KubernetesL · PersistentVolumes and ClaimsPersistentVolumes and Claims
Access modes in depth — RWO, ROX, RWX, RWOP, and what each enables
What you'll learn
- Explain each access mode in detail
- Identify which storage backends support each mode
- Choose the right access mode for a workload
- Recognize the production anti-patterns of mismatched access modes
Prerequisites
Verified against Kubernetes 1.34.x · kubeadm 1.34.x · kubectl 1.34.x · etcd 3.6.x · CoreDNS 1.11.x · containerd 1.7.x / 2.x · 2026-08-16
The access mode is one of the most consequential fields in a PVC: it determines which Pods can mount the volume, on which nodes, and in what mode. This lesson walks each mode in detail.
ReadWriteOnce (RWO)
RWO is the standard database access mode: the volume can be mounted as read-write by a single node.
accessModes: ["ReadWriteOnce"]| Capability | Description |
|---|---|
| Mounts | One node at a time |
| Read-write | Yes |
| Read-only | No |
Most block storage backends support RWO:
- AWS EBS, GCE PD, Azure Disk: RWO only.
- Ceph RBD: RWO (with cluster filesystem, multi-node).
- Local disk: RWO only.
- NFS: not applicable (NFS is shared by design).
RWO is appropriate for:
- Databases (PostgreSQL, MySQL, MongoDB) running as a single replica.
- StatefulSets with
replicas: 1. - Any workload where multi-node mount is not needed.
ReadOnlyMany (ROX)
ROX allows the volume to be mounted as read-only by multiple nodes:
accessModes: ["ReadOnlyMany"]| Capability | Description |
|---|---|
| Mounts | Multiple nodes |
| Read-write | No |
| Read-only | Yes |
ROX is appropriate for:
- Static content distribution (the same files served by many Pods).
- Pre-populated configuration data.
- Machine learning model serving (the same model loaded by many Pods).
Most block storage backends support ROX (the volume is attached to one node and exported read-only to others, or the volume is replicated). NFS supports ROX by design.
ReadWriteMany (RWX)
RWX allows the volume to be mounted as read-write by multiple nodes:
accessModes: ["ReadWriteMany"]| Capability | Description |
|---|---|
| Mounts | Multiple nodes |
| Read-write | Yes |
| Read-only | No |
RWX requires a network filesystem or a multi-attach backend:
- NFS, CephFS, GlusterFS: RWX by design.
- AWS EBS multi-attach: RWX limited to a few instances in the same AZ.
- Ceph RBD with cluster filesystem: RWX.
RWX is appropriate for:
- Shared file uploads (CMS, document management).
- Machine learning training (multiple workers reading the same dataset).
- Distributed applications that share state via the filesystem (rare in modern Kubernetes).
ReadWriteOncePod (RWOP)
RWOP (Kubernetes 1.22+) is the strictest mode: the volume can be mounted as read-write by a single Pod:
accessModes: ["ReadWriteOncePod"]| Capability | Description |
|---|---|
| Mounts | Single Pod |
| Read-write | Yes |
| Read-only | No |
RWOP is the strictest of the four; it guarantees that only one Pod in the entire cluster can mount the volume. This is the right mode for databases that must enforce strict exclusivity.
Not all CSI drivers support RWOP. EBS CSI, for example, supports RWO but not RWOP. Check the CSI driver’s documentation.
The access mode matrix
| Backend | RWO | ROX | RWX | RWOP |
|---|---|---|---|---|
| AWS EBS | Yes | Yes (with export) | Multi-attach only | No |
| GCE PD | Yes | Yes | No | No |
| Azure Disk | Yes | No | No | No |
| Ceph RBD | Yes | Yes | With cluster FS | Driver-dependent |
| CephFS | Yes | Yes | Yes | Driver-dependent |
| NFS | Yes | Yes | Yes | Driver-dependent |
| Local disk | Yes | No | No | Yes |
The matrix is backend-specific. Always check the CSI driver’s documentation for the supported access modes.
Choosing the right access mode
The decision tree:
- Single-node database: RWO.
- Single-Pod exclusive workload: RWOP.
- Multi-node shared content: RWX.
- Multi-node read-only data: ROX.
- Multi-node shared state: RWX (rare; consider alternative architectures).
Quiz
Knowledge check · 4 questions
Q1. A database workload requests a PVC with `ReadWriteMany`. The cluster uses EBS volumes. What happens?
Q2. ReadWriteOnce (RWO) means the volume can be mounted by exactly one Pod across the entire cluster.
Q3. Your team is migrating a content management system from a VM with a shared filesystem to Kubernetes. The CMS has multiple Pods that read and write the same files. Walk through the access mode decision.
CMS with 4 replicas across multiple nodes. All Pods read and write the same upload directory. The cluster has both EBS and NFS CSI drivers available.
Q4. Explain the difference between RWO and RWOP access modes and when each is appropriate.
Passing score: 75%. Answers are checked in this browser.
Production discipline
- RWO is the standard for databases. Most block backends support it; it is sufficient for single-node databases.
- RWX requires a network filesystem or multi-attach. Do not request RWX on EBS unless multi-attach is configured.
- RWOP for strict single-Pod exclusivity. Use it for workloads with single-writer requirements.
- The access mode is a backend property. The PVC request must match the backend’s capability.
- Mismatched access modes cause Pending PVCs. The
diagnostic is in
kubectl describe pvc.