kubernetes: Windows Pod with RunAsUserName and a Projected Volume does not honor file permissions in the volume

What happened:

When a Windows Pod is created with a Projected Volume and RunAsUserName set, file permissions are not handled in the projected volume. In addition if a Windows Pod is created with a Projected Volume and RunAsUser set,

    securityContext:
      runAsUser: 1000640000
      windowsOptions:
        runAsUserName: ContainerAdministrator

the Pod will be stuck at ContainerCreating:

E0611 17:38:46.666139    2260 atomic_writer.go:404] pod win-webserver/win-webserver-6dd6cd7d9-ng62b volume kube-api-access-62z59: unable to change file c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910\token with owner 1000640000: chown c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910\token: not supported by windows
E0611 17:38:46.666139    2260 atomic_writer.go:175] pod win-webserver/win-webserver-6dd6cd7d9-ng62b volume kube-api-access-62z59: error writing payload to ts data directory c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910: chown c:\var\lib\kubelet\pods\a7bddda2-a355-48cd-8ee2-71776d6de78f\volumes\kubernetes.io~projected\kube-api-access-62z59\..2021_06_11_17_38_46.035861910\token: not supported by windows

What you expected to happen:

The Pod should go to Running with the project volume files having the correct container user ownership.

How to reproduce it (as minimally and precisely as possible):

Create a Windows Pod with a Projected Volume and runAsUserName set (optionally with runAsUser to cause the stuck at ContainerCreating issue).

Anything else we need to know?:

The KEP, proposal for file permission handling in projected service account volume and its implementation did not take Windows in to account. An os.Chown() was introduced which is not supported on Windows. In addition RunAsUserName being set on Windows Pods was not taken into account.

Environment:

• Kubernetes version (use kubectl version): 1.21.1
• Cloud provider or hardware configuration: AWS / Azure
• OS: Windows Server 2019 1809
• Kernel: