Running stateful applications on Kubernetes introduces storage requirements that go beyond simply keeping data persistent. While many applications operate effectively with dedicated persistent volumes, others require multiple pods running across different nodes to access and modify the same files. Network File System (NFS) has long provided this shared-access capability, but deploying it in Kubernetes can introduce additional infrastructure and management complexity. Administrators must configure NFS services, connect them to persistent storage, manage access permissions, and ensure the service can recover when its hosting node becomes unavailable. Even when the underlying storage is replicated, the NFS server can remain a point of disruption.
DataCore Puls8 addresses these challenges with built-in NFS support for ReadWriteMany (RWX) volumes and extended Lifeline protection for NFS workloads. Built on CNCF OpenEBS technology, Puls8 combines shared filesystem access with replicated persistent storage and coordinated node-failure recovery. Organizations can provide concurrent access to data across Kubernetes nodes without manually deploying and managing a separate NFS server, while benefiting from automated recovery mechanisms designed to restore access when infrastructure failures occur.
Making Shared Persistent Storage Easier to Deploy
Kubernetes persistent volumes support different access modes depending on application requirements. ReadWriteOnce (RWO) allows read-write mounting by a single node, making it suitable for many traditional stateful applications. However, workloads such as content management systems, shared application repositories, and distributed data-processing environments may require multiple pods running on different nodes to access the same filesystem simultaneously. These applications need ReadWriteMany (RWX) access, which conventional block volumes do not inherently provide.
Previously, enabling shared filesystem access on top of Puls8’s replicated block storage required a separate NFS configuration. Administrators needed to deploy and configure an NFS server and its associated CSI integration, adding another layer of deployment and maintenance to the Kubernetes environment.
Puls8 offers a built-in NFS CSI driver that makes shared persistent storage easier to provision and manage. When an NFS volume is mounted, Puls8 automatically provisions a dedicated NFS server pod, enabling multiple application pods across different Kubernetes nodes to access and modify the same files. Underneath, OpenEBS provides the resilient block storage foundation, while the integrated NFS layer enables shared filesystem access across Kubernetes nodes.
Beyond initial provisioning, Puls8 supports snapshot and restore operations, online volume expansion, and the ability to adopt existing compatible persistent volumes for shared NFS access. Administrators can therefore introduce shared access to supported existing storage and manage its capacity and recovery requirements within the same environment. For organizations operating multiple applications that depend on shared filesystems, this reduces operational complexity without requiring a separate storage architecture for RWX workloads.
Keeping NFS Workloads Available During Node Failures
Shared storage introduces an important availability challenge: protecting the data is not necessarily the same as maintaining access to it. Puls8 protects the underlying block storage through replication across Kubernetes nodes, but applications still depend on the NFS server pod to access the shared filesystem. If the node hosting that server becomes unavailable, client applications may lose their connection even though the underlying data remains protected and accessible through the storage layer. Depending on their behavior, applications may remain blocked while waiting for the unreachable NFS service, creating an interruption that storage replication alone cannot resolve.
To address this, Puls8 extends its Lifeline protection to NFS RWX workloads, coordinating recovery of the NFS server and participating application pods when a node fails. When the hosting node becomes unreachable, Lifeline helps reschedule the affected NFS server pod and appropriately annotated application pods onto a healthy node. Once the service has been re-established, applications can reconnect to the shared filesystem and resume their operations. This coordinated approach addresses both the availability of the NFS service and the recovery of clients that depend on it, rather than treating them as independent components.
Consider a Kubernetes application with multiple instances accessing a common file repository. If the NFS server’s hosting node fails, those instances may lose access to the shared files even though the underlying data remains protected. With Lifeline protection enabled, the recovery process is coordinated automatically, reducing the need for administrators to intervene manually. Puls8’s Lifeline protection is configured through application pod annotations, allowing administrators to selectively enable this behavior for workloads that require it. Although the time needed to restore access depends on cluster conditions and application behavior, automated recovery helps limit manual intervention and reduce the operational impact of node failures.
Adding Enterprise Security to Shared NFS Access
Concurrent access to persistent storage also creates security considerations, particularly in environments where multiple applications, users, or teams share Kubernetes infrastructure. Organizations need mechanisms to authenticate clients, resolve user identities, enforce appropriate filesystem permissions, and protect data moving between applications and the NFS service. These requirements become especially relevant for business-critical workloads and environments subject to internal security policies or regulatory obligations.
Puls8 supports Kerberos security integration with LDAP identity resolution for NFS, enabling shared storage access to work with established enterprise authentication infrastructure. Three Kerberos security modes are supported: krb5 for authentication, krb5i for authentication with integrity protection, and krb5p for authentication, integrity protection, and encryption of NFS traffic in transit. Administrators can supply Kerberos keytabs directly or generate them through kadmin credentials, while Kubernetes StorageClasses provide configuration options for NFS export permissions, squash modes, access modes, anonymous UID/GID mappings, and export root permissions. By bringing these controls into the integrated NFS implementation, Puls8 helps organizations deliver shared storage without treating authentication and access management as entirely separate infrastructure concerns.
Shared Access and Resilience, Working Together
With Puls8, DataCore brings together two capabilities that are particularly important for stateful Kubernetes applications: shared access to persistent data across multiple nodes and coordinated recovery when the infrastructure providing that access fails. The built-in NFS CSI driver makes RWX storage easier to provision and manage, while the extended Lifeline protection helps restore NFS services and dependent workloads following node failures. Enterprise authentication and encryption capabilities add the security controls needed to support shared storage in more demanding environments.
For organizations running applications that rely on shared filesystems, these enhancements reduce the need for separately managed NFS infrastructure while strengthening the operational resilience of shared storage. By combining replicated persistent storage, integrated NFS access, and coordinated failover, Puls8 helps make shared data more accessible, manageable, and resilient within Kubernetes.
