StorageClasses and dynamic provisioning

Exam tasks: 4.1 (StorageClasses and dynamic provisioning)

The decision: which class does a claim end up with, when is the real volume created, and will you be able to grow it later?

What happens when a claim names a classCopy Anchor Link

• The provisioner named in the class does the work. For CSI drivers it's the external-provisioner sidecar running next to the driver's controller; it watches claims whose class names its driver.
• The new PV copies reclaimPolicy, mountOptions and the class name from the StorageClass, and is pre-bound to the claim that triggered it.
• kubectl get csidrivers lists installed CSI drivers. kubectl get sc shows each class's provisioner, reclaim policy, binding mode and whether expansion is allowed.

Anatomy of a StorageClassCopy Anchor Link

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"   # optional
provisioner: csi.quarrystore.example      # driver name, required
parameters:                               # opaque to Kubernetes, driver-specific
  tier: nvme
  replicas: "2"
reclaimPolicy: Retain                     # Delete if omitted
volumeBindingMode: WaitForFirstConsumer   # Immediate if omitted
allowVolumeExpansion: true                # false if omitted
mountOptions:
  - noatime

The default classCopy Anchor Link

• Mark a class as default with the annotation storageclass.kubernetes.io/is-default-class: "true". Any claim created without a storageClassName gets that class written into it at admission.
• If more than one class carries the annotation, new claims get the most recently created default. Keep exactly one; multiple defaults exist only to make migrations painless.
• Claims created while no default existed stay unset, and are updated retroactively once a default appears.
• A claim with storageClassName: "" opts out: it is never defaulted and only binds classless PVs.

# Move the default from local-path to fast-ssd
k patch sc local-path -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'
k patch sc fast-ssd   -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
k get sc        # "(default)" appears after the name

Binding modeCopy Anchor Link

• For local PVs there's no dynamic provisioning: use provisioner: kubernetes.io/no-provisioner with WaitForFirstConsumer, so binding waits until the scheduler knows which node's disk the Pod can use.
• allowedTopologies restricts where volumes may be provisioned (for example, two zones only). Usually you leave it out and let WaitForFirstConsumer follow the Pod.

Growing a volumeCopy Anchor Link

• Only claims bound to an expandable volume type (CSI drivers that support it) can grow. The driver must implement expansion; the field alone doesn't make it possible.
• Never shrink. A request smaller than the current size is rejected. You can't edit the class of a bound claim either: copy data to a new claim instead.
• Watch kubectl describe pvc for conditions such as Resizing and FileSystemResizePending. File system growth finishes when a Pod uses the claim, so an unused claim waits.
• If an expansion fails because the backend has no room, you may retry with a smaller value than you asked for, as long as it's still above the current status.capacity.

ScenariosCopy Anchor Link

DrillCopy Anchor Link

kubectl config use-context cka-provision

The cluster runs the rancher.io/local-path provisioner, and class local-path is currently the default.

1. Create a StorageClass scratch-wffc with that provisioner, reclaim policy Retain, binding mode WaitForFirstConsumer, and volume expansion allowed.
2. Make scratch-wffc the only default StorageClass.
3. In namespace kiln, create PVC glaze-data requesting 256Mi ReadWriteOnce without naming a class, and confirm it got scratch-wffc.
4. Start a Pod glaze (image nginx:1.27) that mounts it at /usr/share/nginx/html, and confirm the claim binds.

# sc.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: scratch-wffc
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
provisioner: rancher.io/local-path
reclaimPolicy: Retain
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: glaze-data
  namespace: kiln
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 256Mi
---
apiVersion: v1
kind: Pod
metadata:
  name: glaze
  namespace: kiln
spec:
  containers:
  - name: web
    image: nginx:1.27
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html
  volumes:
  - name: html
    persistentVolumeClaim:
      claimName: glaze-data

k patch sc local-path -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'
k create ns kiln                 # skip if it exists
k apply -f sc.yaml
k get sc                         # only scratch-wffc shows (default)
k get pvc -n kiln glaze-data -o jsonpath='{.spec.storageClassName}{"\n"}'   # scratch-wffc
k get pvc -n kiln glaze-data     # Bound once the Pod is scheduled; Pending before that is expected
k get pv                         # new PV, RECLAIM POLICY Retain, CLAIM kiln/glaze-data

Further readingCopy Anchor Link

• Storage Classes
• Dynamic Volume Provisioning
• Change the default StorageClass
• Kubernetes CSI documentation