mkdir: cannot create directory '/bitnami/<chart>/data': Permission denied

[achar007]

Name and Version

bitnami/mariadb

What architecture are you using?

amd64

What steps will reproduce the bug?

Attempting to install MariaDB using Helm on a K8s cluster.
Successful installation using the provided Helm command.
I had created a Persistent Volume (PV) using the manifest file below:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfs-pv
spec:
  capacity:
    storage: 20Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  storageClassName: nfs-pc
  mountOptions:
    - hard
    - nfsvers=4.1
  nfs:
    path: /nfs/data
    server: 192.168.56.1

kubectl apply -f pv.yml

helm install my-mariadb bitnami/mariadb -n my-mariadb

MariaDB pod fails to come up healthy due to volume permissions issue.

kubectl -n my-mariadb logs pods/my-mariadb-0 
mariadb 13:58:45.97 INFO  ==> 
mariadb 13:58:45.98 INFO  ==> Welcome to the Bitnami mariadb container
mariadb 13:58:45.98 INFO  ==> Subscribe to project updates by watching https://github.com/bitnami/containers
mariadb 13:58:45.98 INFO  ==> Submit issues and feature requests at https://github.com/bitnami/containers/issues
mariadb 13:58:45.98 INFO  ==> 
mariadb 13:58:45.99 INFO  ==> ** Starting MariaDB setup **
mariadb 13:58:46.00 INFO  ==> Validating settings in MYSQL_*/MARIADB_* env vars
mariadb 13:58:46.02 INFO  ==> Initializing mariadb database
mkdir: cannot create directory '/bitnami/mariadb/data': Permission denied

What values I need to change to fix this permission issue.

Attempted to set volume permissions with Helm install command:

helm install my-mariadb bitnami/mariadb --set volumePermissions.enabled=true -n my-mariadb

However, the init container for changing permissions fails.

kubectl get pods -n my-mariadb 
NAME           READY   STATUS                  RESTARTS        AGE
my-mariadb-0   0/1     Init:CrashLoopBackOff   7 (2m54s ago)   14m

kubectl logs my-mariadb-0 -c volume-permissions --namespace my-mariadb
chown: changing ownership of '/bitnami/mariadb': Operation not permitted

Are you using any custom parameters or values?

I followed the documentation -

https://docs.bitnami.com/kubernetes/faq/troubleshooting/troubleshooting-helm-chart-issues/

--set volumePermissions.enabled=true

What is the expected behavior?

No response

What do you see instead?

MariaDB pod fails to initialize due to permission issues.

kubectl -n my-mariadb logs pods/my-mariadb-0 
mariadb 13:58:45.97 INFO  ==> 
mariadb 13:58:45.98 INFO  ==> Welcome to the Bitnami mariadb container
mariadb 13:58:45.98 INFO  ==> Subscribe to project updates by watching https://github.com/bitnami/containers
mariadb 13:58:45.98 INFO  ==> Submit issues and feature requests at https://github.com/bitnami/containers/issues
mariadb 13:58:45.98 INFO  ==> 
mariadb 13:58:45.99 INFO  ==> ** Starting MariaDB setup **
mariadb 13:58:46.00 INFO  ==> Validating settings in MYSQL_*/MARIADB_* env vars
mariadb 13:58:46.02 INFO  ==> Initializing mariadb database
mkdir: cannot create directory '/bitnami/mariadb/data': Permission denied

kubectl get pods -n my-mariadb 
NAME           READY   STATUS                  RESTARTS        AGE
my-mariadb-0   0/1     Init:CrashLoopBackOff   7 (2m54s ago)   14m

kubectl logs my-mariadb-0 -c volume-permissions --namespace my-mariadb
chown: changing ownership of '/bitnami/mariadb': Operation not permitted

Additional information

No response

[achar007]

is this because the initContainer running as USER 1001 doesn't have permission to change the ownership as per the container dockerfile - https://github.com/bitnami/containers/blob/main/bitnami/os-shell/11/debian-11/Dockerfile#L51
If so should this image needs to run as root ?

[carrodher]

Bitnami containers are designed to operate as non-root by default. Consequently, any files or directories used by the application should be owned by the root group, as the random user (1001 by default) is a member of this root group. To ensure proper permissions, you'll need to adjust the ownership of your local directory accordingly.

For more comprehensive information about non-root containers and their significance for security, you can explore the following resources:

• Why non-root containers are important for security
• Use Non-Root Containers
• Work With Non-Root Containers for Bitnami Applications
• Running non-root containers on Openshift

These references provide valuable insights into the best practices and considerations when working with non-root containers in Bitnami applications.

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.