<p>I have setup and Kubernetes cluster from kubespray - ansible script. 
Now i have created a deployment with volume to be mounted as hostPath in spec.template.spec.volumes. And i have mounted the volume on all my nodes via nfs file-system. 
Now i read in k8s documentation its not good practice but need to understand the harmfulness for the hostPath. 
Below is sample yaml file.</p>

<pre><code>spec:
  containers:
  - image: test:latest
    imagePullPolicy: Always
    name: test1
    ports:
    - containerPort: 4006
      protocol: TCP
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - name : test-data
      mountPath : /RIC/
    - name : test-config
      mountPath : /xyz/abc.config
      subPath : abc.config
  volumes:
  - name : test-data
    hostPath :
      path : /nfs-mount/RIC/
  - name : test-config
    configMap :
      name : test-config
</code></pre>

Ankit Saxena
<p>There are some reasons:</p>

<ol>
<li><p>Allowing HostPaths on production clusters is not a good idea from security point of view , if your pod is hacked and someone gets access to your host becuase he can write to hostPath , then your entire cluster is hacked...</p></li>
<li><p>Using hostPaths are not portable , you can use the same paths using kubernetes local volume provisoner if you are deploying some stateful set such as elasticsearch or some database etc.</p></li>
<li><p>Using local volume provisoner is not useful for other deployments that for example if a node goes down you need the pod to be scheduled on other node where your locally provisoned volume will not be available.</p></li>
<li><p>Therefore , use the NFS share directly from kubernetes instead of using it as hosthpath or local volume. for example:</p></li>
</ol>

<pre><code>volumes:
      - name: test-data
        nfs:
          path: /projects/test/dev/data
          server: 192.168.1.11



</code></pre>

<p>This way , you dont have to allow hostPaths , or dont have to manage mounting nfs on hosts yourself , or dont have to manage local volumes etc</p>
