Add PersistentVolumeClaim for pod state persistence and update README

k8s/README.md

@@ -7,6 +7,7 @@ These manifests deploy `k8s-mgmt-pod` as a single-replica bastion deployment ins
 1. Build and publish the image.
 2. Replace the placeholder image in `deployment.yaml` with a pinned tag or digest.
 3. Create the real `k8s-mgmt-pod-auth` Secret instead of applying `secret.yaml.example`.
+4. The pod state directory is now backed by a PVC, so SSH host keys and generated fallback passwords survive pod recreation until you delete the claim.
 
 ## Create the Secret
 

k8s/deployment.yaml

@@ -104,4 +104,5 @@ spec:
 
       volumes:
         - name: state
-          emptyDir: {}
+          persistentVolumeClaim:
+            claimName: k8s-mgmt-pod-state

k8s/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   - namespace.yaml
   - serviceaccount.yaml
   - rbac.yaml
+  - pvc.yaml
   - deployment.yaml
   - service.yaml
   - networkpolicy.yaml

k8s/pvc.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: k8s-mgmt-pod-state
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi