Clickhouse cluster creation fails with setcap cap_ipc_lock=+ep /usr/bin/clickhouse error in OpenShift

Although I have set the security context for the containers and added 'anyuid' SCC for the 'defualt' service account, it still doesn't work.

I have also added 'privileged' SCC to default serviceaccount in the namespace but still the same error.

NAME READY STATUS RESTARTS AGE
chi-ch-1-shard-replica-ch-1s-1r-0-0-0 1/2 Running 5 (100s ago) 11m
chk-chi-keeper-keeper-cluster-0-0-0 1/1 Running 0 55m
chk-chi-keeper-keeper-cluster-0-1-0 1/1 Running 0 54m
chk-chi-keeper-keeper-cluster-0-2-0 1/1 Running 0 54m

====== Logs from the pod ===========

oc logs chi-ch-1-shard-replica-ch-1s-1r-0-0-0

Defaulted container "clickhouse" out of: clickhouse, clickhouse-log
/entrypoint.sh: explicitly skip changing user 'default'
Processing configuration file '/etc/clickhouse-server/config.xml'.
Merging configuration file '/etc/clickhouse-server/conf.d/chop-generated-hostname-ports.xml'.
Merging configuration file '/etc/clickhouse-server/conf.d/chop-generated-macros.xml'.
Merging configuration file '/etc/clickhouse-server/conf.d/chop-generated-zookeeper.xml'.
Merging configuration file '/etc/clickhouse-server/config.d/01-clickhouse-01-listen.xml'.
Merging configuration file '/etc/clickhouse-server/config.d/01-clickhouse-02-logger.xml'.
Merging configuration file '/etc/clickhouse-server/config.d/01-clickhouse-03-query_log.xml'.
Merging configuration file '/etc/clickhouse-server/config.d/01-clickhouse-04-part_log.xml'.
Merging configuration file '/etc/clickhouse-server/config.d/01-clickhouse-05-trace_log.xml'.
Merging configuration file '/etc/clickhouse-server/config.d/chop-generated-remote_servers.xml'.
Merging configuration file '/etc/clickhouse-server/config.d/chop-generated-settings.xml'.
Logging debug to /var/log/clickhouse-server/clickhouse-server.log
Logging errors to /var/log/clickhouse-server/clickhouse-server.err.log
2026.07.02 20:32:33.383337 [ 1 ] {} CrashWriter: Sending crash reports is initialized with https://crash.clickhouse.com/ endpoint (anonymized)
2026.07.02 20:32:33.383408 [ 1 ] {} Application: Sending logical errors is enabled
2026.07.02 20:32:33.426293 [ 1 ] {} Application: Starting ClickHouse 26.6.1.1193 (revision: 54511, git hash: 6615864161fd5332edfcb2864658bd9ccc65197b, build id: 29D94EB32905E2740CDEEEBACAFA41F3BE670809), PID 1
2026.07.02 20:32:33.426394 [ 1 ] {} Application: starting up
2026.07.02 20:32:33.426408 [ 1 ] {} Application: OS name: Linux, version: 6.7.4-200.fc39.x86_64, architecture: x86_64
2026.07.02 20:32:33.426550 [ 1 ] {} Application: Available RAM: 15.61 GiB; logical cores: 8; used cores: 8.
2026.07.02 20:32:33.426564 [ 1 ] {} Application: Available CPU instruction sets: SSE, SSE2, SSE3, SSSE3, SSE41, SSE42, F16C, POPCNT, BMI1, BMI2, LZCNT, MOVBE, PCLMUL, AES, AVX, FMA, AVX2, SHA, ADX, RDRAND, RDSEED, RDTSCP, CLFLUSHOPT, CLWB, XSAVE, OSXSAVE, VAES, VPCLMULQDQ

2026.07.02 20:32:33.427474 [ 1 ] {} Application: It looks like the process has no CAP_IPC_LOCK capability, binary mlock will be disabled. It could happen due to incorrect ClickHouse package installation. You could resolve the problem manually with 'sudo setcap cap_ipc_lock=+ep /usr/bin/clickhouse'. Note that it will not work on 'nosuid' mounted filesystems.

2026.07.02 20:32:33.435579 [ 1 ] {} CgroupsReader: Will create cgroup reader from '/sys/fs/cgroup/' (cgroups version: v2)
2026.07.02 20:32:33.435873 [ 1 ] {} AsynchronousMetrics: Will use cgroup reader from '/sys/fs/cgroup/' (cgroups version: v2)
2026.07.02 20:32:33.436443 [ 1 ] {} StatusFile: Status file /var/lib/clickhouse/status already exists and is empty - probably unclean hardware restart.

===== Manifest used ==============================================================

apiVersion: "clickhouse.altinity.com/v1"
kind: "ClickHouseInstallation"
metadata:
name: "ch-1-shard-replica"
spec:
defaults:
templates:
dataVolumeClaimTemplate: data-volume-template
logVolumeClaimTemplate: log-volume-template
configuration:
users:
# printf 'test_password' | sha256sum
admin_user/password_sha256_hex: 10a6e6cc8311a3e2bcc09bf6c199adecd5dd59408c343e926b129c4914f3cb01
admin_user/password: test_password
admin_user/networks/ip:
- 0.0.0.0/0
settings:
http_port: 8123
tcp_port: 9000
interserver_http_port: 9010
clusters:
- name: "ch-1s-1r"
layout:
shardsCount: 1
replicasCount: 1
zookeeper:
nodes:
- host: "chk-chi-keeper-keeper-cluster-0-0-0.clickhouse-altinity.svc.cluster.local"
- host: "chk-chi-keeper-keeper-cluster-0-1-0.clickhouse-altinity.svc.cluster.local"
- host: "chk-chi-keeper-keeper-cluster-0-2-0.clickhouse-altinity.svc.cluster.local"
templates:
podTemplates:
- name: pod-template
metadata:
labels:
custom.label: "label.value"
annotations:
custom.annotation: "annotation.value"
spec:
containers:
- name: clickhouse
image: clickhouse/clickhouse-server:26.6.1
resources:
requests:
cpu: "1000m"
ports:
- name: http
containerPort: 8123
- name: tcp
containerPort: 9000
- name: interserver
containerPort: 9010
securityContext:
capabilities:
add:
- IPC_LOCK
- SYS_NICE
volumeClaimTemplates:
- name: data-volume-template
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
- name: log-volume-template
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 100Mi

Start with the ClickHouseInstallation manifest, the rendered pod securityContext, and the /entrypoint.sh logs; inspect how the requested IPC_LOCK capability appears in the OpenShift pod. Reproduce the cluster creation failure and verify that the ClickHouse container starts without the capability warning or repeated restarts.