Deployment specific volumes in Kubernetes

Question

Is it possible to create a volume that is shared between all pods in a deployment but impossible to mount for any other pod?

Alternatively that is read/write from one deployment and just read from any other pod?

Answer 1

That could be addressed in Kubernetes 1.12 (Q3 2018) with Topology aware dynamic provisioning, which is now in beta.
That means storage resources can now understand where they live.
This also includes beta support to AWS EBS and GCE PD.

See kubernetes/feature 561 and its doc PR 9939 (commit e1e6555)

See Storage / Storage Classes / Volume Binding Mode (beta in K8s 1.12)

By default, the Immediate mode indicates that volume binding and dynamic provisioning occurs once the PersistentVolumeClaim is created. For storage backends that are topology-constrained and not globally accessible from all Nodes in the cluster, PersistentVolumes will be bound or provisioned without knowledge of the Pod’s scheduling requirements. This may result in unschedulable Pods.

Allowed Topologies is how to restrict the topology of provisioned volumes to specific zones.

allowedTopologies:
- matchLabelExpressions:
  - key: failure-domain.beta.kubernetes.io/zone
    values:
    - us-central1-a
    - us-central1-b