Storage

The Storage Stack

Key Numbers

StorageClass and Dynamic Provisioning

# StorageClass — recipe for a kind of storage
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata: { name: fast-ssd }
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  iops: "3000"
  throughput: "125"
  encrypted: "true"
  kmsKeyId: arn:aws:kms:us-east-1:...:key/...
volumeBindingMode: WaitForFirstConsumer    # bind only when a Pod is scheduled
allowVolumeExpansion: true
reclaimPolicy: Delete
mountOptions: [discard, noatime]

---
# PVC — request from a user
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: pgdata }
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: fast-ssd
  resources:
    requests: { storage: 100Gi }

---
# Pod consuming it
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: postgres
      image: postgres:16
      volumeMounts:
        - name: data
          mountPath: /var/lib/postgresql/data
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: pgdata

CSI Driver Anatomy

# A CSI driver is two Pods:
# 1. Controller Pod — runs in cluster, talks to cloud API to provision/attach
# 2. Node DaemonSet — runs on every node, handles mount/unmount

# Sidecars (provided by Kubernetes-CSI)
external-provisioner   # watches PVCs, calls CreateVolume/DeleteVolume
external-attacher      # ControllerPublish/Unpublish (cloud attach)
external-resizer       # ControllerExpand
external-snapshotter   # CreateSnapshot
node-driver-registrar  # registers the driver with kubelet
livenessprobe          # k8s-style health for the driver

# CSI gRPC interface (simplified)
service Identity   { rpc GetPluginInfo / GetPluginCapabilities }
service Controller { rpc CreateVolume / DeleteVolume / ControllerPublishVolume /
                      ControllerExpandVolume / CreateSnapshot }
service Node       { rpc NodeStageVolume / NodePublishVolume / NodeUnpublishVolume /
                      NodeExpandVolume }

VolumeSnapshot and Restore

# Snapshot a running PVC
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshot
metadata: { name: pgdata-2026-05-03 }
spec:
  volumeSnapshotClassName: ebs-snapshot
  source:
    persistentVolumeClaimName: pgdata

---
# Restore: new PVC from the snapshot
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: pgdata-restored }
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: fast-ssd
  resources:
    requests: { storage: 100Gi }
  dataSource:
    name: pgdata-2026-05-03
    kind: VolumeSnapshot
    apiGroup: snapshot.storage.k8s.io

ReadWriteMany Options

Local PVs and Ephemeral Volumes

# Local PV — directly attached SSD/NVMe, no cloud volume
apiVersion: v1
kind: PersistentVolume
metadata: { name: local-nvme-1 }
spec:
  capacity: { storage: 1Ti }
  accessModes: [ReadWriteOnce]
  persistentVolumeReclaimPolicy: Retain
  storageClassName: local-storage
  local:
    path: /mnt/disks/nvme0n1
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values: [node-7]

---
# Generic ephemeral — PVC lifetime tied to Pod
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: app
      volumeMounts: [ { name: scratch, mountPath: /scratch } ]
  volumes:
    - name: scratch
      ephemeral:
        volumeClaimTemplate:
          spec:
            accessModes: [ReadWriteOnce]
            storageClassName: fast-ssd
            resources: { requests: { storage: 50Gi } }

Tradeoffs

Frequently Asked Questions