CKA — Access Modes & Reclaim Policies

5 minute read

CKA Exam Domain

Storage — 10%

Access modes and reclaim policies are small but important details that show up on the CKA exam. You need to know what each mode and policy means, which storage backends support them, and how to change them.

Access Modes

Access modes define how a volume can be mounted by nodes and Pods:

Mode Abbreviation Description
ReadWriteOnce RWO Volume can be mounted as read-write by a single node
ReadOnlyMany ROX Volume can be mounted as read-only by multiple nodes
ReadWriteMany RWX Volume can be mounted as read-write by multiple nodes
ReadWriteOncePod RWOP Volume can be mounted as read-write by a single Pod (Kubernetes 1.27+)

Important nuances:

  • Access modes are about nodes, not Pods (except RWOP)
  • RWO means multiple Pods on the same node can still read and write — it just limits to one node
  • A PV can support multiple access modes, but a PVC requests specific modes
  • RWOP is the strictest — only one Pod across the entire cluster can mount the volume

Exam tip: The abbreviations (RWO, ROX, RWX) show up in kubectl get pv output under the ACCESS MODES column. Know them by heart.

Which Storage Supports What?

Not all storage backends support all access modes:

Storage Type RWO ROX RWX RWOP
hostPath ✅ ❌ ❌ ❌
emptyDir ✅ ❌ ❌ ❌
NFS ✅ ✅ ✅ ❌
AWS EBS ✅ ❌ ❌ ✅
Azure Disk ✅ ❌ ❌ ✅
GCE PD ✅ ✅ ❌ ❌
CephFS ✅ ✅ ✅ ❌
iSCSI ✅ ✅ ❌ ❌

Exam tip: On the CKA exam, you will mostly work with hostPath (RWO only) and sometimes NFS. Know that hostPath does not support ROX or RWX.

Reclaim Policies

Reclaim policies determine what happens to a PV when its bound PVC is deleted:

Policy Description
Retain PV is kept after PVC deletion. Data is preserved. Admin must manually clean up and delete the PV. The PV goes to Released state.
Delete PV and the underlying storage resource are automatically deleted when the PVC is deleted. Common with cloud-provisioned volumes.
Recycle (Deprecated) Performs a basic rm -rf /volume/* scrub and makes the PV available again. Not recommended — use dynamic provisioning instead.

Retain in Detail

When a PVC is deleted with Retain policy:

PVC deleted → PV status changes to Released → Data still exists → Admin action needed

The admin must:

  1. Back up data if needed
  2. Delete the PV: kubectl delete pv <name>
  3. Clean up the underlying storage
  4. Optionally create a new PV

Or to reuse the PV:

kubectl edit pv <pv-name>
# Remove the spec.claimRef section

Delete in Detail

When a PVC is deleted with Delete policy:

PVC deleted → PV automatically deleted → Underlying storage deleted

This is the default for most dynamically provisioned volumes. Be careful — there is no undo.

Exam tip: For CKA, use Retain when you want to preserve data and Delete when storage is disposable. If the question does not specify, Retain is the safer choice.

Volume Modes

Volume mode specifies whether the volume should be used as a formatted filesystem or a raw block device:

Mode Description Use Case
Filesystem (default) Volume is mounted as a directory with a filesystem Most workloads — web apps, databases, logs
Block Volume is exposed as a raw block device (no filesystem) High-performance applications that manage their own data layout

Filesystem Mode (Default)

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-fs
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  hostPath:
    path: /data/pv-fs

Block Mode

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-block
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteOnce
  volumeMode: Block
  hostPath:
    path: /dev/sdb

When using Block mode in a Pod, use volumeDevices instead of volumeMounts:

containers:
  - name: app
    image: myapp
    volumeDevices:
      - name: raw-storage
        devicePath: /dev/xvda
volumes:
  - name: raw-storage
    persistentVolumeClaim:
      claimName: block-pvc

Exam tip: Unless explicitly asked for block mode, always use the default Filesystem mode on the CKA exam.

Changing Reclaim Policy

You can change the reclaim policy of an existing PV:

# Change from Delete to Retain
kubectl patch pv pv-demo -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}'

Verify the change:

kubectl get pv pv-demo

Output:

NAME      CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM              STORAGECLASS   AGE
pv-demo   5Gi        RWO            Retain           Bound    default/pvc-demo   manual         10m

You can also change it for dynamically provisioned PVs to prevent accidental data loss:

# List all PVs with Delete policy
kubectl get pv -o custom-columns=NAME:.metadata.name,RECLAIM:.spec.persistentVolumeReclaimPolicy | grep Delete

# Patch each one to Retain
kubectl patch pv <pv-name> -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}'

Practice Questions

Q1. What access mode should you use if multiple Pods on different nodes need to read and write to the same volume?

Show Answer

Use ReadWriteMany (RWX). This allows the volume to be mounted as read-write by multiple nodes simultaneously.

Note that not all storage types support RWX. You would need a shared filesystem like NFS or CephFS.

Q2. A PV has reclaim policy Delete. You want to change it to Retain to protect the data. How do you do it?

Show Answer 
kubectl patch pv <pv-name> -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}'

Verify:

kubectl get pv <pv-name> -o jsonpath='{.spec.persistentVolumeReclaimPolicy}'

Q3. What is the difference between ReadWriteOnce and ReadWriteOncePod?

Show Answer
  • ReadWriteOnce (RWO): The volume can be mounted as read-write by a single node. Multiple Pods on the same node can still access it.
  • ReadWriteOncePod (RWOP): The volume can be mounted as read-write by a single Pod across the entire cluster. This is the strictest mode and ensures exclusive access.

RWOP was introduced in Kubernetes 1.27 and requires CSI driver support.

Q4. What happens if you create a PV with hostPath and ReadWriteMany access mode?

Show Answer

Kubernetes will accept the YAML and create the PV, but hostPath does not truly support ReadWriteMany. Since hostPath is local to a single node, only Pods scheduled on that specific node can access the volume. Pods on other nodes will not have access to the same data.

This is a configuration mistake — hostPath should only use ReadWriteOnce.

Q5. Explain the Recycle reclaim policy and why it is deprecated.

Show Answer

The Recycle policy performs a basic scrub (rm -rf /volume/*) on the volume when the PVC is deleted, then makes the PV available for a new claim.

It is deprecated because:

  • It only performs a simple delete, which may not securely erase data
  • It does not support all volume types
  • Dynamic provisioning with Delete policy achieves the same goal more reliably
  • Custom cleanup logic is not supported

The recommended approach is to use dynamic provisioning with the Delete reclaim policy or Retain with manual cleanup.

Updated:

You may also enjoy