<p><strong>Issue:</strong> 
Deploying Artifactory as a deployment in Kubernetes. The VolumeMounts are being mounted as root:artifact and permissions of drwxr-sr-x</p>

<pre><code>/var/opt/jfrog/artifactory
drwxr-sr-x    2 root     artifact      4096 Jan 24 17:52 etc
/var/opt/jfrog/artifactory/etc
-rw-r--r--    1 root     artifact      1048 Jan 24 17:48 artifactory.config.import.yml
-rw-r--r--    1 root     artifact     12703 Jan 24 17:48 artifactory.system.properties
</code></pre>

<p><strong>Expected:</strong>
The VolumeMount should be mounted as artifact:artifact with read and write permissions</p>

<p>kubernetes manifest file its incomplete due to restriction</p>

<pre><code>    spec:
      securityContext:
        runAsUser: 1030
        runAsGroup: 1030
        fsGroup: 1030

        volumeMounts:
        - name: artifactory-volume
          mountPath: "/var/opt/jfrog/artifactory"
        - name: bootstrap
          mountPath: "/var/opt/jfrog/artifactory/etc/artifactory.config.import.yml"
          subPath: bootstrap
        - name: artifactory-system-properties
          mountPath: "/var/opt/jfrog/artifactory/etc/artifactory.system.properties"
          subPath: artifactory.system.properties
        resources:
          limits:
            cpu: "3"
            memory: 6Gi
          requests:
            cpu: "2"
            memory: 4Gi


      volumes:
      - name: bootstrap
        secret:
          secretName: artifactory6170-artifactory
      - name: artifactory-system-properties
        configMap:
          name: artifactory6170-artifactory-system-properties
      - name: artifactory-volume
        persistentVolumeClaim:
          claimName: artifactory6170-artifactory
</code></pre>

<p><strong>Kubernetes Version :</strong></p>

<pre><code>Server Version: version.Info{
  Major: "1",
  Minor: "14",
  GitVersion: "v1.14.1",
  GitCommit: "b7394102d6ef778017f2ca4046abbaa23b88c290",
  GitTreeState: "clean",
  BuildDate: "2019-04-08T17:02:58Z",
  GoVersion: "go1.12.1",
  Compiler: "gc",
  Platform: "linux/amd64"
}
</code></pre>

<p>I believe the  security context covers the required </p>

<pre><code>        runAsUser: 1030
</code></pre>

<p>runs the process as 1030</p>

<pre><code>        runAsGroup: 1030
</code></pre>

<p>Any files created will also be owned by user 1030 and group 1030 when runAsGroup is specified.
runs</p>

<pre><code>        fsGroup: 1030
</code></pre>

<p>the owner of any volume attached will be owner by group ID 1099.</p>

<p><strong><a href="https://github.com/binnythomas-1989/artifactory/blob/master/Dockerfile" rel="nofollow noreferrer">Docker file path</a></strong></p>

<p>Not sure why the container comes up with wrong user ownership, any help would be really appreciated.</p>

<p>Error:</p>

<pre><code>kubectl logs artifactory6170-artifactory-756cffb9-68zjj
2020-01-26 12:28:13  [719 entrypoint-artifactory.sh] Preparing to run Artifactory in Docker
2020-01-26 12:28:13  [720 entrypoint-artifactory.sh] Running as uid=1030(artifactory) gid=1030(artifactory) groups=1030(artifactory)
2020-01-26 12:28:13   [57 entrypoint-artifactory.sh] Dockerfile for this image can found inside the container.
2020-01-26 12:28:13   [58 entrypoint-artifactory.sh] To view the Dockerfile: 'cat /docker/artifactory-pro/Dockerfile.artifactory'.
2020-01-26 12:28:13   [63 entrypoint-artifactory.sh] Checking open files and processes limits
2020-01-26 12:28:13   [66 entrypoint-artifactory.sh] Current max open files is 1048576
2020-01-26 12:28:13   [78 entrypoint-artifactory.sh] Current max open processes is unlimited
2020-01-26 12:31:13  [211 entrypoint-artifactory.sh] Testing directory /var/opt/jfrog/artifactory has read/write permissions for user 'artifactory' (id 1030)
/entrypoint-artifactory.sh: line 180: /var/opt/jfrog/artifactory/etc/test-permissions: Permission denied
2020-01-26 12:31:13  [229 entrypoint-artifactory.sh] ###########################################################
2020-01-26 12:31:13  [230 entrypoint-artifactory.sh] /var/opt/jfrog/artifactory DOES NOT have proper permissions for user 'artifactory' (id 1030)
2020-01-26 12:31:13  [231 entrypoint-artifactory.sh] Directory: /var/opt/jfrog/artifactory, permissions: 2775, owner: artifactory, group: artifactory
2020-01-26 12:31:13  [232 entrypoint-artifactory.sh] Mounted directory must have read/write permissions for user 'artifactory' (id 1030)
2020-01-26 12:31:13  [233 entrypoint-artifactory.sh] ###########################################################
2020-01-26 12:31:13   [47 entrypoint-artifactory.sh] ERROR: Directory /var/opt/jfrog/artifactory has bad permissions for user 'artifactory' (id 1030)

</code></pre>

Roger
<p>All i had to do was add an initContainer and mount the Configmaps to /tmp and have it moved to the necessary path /var/opt/jfrog/artifactory/etc/, instead of mounting the configmap in the volumemount /var/opt/jfrog/artifactory.</p>

<p>Reason: ConfigMaps are ReadOnly hence /etc was and would always be Readonly.</p>

<pre><code>  initContainers:
  - name: "grant-permissions"
    image: "busybox:1.26.2"
    securityContext:
      runAsUser: 0
    imagePullPolicy: "IfNotPresent"
    command:
    - 'sh'
    - '-c'
    - 'mkdir /var/opt/jfrog/artifactory/etc ; cp -vf /tmp/artifactory* /var/opt/jfrog/artifactory/etc ; chown -R 1030:1030 /var/opt/jfrog/ ; rm -rfv /var/opt/jfrog/artifactory/lost+found'

    volumeMounts:
    - mountPath: "/var/opt/jfrog/artifactory"
      name: artifactory-volume
    - name: bootstrap
      mountPath: "/tmp/artifactory.config.import.yml"
      subPath: bootstrap
      readOnly: false
    - name: artifactory-system-properties
      mountPath: "/tmp/artifactory.system.properties"
      subPath: artifactory.system.properties
      readOnly: false
</code></pre>

<p>then mount the volume to the main container that runs artifactory</p>

<pre><code>  containers:
  - name: artifactory
    image: "registry.eu02.dsg.arm.com/sqa/artifactory-pro:6.17.0"

  volumeMounts:
  - name: artifactory-volume
    mountPath: "/var/opt/jfrog/artifactory"
</code></pre>
