<p>Is it possible to create a volume that is shared between all pods in a deployment but impossible to mount for any other pod?</p>

<p>Alternatively that is read/write from one deployment and just read from any other pod?</p>

<p>That could be addressed in <a href="https://kubernetes.io/blog/2018/09/27/kubernetes-1.12-kubelet-tls-bootstrap-and-azure-virtual-machine-scale-sets-vmss-move-to-general-availability/#additional-notable-feature-updates" rel="nofollow noreferrer">Kubernetes 1.12</a> (Q3 2018) with <strong>Topology aware dynamic provisioning</strong>, which is now in beta.<br>
That means storage resources can now understand where they live.<br>
This also includes beta support to AWS EBS and GCE PD.</p>

<p>See <a href="https://github.com/kubernetes/features/issues/561" rel="nofollow noreferrer">kubernetes/feature 561</a> and its <a href="https://github.com/kubernetes/website/pull/9939" rel="nofollow noreferrer">doc PR 9939</a> (<a href="https://github.com/kubernetes/website/commit/e1e655507d91f2eeb882bef6d5091b7f434f867c" rel="nofollow noreferrer">commit e1e6555</a>)</p>

<p>See <a href="https://kubernetes.io/docs/concepts/storage/storage-classes/#volume-binding-mode" rel="nofollow noreferrer">Storage / Storage Classes / Volume Binding Mode</a> (beta in K8s 1.12)</p>

<blockquote>
  <p>By default, the <code>Immediate</code> mode indicates that volume binding and dynamic provisioning occurs once the <code>PersistentVolumeClaim</code> is created. 
  For storage backends that are topology-constrained and not globally accessible from all Nodes in the cluster, <code>PersistentVolumes</code> will be bound or provisioned without knowledge of the Pod’s scheduling requirements. This may result in unschedulable Pods.</p>
</blockquote>

<p><a href="https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies" rel="nofollow noreferrer">Allowed Topologies</a> is how to restrict the topology of provisioned volumes to specific zones.</p>

<pre><code>allowedTopologies:
- matchLabelExpressions:
  - key: failure-domain.beta.kubernetes.io/zone
    values:
    - us-central1-a
    - us-central1-b
</code></pre>
