Course outline

01 · Kubernetes Architecture Deep Dive

02 · Workloads & Scheduling

03 · Networking, Storage & Service Mesh

04 · Platform Engineering & Multi-Tenancy

05 · Networking & Service Mesh

06 · Observability & Autoscaling

07 · Configuration & Secrets Management

08 · Stateful Storage Operations

09 · Security, Identity & Admission

10 · Release Packaging with Helm & Kustomize

11 · Operators, CRDs & Controllers

12 · Production Troubleshooting & Operations

Stage 5 · Platform

Networking, Storage & Service Mesh

Storage Classes & Dynamic Provisioning

Provisioners, volume binding modes, and reclaim policies.

6 min readKubernetes & Cloud NativePlatform

StorageClass Overview

A StorageClass defines a class of storage with specific properties: provisioner, parameters, reclaim policy, and binding mode. Instead of creating volumes manually, you create a StorageClass and reference it in PVCs. The CSI driver provisions volumes on demand.

StorageClass definition


apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
  labels:
    tier: premium
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  iops: "3000"
  throughput: "125"
  encrypted: "true"
  fsType: ext4
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Delete
allowVolumeExpansion: true

This StorageClass creates encrypted gp3 EBS volumes with 3000 IOPS and 125 MB/s throughput. WaitForFirstConsumer ensures the volume is created in the same zone as the pod. allowVolumeExpansion lets PVCs grow after creation.

CSI Provisioners

The provisioner field identifies which CSI driver handles volume creation. Each cloud provider and storage vendor has its own provisioner. The provisioner must be installed in the cluster before StorageClasses can use it.

Provider	Provisioner	Volume Types
AWS	ebs.csi.aws.com	gp3, io2, st1, sc1
GCP	pd.csi.gke.io	standard, ssd, extreme
Azure	disk.csi.azure.com	Standard_LRS, Premium_LRS
Ceph	rook-ceph.rbd.csi.ceph.com	rbd images

Volume Binding Modes

VolumeBindingMode controls when and how PVCs are bound to PVs. Immediate mode binds as soon as the PVC is created. WaitForFirstConsumer delays binding until a pod is scheduled, ensuring zone-aware provisioning.

Immediate vs WaitForFirstConsumer


# Immediate binding — volume created right away
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: immediate-bind
provisioner: ebs.csi.aws.com
volumeBindingMode: Immediate  # Default
parameters:
  type: gp3
---
# Wait for consumer — volume created when pod is scheduled
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: wait-for-pod
provisioner: ebs.csi.aws.com
volumeBindingMode: WaitForFirstConsumer
parameters:
  type: gp3

Use WaitForFirstConsumer for multi-zone clusters. With Immediate mode, the volume is created in a random zone. If the pod is scheduled in a different zone, the volume cannot be attached. WaitForFirstConsumer prevents this mismatch.

Immediate binding causes zone issues

In multi-zone clusters, always use WaitForFirstConsumer. Immediate binding creates the volume in the provisioner's zone. If the pod lands in a different zone, attachment fails with Multi-Attach error.

Reclaim Policies

ReclaimPolicy determines what happens to a PV when its PVC is deleted. Delete removes the volume from the storage system. Retain keeps the volume but disconnects it from the PV object. This protects data from accidental deletion.

Retain policy for critical data


apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: critical-data
provisioner: ebs.csi.aws.com
reclaimPolicy: Retain  # Don't delete on PVC deletion
parameters:
  type: io2
  iops: "10000"
volumeBindingMode: WaitForFirstConsumer

With Retain, when the PVC is deleted, the PV enters Released state. The underlying volume still exists in the storage system. An admin must manually back up, reattach, or delete the volume. This is essential for databases and critical data.

StorageClass Parameters

Parameters are passed directly to the CSI driver. They vary by provisioner. Common parameters include volume type, IOPS, throughput, encryption, filesystem type, and tags. Check your CSI driver documentation for available parameters.

Multiple StorageClasses for different tiers


apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: hot-storage
provisioner: ebs.csi.aws.com
parameters:
  type: io2
  iops: "20000"
  encrypted: "true"
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: warm-storage
provisioner: ebs.csi.aws.com
parameters:
  type: st1
  encrypted: "true"
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: cold-storage
provisioner: ebs.csi.aws.com
parameters:
  type: sc1
  encrypted: "true"

Create StorageClasses for different performance tiers. Hot storage (io2) for databases, warm storage (st1) for logs, cold storage (sc1) for archives. Teams choose the appropriate tier in their PVCs.

Default StorageClass

Mark one StorageClass as default so PVCs without a storageClassName use it automatically. This simplifies PVC creation — users don't need to specify the StorageClass unless they want a different tier.

Set default StorageClass


# Mark a StorageClass as default
kubectl patch storageclass fast-ssd -p \
  '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

# Remove default designation
kubectl patch storageclass cold-storage -p \
  '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'

# List StorageClasses and see which is default
kubectl get sc

Only one StorageClass should be default. The is-default-class annotation controls this. PVCs with storageClassName: "" (empty string) use the default StorageClass.

List available StorageClasses

Use labels to organize StorageClasses by tier, team, or environment. This makes it easier for teams to find the right StorageClass for their workloads.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.