<p>i try to run a mongodb within a kubernetes cluster secured with a keyFile. For this, i created a simple statefulset and a configmap, where i stored the keyfile:</p>
<pre><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongodb
spec:
  serviceName: mongodb
  replicas: 1
  selector:
    matchLabels:
      app: mongodb
  template:
    metadata:
      labels:
        app: mongodb
    spec:
      containers:
      - name: mongodb
        image: mongo:4.4
        args:
          - --bind_ip
          - '0.0.0.0,::'
          - --replSet
          - MySetname01
          - --auth
          - --keyFile
          - /etc/mongodb/keyfile/keyfile
        env:
        - name: MONGO_INITDB_ROOT_USERNAME
          value: MyUsername
        - name: MONGO_INITDB_ROOT_PASSWORD
          value: MyPassword
        ports:
        - containerPort: 27017
          name: mongodb
        volumeMounts:
        - name: mongodb-persistent-storage
          mountPath: /data/db
        - name: mongodb-keyfile
          mountPath: /etc/mongodb/keyfile
          readOnly: True
      volumes:
        - name: mongodb-keyfile
          configMap:
            name: mongodb-keyfile
  volumeClaimTemplates:
  - metadata:
      name: mongodb-persistent-storage
    spec:
      accessModes: [ &quot;ReadWriteOnce&quot; ]
      resources:
        requests:
          storage: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: mongodb
  labels:
    app: mongodb
spec:
  ports:
    - port: 27017
  selector:
    app: mongodb
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mongodb-keyfile
data:
  keyfile: |
    +PN6gXEU8NeRsyjlWDnTesHCoPOn6uQIEI5pNorDkphREi6RyoSHCIaXOzLrUpPq
    jpSGhSc5/MZj17R7K5anjerhvR6f5JtWjBuQcrjdJdNBceck71F2bly/u9ICfCOy
    STFzv6foMQJBJTBYqLwtfyEO7CQ9ywodM0K5r9jtT7x5BiJaqso+F8VN/VFtIYpe
    vnzKj7uU3GwDbmw6Yduybgv6P88BGXyW3w6HG8VLMgud5aV7wxIIPE6nAcr2nYmM
    1BqC7wp8G6uCcMiHx5pONPA5ONYAIF+u3zj2wAthgMe2UeQxx2L2ERx8Zdsa9HLR
    qYOmy9XhfolwdCTwwYvqYRO+RqXGoPGczenC/CKJPj14yfkua+0My5NBWvpL/fIB
    osu0lQNw1vFu0rcT1/9OcaJHuwFWocec2qBih9tk2C3c7jNMuxkPo3dxjv8J/lex
    vN3Et6tK/wDsQo2+8j6uLYkPFQbHZJQzf/oQiekV4RaC6/pejAf9fSAo4zbQXh29
    8BIMpRL3fik+hvamjrtS/45yfqGf/Q5DQ7o8foI4HYmhy+SU2+Bxyc0ZLTn659zl
    myesNjB6uC9lMWtpjas0XphNy8GvJxfjvz+bckccPUVczxyC3QSEIcVMMH9vhzes
    AcQscswhFMgzp1Z0fbNKy0FqQiDy1hUSir06ZZ3xBGLKeIySRsw9D1Pyh1Y11HlH
    NdGwF14cLqm53TGVd9gYeIAm2siQYMKm8rEjxmecc3yGgn0B69gtMcBmxr+z3xMU
    X256om6l8L2BJjm3W1zUTiZABuKzeNKjhmXQdEFPQvxhubvCinTYs68XL76ZdVdJ
    Q909MmllkOXKbAhi/TMdWmpV9nhINUCBrnu3F08jAQ3UkmVb923XZBzcbdPlpuHe
    Orp11/f3Dke4x0niqATccidRHf6Hz+ufVkwIrucBZwcHhK4SBY/RU90n233nV06t
    JXlBl/4XjWifB7iJi9mxy/66k
</code></pre>
<p>Problem is: MongoDb stays in a Crashloopbackoff , because the permissions on the keyfile are too open:</p>
<pre><code>{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-12-19T12:41:41.399+00:00&quot;},&quot;s&quot;:&quot;I&quot;, &quot;c&quot;:&quot;CONTROL&quot;, &quot;id&quot;:23285, &quot;ctx&quot;:&quot;main&quot;,&quot;msg&quot;:&quot;Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-12-19T12:41:41.402+00:00&quot;},&quot;s&quot;:&quot;I&quot;, &quot;c&quot;:&quot;NETWORK&quot;, &quot;id&quot;:4648601, &quot;ctx&quot;:&quot;main&quot;,&quot;msg&quot;:&quot;Implicit TCP FastOpen unavailable. If TCP FastOpen is required, set tcpFastOpenServer, tcpFastOpenClient, and tcpFastOpenQueueSize.&quot;}
{&quot;t&quot;:{&quot;$date&quot;:&quot;2022-12-19T12:41:41.402+00:00&quot;},&quot;s&quot;:&quot;I&quot;, &quot;c&quot;:&quot;ACCESS&quot;, &quot;id&quot;:20254, &quot;ctx&quot;:&quot;main&quot;,&quot;msg&quot;:&quot;Read security file failed&quot;,&quot;attr&quot;:{&quot;error&quot;:{&quot;code&quot;:30,&quot;codeName&quot;:&quot;InvalidPath&quot;,&quot;errmsg&quot;:&quot;permissions on /etc/mongodb/keyfile/keyfile are too open&quot;}}}
</code></pre>
<p>For what i dont have a explanation.</p>
<p>I already set the volumemount of the configmap on readonly (You see in the mongo statefulset). Also i tried around with commands or lifecyclehooks to chmod 600/400 the file. I tried differnt versions of mongodb, but got always the same error.
