<p>I'm trying to isntall Jenkins on Kubernetes using Helm 3 and following hte official instructions but running up against a permission issue.</p>
<pre><code>---

apiVersion: v1
kind: Namespace
metadata:
  name: jenkins
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: jenkins-pv
  namespace: jenkins
spec:
  storageClassName: jenkins-pv
  accessModes:
    - ReadWriteOnce
  capacity:
    storage: 5Gi
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: /data/jenkins-volume/
</code></pre>
<p>Then pull down the <code>values.yaml</code> file: <code>wget https://raw.githubusercontent.com/jenkinsci/helm-charts/main/charts/jenkins/values.yaml</code></p>
<p>I adjust the <code>adminPassword</code> (this is a demo system): <code>adminPassword: &quot;mySecret&quot;</code></p>
<p>Finally I change <code>storageClass:</code> to be <code>storageClass: jenkins-pv</code></p>
<h1>Output / Debug Logs</h1>
<pre><code>$ kubectl logs -n jenkins jenkins-0 init
disable Setup Wizard
/var/jenkins_config/apply_config.sh: 4: /var/jenkins_config/apply_config.sh: cannot create /var/jenkins_home/jenkins.install.UpgradeWizard.state: Permission denied


$ kubectl describe pod -n jenkins jenkins-0

Name:         jenkins-0
Namespace:    jenkins
Priority:     0
Node:         ip-172-31-40-127/172.31.40.127
Start Time:   Mon, 30 Nov 2020 10:37:19 +0000
Labels:       app.kubernetes.io/component=jenkins-controller
              app.kubernetes.io/instance=jenkins
              app.kubernetes.io/managed-by=Helm
              app.kubernetes.io/name=jenkins
              controller-revision-hash=jenkins-57958b7d49
              statefulset.kubernetes.io/pod-name=jenkins-0
Annotations:  checksum/config: 2a4c2b3ea5dea271cb7c0b8e8582b682814d39f8e933e0348725b0b9a7dbf258
Status:       Pending
IP:           10.42.0.44
IPs:
  IP:           10.42.0.44
Controlled By:  StatefulSet/jenkins
Init Containers:
  init:
    Container ID:  containerd://64862ebd6791966db07981196d5dbd4c3b583d9e3e6543a31b252d19c2f9405b
    Image:         jenkins/jenkins:lts
    Image ID:      docker.io/jenkins/jenkins@sha256:980d55fd29a287d2d085c08c2bb6c629395ab2e3dd7547641035b4f126acc322
    Port:          &lt;none&gt;
    Host Port:     &lt;none&gt;
    Command:
      sh
      /var/jenkins_config/apply_config.sh
    State:          Terminated
      Reason:       Error
      Exit Code:    2
      Started:      Mon, 30 Nov 2020 10:53:41 +0000
      Finished:     Mon, 30 Nov 2020 10:53:41 +0000
    Last State:     Terminated
      Reason:       Error
      Exit Code:    2
      Started:      Mon, 30 Nov 2020 10:48:29 +0000
      Finished:     Mon, 30 Nov 2020 10:48:29 +0000
    Ready:          False
    Restart Count:  8
    Limits:
      cpu:     2
      memory:  4Gi
    Requests:
      cpu:        50m
      memory:     256Mi
    Environment:  &lt;none&gt;
    Mounts:
      /usr/share/jenkins/ref/plugins from plugins (rw)
      /var/jenkins_config from jenkins-config (rw)
      /var/jenkins_home from jenkins-home (rw)
      /var/jenkins_plugins from plugin-dir (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from jenkins-token-zjzdt (ro)
Containers:
  jenkins:
    Container ID:
    Image:         jenkins/jenkins:lts
    Image ID:
    Ports:         8080/TCP, 50000/TCP
    Host Ports:    0/TCP, 0/TCP
    Args:
      --httpPort=8080
    State:          Waiting
      Reason:       PodInitializing
    Ready:          False
    Restart Count:  0
    Limits:
      cpu:     2
      memory:  4Gi
    Requests:
      cpu:      50m
      memory:   256Mi
    Liveness:   http-get http://:http/login delay=0s timeout=5s period=10s #success=1 #failure=5
    Readiness:  http-get http://:http/login delay=0s timeout=5s period=10s #success=1 #failure=3
    Startup:    http-get http://:http/login delay=0s timeout=5s period=10s #success=1 #failure=12
    Environment:
      POD_NAME:                  jenkins-0 (v1:metadata.name)
