<p>I'm attempting to create a persistent volume claim for my pgadmin deployment so I can persist my settings, servers, etc. when I rollout updates after each deployment from CD pipeline.</p>
<p>In my logs I'm getting the following errors:</p>
<pre><code>...
[2020-10-05 00:54:56 +0000] [91] [INFO] Worker exiting (pid: 91)
WARNING: Failed to set ACL on the directory containing the configuration database:
           [Errno 1] Operation not permitted: '/var/lib/pgadmin'
HINT   : You may need to manually set the permissions on
         /var/lib/pgadmin to allow pgadmin to write to it.
ERROR  : Failed to create the directory /var/lib/pgadmin/sessions:
           [Errno 13] Permission denied: '/var/lib/pgadmin/sessions'
HINT   : Create the directory /var/lib/pgadmin/sessions, ensure it is writeable by
         'pgadmin', and try again, or, create a config_local.py file
         and override the SESSION_DB_PATH setting per
         https://www.pgadmin.org/docs/pgadmin4/4.26/config_py.html
</code></pre>
<p>Just a bunch of permission failures for writing:</p>
<h1>PGAdmin deployment</h1>
<pre class="lang-yml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgadmin
spec:
  selector:
   matchLabels:
    app: pgadmin
  replicas: 1
  template:
    metadata:
      labels:
        app: pgadmin
    spec:
      containers:
        - name: pgadmin4
          image: dpage/pgadmin4
          volumeMounts:
            - mountPath: /var/lib/pgadmin
              name: pgadminstorage
          env:
           - name: PGADMIN_DEFAULT_EMAIL
             valueFrom:
               secretKeyRef:
                 name: un
                 key: un
           - name: PGADMIN_DEFAULT_PASSWORD
             valueFrom:
               secretKeyRef:
                 name: pw 
                 key: pw
           - name: PGADMIN_PORT
             value: &quot;80&quot;
          ports:
            - containerPort: 80
              name: pgadminport
      volumes:
        - name: pgadminstorage
          persistentVolumeClaim:
            claimName: pgadmin-persistent-volume-claims-cfg
</code></pre>
<h1>Volumes</h1>
<pre><code>apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pgadmin-persistent-volume-claims-cfg
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
</code></pre>
<p>What could I be missing here?</p>
<h1>Update:</h1>
<p>This might be a problem specific to digitalocean and inability to set permissions. PVC will set perms to root, but writing as pgadmin is causing issues at startup Adding this to my pgadmin deployment fixed everything</p>
<pre><code>      initContainers:
        - name: pgadmin-data-permission-fix
          image: busybox
          command: [&quot;/bin/chown&quot;, &quot;-R&quot;, &quot;5050:5050&quot;, &quot;/var/lib/pgadmin&quot;]
          volumeMounts:
          - name: pgadminstorage
            mountPath: /var/lib/pgadmin
</code></pre>
<p>You could probably also chmod recursive on the dir as well and also be fine.</p>

<p>I've replicated your issue. Root cause is with <a href="https://stackoverflow.com/questions/46707935/oserror-errno-13-permission-denied-var-lib-pgadmin">PgAdmin</a> issue, not Kubernetes. Pods will be deployed without issue. You will receive error as container won't be able to create folder inside folder <code>/var/lib</code>. If you will check <code>pgadmin</code> pod logs - <code>kubectl logs &lt;pgadmin-pod&gt;</code> you will see errors like:</p>
<pre><code>$ kubectl logs pgadmin-d569b67fd-8rnkc
WARNING: Failed to set ACL on the directory containing the configuration database:
           [Errno 1] Operation not permitted: '/var/lib/pgadmin'
HINT   : You may need to manually set the permissions on
         /var/lib/pgadmin to allow pgadmin to write to it.
ERROR  : Failed to create the directory /var/lib/pgadmin/sessions:
           [Errno 13] Permission denied: '/var/lib/pgadmin/sessions'
HINT   : Create the directory /var/lib/pgadmin/sessions, ensure it is writeable by
         'pgadmin', and try again, or, create a config_local.py file
         and override the SESSION_DB_PATH setting per
         https://www.pgadmin.org/docs/pgadmin4/4.26/config_py.html
sudo: setrlimit(RLIMIT_CORE): Operation not permitted
</code></pre>
<p>If you will check <code>/var/lib/</code> folder permissions you will se that you can only <code>Read</code> and <code>Execute</code>, so you won't be able to create in this folder anything (as default, you will be logged as <code>pgadmin</code> user).</p>
<pre><code>drwxr-xr-x    1 root     root          4096 Sep  5 14:01 lib
</code></pre>
<p>Depends on your needs you can resolve it in a few ways. As fastest workaround you can just change path to folder which allows <code>Write</code>, like <code>tmp</code>.</p>
<pre><code>drwxrwxrwt    1 root     root          4096 Oct  5 14:28 tmp
</code></pre>
<p>In <code>YAML</code> it would looks like:</p>
<pre><code>  containers:
    - name: pgadmin4
      image: dpage/pgadmin4
      volumeMounts:
        - mountPath: /var/tmp/pgadmin
          name: pgadminstorage
</code></pre>
<p>When you will check logs, there won't be any issues.</p>
<pre><code>$ kubectl logs pgadmin-6bb74cffb8-6q9tr
NOTE: Configuring authentication for SERVER mode.

sudo: setrlimit(RLIMIT_CORE): Operation not permitted
[2020-10-05 14:28:15 +0000] [1] [INFO] Starting gunicorn 19.9.0
[2020-10-05 14:28:15 +0000] [1] [INFO] Listening at: http://[::]:80 (1)
[2020-10-05 14:28:15 +0000] [1] [INFO] Using worker: threads
/usr/local/lib/python3.8/os.py:1023: RuntimeWarning: line buffering (buffering=1) isn't supported in binary mode, the default buffer size will be used
  return io.open(fd, *args, **kwargs)
[2020-10-05 14:28:15 +0000] [89] [INFO] Booting worker with pid: 89
user@cloudshell:~/pgadmin (project)$
</code></pre>
<p>Regarding <code>PgAdmin</code> permissions issue there was already a few topics on <code>StackOverflow</code> or <code>Github</code> like:
<a href="https://stackoverflow.com/questions/46707935/oserror-errno-13-permission-denied-var-lib-pgadmin">OSError: [Errno 13] Permission denied: '/var/lib/pgadmin'</a></p>
<p><a href="https://github.com/laradock/laradock/issues/2552" rel="nofollow noreferrer">pgadmin exit code 3 PermissionError: [Errno 13] Permission denied: '/var/lib/pgadmin/sessions'</a></p>
<p><a href="https://github.com/helm/charts/issues/19690" rel="nofollow noreferrer">[stable/pgadmin] files in /var/lib/pgadmin/sessions crash the pod</a></p>
<p>In short, you could try to manually change permissions or use specific user.</p>
<p>In addition, if you are using Cloud environment, you could think about using <a href="https://cloud.google.com/sql" rel="nofollow noreferrer">CloudSQL</a>, instead of trying to put database into cloud. For example <code>PostgreSQL with GKE</code></p>
<p><strong>EDIT</strong></p>
<p>As per @Ryan comment below this answer, you can also use <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">Init Containers</a> to change <code>/var/lib/</code> permissions. Each <code>init container</code> must complete successfully before the next one starts and it runs before app containers in a <code>pod</code>.</p>
<blockquote>
<p>specialized containers that run before app containers in a Pod. Init containers can contain utilities or setup scripts not present in an app image.</p>
</blockquote>
