PVC Protection

This page describes PersistentVolumeClaim (PVC) protection for AIStor Object Store deployments on Kubernetes. When enabled, PVC protection prevents accidental data loss by blocking PVC deletion until the protection is explicitly removed.

How PVC protection works

Kubernetes uses finalizers to prevent the deletion of resources until specific cleanup operations complete. The AIStor Operator can add the aistor.min.io/pvc-protection finalizer to all PVCs created by an Object Store deployment.

When PVC protection is enabled:

  1. The Operator adds the aistor.min.io/pvc-protection finalizer to each PVC at its creation.
  2. The finalizer prevents any attempt to delete a protected PVC (including namespace deletion). Remove the finalizer to allow deletion.
  3. The PVC remains in a Terminating state until you explicitly remove the finalizer.

This layer of protection can provide value in situations such as the following:

  • Activities may inadvertently delete a namespace.
  • Automation or scripts have access that may remove storage resources.
  • Multiple teams share a cluster, making accidental deletions possible.

Enable PVC protection

PVC protection is disabled by default. To enable it, set objectStore.pvcProtection to true in your Helm values:

objectStore:
  pvcProtection: true

Apply the configuration when deploying or upgrading your Object Store:

helm upgrade -n OBJECT-STORE-NAMESPACE OBJECT-STORE-NAME minio/aistor-objectstore -f aistor-objectstore-values.yaml

Replace OBJECT-STORE-NAMESPACE with your Object Store namespace and OBJECT-STORE-NAME with the Helm release name.

The Operator adds the finalizer to all existing and new PVCs for the Object Store.

Remove PVC protection

To delete individual PVCs while protection remains enabled, you must first remove the finalizer from those PVCs. Alternatively, you can disable PVC protection entirely, which automatically removes finalizers from all PVCs.

Remove protection from a single PVC for deletion

Use kubectl patch to remove the finalizer from a specific PVC to allow its deletion:

kubectl patch pvc PVC-NAME -n OBJECT-STORE-NAMESPACE -p '{"metadata":{"finalizers":null}}' --type=merge

Replace PVC-NAME with the name of the PVC and OBJECT-STORE-NAMESPACE with the Object Store namespace.

You can then remove the PVC.

If pvcProtection remains enabled on the Object Store and the PVC is not immediately deleted, the Operator re-adds the finalizer during its next reconciliation. Reconciliation occurs when the Object Store spec changes or when modifying related resources (StatefulSets, Secrets, ConfigMaps). To permanently remove protection from PVCs, disable PVC protection on the Object Store.

Disable PVC protection and remove the finalizer from all existing PVCs

To disable PVC protection, set objectStore.pvcProtection to false:

objectStore:
  pvcProtection: false

The Operator automatically removes the aistor.min.io/pvc-protection finalizer from all existing PVCs when you disable protection.

Considerations

StatefulSet PVC retention policy

The AIStor Operator configures StatefulSets with a PVC retention policy of Retain for both WhenDeleted and WhenScaled operations. This ensures the preservation of PVCs when deleting or scaling down StatefulSets.

Do not modify the StatefulSet’s persistentVolumeClaimRetentionPolicy field. The Operator enforces Retain and restores this setting during reconciliation if changed. Changing this setting manually can lead to unexpected behavior or data loss.

Storage class reclaim policy

PVC protection complements but does not replace the StorageClass reclaim policy. The finalizer prevents PVC deletion, but if you remove the finalizer and delete the PVC, the reclaim policy determines what happens to the underlying storage:

  • If the reclaim policy is Delete, the underlying PersistentVolume (PV) and its data are deleted.
  • If the reclaim policy is Retain, the PV and its data persist, allowing recovery.

For maximum data protection, combine PVC protection with a Retain reclaim policy on your StorageClass. This provides two layers of defense: the finalizer prevents accidental PVC deletion, and the Retain policy preserves data even if deletion occurs.

The default AIStor storage class has a reclaim policy of Delete, following standard Kubernetes practice. This means deleting a PVC also removes the underlying storage.

Define and use your own storage class to set the Retain behavior.