Chapter 33 of 47 · Storage, part 4

Ephemeral volumes

Sometimes a Pod needs real storage (a big disk, a fast SSD, secrets fetched from Vault) but only for as long as the Pod lives. Making a PVC by hand and remembering to delete it is clumsy. Ephemeral volumes are created with the Pod and cleaned up with it, automatically.

The ephemeral family

You have already met most of it. "Ephemeral" just means: this volume lives exactly as long as its Pod.

Type	What it gives you	Chapter
`emptyDir`	An empty folder on the node's disk or in RAM	30
`configMap`, `secret`, `downwardAPI`	Files from Kubernetes data (downwardAPI: the Pod's own name, labels, limits)	18, 19
generic ephemeral	A real disk from a StorageClass, for one Pod's lifetime	this one
CSI ephemeral inline	A volume a CSI driver builds specially for the Pod, e.g. secrets from Vault	this one

Generic ephemeral volumes

Think "emptyDir, but on a proper disk from a StorageClass": any size, SSD, encrypted, not limited by the node's spare space. You write a PVC template inside the Pod:

apiVersion: v1
kind: Pod
metadata:
  name: report-builder
spec:
  containers:
    - name: builder
      image: report-builder:1.0
      volumeMounts:
        - name: scratch
          mountPath: /scratch
  volumes:
    - name: scratch
      ephemeral:
        volumeClaimTemplate:
          spec:
            accessModes: [ReadWriteOnce]
            storageClassName: fast-ssd
            resources:
              requests:
                storage: 100Gi

`ephemeral.volumeClaimTemplate`

Kubernetes creates a PVC for this Pod automatically, named <pod>-<volume>: here report-builder-scratch. The Pod owns it, so when the Pod is deleted the PVC is deleted too (and with reclaim Delete, the disk).

$ kubectl apply -f report-builder.yaml
$ kubectl get pvc
NAME                     STATUS   CAPACITY   STORAGECLASS
report-builder-scratch   Bound    100Gi      fast-ssd

The PVC and a fresh 100Gi disk appear together with the Pod.

builder: crunching 80Gi of data in /scratch …
builder: report.pdf uploaded to S3

The job uses it like any disk, and it survives container restarts within the Pod.

$ kubectl delete pod report-builder
$ kubectl get pvc
No resources found in default namespace.

Pod gone → its PVC and disk are gone. Nothing to clean up, nothing left costing money.

Good for: big temporary work (video transcoding, data processing, builds) that would overflow the node's disk with an emptyDir.

CSI ephemeral inline volumes

Here a CSI driver (a storage plugin) builds the volume's content for this one Pod, described right in the Pod spec. No PVC, no StorageClass. The best-known example is the Secrets Store CSI Driver: it fetches secrets from AWS Secrets Manager, Azure Key Vault, Google Secret Manager or HashiCorp Vault and mounts them as files, so they never need to exist as Kubernetes Secrets at all.

spec:
  containers:
    - name: posts
      image: micro-posts:1.0
      volumeMounts:
        - name: secrets
          mountPath: /mnt/secrets
          readOnly: true
  volumes:
    - name: secrets
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: posts-aws-secrets   # which secrets to fetch, defined separately

$ kubectl exec deployment/posts-depl -- cat /mnt/secrets/DB_PASSWORD
hunter2

The driver must be installed in the cluster and must support this "inline" mode (not every CSI driver does).
Other examples: cert-manager's CSI driver (a fresh TLS certificate per Pod), image-populating drivers.
Because the Pod spec decides what gets mounted, admins can restrict which drivers may be used inline.

Side by side

	emptyDir	Generic ephemeral	CSI inline	PVC (persistent)
Lives as long as	The Pod	The Pod	The Pod	Until you delete the PVC
Backed by	Node disk or RAM	A StorageClass disk	A CSI driver	A PV
Size	What the node has free	Anything you request	Driver-specific	Anything you request
Creates a PVC	No	Yes, automatically	No	You create it
Typical use	Cache, sharing between containers	Big temporary work	Secrets from an external vault	Data that must survive

Which storage should I use?

Answer the questions for your use case:

Database files that must survive restarts and deploys
Two containers in a Pod sharing a small log folder
A job needing 200Gi of fast scratch space for an hour
Database password stored in AWS Secrets Manager, mounted as a file

Recap

Ephemeral volumes live and die with their Pod.
Generic ephemeral: a PVC template inside the Pod; Kubernetes creates and deletes the PVC and disk for you.
CSI inline: a driver builds the volume per Pod, most often secrets from an external store.
Data that must survive the Pod still belongs in a normal PVC.