Building-permits considers hostPath for a privileged node agent. What caveat should guide that decision?
Select an answer to reveal the explanation.
Short Explanation
hostPath is taping your app to one server’s hallway closet—fine for a node agent that must see that node, terrible as “the database disk” for a portable cluster. It doesn’t magically RWX-replicate or replace StorageClasses for real durable storage.
Full Explanation
Building-permits considering hostPath for a privileged node agent should understand the caveat: hostPath binds the Pod to a node’s local filesystem path and is not portable durable cluster storage. It is taping your app to one server’s hallway closet—acceptable for agents that must see that node’s files, terrible as the database disk for a portable cluster. Security exposure is high because Pods can reach host paths if permitted.
hostPath volumes do not automatically replicate to every node or act as ReadWriteMany. hostPath is not the preferred StorageClass replacement for production databases. hostPath does not ignore node filesystem permissions because kubelet remounts as NFS—permissions and path existence on that node still matter.
Exam caveat: Pods using hostPath often need matching nodeSelector/affinity and privileged/extra capabilities. Prefer CSI/PVCs for durable municipal data; reserve hostPath for carefully reviewed node-level agents.
Operational check: if used, pin the agent with node affinity, verify the host path exists with correct permissions, test eviction/reschedule behavior, and document why PVC storage was not appropriate. Keep civic change tickets precise: record object names, namespaces, and before/after observations so the next on-call engineer can replay the fix without guesswork.