# Running node-red on kubernetes: file permissions error on pod initialization

**URL:** <https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420>\
**Category:** General\
**Created:** [28 March 2022 00:58 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420 "2022-03-28T00:58:46Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![packnology](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@packnology](https://discourse.nodered.org/u/packnology)\
**Post date:** [28 March 2022 00:58 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/1 "2022-03-28T00:58:46Z")

</div>

Hi, I'm trying to install node-red on a kubernetes cluster and when the pod starts up it fails with the following error message:

```auto
Error: EACCES: permission denied, copyfile '/usr/src/node-red/node_modules/node-red/settings.js' -> '/data/settings.js'
    at Object.copyFileSync (fs.js:2061:3)
    at copyFile (/usr/src/node-red/node_modules/fs-extra/lib/copy-sync/copy-sync.js:70:6)
    at onFile (/usr/src/node-red/node_modules/fs-extra/lib/copy-sync/copy-sync.js:56:25)
    at getStats (/usr/src/node-red/node_modules/fs-extra/lib/copy-sync/copy-sync.js:48:44)
    at handleFilterAndCopy (/usr/src/node-red/node_modules/fs-extra/lib/copy-sync/copy-sync.js:33:10)
    at Object.copySync (/usr/src/node-red/node_modules/fs-extra/lib/copy-sync/copy-sync.js:26:10)
    at Object.<anonymous> (/usr/src/node-red/node_modules/node-red/red.js:125:20)
    at Module._compile (internal/modules/cjs/loader.js:1085:14)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)
    at Module.load (internal/modules/cjs/loader.js:950:32) {
  errno: -13,
  syscall: 'copyfile',
  code: 'EACCES',
  path: '/usr/src/node-red/node_modules/node-red/settings.js',
  dest: '/data/settings.js'
}

```

Here's my kubernetes deployment configuration:

```auto
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: node-red
  name: node-red
  namespace: node-red
spec:
  replicas: 1
  selector:
    matchLabels:
      app: node-red
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: node-red
    spec:
      containers:
        - image: nodered/node-red:2.2.0
          imagePullPolicy: IfNotPresent
          name: node-red
          ports:
            - containerPort: 1880
              protocol: TCP
          resources: {}
          env:
            - name: NODE_RED_ENABLE_PROJECTS
              value: "true"
            - name: PGID
              value: "1000"
            - name: PUID
              value: "1000"
          volumeMounts:
            - mountPath: /data
              name: pvc-nodered
      volumes:
        - name: pvc-nodered
          persistentVolumeClaim:
            claimName: pvc-nodered

```

I added the env settings PGID and PUID based on other posts on github etc. experiencing the same problem (but on Docker, not kubernetes). The file system is AWS EFS, so I also tried creating the access point with user/group 1000 as owner. Also added runAsUser and runAsGroup to the container template. Nothing works. Any ideas what I'm doing wrong here? I have successfully deployed several other services with persistent volume claims and had no permissions issues, so I'm not sure why the node-red container is different. Any help appreciated.

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [28 March 2022 12:30 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/2 "2022-03-28T12:30:43Z")

</div>

Assuming you've set the access point up correctly this should work

PUID and PGID won't do anything to the default Node-RED container

---

<div class="post-metadata">

**Author:** ![packnology](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@packnology](https://discourse.nodered.org/u/packnology)\
**Post date:** [28 March 2022 19:19 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/3 "2022-03-28T19:19:33Z")

</div>

Thanks @hardillb I have attached my EFS access point settings. I have also tried a different install method with a helm chart and I have set all of the following to 1000:

podSecurityContext.runAsUser  
podSecurityContext.runAsGroup  
podSecurityContext.fsGroup  
securityContext.runAsUser  
securityContext.runAsGroup

Not sure what to try next.

 ![Capture_EFS_perms_node-red](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/6/a/6a877a1fcc6857887058fb1f6be7880018c72893.png)

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [28 March 2022 21:30 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/4 "2022-03-28T21:30:22Z")

</div>

Yes, but have you made sure the PersistentVolume is using the mountpoint id and not just the root EFS volume?

Also setting all those options to `1000` isn't going to change anything, the node-red user already has the id of `1000`

---

<div class="post-metadata">

**Author:** ![packnology](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@packnology](https://discourse.nodered.org/u/packnology)\
**Post date:** [28 March 2022 21:54 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/5 "2022-03-28T21:54:07Z")

</div>

The PV is using csi.volumeHandle in the format fileSystemId::accessPointId as shown in excerpt from my script below. This config works for other deployments with PVs, any reason why that wouldn't work for node-red?

```auto
apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: efs.csi.aws.com
spec:
  attachRequired: false
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: efs-sc
provisioner: efs.csi.aws.com
reclaimPolicy: Retain
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-efs-nodered
spec:
  capacity:
    storage: 2Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: efs-sc
  csi:
    driver: efs.csi.aws.com
    volumeHandle: $PW_NODERED_EFS_FS_ID::$PW_NODERED_EFS_AP
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-nodered
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: efs-sc
  resources:
    requests:
      storage: 1Gi

```

---

<div class="post-metadata">

**Author:** ![jmk-randers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jmk-randers/32/49562_2.png) [@jmk-randers](https://discourse.nodered.org/u/jmk-randers)\
**Post date:** [29 March 2022 07:02 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/6 "2022-03-29T07:02:49Z")

</div>

We are using this Helm chart: [node-red 0.13.2 · schwarzit/node-red](https://artifacthub.io/packages/helm/node-red/node-red) which seem to work fine with PVCs on our longhorn based distributed storage.

