Date: 2026-02-02
Two NFSv4 exports are available via IPA/Kerberos with sec=krb5p and currently mounted on the host via fstab:
kryptovisor.auth.home.lan:/mnt/bigdata -> /mnt/bigdatakryptovisor.auth.home.lan:/mnt/fastdata -> /mnt/fastdataGoal: ensure reliable Kubernetes consumption of these storage locations while preserving Kerberos-protected transport.
Use the existing host mounts and expose them to Kubernetes as local/hostPath-backed PersistentVolumes with strict node affinity. This keeps Kerberos on the host, avoids putting keytabs in pods, and works well on a single-node cluster.
Why:
StorageClass per tier (e.g., nfs-fast, nfs-big) with volumeBindingMode: WaitForFirstConsumer and reclaimPolicy: Retain.PersistentVolume for /mnt/fastdata and /mnt/bigdata using local + nodeAffinity targeting the node.PersistentVolumeClaims in namespaces as needed.Use CSI or in-cluster NFS provisioners. For Kerberos, this typically requires distributing keytabs/credentials to nodes or pods, and careful renewal/rotation. This is more complex and higher risk.
Suggested flags when using automount with NFSv4 + Kerberos:
sec=krb5p for integrity + privacy_netdev so systemd orders after networkx-systemd.automount for on-demand mountnofail to avoid boot blockingx-systemd.idle-timeout=600 to release when idletimeo=600,retrans=2 to avoid long hangsExample (adjust to local policy):
kryptovisor.auth.home.lan:/mnt/fastdata /mnt/fastdata nfs4 sec=krb5p,_netdev,x-systemd.automount,nofail,x-systemd.idle-timeout=600,timeo=600,retrans=2 0 0
kryptovisor.auth.home.lan:/mnt/bigdata /mnt/bigdata nfs4 sec=krb5p,_netdev,x-systemd.automount,nofail,x-systemd.idle-timeout=600,timeo=600,retrans=2 0 0
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: nfs-fast
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Retain
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-fastdata
spec:
capacity:
storage: 1Ti
volumeMode: Filesystem
accessModes:
- ReadWriteMany
persistentVolumeReclaimPolicy: Retain
storageClassName: nfs-fast
local:
path: /mnt/fastdata
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- <node-name>
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-fastdata
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 100Gi
storageClassName: nfs-fast
If approved, implement:
/mnt/fastdata and /mnt/bigdata.