[bitnami/postgresql] 15.1.0 fails on mkdir: cannot create directory ‘/bitnami/postgresql/data’ when using `persistence.enabled: false` about charts HOT 6 OPEN

Bitnami containers are designed to operate as non-root by default. Consequently, any files or directories used by the application should be owned by the root group, as the random user (1001 by default) is a member of this root group. To ensure proper permissions, you'll need to adjust the ownership of your local directory accordingly.

For more comprehensive information about non-root containers and their significance for security, you can explore the following resources:

• Why non-root containers are important for security
• Use Non-Root Containers
• Work With Non-Root Containers for Bitnami Applications
• Running non-root containers on Openshift

These references provide valuable insights into the best practices and considerations when working with non-root containers in Bitnami applications.

from charts.

@carrodher spec that works on 14.3.3 breaks on 15.1.0. Am I to understand that it's an expected regression ?

from charts.

There were some related changes in this new major, see https://github.com/bitnami/charts/tree/main/bitnami/postgresql#to-1500

from charts.

In my case when setting volumePermissions.enabled = true, the pod still fails since there is no way to set allowPrivilegeEscalation and capabilities.drop = ["ALL"] for the initContainer.

In our cluster, nonroot, allowPrivilegeEscalation=false and capabilities.drop=["ALL"] are required, hope i don't misunderstand something

from charts.

Hi,

@maximveksler I believe it has to do with setting readOnlyRootFilesystem=true. In the case persistence is disabled, we should mount an empty dir in /bitnami/postgresql. I think this should work. In the statefulset.yaml file, change this:

            {{- if .Values.primary.persistence.enabled }}
            - name: data
              mountPath: {{ .Values.primary.persistence.mountPath }}
              {{- if .Values.primary.persistence.subPath }}
              subPath: {{ .Values.primary.persistence.subPath }}
              {{- end }}
            {{- end }}

To this

            - name: data
              mountPath: {{ .Values.primary.persistence.mountPath }}
              {{- if .Values.primary.persistence.subPath }}
              subPath: {{ .Values.primary.persistence.subPath }}
              {{- end }}

If that works, would you like to submit a PR with the change? If not, we will work on it.

from charts.

@cernockyd which exact init container is failing? In principle this should work

          {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}
          securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }}
          {{- else }}
          securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }}
          {{- end }}

from charts.