Maybe the pvc template in this chart is helpful?

---

<div class="post-metadata">

**Author:** ![packnology](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@packnology](https://discourse.nodered.org/u/packnology)\
**Post date:** [29 March 2022 09:38 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/7 "2022-03-29T09:38:24Z")

</div>

Thanks @jmk-randers I tried the helm chart you suggested. It fails when it runs an InitContainer called "permission-fix", the node-red container never even starts. Looking at the template I think it's failing because it tries to set permissions on a dynamic volumeMount which isn't possible because I have static existing volumes in EFS. I can see [here](https://github.com/SchwarzIT/node-red-chart/issues/22) that they created the InitContainer to work around the same issue I reported. At this stage I'm thinking node-red is not compatible with static volumes on AWS EFS due to the node-red user configuration. This means it won't run on EKS Fargate because Fargate only supports static volumes on EFS (afaik).

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [29 March 2022 09:56 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/8 "2022-03-29T09:56:30Z")

</div>

This is not the case, I have had this working (not for the user dir, but for a data directory mounted under it) on AWS EKS with Node-RED running on fargate.

Out of interest can you talk a bit more about what your end goal is here. Is it a single Node-RED instance or are you planning to run a lot more? If so there may be better solutions

---

<div class="post-metadata">

**Author:** ![packnology](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@packnology](https://discourse.nodered.org/u/packnology)\
**Post date:** [29 March 2022 10:14 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/9 "2022-03-29T10:14:26Z")

</div>

I have a few services already running on Fargate, including postgresql, and wanted to use node-red to prototype an MQTT to database adapter. Did you see anything obviously wrong with my EFS and PV setup? Did you have to configure any user/group settings on EFS to get your solution to work?

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [29 March 2022 10:28 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/10 "2022-03-29T10:28:39Z")

</div>

No, nothing special. I was creating the EFS AccessPoints dymaically with the AWS NodeJS Library passing in the following:

```auto
{
	FileSystemId: this._fsID,
	PosixUser: {
		Uid: 1000,
		Gid: 1000
	},
	RootDirectory: {
		Path: "/"+ name,
		CreationInfo: {
			OwnerUid: 1000,
			OwnerGid: 1000,
			Permissions: "755"
		}
	},
	Tags: [
		{Key: "Name", Value: name+"-ap"}
	]
}

```

Where `name` is a unique name for each Node-RED instance.

Then used the following to create the PV and PVC (note this is JSON representation, but it's the same structure as the YAML would be:

```auto
let pv = {
	apiVersion: "v1",
	kind: "PersistentVolume",
	metadata: {
			name: instance.appname+"-pv"
	},
	spec: {
		capacity: {
			storage: "5Gi"
		},
		volumeMode: "Filesystem",
		accessModes: ["ReadWriteOnce"],
		persistentVolumeReclaimPolicy: "Retain",
		storageClassName: "efs-sc",
		csi: {
			driver: "efs.csi.aws.com",
			volumeHandle: this.storage._fsID + "::" + data.AccessPointId
		},
		claimRef: {
			namespace: instance.namespace,
			name: instance.appname+"-pvc"
		}
	}
}

let pvc = {
	apiVersion: "v1",
	kind: "PersistentVolumeClaim",
	metadata: {
		name: instance.appname+"-pvc"
	},
	spec: {
		accessModes: ["ReadWriteOnce"],
		storageClassName: "efs-sc",
		resources: {
			requests: {
				storage: "5Gi"
			}
		},
		volumeName: instance.appname+"-pv"
	}
}

```

`this.storage._fsID` is the EFS filesystem ID and `data.AccessPointId` is the AccessPoint ID.

---

<div class="post-metadata">

**Author:** ![packnology](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@packnology](https://discourse.nodered.org/u/packnology)\
**Post date:** [29 March 2022 11:12 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/11 "2022-03-29T11:12:12Z")

</div>

Well I'm not exactly sure which part made it work, but I added a few extra lines from your PV/PVC configs (e.g. claimRef section in PV and volumeName in PVC) and I created a new access point with root directory set to "/node-red" (instead of default "/" ). Works like a dream, thanks!! If I get some time I'll try to find out which of those changes got it working and post the results here.

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [29 March 2022 11:45 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/12 "2022-03-29T11:45:26Z")

</div>

It will have been the `/node-red` you can't have an access point at the root of the volume with different uid/gid to 0 iirc

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [12 April 2022 11:45 UTC](https://discourse.nodered.org/t/running-node-red-on-kubernetes-file-permissions-error-on-pod-initialization/60420/13 "2022-04-12T11:45:27Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.