Support exposing user, group and perm patterns

[treydock]

This is still untested but the idea is to allow the setup command to be this:

install -d -u $VOL_USER -g $VOL_GROUP -m $VOL_PERM $VOL_DIR

We are overloading local-path-provisioner to allow PVC storage onto our cluster filesystems and having root:root and 0777 on a shared resource is far from ideal especially when we sometimes deal with very sensitive data on our clusters where a 0777 directory behind a 0700 directory still raises red flags.

[treydock]

This has been verified.

# kubectl get storageclass local-ess -o yaml
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  annotations:
    allowUnsafePathPattern: "true"
    defaultVolumeType: hostPath
    groupPattern: '{{ index .PVC.Labels "osc.edu/service-account-gid" }}'
    meta.helm.sh/release-name: local-path-provisioner
    meta.helm.sh/release-namespace: local-path-provisioner
    permPattern: '{{ or (index .PVC.Annotations "osc.edu/volume-permission") "0750" }}'
    storageclass.kubernetes.io/is-default-class: "false"
    userPattern: '{{ index .PVC.Labels "osc.edu/service-account-uid" }}'
  creationTimestamp: "2026-03-04T17:45:11Z"
  labels:
    app.kubernetes.io/instance: local-path-provisioner
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: local-path-provisioner
    app.kubernetes.io/version: v0.0.34
    helm.sh/chart: local-path-provisioner-0.0.34-osc-r1
  name: local-ess
  resourceVersion: "1412207233"
  uid: 57e1886e-de29-48df-8f78-676cf727a1aa
parameters:
  pathPattern: '{{ index .PVC.Annotations "osc.edu/fileset" }}/kubernetes-dev-{{ .PVC.Namespace }}-{{ .PVC.Name }}'
provisioner: cluster.local/local-path-provisioner
reclaimPolicy: Delete
volumeBindingMode: Immediate

The following PVC was used to test:

$ kubectl get pvc -n tdockendorf test-ess -o yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"PersistentVolumeClaim","metadata":{"annotations":{"osc.edu/fileset":"PZS0708"},"name":"test-ess","namespace":"tdockendorf"},"spec":{"accessModes":["ReadWriteMany"],"resources":{"requests":{"storage":"8Gi"}},"storageClassName":"local-ess"}}
    osc.edu/fileset: PZS0708
    pv.kubernetes.io/bind-completed: "yes"
    pv.kubernetes.io/bound-by-controller: "yes"
    volume.beta.kubernetes.io/storage-provisioner: cluster.local/local-path-provisioner
    volume.kubernetes.io/storage-provisioner: cluster.local/local-path-provisioner
  creationTimestamp: "2026-03-04T18:26:40Z"
  finalizers:
  - kubernetes.io/pvc-protection
  labels:
    osc.edu/service-account: tdockendorf
    osc.edu/service-account-gid: "5509"
    osc.edu/service-account-uid: "20821"
  name: test-ess
  namespace: tdockendorf
  resourceVersion: "1412210949"
  uid: 0b4d7b5a-0909-4a8d-9bac-a71435df3c32
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 8Gi
  storageClassName: local-ess
  volumeMode: Filesystem
  volumeName: pvc-0b4d7b5a-0909-4a8d-9bac-a71435df3c32
status:
  accessModes:
  - ReadWriteMany
  capacity:
    storage: 8Gi
  phase: Bound

The resulting directory:

$ ls -la /fs/ess/PZS0708/kubernetes-dev-tdockendorf-test-ess/
total 1
drwxr-x---+ 2 tdockendorf PZS0708 4096 Mar  4 13:26 .

[treydock]

@derekbit Could I get a review please?

[treydock]

@innobead Could I get a review please?

[derekbit]

@derekbit Could I get a review please?

Sure. I will review it soon.

[treydock]

@derekbit Could I get a review please?

[derekbit]

@derekbit Could I get a review please?

Sure. Sorry for the late review.

[github-actions]

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[jcpunk]

I think this could still be useful.

[treydock]

@derekbit Could this get a review please?

[treydock]

@derekbit This could still use a review please.

[Copilot]

Pull request overview

Adds support for rendering StorageClass-configured userPattern, groupPattern, and permPattern templates from PVC metadata and exposing the results to helper setup/teardown scripts via new environment variables, enabling safer default ownership/mode for provisioned directories.

Changes:

• Add userPattern/groupPattern/permPattern resolution and pass results to the helper pod as VOL_USER/VOL_GROUP/VOL_PERM.
• Extend the Helm chart to optionally set these patterns as StorageClass parameters.
• Document the new environment variables and pattern behavior in the README.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
README.md	Documents new VOL_USER/VOL_GROUP/VOL_PERM env vars and pattern usage.
provisioner.go	Implements pattern rendering and injects rendered values into helper pod env.
deploy/chart/local-path-provisioner/values.yaml	Adds chart values for user/group/perm patterns.
deploy/chart/local-path-provisioner/templates/storageclass.yaml	Wires chart values into StorageClass parameters.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.