Kraft mode fails with AccessDeniedException on meta.properties because PVC mounts with root ownership. Adding fsGroup: 1000 ensures the volume group matches the Kafka container user.