Hi team, I got this error when installing Starrocks on OpenShift

[Thu Dec 4 18:48:49 CST 2025] Process conf file fe.conf ...
mv: cannot move '/opt/starrocks/fe/conf/fe.conf' to '/opt/starrocks/fe/conf/fe.conf.bak': Permission denied
ln: failed to create symbolic link '/opt/starrocks/fe/conf/fe.conf': Permission denied
[Thu Dec 4 18:48:49 CST 2025] first start fe with meta not exist.
[Thu Dec 4 18:48:49 CST 2025] FE service kube-starrocks-fe-service.:9030 is not alive yet!
[Thu Dec 4 18:48:51 CST 2025] FE service kube-starrocks-fe-service.:9030 is not alive yet!
[Thu Dec 4 18:48:53 CST 2025] FE service kube-starrocks-fe-service.:9030 is not alive yet!
[Thu Dec 4 18:49:19 CST 2025] Timed out, no members detected ever, assume myself is the first node ..
[Thu Dec 4 18:49:19 CST 2025] first start with no meta run start_fe.sh with additional options: ' --host_type FQDN'

I'm using

config:

in values.yaml file

operator:
  starrocksOperator:
    enabled: true
    namespaceOverride: "..."
    podLabels:
      <http://app.kubernetes.io/name|app.kubernetes.io/name>: kube-starrocks-operator

starrocks:
  nameOverride: "kube-starrocks"
  initPassword:
    enabled: true
    passwordSecret: starrocks-root-pass
  
  # TimeZone is used to set the environment variable TZ for pod, with Asia/Shanghai as the default.
  timeZone: Asia/Shanghai

  # Shared-nothing deployment
  starrocksCluster:
    enabledBe: false
    enabledCn: true
    # disable disaster recovery
    
  starrocksFESpec:
    replicas: 1
    image:
      repository: .../starrocks/fe-ubuntu
      tag: "3.5-latest"
    imagePullPolicy: IfNotPresent
    service:
      type: "ClusterIP"
    imagePullSecrets:
      - name: "..."
    resources:
      requests:
        cpu: 1
        memory: 2Gi
      limits:
        cpu: 2
        memory: 4Gi
    storageSpec:
      name: fe
      storageClassName: "..."
      storageSize: 10Gi
      logStorageSize: 5Gi
    config: |
      LOG_DIR = ${STARROCKS_HOME}/log
      DATE = "$(date +%Y%m%d-%H%M%S)"
      JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true -Xmx8192m -XX:+UseG1GC -Xlog:gc*:${LOG_DIR}/fe.gc.log.$DATE:time"
      http_port = 8030
      rpc_port = 9020
      query_port = 9030
      edit_log_port = 9010
      mysql_service_nio_enabled = true
      sys_log_level = INFO
      min_graceful_exit_time_second = 25
      # Enable Shared-data mode
      run_mode = shared_data
      cloud_native_storage_type = S3
      aws_s3_endpoint = http://...:9000
      aws_s3_path = ...
      aws_s3_access_key = ...
      aws_s3_secret_key = ...
      aws_s3_use_instance_profile = false
      aws_s3_use_aws_sdk_default_behavior = false
      enable_load_volume_from_conf = true
  
  # spec for compute node, compute node provide compute function.
  starrocksCnSpec:
    replicas: 1
    image:
      repository: .../starrocks/cn-ubuntu
      tag: "3.5-latest"
    imagePullPolicy: IfNotPresent
    imagePullSecrets:
      - name: "..."
    resources:
      requests:
        cpu: 1
        memory: 2Gi
      limits:
        cpu: 2
        memory: 4Gi
    storageSpec:
      name: cn
      storageClassName: "..."
      storageSize: 10Gi
    config: |
      sys_log_level = INFO
      thrift_port = 9060
      webserver_port = 8040
      heartbeat_service_port = 9050
      brpc_port = 8060
    configyaml: {}
  
  # specify the FE proxy deployment or not.
  starrocksFeProxySpec:
    enabled: false

This log shows fe is trying to discover if any existing FE leader available, and will timeout and go with the regular provisioning if nothing found. https://github.com/StarRocks/starrocks/blob/main/docker/dockerfiles/fe/fe_entrypoint.sh#L158

@Kevin Cai oh so this log is normal right?

it is not. must be read-only rootfs set to the pod?

runAsNonRoot: false
    readOnlyRootFilesystem: false

@Kevin Cai I've already set this, what else do i need to add? thank you

can you describe the pod fe-0 as yaml, may find something there.

@Kevin Cai I've already set this but still pod has

runAsNonRoot: true

configuration

should be the hard settings from openshift, have to consult openshift doc on how to allow runAsNonRoot to false.