chown: changing ownership of ‘/var/lib/postgresql/data’: Operation not permitted, when running in kubernetes with mounted "/var/lib/postgres/data" volume

[arnold0617]

I am running docker.io/postgres:9.6.5 in kubernetes, pod crash loop back off all the time.

I found this message in log, "chown: changing ownership of ‘/var/lib/postgresql/data’: Operation not permitted"

[k8s-github-robot]

@arnold0617
There are no sig labels on this issue. Please add a sig label by:

1. mentioning a sig: @kubernetes/sig-<group-name>-<group-suffix>
   e.g., @kubernetes/sig-contributor-experience-<group-suffix> to notify the contributor experience sig, OR

2. specifying the label manually: /sig <label>
   e.g., /sig scalability to apply the sig/scalability label

Note: Method 1 will trigger an email to the group. See the group list and label list.
The <group-suffix> in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals

[arnold0617]

I fixed this problem.

This is caused by the parameter of nfs, after setting nfs mount parameter like below, it works fine.
/nfs/data *(rw,sync,no_subtree_check,no_root_squash)

[mpun]

It worked for me. You saved my day.

[RomanGalochkin]

It does not work for me.

[RomanGalochkin]

To solve this problem do it:

1. Set NFS export dir:
   "nfs/main *(rw,sync,no_subtree_check,no_root_squash)"
   And then restart NFS server:
   sudo /etc/init.d/nfs-kernel-server restart
   or
   sudo exportfs -arv
2. Set NFS volume like this:

  nfs:
    server: ***
    path: "nfs/main/data"

3. Update your entity configuration:

         volumeMounts:
            - name: postgres-storage
              mountPath: /var/lib/postgresql/data
              readOnly: false

[malcolmm83]

I guess the only alternative really is run as non-root?

[RomanGalochkin]

No, it is not alternative.

[mhellsten]

I got past it by setting userid and groupid to 999 on the container (the IDs of the mysql user and groups inside the container).

[ThePlenkov]

@mhellsten did you use security context for this?