A shared emptyDir volume is not group-readable by the app process even though runAsUser is set. Which Pod securityContext field should fix volume group permissions?
Select an answer to reveal the explanation.
Short Explanation
fsGroup is how Kubernetes says "make these mounted files readable by this group badge." Set it on the Pod securityContext so volumes match the app UID/GID. hostPID, privilege escalation, and Service annotations won't fix mount ownership.
Full Explanation
PodSecurityContext.fsGroup causes Kubernetes to change ownership/permissions on mounted volumes so processes in that supplemental group can access them. This is the standard fix when a non-root runAsUser cannot read volume content. hostPID, allowPrivilegeEscalation, and Service annotations do not perform that ownership adjustment.