All diagrams
Storage: CSI & Mount Pathk8s 1.36

CSI Ephemeral Volumes

How do you mount a credential from an external store with no PV and no PVC? A CSI volume written inline in the Pod spec goes straight to the CSI node plugin: Kubelet calls NodePublishVolume, the driver creates the volume in that call and deletes it on NodeUnpublishVolume, with no StorageClass, no claim and no attach. Only a driver whose CSIDriver lists the Ephemeral mode may serve it, and since volumeAttributes come from the Pod author, an admin can drop that mode.

Play the animation 6 steps, animated, best on a wide screen

CSI Ephemeral Volumes, Kubernetes diagram

CSI Ephemeral Volumes, step by step

  1. Pod web-0 declares a CSI volume inline: the driver name, a few volumeAttributes and readOnly true, which this driver requires. It names no claim, so no PVC or PV is created and no StorageClass is read, and an inline CSI volume is never attached, so no VolumeAttachment either. The Pod lands on Node-1 and Kubelet picks up its spec.

    Play from step 1

  2. Kubelet checks the CSIDriver object for this driver. It lists Ephemeral in volumeLifecycleModes, so inline use is allowed. With no such mode, or no CSIDriver at all, Kubelet refuses the mount. The attributes come straight from the Pod author, so removing the mode, or a webhook, is how an admin says no.

    Play from step 2

  3. Kubelet calls NodePublishVolume on the node plugin directly, with no ControllerPublishVolume and no NodeStageVolume. The call carries the volumeAttributes plus Pod info, since this CSIDriver sets podInfoOnMount, and, with no PV to take a handle from, a volume id Kubelet hashes from the Pod UID and volume name.

    Play from step 3

  4. The driver has to create the volume inside that one call. Here it is the Secrets Store driver: it mounts an empty tmpfs at the path Kubelet gave it. Its attributes name a SecretProviderClass, and the provider plugin that class names fetches db-password from the external store while the driver waits.

    Play from step 4

  5. With db-password in hand the driver writes it into that tmpfs as a file, and the call returns. Only then does Kubelet start the container, so the Pod turns Running and the app reads db-password at /mnt/secrets like any other file.

    Play from step 5

  6. Deleting the Pod takes the volume with it. Once its containers have stopped, Kubelet calls NodeUnpublishVolume and the driver deletes the volume, and only then is the Pod object gone. There is no claim to release and no PV to reclaim, because the volume lives and dies with the Pod.

    Play from step 6

Sources

Commands for this