The LUKS mount created by the initializer is bound to the initializer's mount namespace. If the container gets deleted or fails, the mount namespace is deleted and the mount goes away, leaving the main container consuming the mount in a broken state. Even after restarting, the mount won't come back.
To reproduce:
- Create a pod using a secure PV (e.g. MySQL example from released yaml).
- Exec into the initializer and kill PID 1.
- Try to use the volume in the other container -> I/O error.
The LUKS mount created by the initializer is bound to the initializer's mount namespace. If the container gets deleted or fails, the mount namespace is deleted and the mount goes away, leaving the main container consuming the mount in a broken state. Even after restarting, the mount won't come back.
To reproduce: