{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/decide-when-kubernetes-topology-spread-should-block-placement/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/",
        "slug": "decide-when-kubernetes-topology-spread-should-block-placement",
        "url": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/decide-when-kubernetes-topology-spread-should-block-placement/"
        },
        "title": "Decide when Kubernetes topology spread should block placement",
        "summary": "DoNotSchedule makes maxSkew a placement restriction; ScheduleAnyway prioritizes reducing skew.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:44+00:00",
        "modified_at": "2026-10-20T18:34:31+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 245,
        "potentially_affected": "Review topology-spread scheduling constraints and the eligible domains used in their skew calculation.",
        "dse_recommendation": "DSE recommends choosing whether reduced placement availability or reduced fault separation is the more acceptable failure mode for each workload.",
        "primary_source": {
            "name": "Kubernetes documentation — Pod Topology Spread Constraints",
            "url": "https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/",
            "published_on": null,
            "authority": "kubernetes.io"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>DoNotSchedule makes maxSkew a placement restriction; ScheduleAnyway prioritizes reducing skew.</p>\n<h2>Source facts</h2>\n<p>Kubernetes topology spread constraints compare matching Pod counts across topology domains. With whenUnsatisfiable set to DoNotSchedule, maxSkew is a hard placement restriction. ScheduleAnyway expresses a scheduling preference instead. The minDomains setting affects the global minimum used in skew calculations when too few eligible domains exist. Eligibility also depends on the configured placement rules.</p>\n<p>Source: <a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/\">Kubernetes documentation — Pod Topology Spread Constraints</a>.</p>\n<h2>Applicability</h2>\n<p>Review topology-spread scheduling constraints and the eligible domains used in their skew calculation.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends choosing whether reduced placement availability or reduced fault separation is the more acceptable failure mode for each workload. Inventory the actual labeled domains and the constraints that make nodes eligible. Review the selector carefully so the count represents the intended application replicas. Explain the expected result when a zone is unavailable, including whether Pending is the desired signal. Keep this policy aligned with capacity planning rather than weakening it during an incident without recording the tradeoff.</p>\n<h2>Verification</h2>\n<p>Use an approved test workload to inspect placement with all domains available and with one excluded from eligibility. Compare scheduler events and matching Pod counts. Confirm that the resulting pending or colocated replicas reflect the documented policy. Write the expected eligible-domain count and skew calculation into the test plan before excluding a domain. Keep the observed count and scheduler explanation with the outcome, including an intentionally Pending replica.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/\">Kubernetes documentation — Pod Topology Spread Constraints</a>. Reviewed October 20, 2026.</p>",
        "content_text": "DoNotSchedule makes maxSkew a placement restriction; ScheduleAnyway prioritizes reducing skew.\nSource facts\nKubernetes topology spread constraints compare matching Pod counts across topology domains. With whenUnsatisfiable set to DoNotSchedule, maxSkew is a hard placement restriction. ScheduleAnyway expresses a scheduling preference instead. The minDomains setting affects the global minimum used in skew calculations when too few eligible domains exist. Eligibility also depends on the configured placement rules.\nSource: Kubernetes documentation — Pod Topology Spread Constraints.\nApplicability\nReview topology-spread scheduling constraints and the eligible domains used in their skew calculation.\nDSE recommendation\nDSE recommends choosing whether reduced placement availability or reduced fault separation is the more acceptable failure mode for each workload. Inventory the actual labeled domains and the constraints that make nodes eligible. Review the selector carefully so the count represents the intended application replicas. Explain the expected result when a zone is unavailable, including whether Pending is the desired signal. Keep this policy aligned with capacity planning rather than weakening it during an incident without recording the tradeoff.\nVerification\nUse an approved test workload to inspect placement with all domains available and with one excluded from eligibility. Compare scheduler events and matching Pod counts. Confirm that the resulting pending or colocated replicas reflect the documented policy. Write the expected eligible-domain count and skew calculation into the test plan before excluding a domain. Keep the observed count and scheduler explanation with the outcome, including an intentionally Pending replica.\nOfficial reference\nKubernetes documentation — Pod Topology Spread Constraints. Reviewed October 20, 2026.",
