Volume subPath and Mounted File Permissions

Storage / Guide 66 of 103 / Intermediate

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 16 min

The ..data timestamp directory name is generated per mount. Everything else here is the same on any cluster.

This guide includes

Use this when a ConfigMap mount hides files the image shipped, or when a mounted Secret turns out to be readable by more than it should be. This matters because a volume mount replaces a directory rather than merging into it, and subPath fixes that at a cost people only discover later.

• establishing what the image ships in a directory before mounting anything over it
• mounting a ConfigMap over that directory and watching the original files disappear
• mounting a single key with subPath so the rest of the directory survives
• editing the ConfigMap and finding that a subPath mount never updates - the cost of using it
• setting defaultMode on a Secret, a decimal number that nearly everyone reads as octal

Before you start

• guide 34 - the four ways configuration reaches a Pod, before this covers what the file mount does to the filesystem.

1. 1

   What the image ships in that directory

2. 2

   Mounting a ConfigMap over it

3. 3

   The same ConfigMap, mounted with subPath

4. 4

   The cost of subPath, which is the part that bites

5. 5

   File permissions on a mounted Secret

Official sources

• Volumes
• ConfigMaps