<p>I'm using this <code>Dockerfile</code> to deploy it on openshift. - <a href="https://github.com/sclorg/postgresql-container/tree/master/9.5" rel="nofollow noreferrer">https://github.com/sclorg/postgresql-container/tree/master/9.5</a></p>

<p>It works fine, until I enabled <code>ssl=on</code> and injected the <code>server.crt</code> and <code>server.key</code> file into the postgres pod via volume mount option.</p>

<p>Secret is created like </p>

<pre><code>$ oc secret new postgres-secrets \
  server.key=postgres/server.key \
  server.crt=postgres/server.crt \
  root-ca.crt=ca-cert
</code></pre>

<p>The volume is created as bellow and attached to the given <code>BuidlConfig</code> of postgres.</p>

<pre><code>$ oc volume dc/postgres \
  --add --type=secret \
  --secret-name=postgres-secrets \
  --default-mode=0600 \
 -m /var/lib/pgdata/data/secrets/secrets/
</code></pre>

<p>Problem is the mounted files of <code>secret.crt</code> and <code>secret.key</code> files is owned by <code>root</code> user, but <code>postgres</code> expect it should be owned by the <code>postgres</code> user. Because of that the postgres server won't come up and says this error.</p>

<blockquote>
  <p>waiting for server to start....FATAL:  could not load server
  certificate file "/var/lib/pgdata/data/secrets/secrets/server.crt":
  Permission denied  stopped waiting pg_ctl: could not start server</p>
</blockquote>

<p>How we can insert a volume and update the <code>uid:guid</code> of the files in it ?</p>

<p>It looks like this is not trivial, as it requires to set Volume Security Context so all the containers in the pod are run as a certain user <a href="https://docs.openshift.com/enterprise/3.1/install_config/persistent_storage/pod_security_context.html" rel="nofollow noreferrer">https://docs.openshift.com/enterprise/3.1/install_config/persistent_storage/pod_security_context.html</a></p>

<p>In the Kubernetes projects, this is something that is still under discussion <a href="https://github.com/kubernetes/kubernetes/issues/2630" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/2630</a>, but seems that you may have to use Security Contexts and PodSecurityPolicies in order to make it work. </p>

<p>I think the easiest option (without using the above) would be to use a container entrypoint that, before actually executing PostgreSQL, it chowns the files to the proper user (postgres in this case).</p>
