<p>I am able to mount different directories to the same container at different mount points using <code>volumeMounts.subPath</code> attribute.</p>
<p>Is it OK to use this in production environment? I am using <code>AWS EFS</code> as my persistent storage.</p>
<p><a href="https://kubernetes.io/docs/concepts/storage/volumes/#using-subpath" rel="nofollow noreferrer">This</a> doc says it is not recommended. What is the concern if this is used?</p>

sandy
<h2>Short answer</h2>
<p>It's absolutely fine to use the <code>subPath</code> in production</p>
<h2>Detailed answer</h2>
<p><strong>Kubernetes example with <code>subPath</code> used.</strong></p>
<p>What this phrase &quot;This sample subPath configuration is not recommended for production use.&quot; means is exactly this sample is not recommended, not the <code>subPath</code> usage.</p>
<p>The example contains frontend and backend applications' containers in a single pod which is fundamentally wrong approach for production usage (for testing it's applicable).</p>
<p>In production frontend and backend applications should be separated to different deployments, it will allow:</p>
<ul>
<li>manage front and back end applications separately</li>
<li>fault tolerance - in single pod if one of the app crashes, the whole pod is affected</li>
<li>pod are disposable units and for databases separate set of pods should be used (like statefulset), it allows to maintain sticky sessions and data persistence even if pod crashed</li>
</ul>
<p><strong><code>subPath</code> vulnerabilities</strong></p>
<p>First it's a good idea to figure out <a href="https://kubernetes.io/blog/2018/04/04/fixing-subpath-volume-vulnerability/#kubernetes-background" rel="nofollow noreferrer">how <code>subPath</code> works</a> to understand what risks/vulnerabilities can be introduced.</p>
<p>I found at least two ones:</p>
<ul>
<li><a href="https://github.com/kubernetes/kubernetes/issues/60813" rel="nofollow noreferrer">CVE-2017-1002101</a></li>
<li><a href="https://github.com/kubernetes/kubernetes/issues/104980" rel="nofollow noreferrer">CVE-2021-25741</a></li>
</ul>
<p>Both are fixed as for today. It's very important to use last available versions which contain fixes for different issues (including both mentioned above).</p>
<p>Since kubernetes developers fix vulnerabilities related to <code>subPath</code> it can be safely used in production clusters.</p>
