\xfc\xe1\xfe\xc8\x32\xc5\x97\x68\x3b\xfb\x05\xd1\xd5\x71\x76\x9c\x75\x7f\x6e\x0b\x1c\x95\x52\x8e\xb4\x14\x7c\x4d\xe1\x72\x31\xd0\x7e\x64\xd1\xe1\x36\xe1\xc1\xde\xa2\x60\x2a\x7f\x48\x37\x79\xc9\x50\x02\xce\x33\xeb\x1b\x67\x42\xe2\xf6\x68\x90\x3a\xe8\x79\x27\x52\xeb\x5f\xf6\xd9\x69\xb5\xe5\x88\x7b\xe0\x3a\xd4\x9e\x6b\xea\x8e\xa1\x8a\x08\x12\x99\x1a\x91\x2f\x02\xff\x88\xf9\x25\x6d\x29\xd8\x72\xa0\x5a\x3d\x16\x36\x1a\x9e\xcd\x06\xbd\xeb\xfe\x64\xd4\x3b\xed\x37\x84\xad\x98\x2c\xf1\xdc\xea\x82\xb6\x72\xbb\x10\x28\xf3\x7a\xbe\x3e\xa2\x47\xdd\x9b\x1e\xcf\xb6\x63\x26\x69\x7a\x75\x80\x43\x91\x7e\xcd\x4c\x5b\xdb\xa3\x82\xa9\xe3\xbb\x3b\x2a\xdb\x6b\xed\x61\x68\x4e\x22\xbd\x9a\x1b\xcf\x8e\xcd\xb0\x43\x94\xd2\xbe\xd9\xf3\xcd\x5d\xb8\xd3\x2a\xc2\x91\x1c\x17\xac\x94\x9e\x54\xd7\x14\x52\x6f\x4b\x4c\x93\x66\x1d\x42\x5d\xa7\x01\xd0\xd0\x14\x7d\xaf\x57\xde\xb5\xce\x91\xc2\x1f\x4c\xf8\x73\x6d\xcf\x85\x75\xfe\x54\x2b\x57\x16\x68\x13\x1b\x1f\x25\x9b\xa2\x3d\x43\x89\x1e\x2b\xcf\xeb\x3d\xb6\x09\x59\xb2\xf3\xca\x7b\x76\x3d\x6c\x0b\xf4\x89\xcd\xb0\x01\x36\x6a\x95\xc2\x9f\xa4\x0a\xc8\x5d\x9d\x9b\x6a\x82\x84\x0a\xb8\x66\x26\xa5\x1f\x6b\xea\xdd\x36\x73\xd5\x7d\x4a\xd3\x4d\xe7\x8e\x7a\xd3\x5f\x67\xe7\xc3\xf1\x6c\x30\x1c\xcc\xae\x2e\x27\xd3\xfe\xd9\x6c\x30\x3c\xeb\x4f\xd2\xb7\x0f\x98\x60\x9d\x4b\xe9\xc7\xf4\xe8\x6e\x83\xbb\x1a\x9e\xf6\xae\x66\x93\xe9\x70\xdc\xbb\xe8\x57\x52\xee\x8f\xaa\x27\x49\xf8\xee\xeb\x7f\x3c\xdf\x57\xeb\xcb\x87\x17\x40\x6d\xec\xff\xff\xd7\x99\x0b\xd5\x71\xcb\xea\xf4\x65\x29\x24\xc2\x0d\x7a\x6d\xbc\x83\xb4\xa0\x8e\x1a\x9a\x82\x36\xb1\x7d\x73\xfd\x30\x07\x98\x43\x78\xa3\x8d\x07\xa1\x5a\xb5\x68\xbe\x6b\x1d\xd9\xdc\x69\x59\xfa\x2a\x0e\xbf\xbc\x19\x8e\xa6\xbd\xf1\x45\x8b\xe1\xdd\xbb\xd6\xd1\xb5\xe1\x4e\x7c\xc3\x4b\xf5\x7e\xed\xd1\xbd\x06\x5d\xb4\xd1\x2b\x2d\x43\xe5\xbc\x84\x44\xc7\x78\xed\x9f\x8a\xdd\x56\xdc\xe6\xc2\x02\x29\xe0\xf8\xe4\xe4\x04\x88\x81\x37\x77\x4d\x47\x62\x50\xf9\xb2\xd0\x39\x9c\x1c\x77\x77\x6f\x3b\x59\x56\xed\x79\x66\x73\xfd\x45\xfd\x17\xea\x67\x43\x6d\x0b\x20\x76\xb1\x27\xc0\x4b\x94\x06\xed\x48\xe7\xd9\x9a\x15\x72\x1b\xc5\x9d\x2e\x0e\xa4\xd8\xe8\x23\x9d\xef\x7d\x51\xc5\xde\x8e\xd2\x88\xa9\x99\x9a\xcf\xa6\xa7\x57\xf0\x0e\x08\x0e\x5b\xbb\x62\x6e\x99\x5d\x93\x79\xe9\xd6\x73\xfd\x95\x76\xb3\x1f\x7f\xc8\xba\xc9\x5f\x01\x00\x00\xff\xff\xfd\xc6\xd0\x47\x6c\x0e\x00\x00")
 
