hostPath Volumes
What does a hostPath volume hand a Pod, and why does it stay on one Node? The Kubelet checks the path by type (unset checks nothing, Directory must exist, DirectoryOrCreate makes it), then the runtime bind-mounts it into the container, so writes land on the Node disk, escape the ephemeral-storage limit and outlive the Pod. A replacement elsewhere finds a different directory or none, and since any path is allowed, Baseline and Restricted Pod Security forbid it.
Play the animation 7 steps, animated, best on a wide screen
hostPath Volumes, step by step
-
Pod app asks for hostPath /data/app, type Directory, mounted at /cache, and lands on Node-1. Before any container starts, the Kubelet checks the path on Node-1: Directory means a directory must already exist there, and one does.
Play from step 1 -
The Kubelet asks containerd to create the app container with that mount, and the container starts with /data/app of Node-1 bind-mounted at /cache. It is one directory under two names: nothing is copied into the Pod.
Play from step 2 -
The app writes cache.db to /cache. No copy sits in between, so the file lands straight in /data/app on the Node-1 disk, where the Node sees it at once.
Play from step 3 -
The Pod has an ephemeral-storage limit of 1Gi, yet cache.db grows to 8Gi and the limit does not stop it: hostPath usage is not counted as ephemeral storage. Only the Node-1 disk fills, which can put the whole Node under disk pressure.
Play from step 4 -
Pod app is deleted. The Kubelet has containerd stop the container, and its bind mount goes with it, but hostPath teardown deletes nothing, so /data/app and cache.db stay on Node-1 after the Pod is gone.
Play from step 5 -
Its replacement, Pod app-2, lands on Node-2: hostPath ties no Pod to a Node. There is no /data/app on Node-2, so the Kubelet check fails with FailedMount and app-2 stays in ContainerCreating. DirectoryOrCreate would start it empty.
Play from step 6 -
The hostPath spec limits no path. On Node-1, /var/lib/kubelet holds the Secret volumes of its Pods and containerd.sock hands out root. So Baseline and Restricted Pod Security forbid hostPath, and only Privileged allows it, for Node agents such as log readers.
Play from step 7