Detected Zookeeper ID 1 mkdir: cannot create directory '/var/lib/zookeeper/data': Permission denied

[Devacc29]

After going through the discussions, Changing the securityContext should fix the issue. But still I'm getting the same error.
Tried changing the runAsUser 0, 1001, 1000001 as mentioned in the documentation.
Yaml:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: strimzi-kafka
  namespace: {{ .Release.Namespace }}
spec:
  kafkaExporter: 
    groupRegex: ".*"
    topicRegex: ".*"
    resources:
      limits:
        cpu: 1000m
        memory: 1000Mi
      requests:
        cpu: 1000m
        memory: 1000Mi
    logging: error
    enableSaramaLogging: true
    readinessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    livenessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    template:
      pod: # (1)
        securityContext:
          runAsUser: 1001
          fsGroup: 0
  kafka:
    config:
      auto.create.topics.enable: true
      log.message.format.version: "2.3"
      log.retention.bytes: 1073741824
      log.retention.hours: 168
      log.retention.check.interval.ms: 300000
      default.replication.factor: 3
      offsets.topic.replication.factor: 3
      transaction.state.log.min.isr: 2
      transaction.state.log.replication.factor: 3
      message.max.bytes: 786432000
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
    livenessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    readinessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    replicas: 3
    resources: {}
    logging:
      type: inline
      loggers:
        zookeeper.root.logger: "ERROR"
    storage:
      deleteClaim: false
      size: 4096Gi
      type: persistent-claim
      class: pvc-storageclass-prod-premium
    template:
      pod: # (1)
        securityContext:
          runAsUser: 1001
          fsGroup: 0
  zookeeper:
    livenessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    readinessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    replicas: 3
    resources: {}
    logging:
      type: inline
      loggers:
        zookeeper.root.logger: "ERROR"
    storage:
      deleteClaim: false
      size: 4Gi
      type: persistent-claim
      class: pvc-storageclass-prod-premium
    template:
      pod: # (1)
        securityContext:
          runAsUser: 1001
          fsGroup: 0
  entityOperator:
    topicOperator:
      resources: {}
      logging:
        type: inline
        loggers:
          zookeeper.root.logger: "ERROR"
    userOperator:
      resources: {}
      logging:
        type: inline
        loggers:
          zookeeper.root.logger: "ERROR"

[scholzj]

I think the security context you have in the example would be pretty much how it would run by default. The question is, what groups can use the storage you use -> that is what you would need to configure.

[Devacc29]

Pods are in CrashLoopBackOff state. I even tried changing the fsGroup to 0, 1001. Is there any way to determine what groups can access the storage. After logging into operator pod, id returns uid:1001 gid=0(root) groups=0(root)

[sehaj-sandhu]

did you find a solution to this issue?
I tried granting all users edit access on the PV and tried setting the security context in the yaml too, nothing worked

[Devacc29]

mount the existing pvc to any pod and change the permission.

apiVersion: v1
kind: Pod
metadata:
name: task-pv-pod
spec:
volumes:
- name: task-pv-storage
persistentVolumeClaim:
claimName: task-pv-claim #
containers:
- name: nginx
image: nginx
volumeMounts:
- mountPath: "/var/lib/zookeeper/data"
name: task-pv-storage

once pod is created log into the pod and change the permission

chown -R 1001:1001 "/var/lib/zookeeper/data"
try sudo if required to change permissions.