Answers: <p>You have a main container that needs access to a volume, but it encounters a permission issue. You can use an init container to set the correct permissions on the volume</p>
  <pre><code>initContainers:
        - name: setup-permissions
          image: busybox
          command: [&quot;sh&quot;, &quot;-c&quot;, &quot;chmod 755 -R /var/lib/grafana&quot;]  # Set permissions for the volume
          volumeMounts:
            - name: grafana-storage
              mountPath: /var/lib/grafana
  </code></pre>
  <p>To fix permission issues using an init container</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-09-04T17:53:03.010Z
Answers: 2024-09-04T17:53:03.010Z
Answers: playwithcode
Answers: <p>You have multiples solutions</p>
  <h3>1 - Set a uid and gid when creating the mount</h3>
  <p>This imply knowing the uid and gid of the user running inside your pod. To get it you could do something like this :</p>
  <pre class="lang-shell prettyprint-override"><code>$ kubectl run -ti debug --image grafana/grafana --command bash
  If you don't see a command prompt, try pressing enter.
  debug:/usr/share/grafana$ id
  uid=472(grafana) gid=0(root) groups=0(root)
  </code></pre>
  <p>Then when creating the mount with minikube, set the uid and gid</p>
  <pre class="lang-shell prettyprint-override"><code>$ minikube mount /var/tmp/minikube-folder1:/folder1 --uid 472 --gid 0
  </code></pre>
  <p>Now in your pod you can see that the <code>/var/lib/grafana/</code> permissions are correct</p>
  <pre class="lang-shell prettyprint-override"><code>grafana-57d4899dd7-fsp5z:/usr/share/grafana$ id
  uid=472(grafana) gid=0(root) groups=0(root),47
  grafana-57d4899dd7-fsp5z:/usr/share/grafana$ ls -lnd /var/lib/grafana/
  drwxrwxr-x    1 472      0             4096 Aug 11 14:19 /var/lib/grafana/
  </code></pre>
  <h3>2 - Use a security context to run the pod</h3>
  <p>Localy your folder is created with your user, you can tell your pod to use the same uid as your local user.</p>
  <p>First you need to get the uid of the user who created <code>/var/tmp/minikube-folder1</code></p>
  <pre class="lang-shell prettyprint-override"><code>$ ls -lnd /var/tmp/minikube-folder1
  total 4
  drwxrwxr-x 2 1000 1000 4096 août  11 16:06 /var/tmp/minikube-folder1
  </code></pre>
  <p>Let say the uid is 1000.</p>
  <p>In your deployment configuration (grafana yaml), you can set the <code>runAsUser</code> directive :</p>
  <pre class="lang-yaml prettyprint-override"><code>...
  spec:
    template:
      spec:
        securityContext:
          runAsUser: 1000
        containers: 
  ...
  </code></pre>
  <p>Now if you check in your started pod you can see that it's started with uid 1000</p>
  <pre class="lang-shell prettyprint-override"><code>$ kc exec -ti grafana-7c895564cc-w26p6 -- bash
  grafana-7c895564cc-w26p6:/usr/share/grafana$ id
  uid=1000 gid=0(root) groups=0(root),472
  </code></pre>
  <p>And that's the same user as the <code>/var/lib/grafana/</code> folder in the pod :</p>
  <pre class="lang-shell prettyprint-override"><code>grafana-5f75d8ff65-dhbb5:/usr/share/grafana$ ls -lnd /var/lib/grafana/
  drwxrwxr-x    1 1000     999           4096 Aug 11 14:16 /var/lib/grafana/
  </code></pre>
  <p>Hope this is clear and that it helps !</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-08-11T14:23:21.780Z
Answers: 2023-08-11T14:23:21.780Z
Answers: Paul
Body: <p>I have a minikube cluster with a grafana pod running in it.</p>
  <p>I have mounted a directory for grafana to use as a persistant volume to store.
  <code>minikube mount /var/tmp/minikube-folder1:/folder1</code></p>
  <p>I receive the output</p>
  <pre><code>  Mounting host path /var/tmp/minikube-folder1 into VM as /folder1 ...
      ▪ Mount type:   9p
      ▪ User ID:      docker
      ▪ Group ID:     docker
      ▪ Version:      9p2000.L
      ▪ Message Size: 262144
      ▪ Options:      map[]
      ▪ Bind Address: 127.0.0.1:64221
    Userspace file server: ufs starting
  ✅  Successfully mounted /var/tmp/minikube-folder1 to /folder1
  </code></pre>
  <p>i bind to the folder as such in my grafana yaml</p>
  <pre><code>apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: pvc-grafana
  spec:
    volumeName: grafana-pv
    accessModes:
      - ReadWriteMany
    resources:
      requests:
        storage: 1Gi
  ---
  apiVersion: v1
  kind: PersistentVolume
  metadata:
    name: grafana-pv
  spec:
    storageClassName: standard
    accessModes:
      - ReadWriteMany
    capacity:
      storage: 2Gi
    hostPath:
      path: /folder1
  </code></pre>
  <p>and eventually mount it on my container as such</p>
  <pre><code>   [spec..tempalate..spec above]
  
      containers:
        - name: mygrafana
          image: grafana/grafana
          ports:
            - containerPort: 3000 
          volumeMounts:
            - name: grafana-storage
              mountPath: /var/lib/grafana
  
       volumes:
         - name: grafana-storage
           persistentVolumeClaim:
              claimName: pvc-grafana
  </code></pre>
  <p>my grafana pod cant launch and always complains the permissions arent correct on <code>/var/lib/grafana</code></p>
  <p>I can remedy it by manually going into <code>/var/tmp/minikube-folder1/</code> and <code>chmod 777</code>ing the folders each time a new one appears (ex /var/lib/grafana/alerting), but this seems like an inefficient and wrong strategy.</p>
  <p>Is there someway to not have the minikube setup have these filesystem permission conflicts?</p>
  
Tags: <kubernetes><grafana><persistent-volumes>
Title: How to set correct mount permissions of Minikube grafana pod
UserDisplayName: Ryu S.
ThreadText: # How to set correct mount permissions of Minikube grafana pod
  
  (Asked by: username_0 on 2023-08-10)
  
  I have a minikube cluster with a grafana pod running in it.
  
