Setting `fsGroup` without a change policy leaves Kubernetes on its default of
`Always`, which walks the whole volume and chowns every file each time the pod
starts. On an instance with a few thousand attachments that turns every
restart into a wait, and a slow enough one fails the readiness probe.
`OnRootMismatch` checks the top directory and stops there when it already
matches, so an existing volume pays the walk once.
Daniel Hiller
fe00e81a81