Kubernetes Storage

Kubernetes storage is the infrastructure that provides durable or temporary file storage for workloads running in Pods.

Containers are ephemeral, and many applications need data that survives container restarts and rescheduling.

Ephemeral storage is temporary storage local to a container or pod and usually lost when the pod is deleted.

Persistent storage remains available across pod restarts and may outlive the pod itself.

A volume is a storage unit mounted into a pod, such as a directory or block device.

A pod volume is a storage object attached to a pod and shared by one or more containers in that pod.

Examples include emptyDir, hostPath, configMap, secret, persistentVolumeClaim, and CSI-based volumes.

emptyDir is a temporary volume created when a pod starts and deleted when the pod ends.

It is useful for scratch space, caches, and temporary data within a single pod.

A hostPath volume mounts a file or directory from the node filesystem into the pod.

It tightly couples the pod to the node filesystem and can expose host data or create security problems.

A ConfigMap volume mounts configuration data as files into a pod.

A Secret volume mounts sensitive data into a pod as files with restricted access.

Logs may need to be retained or shipped to a centralized system, even after pod restarts.

A StatefulSet is a Kubernetes workload designed for stateful applications requiring stable identities and persistent storage.

Because they often manage pods whose storage should survive rescheduling and identity changes.

A PersistentVolume (PV) is cluster-level storage resource provisioned by an administrator or storage system.

A PersistentVolumeClaim (PVC) is a request by a workload for storage with certain capacity and access mode.

A PVC binds to a compatible PV so a pod can use the storage.

Because they abstract the storage backend and let workloads request storage declaratively.

A StorageClass defines the storage provisioner and policy, such as performance or reclaim behavior.

It allows dynamic provisioning of PVs without manual cluster administration.

Dynamic provisioning automatically creates a PV when a PVC requests storage.

Static provisioning means an admin manually creates a PV before a pod requests it.

A provisioner is the storage plugin or controller that creates the storage resource for a PVC.

CSI (Container Storage Interface) is the standard interface for storage plugins in Kubernetes.

It standardizes how storage systems integrate with Kubernetes.

A volume mount attaches a volume to a specific container path inside the pod.

It defines the volumes available to one or more containers in the pod.

A volumeMount is the part of a container definition that mounts a volume to a path.

A container filesystem is the view inside the running container, including mounted volumes.

An access mode defines how a volume can be used, such as ReadWriteOnce or ReadOnlyMany.

RWO means the volume can be mounted read-write by a single node at a time.

ROX means the volume may be mounted read-only by many nodes.

RWX means the volume can be mounted read-write by many nodes.

They define whether a storage backend can satisfy the workload’s concurrency and topology needs.

Binding is the process of matching a PVC to a compatible PV.

A reclaim policy defines what happens to the underlying storage when a PV is released, such as Retain, Delete, or Recycle.

Retain keeps the data on the underlying storage after the PV is released.

Delete deletes the underlying storage resource when the PV is released.

Retain preserves data for later recovery, while Delete removes the underlying storage automatically.

The reclaim policy in a StorageClass defines the default behavior for PVs created from that class.

A volume claim template is a template inside a StatefulSet or similar object that creates PVCs automatically.

Because each pod replica often needs its own persistent volume.

StatefulSet pods have stable names and identities, often used with persistent storage.

A pod restart may keep the same PVC and thus the same data, while an image or ephemeral volume may be lost.

Application state includes user data, databases, caches, logs, and other durable artifacts.

Stateful workloads need persistent data; stateless workloads can be recreated from immutable images.

A database volume stores the database files, journals, and indexes.

Because database data must survive container restarts and node failures in many setups.

It is a directory in the container backed by storage from a volume or PVC.

A block device volume exposes storage as a raw block device rather than a directory.

Some databases and storage systems need block semantics rather than file semantics.

Local storage is storage local to a node, often not portable across machines.

Because if the node fails, the data may be lost or unavailable.

Distributed storage spans multiple nodes or storage clusters and can survive node failures.

A network-attached storage system is accessed over the network, often by NFS or block protocols.

Cloud storage includes services like EBS, Azure Disk, or GCP Persistent Disk.

The capacity is the requested storage size, such as 10Gi.

A PV size is the actual amount of storage the storage backend provides.

Because workloads must be provisioned with enough space to operate reliably.

Volume expansion increases the size of an existing persistent volume or claim.

It allows workloads to grow without redeploying or recreating the storage.

