<p>We are running a pod in Kubernetes that needs to load a file during runtime. This file has the following properties:</p>
<ul>
<li>It is known at build time</li>
<li>It should be mounted read-only by multiple pods (the same kind)</li>
<li>It might change (externally to the cluster) and needs to be updated</li>
<li>For various reasons (security being the main concern) the file cannot be inside the docker image</li>
<li>It is potentially quite large, theoretically up to 100 MB, but in practice between 200kB - 10MB.</li>
</ul>
<p>We have considered various options:</p>
<ul>
<li>Creating a persistent volume, mount the volume in a temporary pod to write (update) the file, unmount the volume, and then mount it in the service with ROX (Read-Only Multiple) claims. This solution means we need downtime during upgrade, and it is hard to automate (due to timings).</li>
<li>Creating multiple secrets using the secrets management of Kubernetes, and then &quot;assemble&quot; the file before loading it in an init-container or something similar.</li>
</ul>
<p>Both of these solutions feels a little bit hacked - is there a better solution out there that we could utilize for solving this?</p>

<p>You need to use a shared filesystem that supports Read/Write Multiple Pods.
Here is a link to the CSI Drivers which can be used with Kubernetes and provide those access:
<a href="https://kubernetes-csi.github.io/docs/drivers.html" rel="nofollow noreferrer">https://kubernetes-csi.github.io/docs/drivers.html</a></p>
<p>Ideally, you need a solution that is not an appliance, and can run anywhere meaning it can run in the cloud or on-prem.</p>
<p>The platforms that could work for you are Ceph, GlusterFS, and Quobyte (<em>Disclaimer, I work for Quobyte</em>)</p>
