<p>I have seen so many issues with Helm and default namespace here on SO that it is embarrassing to post yet another one. I believe I reviewed the ones I saw and did not find a solution to my problem.</p>
<p>Helm version is 3.9.3
Kubernetes: OpenShift 4.9</p>
<p>I create an nginx chart by simply doing:</p>
<pre><code>helm create disco
</code></pre>
<p>When I deploy this application in default project/namespace, it works fine. However, when I deploy it in non-default workspace, it fails.</p>
<p>My command for deploying in non-default workspace:</p>
<pre><code>oc new-project helm-sandbox
helm install disco . --namespace helm-sandbox
</code></pre>
<p>The CLI appears to indicate that the deployment succeeded. But the pod keeps having CrashLoopBackoff.</p>
<p>The pod logs show following error message:</p>
<pre><code>nginx: [warn] the &quot;user&quot; directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
2022/09/08 02:00:19 [emerg] 1#1: mkdir() &quot;/var/cache/nginx/client_temp&quot; failed (13: Permission denied)
nginx: [emerg] mkdir() &quot;/var/cache/nginx/client_temp&quot; failed (13: Permission denied)
</code></pre>
<p>Any idea why this is failing on me?</p>

Billy Billy
<p>By default, every Pod use <code>default</code> service account on OpenShift and the service account is attached <code>restricted</code> SCC.</p>
<p>Additionally, UID in Pod is randomly chose from the range which is defined at <code>openshift.io/sa.scc.uid-range</code> annotation in the namespace which the Pod is defined.</p>
<p>So, the <code>random</code> UID may have no permission to write the <code>/var/cache/nginx/</code> directory.</p>
<p>However, Change UID with anyuid or nonroot SCCs to the service account used by Pod is not good idea unless the Pod needs strong permission to work.</p>
<p>If you want the cache directory is an ephemeral directory, mounting emptyDir or ephemeral volume are better to solve it.</p>
<p>If you want persist it, mount a Persistent Volume as <code>/var/cache/nginx</code>.</p>
<p>If you need to change UID, give anyuid or nonroot SCC to a service account. But, giving a SCC to pre-defined SCC is not good. So if you need to use a SCC other than <code>restricted</code>, you should create a service account and use it to start your Pod.</p>
<p>Hopefully, those are helpful to solve the issue.</p>
