Pods unready/CrashLoopBackOff with message "sed: cannot rename: Operation not permitted"

Issue

• Pods are unready, in CrashLoopBackOff, or in failed state:

[root@server ~]# oc get pod
NAME                            READY     STATUS             RESTARTS   AGE
hawkular-cassandra-1-cwg6p      0/1       CrashLoopBackOff   33         2h
hawkular-metrics-k78t7          0/1       Running            865        5d
hawkular-metrics-schema-tw6kh   0/1       Completed          0          11d
heapster-tbkt9                  0/1       Running            867        5d

• The pod logs show a sed issue, such as the following:

sed: cannot rename /opt/apache-cassandra/conf/sedU1J2iu: Operation not permitted
sed: cannot rename /opt/apache-cassandra/conf/sedBqYVXt: Operation not permitted

• From a shell inside the container, there are no SELinux denials, no ACL-related denials, and no obvious permission problems.
• An attempt to redeploy the schema (if applicable) or redeploy the image may work for a time, but the issue recurs.