      JAVA_OPTS:                 -Dcasc.reload.token=$(POD_NAME)
      JENKINS_OPTS:
      JENKINS_SLAVE_AGENT_PORT:  50000
      CASC_JENKINS_CONFIG:       /var/jenkins_home/casc_configs
    Mounts:
      /run/secrets/chart-admin-password from admin-secret (ro,path=&quot;jenkins-admin-password&quot;)
      /run/secrets/chart-admin-username from admin-secret (ro,path=&quot;jenkins-admin-user&quot;)
      /usr/share/jenkins/ref/plugins/ from plugin-dir (rw)
      /var/jenkins_config from jenkins-config (ro)
      /var/jenkins_home from jenkins-home (rw)
      /var/jenkins_home/casc_configs from sc-config-volume (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from jenkins-token-zjzdt (ro)
  config-reload:
    Container ID:
    Image:          kiwigrid/k8s-sidecar:0.1.275
    Image ID:
    Port:           &lt;none&gt;
    Host Port:      &lt;none&gt;
    State:          Waiting
      Reason:       PodInitializing
    Ready:          False
    Restart Count:  0
    Environment:
      POD_NAME:           jenkins-0 (v1:metadata.name)
      LABEL:              jenkins-jenkins-config
      FOLDER:             /var/jenkins_home/casc_configs
      NAMESPACE:          jenkins
      REQ_URL:            http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)
      REQ_METHOD:         POST
      REQ_RETRY_CONNECT:  10
    Mounts:
      /var/jenkins_home from jenkins-home (rw)
      /var/jenkins_home/casc_configs from sc-config-volume (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from jenkins-token-zjzdt (ro)
Conditions:
  Type              Status
  Initialized       False
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  plugins:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  &lt;unset&gt;
  jenkins-config:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      jenkins
    Optional:  false
  plugin-dir:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  &lt;unset&gt;
  jenkins-home:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  jenkins
    ReadOnly:   false
  sc-config-volume:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  &lt;unset&gt;
  admin-secret:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  jenkins
    Optional:    false
  jenkins-token-zjzdt:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  jenkins-token-zjzdt
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  &lt;none&gt;
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason     Age                 From                       Message
  ----     ------     ----                ----                       -------
  Normal   Scheduled  &lt;unknown&gt;           default-scheduler          Successfully assigned jenkins/jenkins-0 to ip-172-31-40-127
  Normal   Pulled     15m (x4 over 16m)   kubelet, ip-172-31-40-127  Successfully pulled image &quot;jenkins/jenkins:lts&quot;
  Normal   Created    15m (x4 over 16m)   kubelet, ip-172-31-40-127  Created container init
  Normal   Started    15m (x4 over 16m)   kubelet, ip-172-31-40-127  Started container init
  Normal   Pulling    14m (x5 over 16m)   kubelet, ip-172-31-40-127  Pulling image &quot;jenkins/jenkins:lts&quot;
  Warning  BackOff    74s (x71 over 16m)  kubelet, ip-172-31-40-127  Back-off restarting failed container

</code></pre>

<p>I see that this happens when using <code>hostPath</code> Minikube one node cluster, like in the documentation. The issue is because the <code>/data/jenkins-volume</code> folder in the Minikube node is created with <code>root</code> ownership.</p>
<p>So, if you don't want to run as root with the <code>runAsUser: 0</code> you can just change the permissions in the <code>/data/jenkins-volume</code> entering into the node with:</p>
<pre><code>$ minikube ssh

$ sudo chown -R 1000:1000 /data/jenkins-volume
</code></pre>
<p>Once you do that you can create the <code>pv</code> and deploy Jenkins with Helm with values:</p>
<pre><code>runAsUser: 1000
fsGroup: 1000 
</code></pre>
<p>It worked for me.</p>
