Permission denied to TLS key on K8s

[dajester2013]

I am trying to deploy postgres 12.4 to kubernetes. I have set up a certificate using cert-manager.io, and it is being mounted as a volume from a secret.

The first time I tried, initdb complained that the permissions on the key file were too open. So I changed the file mode to 600, then 640 as suggested, but now I get this:

waiting for server to start....2020-10-27 11:37:28.737 GMT [46] FATAL:  could not load private key file "/var/run/secrets/pg/certs/tls.key": Permission denied

These are the resources I'm creating: https://gist.github.com/dajester2013/a4df3195905c416016ee7dc783b1d98f

[wglambert]

Google says 700 or 740 permissions https://stackoverflow.com/questions/12087683/postgresql-wont-start-server-key-has-group-or-world-access

[dajester2013]

Google says 700 or 740 permissions https://stackoverflow.com/questions/12087683/postgresql-wont-start-server-key-has-group-or-world-access

First off, postgres says 600 for user-owned, or 640 for root-owned. Tried both - neither worked.

Second, I'm not loading the certificates from a folder volume - I'm loading them from a kubernetes secret. If I do not specify any mode on the files, as I do here: https://gist.github.com/dajester2013/a4df3195905c416016ee7dc783b1d98f#file-postgres-k8s-yaml-L170, it complains that the mode is too permissive. If I set the mode to either of the above, it fails saying permission denied.

[wglambert]

Since the secret is mounted with root ownership and can't be changed until kubernetes/kubernetes#81089 is resolved; you could try a workaround like what's shown here https://stackoverflow.com/a/57908921

[dajester2013]

I was able to get it working with this, though not sure how portable it is. I had tried setting the fsGroup in the security context to 26 (I had seen that as the UID at some point in my hackery). I was on the right track but launching the container as root and running id postgres, I saw that the postgres user was assigned the 'ssl-cert' group, with an id of 101.

Setting the fsGroup to 101 and the file mode to 0640 appears to have worked. I've updated the gist.