<p>I'm getting the <code>Failed to created node environment</code> error with an elasticsearch docker image:</p>

<pre><code>[unknown] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: Failed to create node environment
</code></pre>

<p>The persistent volume for elasticsearch data is at <code>/mnt/volume/elasticsearch-data</code>.</p>

<p>I'm able to solve this problem by <code>ssh</code> into the remote machine and run <code>chown 1000:1000 /mnt/volume/elasticsearch-data</code>. But I don't want to do it manually. How can I solve this privilege issue using the <code>deployment.yaml</code> file?</p>

<p>I've read that using <code>fsGroup: 1000</code> in <code>securityContext</code> should solve the problem, but it isn't working for me.</p>

<p>deployment.yaml:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: elasticsearch
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
        - name: elasticsearch
          image: me-name/elasticsearch:6.7
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 9200
          envFrom:
            - configMapRef:
                name: elasticsearch-config
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
        capabilities:
          add:
            - IPC_LOCK
            - SYS_RESOURCE
      volumes:
        - name: elasticsearch-volume
          persistentVolumeClaim:
            claimName: elasticsearch-pv-claim
      lifecycle:
        postStart:
          exec:
            command: ["/bin/sh", "-c", "sysctl -w vm.max_map_count=262144"]
</code></pre>

<p>storage.yaml:</p>

<pre><code>kind: PersistentVolume
apiVersion: v1
metadata:
  name: elasticsearch-pv-volume
  labels:
    type: local
    app: elasticsearch
spec:
  storageClassName: manual
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/mnt/volume/elasticsearch-data"
  persistentVolumeReclaimPolicy: Delete

---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: elasticsearch-pv-claim
  labels:
    app: elasticsearch
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 5Gi
</code></pre>

<p>There seems to be on <a href="https://github.com/kubernetes/minikube/issues/1990" rel="nofollow noreferrer">open bug</a> regarding permissions hostPath volumes. To work around this issue you should create an initContainer initially setting the proper permissions:</p>

<pre><code>piVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: elasticsearch
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      initContainers:
        - name: set-permissions
          image: registry.hub.docker.com/library/busybox:latest
          command: ['sh', '-c', 'mkdir -p /usr/share/elasticsearch/data &amp;&amp; chown 1000:1000 /usr/share/elasticsearch/data' ]
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      containers:
        - name: elasticsearch
          image: me-name/elasticsearch:6.7
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 9200
          envFrom:
            - configMapRef:
                name: elasticsearch-config
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
        capabilities:
          add:
            - IPC_LOCK
            - SYS_RESOURCE
      volumes:
        - name: elasticsearch-volume
          persistentVolumeClaim:
            claimName: elasticsearch-pv-claim
      lifecycle:
        postStart:
          exec:
            command: ["/bin/sh", "-c", "sysctl -w vm.max_map_count=262144"]
</code></pre>

<p><del>You are on the right track by setting the <code>fsGroup</code> but what you are currently doing is setting the <em>user</em> to <code>1000</code> and mounting the volume with access to the <em>group</em> <code>1000</code>. What you should change is to use <code>runAsGroup: 1000</code> instead of <code>runAsUser: 1000</code>. </del></p>
