<p>I successfully deployed with kubernetes a custom container based on the official docker-vault image, but when using the <code>vault init</code> command I get the following error:</p>

<pre><code>* failed to initialize barrier: failed to persist keyring: mkdir vault: permission denied
</code></pre>

<p>My Dockerfile is the following:</p>

<pre><code>FROM vault:0.8.3

WORKDIR /app
ADD . /app
RUN chmod +x ./configure_vault.sh
CMD ["server", "-config=vault.conf"]
</code></pre>

<p>What I'm trying to achieve is to execute a shell script after the container is started in order to configure the vault. I have a configuration script that starts like this:</p>

<pre><code>#!/bin/bash

export VAULT_ADDR="http://127.0.0.1:8200"
vault init -key-shares=1 -key-threshold=1 &gt; vault_credentials
...
// configure some default roles and policies
</code></pre>

<p>To execute it, I configured my kubernetes yaml deployment file as follows:</p>

<pre><code>...
spec:
      containers:
      - image: // my image
        imagePullPolicy: Always
        name: vault
        ports:
          - containerPort: 8200
            name: vaultport
            protocol: TCP
        # Enable mlock for the vault executable to stop
        # memory being swapped to disk so that secrets
        # don’t get written to disk.
        securityContext:
          capabilities:
            add:
              - IPC_LOCK
        volumeMounts:
        - name: vault-volume
          mountPath: /vault/file
        lifecycle:
            postStart:
              exec:
                command: ["/bin/sh", "./configure_vault.sh"]
      volumes:
        - name: vault-volume
          persistentVolumeClaim:
            claimName: vault
</code></pre>

<p>I can see that the vault user has the correct rights over the /vault folder so I can't seem to understand why a directory creation would fail. I tried giving root privileges to the vault user or executing the script manually by using <code>kubernetes exec</code> to get a shell to the container but none of it worked.</p>

<p>I'm not sure this is the correct way to proceed so any advice is welcome!</p>

<p>You will have to check your PV. If you are using hostpath then you will have to navigate to the host on which the pod is being scheduled and grant write permissions on the directory which is specified in the PV.
You should be good after that.</p>
