只读挂载
只读挂载
containers:
- name: app
image: registry.example.com/app:1.26.0
volumeMounts:
- name: config
mountPath: /etc/app
readOnly: true
- name: data
mountPath: /var/lib/app/data
readOnly: true
volumes:
- name: config
configMap:
name: app-config
- name: data
persistentVolumeClaim:
claimName: shared-data验证写入被拒
验证写入被拒
kubectl exec -it web-x -- sh -c 'touch /etc/app/test' || echo read-only只读是挂载层约束：同一卷在别的 Pod 仍可读写；需要全局只读用 ROX 模式或存储侧策略。