<p>I've created a NiFi cluster on the AWS EKS. The initial deployment was working fine. Later I attached Persistent volume and persistent volume claim to the NiFi setup. After starting the NiFi, I'm getting this error:</p>
<pre><code>ERROR in ch.qos.logback.core.rolling.RollingFileAppender[USER_FILE] - openFile(/opt/nifi/nifi-current/logs/nifi-user.log,true) call failed. java.io.FileNotFoundException: /opt/nifi/nifi-current/logs/nifi-user.log (Permission denied)
</code></pre>
<p>As I'm not an expert in NiFi and Kubernetes, I couldn't identify the issue. It looks like a permission issue on NiFi. The NiFi version I'm using is NiFI 1.15.0.</p>
<p>What may be the possible root cause for this? Is that because NiFi is not using the root user or is that something else?</p>
<p>I'm sharing the full error here:</p>
<pre><code>13:56:22,449 |-ERROR in ch.qos.logback.core.rolling.RollingFileAppender[USER_FILE] - openFile(/opt/nifi/nifi-current/logs/nifi-user.log,true) call failed. java.io.FileNotFoundException: /opt/nifi/nifi-current/logs/nifi-user.log (Permission denied)
    at java.io.FileNotFoundException: /opt/nifi/nifi-current/logs/nifi-user.log (Permission denied)
    at  at java.io.FileOutputStream.open0(Native Method)
    at  at java.io.FileOutputStream.open(FileOutputStream.java:270)
    at  at java.io.FileOutputStream.&lt;init&gt;(FileOutputStream.java:213)
    at  at ch.qos.logback.core.recovery.ResilientFileOutputStream.&lt;init&gt;(ResilientFileOutputStream.java:26)
    at  at ch.qos.logback.core.FileAppender.openFile(FileAppender.java:204)
    at  at ch.qos.logback.core.FileAppender.start(FileAppender.java:127)
    at  at ch.qos.logback.core.rolling.RollingFileAppender.start(RollingFileAppender.java:100)
    at  at ch.qos.logback.core.joran.action.AppenderAction.end(AppenderAction.java:90)
    at  at ch.qos.logback.core.joran.spi.Interpreter.callEndAction(Interpreter.java:309)
    at  at ch.qos.logback.core.joran.spi.Interpreter.endElement(Interpreter.java:193)
    at  at ch.qos.logback.core.joran.spi.Interpreter.endElement(Interpreter.java:179)
    at  at ch.qos.logback.core.joran.spi.EventPlayer.play(EventPlayer.java:62)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:165)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:152)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:110)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:53)
    at  at ch.qos.logback.classic.util.ContextInitializer.configureByResource(ContextInitializer.java:75)
    at  at ch.qos.logback.classic.util.ContextInitializer.autoConfig(ContextInitializer.java:150)
    at  at org.slf4j.impl.StaticLoggerBinder.init(StaticLoggerBinder.java:84)
    at  at org.slf4j.impl.StaticLoggerBinder.&lt;clinit&gt;(StaticLoggerBinder.java:55)
    at  at org.slf4j.LoggerFactory.bind(LoggerFactory.java:150)
    at  at org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:124)
    at  at org.slf4j.LoggerFactory.getILoggerFactory(LoggerFactory.java:417)
    at  at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:362)
    at  at org.apache.nifi.bootstrap.RunNiFi.&lt;init&gt;(RunNiFi.java:145)
    at  at org.apache.nifi.bootstrap.RunNiFi.main(RunNiFi.java:284)
</code></pre>
<p>I'm also sharing the Kubernetes manifest part that describe the pv and PVC I used for creating the NiFi cluster:</p>
<pre><code>        volumeMounts:
          - name: &quot;data&quot;
            mountPath: /opt/nifi/nifi-current/data
          - name: &quot;flowfile-repository&quot;
            mountPath: /opt/nifi/nifi-current/flowfile_repository
          - name: &quot;content-repository&quot;
            mountPath: /opt/nifi/nifi-current/content_repository
          - name: &quot;provenance-repository&quot;
            mountPath: /opt/nifi/nifi-current/provenance_repository
          - name: &quot;logs&quot;
            mountPath: /opt/nifi/nifi-current/logs

  volumeClaimTemplates:
    - metadata:
        name: &quot;data&quot;
      spec:
        accessModes: [&quot;ReadWriteOnce&quot;]
        storageClassName: &quot;gp2&quot;
        resources:
          requests:
            storage: 1Gi
    - metadata:
        name: &quot;flowfile-repository&quot;
      spec:
        accessModes: [&quot;ReadWriteOnce&quot;]
        storageClassName: &quot;gp2&quot;
        resources:
          requests:
            storage: 10Gi
    - metadata:
        name: &quot;content-repository&quot;
      spec:
        accessModes: [&quot;ReadWriteOnce&quot;]
        storageClassName: &quot;gp2&quot;
        resources:
          requests:
            storage: 10Gi
    - metadata:
        name: &quot;provenance-repository&quot;
      spec:
        accessModes: [&quot;ReadWriteOnce&quot;]
        storageClassName: &quot;gp2&quot;
        resources:
          requests:
            storage: 10Gi
    - metadata:
        name: &quot;logs&quot;
      spec:
        accessModes: [&quot;ReadWriteOnce&quot;]
        storageClassName: &quot;gp2&quot;
        resources:
          requests:
            storage: 5Gi
</code></pre>
<p>Any help is appreciated.</p>

<p>Assuming you don´t have any issues creating pv and pvc, try to use an extra <code>initContainers</code> section to allow the NiFi user with UID and GID 1000 read and write to the provisioned EBS volume:</p>
<pre class="lang-yaml prettyprint-override"><code>initContainers:
- name: fixmount
  image: busybox
  command: [ 'sh', '-c', 'chown -R 1000:1000 /opt/nifi/nifi-current/logs' ]
  volumeMounts:
  - name: logs
    mountPath: /opt/nifi/nifi-current/logs
</code></pre>
<p>I hope this will help solve your issues. Here is the official Kubernetes documentation page <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">Init Containers</a>.</p>