 func localStorageYamlBytes() ([]byte, error) {
 	return bindataRead(

tests/localstorage_int_test.go

+package tests
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"regexp"
+	"testing"
+	"time"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"github.com/rancher/k3s/pkg/util/tests"
+)
+
+var serverCmd *exec.Cmd
+var _ = BeforeSuite(func() {
+	var err error
+	serverCmd, _, err = tests.K3sCmdAsync("server", "--cluster-init")
+	Expect(err).ToNot(HaveOccurred())
+})
+
+var _ = Describe("local storage", func() {
+	When("a new local storage is created", func() {
+		It("starts up with no problems", func() {
+			Eventually(func() (string, error) {
+				return tests.K3sCmd("kubectl", "get", "pods", "-A")
+			}, "90s", "1s").Should(MatchRegexp("kube-system.+coredns.+1\\/1.+Running"))
+		})
+		It("creates a new pvc", func() {
+			Expect(tests.K3sCmd("kubectl", "create", "-f", "testdata/localstorage_pvc.yaml")).
+				To(ContainSubstring("persistentvolumeclaim/local-path-pvc created"))
+		})
+		It("creates a new pod", func() {
+			Expect(tests.K3sCmd("kubectl", "create", "-f", "testdata/localstorage_pod.yaml")).
+				To(ContainSubstring("pod/volume-test created"))
+		})
+		time.Sleep(30 * time.Second)
+		It("shows storage up in kubectl", func() {
+			Eventually(func() (string, error) {
+				return tests.K3sCmd("kubectl", "get", "pv")
+			}, "30s", "1s").Should(MatchRegexp(`pvc.+2Gi.+Bound`))
+			Eventually(func() (string, error) {
+				return tests.K3sCmd("kubectl", "get", "pvc")
+			}, "10s", "1s").Should(MatchRegexp(`local-path-pvc.+Bound`))
+		})
+		It("has proper folder permissions", func() {
+			var k3sStorage = "/var/lib/rancher/k3s/storage"
+			fileStat, err := os.Stat(k3sStorage)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(fmt.Sprintf("%04o", fileStat.Mode().Perm())).To(Equal("0701"))
+
+			pvResult, err := tests.K3sCmd("kubectl", "get", "pv")
+			Expect(err).ToNot(HaveOccurred())
+			reg, err := regexp.Compile(`pvc[^\s]+`)
+			Expect(err).ToNot(HaveOccurred())
+			volumeName := reg.FindString(pvResult) + "_default_local-path-pvc"
+			fileStat, err = os.Stat(k3sStorage + "/" + volumeName)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(fmt.Sprintf("%04o", fileStat.Mode().Perm())).To(Equal("0777"))
+		})
+		It("deletes properly", func() {
+			Expect(tests.K3sCmd("kubectl", "delete", "pod", "volume-test")).
+				To(ContainSubstring("pod \"volume-test\" deleted"))
+			Expect(tests.K3sCmd("kubectl", "delete", "pvc", "local-path-pvc")).
+				To(ContainSubstring("persistentvolumeclaim \"local-path-pvc\" deleted"))
+		})
+	})
+})
+
+var _ = AfterSuite(func() {
+	Expect(tests.K3sKillAsync(serverCmd)).To(Succeed())
+})
+
+func Test_IntegrationLocalStorage(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Local Storage Suite")
+
+}

tests/testdata/localstorage_pod.yaml

+apiVersion: v1
+kind: Pod
+metadata:
+  name: volume-test
+  namespace: default
+spec:
+  containers:
+  - name: volume-test
+    image: nginx:stable-alpine
+    imagePullPolicy: IfNotPresent
+    volumeMounts:
+    - name: volv
+      mountPath: /data
+    ports:
+    - containerPort: 80
+  volumes:
+  - name: volv
+    persistentVolumeClaim:
+      claimName: local-path-pvc

tests/testdata/localstorage_pvc.yaml

+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: local-path-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 2Gi