<p>I have an application running on Kubernetes that needs to access SMB shares that are configured dynamically (host, credentials, etc) within said application. I am struggling to achieve this (cleanly) with Kubernetes.</p>
<p>I am facing several difficulties:</p>
<ul>
<li>I do not want &quot;a&quot; storage, I want explicitly specified SMB shares</li>
<li>These shares are dynamically defined within the application and not known beforehand</li>
<li>I have a variable amount of shares and a single pod needs to be able to access all of them</li>
</ul>
<p>We currently have a solution where, on each kubernetes worker node, all shares are mounted to mountpoints in a common folder. This folder is then given as <code>HostPath</code> volume to the containers that need access to those storages. Finally, each of those containers has a logic to access the subfolder(s) matching the storage(s) he needs.</p>
<p>The downside, and the reason why I'm looking for a cleaner alternative, is:</p>
<ul>
<li><code>HostPath</code> volumes present security risks</li>
<li>For this solution, I need something outside Kubernetes that mounts the SMB shares automatically on each Kubernetes node</li>
</ul>
<p>Is there a better solution that I am missing?</p>
<p>The Kubernetes object that seems to match this approach the most closely is the Projected Volume, since it &quot;maps existing volume sources into the same directory&quot;. However, it doesn't support the type of volume source I need and I don't think it is possible to add/remove volume sources dynamically without restarting the pods that use this Projected Volume.</p>

<p>For sure your current solution using HostPath on the nodes is not flexible, not secure thus it is not a good practice.</p>
<p>I think you should consider using one of the custom drivers for your SMB shares:</p>
<ul>
<li><a href="https://github.com/fstab/cifs#cifs-flexvolume-plugin-for-kubernetes" rel="nofollow noreferrer">CIFS FlexVolume Plugin</a> - older solution, not maintained</li>
<li><a href="https://github.com/kubernetes-csi/csi-driver-smb#smb-csi-driver-for-kubernetes" rel="nofollow noreferrer">SMB CSI Driver</a> - actively developed (recommended)</li>
</ul>
<hr />
<p><strong>CIFS FlexVolume Plugin</strong>:</p>
<p>This solution is older and it is replaced by a CSI Driver. The advantage compared to CSI is that you can specify <a href="https://github.com/fstab/cifs#running" rel="nofollow noreferrer">SMB shares directly from the pod definition (including credentials as Kubernetes secret) as you prefer</a>.</p>
<p><a href="https://github.com/fstab/cifs#installing" rel="nofollow noreferrer">Here</a> you can find instructions on how to install this plugin on your cluster.</p>
<p><strong>SMB CSI Driver</strong>:</p>
<p>This driver will automatically take care of <a href="https://github.com/kubernetes-csi/csi-driver-smb/blob/master/deploy/v1.4.0/csi-smb-node.yaml" rel="nofollow noreferrer">mounting SMB shares on all nodes by using DaemonSet</a>.</p>
<p>You can install SMB CSI Driver either by <a href="https://github.com/kubernetes-csi/csi-driver-smb/blob/master/docs/install-csi-driver-master.md#install-smb-csi-driver-master-version-on-a-kubernetes-cluster" rel="nofollow noreferrer">bash script</a> or by using <a href="https://github.com/kubernetes-csi/csi-driver-smb/tree/master/charts" rel="nofollow noreferrer">a helm chart</a>.</p>
<p>Assuming you have your SMB server ready, you can use one of the following solution to access it from your pod:</p>
<ul>
<li><a href="https://github.com/kubernetes-csi/csi-driver-smb/blob/master/deploy/example/e2e_usage.md#option1-storage-class-usage" rel="nofollow noreferrer">Storage class</a></li>
<li><a href="https://github.com/kubernetes-csi/csi-driver-smb/blob/master/deploy/example/e2e_usage.md#option2-pvpvc-usage" rel="nofollow noreferrer">PV/PVC</a></li>
</ul>
<p>In both cases you have to use a previously created secret with the credentials.</p>
<p>In your case, for every SMB share you should create a Storage class / PV and mount it to the pod.</p>
<p>The advantage of CSI Driver is that it is <a href="https://medium.com/flant-com/kubernetes-volume-plugins-from-flexvolume-to-csi-c9a011d2670d" rel="nofollow noreferrer">newer, currently maintained solution and it replaced FlexVolume</a>.</p>
<p>Below is diagram representing how CSI plugin operates:
<img src="https://miro.medium.com/max/2400/0*I4HPfmFAGgM6-oGw" alt="" /></p>
<p>Also check:</p>
<ul>
<li><a href="https://medium.com/flant-com/kubernetes-volume-plugins-from-flexvolume-to-csi-c9a011d2670d" rel="nofollow noreferrer">Kubernetes volume plugins evolution from FlexVolume to CSI</a></li>
<li><a href="https://kubernetes.io/blog/2018/01/introducing-container-storage-interface/" rel="nofollow noreferrer">Introducing Container Storage Interface (CSI) Alpha for Kubernetes</a></li>
</ul>
