Permission denied

[dmicallefb]

Hello,
I have an issue with my strimzi deploy
the operator is on, but when I want to deploy a new cluster kafka on my kubernetes cluster, I have a error type of
mkdir: cannot create directory '/var/lib/zookeeper/data': Permission denied

I resolve it by with a securityContext :
` template:

  pod:
    securityContext:
      runAsUser: 0
      fsGroup: 0`

Is there another way to resolve the issue of permission denied ?
Is it a good thing to set user with root privileges or may I to be more specific with the security context (with capabilities for exemple) ?

[scholzj]

These things depend a lot on your infrastructure and platform. In general, that is responsible for setting the right permissions when mounting the volumes. Tuning the security context might help you of course. But yes, running as user 0 is not good -> fsGroup 0 might be fine.

[dmicallefb]

thank you for your answer
it seems like fsGroup is to 0 by default, but I have to find a way to not running as user 0

[scholzj]

Not running as user 0 is easy. That is not your problem. You can just remove it and the default will be something like 1001. What you are missing, is to make your storage respect the fsGroup or the user ID which is used by the container.

[dmicallefb]

here the yaml

apiVersion: kafka.strimzi.io/v1beta2  

kind: Kafka
metadata:  
  name: my-kafka-cluster
spec:
  kafka:
    version: 3.2.0
    replicas: 1
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
    template:
      pod:
        securityContext:
          runAsUser: 0
          fsGroup: 0
    config:
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      default.replication.factor: 1
      min.insync.replicas: 1
      inter.broker.protocol.version: "3.2"
    storage:
      type: jbod
      volumes:
        - id: 0
          type: persistent-claim
          size: 9Gi
          deleteClaim: false
  zookeeper:
    template:
      pod:
        securityContext:
          runAsUser: 0
          fsGroup: 0
    replicas: 1
    storage:
      type: persistent-claim
      size: 9Gi
      deleteClaim: false
  entityOperator:
    topicOperator: {}
    userOperator: {}