Data migration moves data from one storage backend to another, often during upgrades or cloud moves.

It includes creating backups of volume contents and restoring them to new volumes or clusters.

A snapshot is a point-in-time image of a volume, often used for backups or cloning.

They help protect against data loss and speed up recovery.

A clone is a new volume created from an existing volume snapshot or content.

A PVC binding failure occurs when no compatible PV exists or the storage class is misconfigured.

It happens when the requested storage class or access mode does not match the available PVs.

A PVC may stay pending until a suitable PV or dynamic provisioner is available.

It tells Kubernetes which storage backend should provision the volume.

A storage plugin is a CSI driver or integration that connects Kubernetes to an actual storage system.

Because it defines performance, durability, multi-attach behavior, and availability.

A storage tier groups volumes by performance and cost characteristics, such as standard vs premium.

Some workloads need high IOPS or low latency, while others can use cheaper or slower storage.

Temporary data created during pod runtime that is gone when the pod ends.

Data on a PV or other durable backend that remains after pod restarts or reschedules.

It is the flow from the application to the storage, often through a PVC and CSI plugin.

Data locality is the principle of keeping computation near the data to reduce latency and cost.

Because remote storage can add latency and operational complexity.

It includes performance profile, access modes, snapshots, encryption, and multi-attach support.

It is the path inside the container where a volume is exposed.

Because many apps expect to write state there.

It includes creation, attachment, use, release, and reclamation.

A volume is the storage resource; a mount is how the container sees it in the filesystem.

A file-based app workload expects a filesystem tree and often uses read/write directories.

A block-based app workload expects raw devices, common in database systems.

Each stateful microservice may use separate PVCs or storage classes based on needs.

A stateful service depends on persistent data and stable identity.

A stateless service can be recreated from its image or ephemeral storage without losing important state.

Because the image is immutable and not the right place for mutable, growing data.

A cache volume stores temporary data to improve performance but may not be critical.

An upload volume stores user uploads and may need persistence and backup.

Storage throttling limits throughput or IOPS to protect the underlying system.

Slow or unreliable storage can degrade application responsiveness and reliability.

It is a tool or mechanism used to observe storage usage and capacity for PVCs.

It describes how a workload writes data, such as many small writes, large sequential writes, or bursty workloads.

It includes monitoring of disk usage, IOPS, latency, volume health, and PVC status.

A storage outage is when the underlying storage backend becomes unavailable, causing app disruption.

A CSI driver is the implementation that connects Kubernetes to a storage backend.

Because they standardize storage behavior across on-prem, cloud, and NAS systems.

A local PV is storage tied to a specific node and often used for local fast storage.

For highly performance-sensitive workloads, local NVMe or SSD storage can reduce latency.

A network filesystem PV uses NFS or similar file-sharing over the network.

A cloud disk PV uses cloud block storage like AWS EBS or GCP persistent disks.

It uses managed file sharing like Azure Files or EFS-like backends.

It is the controller or driver used to provision storage instances.

It creates PVs automatically from PVC requests according to the storage class.

A static PV is manually created and often used for pre-provisioned storage systems.

A selector can match a PV to PVCs based on labels or properties.

Node affinity restricts where a volume can be attached or used.

It ensures the pod runs on a node that can access the required storage.

It defines which nodes or zones can access certain storage resources.

A volume that can be attached to multiple nodes simultaneously.

Some distributed or replicated workloads need to share storage across nodes.

A single-attach volume only supports one node at a time.

Because many storage backends are designed for single-node attach and simpler failover.

A read-only mount prevents writes to the mounted volume.

For certificates, config, or static assets.

Volume mode is either Filesystem or Block.

Filesystem mode exposes the storage as a mounted directory.

Block mode exposes the storage as a raw block device, e.g. /dev/sda-like interface.

Some databases need block devices or low-level storage semantics.

A key becomes a file in the mounted directory.

A Secret’s keys are presented as mounted files, often restricted by mode and ownership.

A subPath mounts only a specific file or directory from a larger volume into a container.

To mount a specific file or subdirectory without exposing the full volume.

Permissions determine who can read or write the mounted data.

Because wrong permission settings can block the application or reveal sensitive files.

A controller that manages snapshots, restore, and lifecycle of storage snapshots.

Some CSI drivers support snapshot creation and restore.

Restoring from a snapshot creates a new volume from the saved point-in-time data.

PVC resize increases the requested storage capacity for a volume.

