Volumes and volume types

What a volume is, which volume types to know by heart, and how two containers in one Pod share a folder.

When a container restarts, every file it wrote is lost. A volume is a folder that lives outside the container, so its files stay. Containers in the same Pod can also share it.

Storage is 10% of the exam, the smallest part. Volume questions are quick points if you can type the YAML from memory. Typical ones: an emptyDir shared by two containers, or a hostPath folder on one node. They cost minutes if you have to look up where volumeMounts goes.

Why a container needs a volume

A container keeps its files only while it runs. Say your app saves uploaded photos in /data. The container crashes and Kubernetes restarts it. Without a volume, /data is empty again.

There is a second problem. Each container in a Pod has its own filesystem, so two containers cannot pass files through a normal folder. A volume solves both problems. It has two parts in the Pod YAML:

• spec.volumes: you define the volume once, for the whole Pod. You give it a name and a type.
• volumeMounts: each container that wants the volume lists its name and a mountPath, the folder where it appears inside that container.

Whether the data also outlives the Pod depends on the volume type:

emptyDir

An emptyDir is an empty folder. The kubelet creates it when the Pod starts on a node, and deletes it when the Pod is removed. It survives container restarts, but not Pod deletion. Example: a web app that renders thumbnails into a scratch folder.

• emptyDir: {} is the whole definition for the plain case. The folder is on the node's disk.
• sizeLimit caps the size. If the volume grows past it, the kubelet evicts the Pod.
• medium: Memory keeps the files in RAM. It is faster, but the files count as the container's memory use.

apiVersion: v1
kind: Pod
metadata:
  name: scratch
  namespace: st-vol
spec:
  containers:
    - name: app
      image: busybox:1.36
      command: ["sh", "-c", "sleep 3600"]
      volumeMounts:
        - name: scratch
          mountPath: /scratch
        - name: fast
          mountPath: /fast
  volumes:
    - name: scratch
      emptyDir:
        sizeLimit: 256Mi
    - name: fast
      emptyDir:
        medium: Memory
        sizeLimit: 64Mi

hostPath

A hostPath volume mounts a folder (or a file) from the node into the container. The files live on the node's own disk. The optional type says what the kubelet checks before it mounts the path:

A few more types check for a file or a socket instead. You rarely need them.

hostPath data is node-local: it exists only on the node that wrote it. Say your Pod writes logs to /opt/logs on cka-worker. Tomorrow it starts on cka-worker2 and finds an empty folder. So pin such a Pod to one node, with nodeName or a nodeSelector.

To check the files, open a shell on that node. On the lab that is docker exec cka-worker ls /opt/node-writer. On the exam it is ssh cka-worker, then the same ls.

apiVersion: v1
kind: Pod
metadata:
  name: node-writer
  namespace: st-vol
spec:
  nodeName: cka-worker
  containers:
    - name: writer
      image: busybox:1.36
      command: ["sh", "-c", "date > /data/started; sleep 3600"]
      volumeMounts:
        - name: data
          mountPath: /data
  volumes:
    - name: data
      hostPath:
        path: /opt/node-writer
        type: DirectoryOrCreate

Volumes made from ConfigMaps and Secrets

A configMap or secret volume turns each key of that object into a file. Both are taught in ConfigMaps and Secrets.

A projected volume puts several sources into one folder. Example: your app wants its config file and its TLS certificate side by side in /etc/app. One projected volume gives it both:

volumes:
  - name: bundle
    projected:
      sources:
        - configMap:
            name: app-settings
        - secret:
            name: app-tls

volumeMounts and sharing a volume

Four rules decide what a container sees:

• Each mount names a volume from spec.volumes and gives a mountPath: the folder inside the container.
• A mount hides whatever the image had at that path. In the first task, the volume hides nginx's default page in /usr/share/nginx/html. To add one file without hiding the folder, use subPath, shown in ConfigMaps and Secrets.
• readOnly: true goes on the mount, not on the volume. So one container can write while another only reads.
• Two containers share a volume when both mount the same name. Each one can use its own mountPath.

Containers in a Pod also share one network. So in the first task, the writer container can test nginx at http://localhost/. A helper container that works next to the main one is called a sidecar: see Pods, init containers and sidecars.