Warning

This page was translated from the original Japanese version by PLaMo Translate. The Japanese version is authoritative; the English translation may contain inaccuracies.

Sharing File Storage Across Namespaces

Among the two types of persistent storage provided by PFCP, file storage can be simultaneously read from and written to by multiple Pods across different namespaces within the same organization.

Sharing File Storage

Traditional Kubernetes file storage is restricted to read/write operations only within the namespace where the PersistentVolumeClaim (PVC) resource is created. PFCP offers a feature¹ that allows file storage to be shared across namespaces, enabling read/write access even from namespaces different from the one where the PVC was created, provided they are within the same organization.

Below we explain how to share file storage across namespaces within the same organization.

Step 1. Create a PVC in the source namespace

For illustration purposes, let’s assume:

• The PVC to be created is named pvc1
• The namespace providing the file storage is org-example--namespace1
• The namespace that will consume the storage provided by pvc1 is org-example--namespace2 First, in the namespace providing the file storage, apply the trident.netapp.io/shareToNamespace annotation to the PVC you wish to share. This allows sharing access from the specified namespace.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc1
  namespace: org-example--namespace1
  annotations:
    trident.netapp.io/shareToNamespace: org-example--namespace2
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: standard-rwx-example
  resources:
    requests:
      storage: 100Gi

Tip

• Multiple target namespaces can be specified by separating them with commas. Example: trident.netapp.io/shareToNamespace: org-example--namespace2,org-example--namespace3,org-example--namespace4
• Specifying an asterisk * allows access from any namespace. Example: trident.netapp.io/shareToNamespace: *
• The trident.netapp.io/shareToNamespace annotation for a PVC can be added or modified at any time².

Step 2. Create a TridentVolumeReference in the target namespace

In the namespace where the file storage will be shared, create a custom resource TridentVolumeReference. This configuration informs the system which PVC in which namespace you wish to reference.

In this example, we want to reference the PVC pvc1 shared from namespace org-example--namespace1 from namespace org-example--namespace2, so the configuration would look like this:

apiVersion: trident.netapp.io/v1
kind: TridentVolumeReference
metadata:
  name: my-first-tvr
  namespace: org-example--namespace2
spec:
  pvcName: pvc1
  pvcNamespace: org-exapmle--namespace1

Step 3. Create a PVC in the target namespace

In the namespace where the file storage will be shared, create a PVC. By applying the trident.netapp.io/shareFromPVC annotation, you specify which PVC from which namespace to use.

In this example, we want to share the PVC pvc1 located in namespace org-example--namespace1, so the configuration would look like this:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    trident.netapp.io/shareFromPVC: org-example--namespace1/pvc1
  name: pvc2
  namespace: org-example--namespace2
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: standard-rwx-example
  resources:
    requests:
      storage: 100Gi

Note

The storage size specified in the target PVC cannot be larger than the size of the source PVC.

Step 4. Use it just like a regular PVC

Mount the PVC into a Pod and use it as file storage in exactly the same way as with a regular PVC.

Warning

The target PVC will consume quota resources

The target PVC will be treated as having been allocated resource.requests.storage, just like a regular PVC. This means if ResourceQuotas are set in the organization’s namespaces, creating the target PVC will consume those quotas. Since the target PVC’s request values can be different from the source PVC’s settings, you can minimize ResourceQuota consumption by setting resource.requests.quota to as small a value as possible, such as 1 (1 byte). However, you cannot request a value larger than the source PVC’s settings.

Deleting Shared File Storage

Even when file storage is shared across multiple namespaces, there is no special requirement for deletion order. Simply remove the PVC from the target namespace in the usual manner. The system will automatically delete the volume when it detects that the shared file storage is no longer referenced from any namespace.

Related Links

• Share an NFS volume across namespaces | Astra Trident

1. This feature utilizes the TridentVolumeReference from Astra Trident. ↩

2. The actual evaluation of sharing access permissions occurs when creating the sharing-side PVC as described below. ↩