Permission denied: Could not load server certificate file

Please, answer some short questions which should help us to understand your problem / question better?

• Which image of the operator are you using? registry.opensource.zalan.do/acid/postgres-operator:v1.6.3
• Where do you run it - cloud or metal? Kubernetes or OpenShift? Bare Metal K8s (Minikube)
• Are you running Postgres Operator in production? no
• Type of issue? Help

I am new to Postgres-operator and running it on my local machine with minikube single node.
We are mounting certificate files and setting their paths in Postgres-parameters in the manifest file.
I am facing a permission denied issue as shown below

syncing data to disk ... ok

Success. You can now start the database server using:

    /usr/lib/postgresql/13/bin/pg_ctl -D /home/postgres/pgdata/pgroot/data -l logfile start

2021-07-02 12:19:57.115 UTC [92]    FATAL:  could not load server certificate file "/home/postgres/pgdata/certs/data-store.pem": Permission denied
2021-07-02 12:19:57.115 UTC [92]    LOG:  database system is shut down
2021-07-02 12:19:57,118 INFO: postmaster pid=92
/var/run/postgresql:5432 - no response
2021-07-02 12:19:57,130 INFO: removing initialize key after failed attempt to bootstrap the cluster
2021-07-02 12:19:57,175 INFO: renaming data directory to /home/postgres/pgdata/pgroot/data_2021-07-02-12-19-57
/var/run/postgresql:5432 - no response
Traceback (most recent call last):
  File "/usr/local/bin/patroni", line 33, in <module>
    sys.exit(load_entry_point('patroni==2.0.2', 'console_scripts', 'patroni')())
  File "/usr/local/lib/python3.6/dist-packages/patroni/__init__.py", line 170, in main
    return patroni_main()
  File "/usr/local/lib/python3.6/dist-packages/patroni/__init__.py", line 138, in patroni_main
    abstract_main(Patroni, schema)
  File "/usr/local/lib/python3.6/dist-packages/patroni/daemon.py", line 100, in abstract_main
    controller.run()

And this is my manifest file

apiVersion: "acid.zalan.do/v1"
kind: postgresql
metadata:
  name: data-store
  namespace: default
spec:
  dockerImage: localhost:5000/data-store-with-spilo-1
  teamId: "data"
  spiloFSGroup: 103
  volume:
    size: 1Gi
    storageClass: standard
  additionalVolumes:
    - name: data
      subPath: data-store-certs
      mountPath: /home/postgres/pgdata/certs
      targetContainers:
        - postgres
      volumeSource:
        persistentVolumeClaim:
          claimName: vault-pvc
          readOnly: true
  numberOfInstances: 1
  postgresql:
    version: "13"
    parameters:  # Expert section
      listen_addresses: "*"
      log_line_prefix: "%m [%p] %u %a %r "
      ssl: "on"
      ssl_ca_file: "/home/postgres/pgdata/certs/ca.pem"
      ssl_cert_file: "/home/postgres/pgdata/certs/data-store.pem"
      ssl_key_file: "/home/postgres/pgdata/certs/data-store-key.pem"
      ssl_ciphers: "HIGH:+3DES:!aNULL"
      ssl_prefer_server_ciphers: "off"
      ssl_ecdh_curve: "secp384r1"
      ssl_min_protocol_version: "TLSv1.2"
      ssl_max_protocol_version: "TLSv1.3"
      timescaledb.telemetry_level: "off"
      wal_level: "logical"
      wal_log_hints: "on"
      shared_preload_libraries: "timescaledb"
      # ident_file: "/home/postgres/pg_ident.conf"  # ident configuration file
      # hba_file: "/home/postgres/pg_hba.conf"  # ident configuration file 

localhost:5000/data-store-with-spilo-1 is my custome image build on top of registry.opensource.zalan.do/acid/spilo-13:2.0-p7

Please help me to solve this issue.

Start with the provided PostgreSQL manifest, especially additionalVolumes, spiloFSGroup, and the ssl_* paths, then reproduce the certificate mount on a single-node Minikube cluster. Inspect the mounted certificate ownership and permissions in the postgres container; done means the configured server certificate can be loaded and the cluster starts successfully.