How to provision a volume to multiple namespaces?

[derselbst]

Consider that a filesystem or a directory on a Weka Storage must be consumed by many different users on a Kubernetes cluster. While this is trivial to do when all users are working in a shared namespace, it seems a bit tricky when every user operates in a separate namespace. That's because one cannot bind a PVC (a namespace-scoped object) to a pod living in a different namespace.

Our solution to this is the following:

foreach namespace, that needs access to that shared volume:

1. Statically provision the volume as described in the examples/ folder.
2. While doing so, make sure to give the PV a unique name.
3. Create a matching PVC for the PV in the current namespace.
4. Optionally create many pods, which bind this PVC in the current namespace.

This procedure seems to have the desired effect: a pod in namespace A can bind a volume, write to it and any changes to the files can be simultaneously read back by another pod in namespace B.

Now, given the comment about the volumeHandle in #66 (comment) I do wonder if this procedure is officially supported or if there is another approach to this issue?

[sergeyberezansky]

Hello,
According to official Kubernetes documentation, a single storage entity can be represented by a single PersistentVolume only.
However, there might be multiple PersistentVolumeClaims (in different namespaces as well) that point to same persistent volume.
PersistentVolume objects are also global and not bound to any namespace for that very reason.
Obviously, the volume should be provisioned statically.

To use PersistentVolumeClaim in each Namespace:
Create a separate PersistentVolumeClaim in each namespace that references the same underlying PersistentVolume. For example:

# Namespace: namespace-1
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
  namespace: namespace-1
spec:
  storageClassName: storageclass-wekafs-dir-static-api
  volumeName: pv-wekafs-dir-static-api
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

# Namespace: namespace-2
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
  namespace: namespace-2
spec:
  storageClassName: storageclass-wekafs-dir-static-api
  volumeName: pv-wekafs-dir-static-api
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

This way, you have separate claims in each namespace, but they are bound to the same underlying PV.

[derselbst]

Thanks Sergey - Originally, this was also my understanding. But I found it doesn't work that way: Before having created any PVCs, the PV is in state Available. As soon as the first PVC is created, it binds to the PV so that both, PV and PVC become Bound. When then creating the second PVC it will stay Pending, complaining that "volume pv-wekafs-dir-static-api already bound to a different claim".

One would have to delete the first PVC, remove the claimRef in the PV to make it become Available again, and only then the second pending PVC can bind it. But we want both namespaces to access the data simultaneously.

---

Disclaimer: I used a static filesystem and ReadWriteMany for testing this before, rather than dir and RWO as in your example. But that should be irrelevant.