Not all storage backends support online expansion or resizing of all volume types.

A StorageClass parameter configures the behavior or backend-specific options of the provisioner.

A selector can match labels on a PV to select a specific storage pool or region.

Storage objects are often namespaced or context-scoped to the cluster.

Examples include lost node affinity, backend outage, or disk full conditions.

It can cause application failures and data corruption if writes fail.

It is the plan for copying or snapshotting volumes to protect against loss or corruption.

It confirms that a backup or snapshot can be restored and used by the app successfully.

A multi-zone volume is available across availability zones, improving resilience.

It helps ground stateful workloads against node or zone failures.

RPO (Recovery Point Objective) is the maximum acceptable data loss window.

RTO (Recovery Time Objective) is the maximum acceptable time to recover after a failure.

Because durable storage determines how quickly and completely systems can recover.

It defines how PVs behave when no longer claimed by a workload.

It can trigger a reclaim policy and potentially delete associated storage.

It preserves data for later manual handling or restores.

It is the name used for the PVC generated per pod.

Each StatefulSet pod may have a unique PVC tied to its identity.

Because each pod often needs its own stable state and data store.

A shared volume can be used by multiple app replicas or a cluster, often with careful access control.

Because concurrency and locking semantics must be designed carefully.

A distributed file system is a storage system that spreads files across multiple nodes for capacity and resilience.

An object store stores files as objects with metadata, often used for blobs and backups rather than databases.

Because it lacks the random access and transactional semantics needed by many databases.

An ephemeral volume is a volume that lasts the lifetime of the pod but is backed by a CSI driver.

Ephemeral volumes are not persisted across deletion, while PVs are persistent.

It is simpler to manage and often used for caches or temporary data.

Persistence keeps data available while the app is running; retention is a policy for keeping backups and historical data longer.

A default StorageClass automatically applies when a PVC does not specify one.

A custom storage class is defined for a specific backend or service level.

It allows fine-grained performance and cost management across workloads.

Binding mode determines how quickly a PVC binds to a PV, such as Immediate or WaitForFirstConsumer.

A PVC waits for the first pod to be scheduled before binding to a suitable PV, improving topology alignment.

It reduces cross-zone or cross-node inefficiencies.

The scheduler may need to place a pod near the volume or in a zone that can access it.

A PV may be tied to a specific zone, affecting where the pod must run.

Because volumes often exist in a specific region or zone.

A cloud disk may fail if its zone or availability domain fails.

Because losing the node or zone can affect data availability if the storage is not replicated or resilient.

It duplicates data across nodes, disks, or zones for resilience.

A plan to recover a workload from snapshot-backed storage to a cluster or environment.

Abstract the backend behind PVCs and StorageClasses so the workload does not care whether the storage is local, cloud, or network-based.

It includes create, delete, attach, detach, mount, and snapshot operations.

Attach/detach is the lifecycle where a storage device is connected or disconnected from a node.

Mount/unmount connects or disconnects the storage from the pod filesystem.

A storage controller manages the backend and lifecycle of storage resources behind Kubernetes.

It watches PVCs and binds them to PVs or provisions new storage.

It is the storage implementation used by the cluster to provision and manage volumes.

It is the process of managing the lifecycle, placement, and provisioning of persistent storage for workloads.

It is storage shared across multiple workloads or teams with policies and isolation.

Because persistent data often contains credentials, user content, or sensitive business state.

It encrypts data stored on the underlying storage volume, reducing risk if the backend is compromised.

Kubernetes or the storage backend may integrate with a KMS for encryption keys.

To protect data from unauthorized reads at rest or in backup snapshots.

It replaces existing encryption keys without losing data integrity or availability.

It limits who can attach, mount, or read a volume.

It is the unauthorized movement of data from a volume to outside the system.

It means each workload uses separate storage boundaries and access controls.

Shared storage can let multiple workloads access the same data if not isolated properly.

Snapshots can contain sensitive data and therefore must be protected like primary data.

Data sanitization destroys or wipes storage content before reuse or deletion.

Because old disks or backups may retain sensitive data and be reused unexpectedly.

It includes retention, backup, archival, reclamation, and secure deletion decisions.

A storage backend that cannot keep up may cause latency spikes and application timeouts.

Because node or zone failure can cause application downtime if data is not replicated or robustly provisioned.

Kubernetes storage is the layer that transforms ephemeral containers into durable, stateful services by abstracting storage backends behind volumes, claims, classes, and CSI drivers.