<p>I want to deploy postgres using kubernetes</p>
<p>This is my postgres pod yaml file</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      securityContext:
        runAsUser: 70
        runAsGroup: 70
        fsGroup: 70
        fsGroupChangePolicy: &quot;Always&quot;
      containers:
        - image: docker.io/postgres:14.8-alpine3.18
          name: postgres
          resources: 
            limits:
              hugepages-2Mi: 512Mi
              memory: 2Gi
              cpu: &quot;8&quot;
            requests:
              memory: 128Mi
              cpu: &quot;1&quot;
          env:
            - name: POSTGRES_DB
              value: postgres_db_name
            - name: POSTGRES_USER
              value: postgres_db_user
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
                  key: root_password_key
            - name: PGDATA
              value: /some/path/here
          ports:
            - containerPort: 5432
              name: postgres
          volumeMounts:
            - name: postgres-volume-name
              mountPath: /some/path/here
      volumes:
        - name: postgres-volume-name
          persistentVolumeClaim:
            claimName: postgres-pv-claim
</code></pre>
<p>After running</p>
<blockquote>
<p>kubectl get pods</p>
</blockquote>
<p>I POD status is terminating, so I have checked logs and
It shows</p>
<blockquote>
<p>mkdir: can't create directory '/some/path/here': Permission denied</p>
</blockquote>
<p>How can I solve this?
Thanks!</p>

Shubham Nikam
<p>As per official Kubernetes doc on <a href="https://kubernetes.io/blog/2020/12/14/kubernetes-release-1.20-fsgroupchangepolicy-fsgrouppolicy/#allow-users-to-skip-recursive-permission-changes-on-mount" rel="nofollow noreferrer">Allow users to skip recursive permission changes on mount</a>:</p>
<p>While inspecting the YAML used for the <code>StatefulSet</code>, noticed there's the use of a fsGroup inside the pod’s <code>security context</code>, which makes sure that the volume's content can be readable and writable by each new pod. One side-effect of setting fsGroup is that, each time a volume is mounted, <strong>Kubernetes must recursively change the owner and permission of all the files and directories inside the volume</strong>. This happens even if group ownership of the volume already matches the requested 'fsGroup', and can be pretty expensive for larger volumes with lots of small files, which causes pod startup to take a long time.</p>
<p><strong>Solution :</strong> As per <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods" rel="nofollow noreferrer">Configure volume permission and ownership change policy for Pods</a>. Suggest setting <code>'fsGroupChangePolicy' to &quot;OnRootMismatch&quot;</code> so if the root of the volume already has the correct permissions, the recursive permission change can be skipped.</p>
<blockquote>
<p><code>fsGroupChangePolicy</code> - fsGroupChangePolicy defines behavior for
changing ownership and permission of the volume before being exposed
inside a Pod. This field only applies to volume types that support
fsGroup controlled ownership and permissions. This field has two
possible values:</p>
<p><code>OnRootMismatch:</code> Only change permissions and ownership if the
permission and the ownership of root directory does not match with
expected permissions of the volume. This could help shorten the time
it takes to change ownership and permission of a volume.</p>
<p><code>Always:</code> Always change permission and ownership of the volume when
volume is mounted.</p>
<p><strong>For example:</strong></p>
<p><strong>securityContext</strong>:</p>
<pre><code>  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
  fsGroupChangePolicy: &quot;OnRootMismatch&quot;
</code></pre>
</blockquote>
<p>*Also refer to the <strong>System Admin</strong> <a href="https://ny55.blogspot.com/2020/06/error-mkdir-cannot-create-directory.html" rel="nofollow noreferrer">blog</a> by <strong>LiveStream</strong> related to the Error, which may help to resolve your issue.</p>