        "content_markdown": "DoNotSchedule makes maxSkew a placement restriction; ScheduleAnyway prioritizes reducing skew.\n\n## Source facts\n\nKubernetes topology spread constraints compare matching Pod counts across topology domains. With whenUnsatisfiable set to DoNotSchedule, maxSkew is a hard placement restriction. ScheduleAnyway expresses a scheduling preference instead. The minDomains setting affects the global minimum used in skew calculations when too few eligible domains exist. Eligibility also depends on the configured placement rules.\n\nSource: [Kubernetes documentation — Pod Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/).\n\n## Applicability\n\nReview topology-spread scheduling constraints and the eligible domains used in their skew calculation.\n\n## DSE recommendation\n\nDSE recommends choosing whether reduced placement availability or reduced fault separation is the more acceptable failure mode for each workload. Inventory the actual labeled domains and the constraints that make nodes eligible. Review the selector carefully so the count represents the intended application replicas. Explain the expected result when a zone is unavailable, including whether Pending is the desired signal. Keep this policy aligned with capacity planning rather than weakening it during an incident without recording the tradeoff.\n\n## Verification\n\nUse an approved test workload to inspect placement with all domains available and with one excluded from eligibility. Compare scheduler events and matching Pod counts. Confirm that the resulting pending or colocated replicas reflect the documented policy. Write the expected eligible-domain count and skew calculation into the test plan before excluding a domain. Keep the observed count and scheduler explanation with the outcome, including an intentionally Pending replica.\n\n## Official reference\n\n[Kubernetes documentation — Pod Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/",
                "url": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "IT",
                        "item": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Decide when Kubernetes topology spread should block placement",
                        "item": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/#article",
                "identifier": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/",
                "url": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/",
                "headline": "Decide when Kubernetes topology spread should block placement",
                "description": "DoNotSchedule makes maxSkew a placement restriction; ScheduleAnyway prioritizes reducing skew.",
                "abstract": "DoNotSchedule makes maxSkew a placement restriction; ScheduleAnyway prioritizes reducing skew.",
                "articleBody": "DoNotSchedule makes maxSkew a placement restriction; ScheduleAnyway prioritizes reducing skew.\nSource facts\nKubernetes topology spread constraints compare matching Pod counts across topology domains. With whenUnsatisfiable set to DoNotSchedule, maxSkew is a hard placement restriction. ScheduleAnyway expresses a scheduling preference instead. The minDomains setting affects the global minimum used in skew calculations when too few eligible domains exist. Eligibility also depends on the configured placement rules.\nSource: Kubernetes documentation — Pod Topology Spread Constraints.\nApplicability\nReview topology-spread scheduling constraints and the eligible domains used in their skew calculation.\nDSE recommendation\nDSE recommends choosing whether reduced placement availability or reduced fault separation is the more acceptable failure mode for each workload. Inventory the actual labeled domains and the constraints that make nodes eligible. Review the selector carefully so the count represents the intended application replicas. Explain the expected result when a zone is unavailable, including whether Pending is the desired signal. Keep this policy aligned with capacity planning rather than weakening it during an incident without recording the tradeoff.\nVerification\nUse an approved test workload to inspect placement with all domains available and with one excluded from eligibility. Compare scheduler events and matching Pod counts. Confirm that the resulting pending or colocated replicas reflect the documented policy. Write the expected eligible-domain count and skew calculation into the test plan before excluding a domain. Keep the observed count and scheduler explanation with the outcome, including an intentionally Pending replica.\nOfficial reference\nKubernetes documentation — Pod Topology Spread Constraints. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:44+00:00",
                "dateModified": "2026-10-20T18:34:31+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/decide-when-kubernetes-topology-spread-should-block-placement/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Decide when Kubernetes topology spread should block placement"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 245,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Kubernetes documentation — Pod Topology Spread Constraints",
                    "url": "https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/"
                }
            }
        ]
    }
}