  I have mounted a directory for grafana to use as a persistant volume to store.
  `minikube mount /var/tmp/minikube-folder1:/folder1`
  
  I receive the output
  
  ```
    Mounting host path /var/tmp/minikube-folder1 into VM as /folder1 ...
      ▪ Mount type:   9p
      ▪ User ID:      docker
      ▪ Group ID:     docker
      ▪ Version:      9p2000.L
      ▪ Message Size: 262144
      ▪ Options:      map[]
      ▪ Bind Address: 127.0.0.1:64221
    Userspace file server: ufs starting
  ✅  Successfully mounted /var/tmp/minikube-folder1 to /folder1
  
  ```
  
  i bind to the folder as such in my grafana yaml
  
  ```
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: pvc-grafana
  spec:
    volumeName: grafana-pv
    accessModes:
      - ReadWriteMany
    resources:
      requests:
        storage: 1Gi
  ---
  apiVersion: v1
  kind: PersistentVolume
  metadata:
    name: grafana-pv
  spec:
    storageClassName: standard
    accessModes:
      - ReadWriteMany
    capacity:
      storage: 2Gi
    hostPath:
      path: /folder1
  
  ```
  
  and eventually mount it on my container as such
  
  ```
     [spec..tempalate..spec above]
  
      containers:
        - name: mygrafana
          image: grafana/grafana
          ports:
            - containerPort: 3000 
          volumeMounts:
            - name: grafana-storage
              mountPath: /var/lib/grafana
  
       volumes:
         - name: grafana-storage
           persistentVolumeClaim:
              claimName: pvc-grafana
  
  ```
  
  my grafana pod cant launch and always complains the permissions arent correct on `/var/lib/grafana`
  
  I can remedy it by manually going into `/var/tmp/minikube-folder1/` and `chmod 777`ing the folders each time a new one appears (ex /var/lib/grafana/alerting), but this seems like an inefficient and wrong strategy.
  
  Is there someway to not have the minikube setup have these filesystem permission conflicts?
  
  **Tags:** kubernetes, grafana, persistent-volumes
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2024-09-04. Score: 0
  
  You have a main container that needs access to a volume, but it encounters a permission issue. You can use an init container to set the correct permissions on the volume
  
  ```
  initContainers:
        - name: setup-permissions
          image: busybox
          command: ["sh", "-c", "chmod 755 -R /var/lib/grafana"]  # Set permissions for the volume
          volumeMounts:
            - name: grafana-storage
              mountPath: /var/lib/grafana
  
  ```
  
  To fix permission issues using an init container
  
  
  ---
  
  ### Answer by username_2 on 2023-08-11. Score: 0
  
  You have multiples solutions
  
  ### 1 - Set a uid and gid when creating the mount
  
  This imply knowing the uid and gid of the user running inside your pod. To get it you could do something like this :
  
  ```shell
  $ kubectl run -ti debug --image grafana/grafana --command bash
  If you don't see a command prompt, try pressing enter.
  debug:/usr/share/grafana$ id
  uid=472(grafana) gid=0(root) groups=0(root)
  
  ```
  
  Then when creating the mount with minikube, set the uid and gid
  
  ```shell
  $ minikube mount /var/tmp/minikube-folder1:/folder1 --uid 472 --gid 0
  
  ```
  
  Now in your pod you can see that the `/var/lib/grafana/` permissions are correct
  
  ```shell
  grafana-57d4899dd7-fsp5z:/usr/share/grafana$ id
  uid=472(grafana) gid=0(root) groups=0(root),47
  grafana-57d4899dd7-fsp5z:/usr/share/grafana$ ls -lnd /var/lib/grafana/
  drwxrwxr-x    1 472      0             4096 Aug 11 14:19 /var/lib/grafana/
  
  ```
  
  ### 2 - Use a security context to run the pod
  
  Localy your folder is created with your user, you can tell your pod to use the same uid as your local user.
  
  First you need to get the uid of the user who created `/var/tmp/minikube-folder1`
  
  ```shell
  $ ls -lnd /var/tmp/minikube-folder1
  total 4
  drwxrwxr-x 2 1000 1000 4096 août  11 16:06 /var/tmp/minikube-folder1
  
  ```
  
  Let say the uid is 1000.
  
  In your deployment configuration (grafana yaml), you can set the `runAsUser` directive :
  
  ```yaml
  ...
  spec:
    template:
      spec:
        securityContext:
          runAsUser: 1000
        containers: 
  ...
  
  ```
  
  Now if you check in your started pod you can see that it's started with uid 1000
  
  ```shell
  $ kc exec -ti grafana-7c895564cc-w26p6 -- bash
  grafana-7c895564cc-w26p6:/usr/share/grafana$ id
  uid=1000 gid=0(root) groups=0(root),472
  
  ```
  
  And that's the same user as the `/var/lib/grafana/` folder in the pod :
  
  ```shell
  grafana-5f75d8ff65-dhbb5:/usr/share/grafana$ ls -lnd /var/lib/grafana/
  drwxrwxr-x    1 1000     999           4096 Aug 11 14:16 /var/lib/grafana/
  
  ```
  
  Hope this is clear and that it helps !
  
  
  ---
  
  