How to prevent changing ownership of '/data/db' in mongodb pod

Question

I'm running a mongodb instance as a kubernetes pod in a single node cluster (bare metal ubuntu machine). The volume is configured ReadWriteOnce as the mongodb pod is accessed only by pods in one node.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mongo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mongo
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: mongo
    spec:
      hostname: mongo
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: data
        - name: restore
          persistentVolumeClaim:
            claimName: restore
      containers:
        - name: mongo
          image: mongo:4.4.14
          args: ["--auth"]
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 27017
          volumeMounts:
            - mountPath: /data/db
              name: data
            - mountPath: /restore
              name: restore
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

But from time to time I cannot run commands like inserting documents to a non existing collection or running mongodump. Then I do get the error MongoServerError: 1: Operation not permitted. This is caused by a chown problem: ls -ld /data/db/ is returning

drwxr-sr-x 4 nobody 4294967294 16384 Jun 28 18:19 /data/db/

I can fix the problem by running

chown mongodb:mongodb /data/db

But after some time it changes again, so the same problem happens again and I have to rerun the chown mongodb:mongodb /data/db

score 0 · Answer 1 · answered Jun 30 '22 at 14:01

0

You need to add securityContext for your volume, something like following. securityContext have more options so you can adjust permissions according to your needs.

spec:
  securityContext:
    fsGroup: 2000 
    runAsUser: 1000
    fsGroup: 1000    
  volumes:
    name: data
      persistentVolumeClaim:
        claimName: data

answered Jun 30 '22 at 14:01

xs2rashid

184
5

You have two `fsGroup`. I think this is a mistake. Do I have to use IDs or can I just set `mongodb` for fsGroup and runAsUser? – user3142695 Jun 30 '22 at 16:05
My bad, you can use one fsGroup. I didn't try it with username but let,s give it a try and update here. – xs2rashid Jul 01 '22 at 14:44
Values have to be number, no string. But with this `securityContext` the pod is failing in running – user3142695 Jul 01 '22 at 15:26
If POD is failing then it must be throwing some error. You can check error and solve it accordingly. – xs2rashid Jul 01 '22 at 15:35

How to prevent changing ownership of '/data/db' in mongodb pod

1 Answers1