Storage

← Documentation · Welcome

Pods are ephemeral - anything written inside a container is gone when the pod restarts, and that local disk is small: a pod writing more than 2Gi per container to it is evicted (see Resource quotas). For data that must survive, you have two options: a persistent volume (PVC) mounted into your pods, or S3 object storage your app talks to over HTTPS.

Persistent volumes (PVCs)

You create a PersistentVolumeClaim in your repo like any other manifest; the platform provisions the actual storage behind it. Two storage classes are available:

StorageClass	Type	Access	Use it for
`default-cephfs` (default)	Shared filesystem (CephFS)	RWX - mountable by many pods at once	Shared data, uploads, anything several replicas read/write together.
`default-rbd`	Block device (Ceph RBD)	RWO - mountable by one node at a time	Databases and other single-writer workloads; a bit faster than CephFS.

If you omit storageClassName, you get default-cephfs.

Here's an example PVC manifest:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-app-data
spec:
  storageClassName: default-cephfs   # or default-rbd for single-pod block storage
  accessModes:
    - ReadWriteMany                  # ReadWriteOnce for default-rbd
  resources:
    requests:
      storage: 5Gi

Then mount it in your deployment.yaml:

spec:
  template:
    spec:
      containers:
        - name: my-app
          volumeMounts:
            - name: data
              mountPath: /data
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: my-app-data

Deleting a PVC deletes its data. Remember that ArgoCD syncs your repo: removing pvc.yaml from your environment folder removes the volume - and everything on it. The total size you can request is capped by your namespace quota; raising it is a ticket to support@inf.ethz.ch (see Resource quotas).

S3 object storage

For object storage (large files, artifacts, data shared across apps or accessed from outside the cluster), order an S3 bucket at https://kiosk.inf.ethz.ch. You'll receive the endpoint and access credentials for your bucket.

The credentials are secrets - don't put them in a ConfigMap. Store them encrypted in test.sops.yaml / prod.sops.yaml and reference them from your secret.yaml, exactly as described in Secrets & encryption:

stringData:
  S3_ACCESS_KEY: <sops:S3_ACCESS_KEY>
  S3_SECRET_KEY: <sops:S3_SECRET_KEY>

Backups

All storage is backed up daily by the platform - you don't need to set anything up. To restore, open a ticket at support@inf.ethz.ch with your namespace, the PVC (or bucket) name, and the point in time you need restored.

Daily snapshots are a safety net, not an application backup strategy: anything written and lost between two runs is gone, so for critical data (e.g. databases) consider an app-level backup on top.