For sure i also tried if the configmap is included correctly, it is (I uncommented the args and Username/Password for that one).</p>
<p>Permissions are shown:</p>
<pre><code>lrwxrwxrwx 1 root root   14 Dec 19 12:50 keyfile -&gt; ..data/keyfile
</code></pre>
<p>Maybe its related to that fact that the file is shown as linked?</p>
<p>I expect a kubernetes yaml which is able to start with a keyfile. Thank you very much.</p>
<hr />
<p>EDIT: I tried to mount the file directly, not as a link with subpath. Now i got the following permissions:</p>
<p><code>-rw-r--r-- 1 root root 1001 Dec 19 13:34 mongod.key</code></p>
<p>But sadly the db will not start with that one too, it's still crashing with the same error.</p>
<hr />
<p>EDIT2:
Adding <code>defaultMode: 0600</code> to the volume in the statefulset led at least to the correct permissions, but also another error (already mentioned in one of my comments):</p>
<p><code>file: /var/lib/mongo/mongod.key: bad file&quot;</code></p>
<p>So i tried to mount on different places in the Pod (You see here /var/lib/) for example and i tried to include the keyfile as secret. But none is working.</p>

MarM25
<p>If anyone is still looking for a solution to this issue, I found one that does not use the init container.</p>
<p>Working with <strong>k8s 1.26</strong>,
I mounted the <strong>keyfile</strong> as a secret inside the pod with a volume and I set the <code>defaultMode</code> to <code>0o400</code>.</p>
<p>We have to put the <strong>&quot;o&quot;</strong> after the <strong>&quot;0&quot;</strong> so the system would recognize it as readonly for the owner and we will be able to get the file with a permission like so <code>-r--------</code>.</p>
<p>I mounted the secret in <code>/var/run/secrets/keyfile</code>
and using a subPath: <code>./keyfile</code></p>
<p>Here is the <code>statefulset</code> yaml:</p>
<pre><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongod
  namespace: test
spec:
  serviceName: mongodb-service
  replicas: 1
  selector:
    matchLabels:
      role: mongo
      app: mongo
      replicaset: rsTest
  template:
    metadata:
      labels:
        role: mongo
        app: mongo
        replicaset: rsTest
    spec:
      volumes:
        - name: mongo-conf
          configMap:
            name: mongo-conf-cm
        - name: mongodb-keyfile
          secret:
            secretName: mongodb-keyfile
            defaultMode: 0o400
      containers:
      - name: mongod-container
        image: mongo:6.0.1
        command:
        - &quot;numactl&quot;
        - &quot;--interleave=all&quot;
        - &quot;mongod&quot;
        - &quot;--config&quot;
        - &quot;/etc/mongo.conf&quot;
        resources:
          requests:
            cpu: 0.2
            memory: 200Mi
        ports:
        - containerPort: 27017
        volumeMounts:
        - name: mongodb-persistent-storage-claim
          mountPath: /data/db
        - name: mongo-conf
          mountPath: /etc/mongo.conf
          subPath: mongo.conf
        - name: mongodb-keyfile
          mountPath: /var/run/secrets/keyfile
          subPath: ./keyfile
          readOnly: true
  volumeClaimTemplates:
  - metadata:
      name: mongodb-persistent-storage-claim
      annotations:
        volume.beta.kubernetes.io/storage-class: &quot;standard&quot;
    spec:
      accessModes: [ &quot;ReadWriteOnce&quot; ]
      resources:
        requests:
          storage: 5Gi 
</code></pre>
