How to set correct mount permissions of Minikube grafana pod

Question

I have a minikube cluster with a grafana pod running in it.

I have mounted a directory for grafana to use as a persistant volume to store. minikube mount /var/tmp/minikube-folder1:/folder1

I receive the output

📁  Mounting host path /var/tmp/minikube-folder1 into VM as /folder1 ...
    ▪ Mount type:   9p
    ▪ User ID:      docker
    ▪ Group ID:     docker
    ▪ Version:      9p2000.L
    ▪ Message Size: 262144
    ▪ Options:      map[]
    ▪ Bind Address: 127.0.0.1:64221
🚀  Userspace file server: ufs starting
✅  Successfully mounted /var/tmp/minikube-folder1 to /folder1

i bind to the folder as such in my grafana yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-grafana
spec:
  volumeName: grafana-pv
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: grafana-pv
spec:
  storageClassName: standard
  accessModes:
    - ReadWriteMany
  capacity:
    storage: 2Gi
  hostPath:
    path: /folder1

and eventually mount it on my container as such

   [spec..tempalate..spec above]

    containers:
      - name: mygrafana
        image: grafana/grafana
        ports:
          - containerPort: 3000 
        volumeMounts:
          - name: grafana-storage
            mountPath: /var/lib/grafana

     volumes:
       - name: grafana-storage
         persistentVolumeClaim:
            claimName: pvc-grafana

my grafana pod cant launch and always complains the permissions arent correct on /var/lib/grafana

I can remedy it by manually going into /var/tmp/minikube-folder1/ and chmod 777ing the folders each time a new one appears (ex /var/lib/grafana/alerting), but this seems like an inefficient and wrong strategy.

Is there someway to not have the minikube setup have these filesystem permission conflicts?

Answer 1

You have multiples solutions

1 - Set a uid and gid when creating the mount

This imply knowing the uid and gid of the user running inside your pod. To get it you could do something like this :

$ kubectl run -ti debug --image grafana/grafana --command bash
If you don't see a command prompt, try pressing enter.
debug:/usr/share/grafana$ id
uid=472(grafana) gid=0(root) groups=0(root)

Then when creating the mount with minikube, set the uid and gid

$ minikube mount /var/tmp/minikube-folder1:/folder1 --uid 472 --gid 0

Now in your pod you can see that the /var/lib/grafana/ permissions are correct

grafana-57d4899dd7-fsp5z:/usr/share/grafana$ id
uid=472(grafana) gid=0(root) groups=0(root),47
grafana-57d4899dd7-fsp5z:/usr/share/grafana$ ls -lnd /var/lib/grafana/
drwxrwxr-x    1 472      0             4096 Aug 11 14:19 /var/lib/grafana/

2 - Use a security context to run the pod

Localy your folder is created with your user, you can tell your pod to use the same uid as your local user.

First you need to get the uid of the user who created /var/tmp/minikube-folder1

$ ls -lnd /var/tmp/minikube-folder1
total 4
drwxrwxr-x 2 1000 1000 4096 août  11 16:06 /var/tmp/minikube-folder1

Let say the uid is 1000.

In your deployment configuration (grafana yaml), you can set the runAsUser directive :

...
spec:
  template:
    spec:
      securityContext:
        runAsUser: 1000
      containers: 
...

Now if you check in your started pod you can see that it's started with uid 1000

$ kc exec -ti grafana-7c895564cc-w26p6 -- bash
grafana-7c895564cc-w26p6:/usr/share/grafana$ id
uid=1000 gid=0(root) groups=0(root),472

And that's the same user as the /var/lib/grafana/ folder in the pod :

grafana-5f75d8ff65-dhbb5:/usr/share/grafana$ ls -lnd /var/lib/grafana/
drwxrwxr-x    1 1000     999           4096 Aug 11 14:16 /var/lib/grafana/

Hope this is clear and that it helps !

Answer 2

You have a main container that needs access to a volume, but it encounters a permission issue. You can use an init container to set the correct permissions on the volume

initContainers:
      - name: setup-permissions
        image: busybox
        command: ["sh", "-c", "chmod 755 -R /var/lib/grafana"]  # Set permissions for the volume
        volumeMounts:
          - name: grafana-storage
            mountPath: /var/lib/grafana

To fix permission issues using an init container