Share large block device among multiple Kubernetes pods via NFS keeping exports isolated per namespace

8/9/2019

I host multiple projects on a Kubernetes cluster. Disk usage for media files is growing fast. My hosting provider allows me to create large block storage spaces, but these spaces can only be attached to a node (VPS) as a block device. For now I don’t consider switching to an object storage.

I want to use a cheap small VPS with a large block device attached to it as a NFS server for several projects (pods).

I've read some tutorials about using NFS as persistent volumes. The approaches are:

External NFS service. What about security? How to expose an export to one and only one pod inside the cluster?

ie, on the NFS server machine:

/share/
    project1/
    project2/
    ...
    projectN/

Where each /share/project{i} must be only available to pods in project{i} namespace.

Multiple dockerized NFS services, using the affinity value to attach the nfs services to nfs server node.

I don't know if it's a good practice having many NFS server pods on the same node.

Maybe there are other approaches I'm not aware. What's the best Kubernetes approach for this use case?

-- Manel R. Doménech
kubernetes
nfs

1 Answer

9/3/2019

There is no 1 answer for your questions. It depends on your solution(architecture),requirements,security many others factors.

  • External NFS service. What about security?

In this case all consideration are on your side (my advice is to choose some supported solution by your cloud provided) please refer to Considerations when choosing a right solution.

As one example please read about security NFS Volume Security. In your case all responsibility are on administrator side to share volumes and provide appropriate security settings.

  • According to the second question.

You can use pv,pvc claim, namespaces and storage classes to achieve your goals.

Please refer to pv with nfs server and storage classes

Note:

For example, NFS doesn’t provide an internal provisioner, but an external provisioner can be used. Some external provisioners are listed under the repository kubernetes-incubator/external-storage. There are also cases when 3rd party storage vendors provide their own external provisioner .

For affinity rules please also refer to Allowed Topologies in case topology of provisioned volumes will be applied/restricted to specific zones.

Additional resources:

Hope this help.

-- Hanx
Source: StackOverflow