# Fdb k8s operator readonly file system security context

**URL:** https://forums.foundationdb.org/t/fdb-k8s-operator-readonly-file-system-security-context/2648
**Category:** Kubernetes Operator
**Tags:** operator
**Created:** [April 10, 2021, 5:42pm UTC](https://forums.foundationdb.org/t/fdb-k8s-operator-readonly-file-system-security-context/2648 "2021-04-10T17:42:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![tangerine](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/tangerine/32/1084_2.png) [@tangerine](https://forums.foundationdb.org/u/tangerine)
#### Post date: [April 10, 2021, 5:42pm UTC](https://forums.foundationdb.org/t/fdb-k8s-operator-readonly-file-system-security-context/2648/1 "2021-04-10T17:42:08Z")

</div>

Hi,  
I tried to deploy the fdb operator v0.31.1 with the foundationdb image pulled in by the GitHub script in my locally defined OCP 4.7 env. using the deployment.yaml from the GitHub as is. I can deploy the cluster and all pods are running. Due to the setup in my env., I have to modify the runes/fsgroup to match my namespace allowed range which is in the 100xxxxx range. What I found is even though all pods are up and running, the DB is not up due to the fdbserver cannot start. Further examination show that the user for running the fdb pods cannot write to the /tmp or the mounted /var/fdb/data where the processID suppose to be created. I have tried to add the security context to the deployment.yaml and also tried to set readOnlyRootFilesystem to false but those attempts have not result in a writeable /tmp nor /var/fdb/data.  
Here is the security context I added to the deployment.yaml:  
securityContext:  
allowPrivilegeEscalation: false  
privileged: false  
readOnlyRootFilesystem: true  
volumeMounts:  
- mountPath: /tmp  
name: tmp  
- mountPath: /var/log/fdb  
name: logs  
- mountPath: /var/fdb/data  
name: data  
- mountPath: /var/testfdb  
name: testfdb  
securityContext:  
#fsGroup: 4059  
#runAsGroup: 4059  
#runAsUser: 4059  
serviceAccountName: fdb-kubernetes-operator-controller-manager  
terminationGracePeriodSeconds: 10  
volumes:  
- emptyDir: {}  
name: tmp  
- emptyDir: {}  
name: logs  
- emptyDir: {}  
name: data  
- emptyDir: {}  
name: testfdb

Any help on this would be appreciated to make the user that run fdbmonitor/fdbserver can create a file in /var/fdb/data which is mounted.

---

<div class="post-metadata">

### Author: ![tangerine](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/tangerine/32/1084_2.png) [@tangerine](https://forums.foundationdb.org/u/tangerine)
#### Post date: [April 10, 2021, 7:02pm UTC](https://forums.foundationdb.org/t/fdb-k8s-operator-readonly-file-system-security-context/2648/2 "2021-04-10T19:02:29Z")

</div>

Ok, I get it to work now by mounting the /var/fdb/data in the operator deployment. not sure what I have done wrong the first time. This is not an issue any more.