Using host paths for persistent volumes with restrictions

7/31/2018

Is there any way to configure k8s so that pre defined host paths on worker nodes , are only available for the pods that belong to a particular name space and other pods in other name spaces cannot mount it.

-- Ijaz Ahmad Khan
kubernetes
kubernetes-security

1 Answer

8/1/2018

There is no such possibility. It is related with the nature of volumes. To be more specific:

A Kubernetes volume has an explicit lifetime - the same as the pod that encloses it. [...] when a Pod ceases to exist, the volume will cease to exist, too. Perhaps more importantly than this, Kubernetes supports many types of volumes, and a Pod can use any number of them simultaneously. [...] A volume is just a directory, which is accessible to the Containers in Pod. How that directory comes to be, the medium that backs it and the contents are determined by particular volume type used.

With an emptyDir the idea is that node can store it's contents in another node. And there is essentially no difference between emptyDir and hostpath other than the emptyDir starts empty and they are not persistent (also they do not require any special provisioning as they use existing storage on the node). HostPath volumes persist on the original node, unless after restart it starts on different node - then it will be unable to access that volume. So if your host node filesystem (the node on which the hostPath will be created) has some path on it, then the hostPath will allow it to be mounted on any Pod. With no other restrictions here.

-- aurelius
Source: StackOverflow