# Use WaitForFirstConsumer without bypassing the Kubernetes scheduler

> Topology-aware volume binding needs the future Pod’s placement information.

- Canonical URL: https://update.dsesecurity.com/updates/use-waitforfirstconsumer-without-bypassing-the-kubernetes-scheduler/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:50+00:00
- Modified: 2026-10-20T18:34:31+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Topology-aware volume binding needs the future Pod’s placement information.

## Potentially affected

This applies to supported topology-constrained storage and StorageClass volume-binding modes. The provisioner’s capabilities still determine which modes are available.

## DSE recommendation

DSE recommends checking the volume’s binding mode whenever a stateful Pod and its claim remain pending together.

## Article

Topology-aware volume binding needs the future Pod’s placement information.

## Source facts

Kubernetes StorageClass Immediate mode can bind or provision a volume before the consuming Pod’s scheduling needs are known. WaitForFirstConsumer delays that work so placement constraints can inform volume selection. Kubernetes warns against using nodeName with this mode: bypassing the scheduler can leave the claim pending. A node selector can express a host preference without that bypass.

Source: [Kubernetes documentation — Storage Classes](https://kubernetes.io/docs/concepts/storage/storage-classes/).

## Applicability

This applies to supported topology-constrained storage and StorageClass volume-binding modes. The provisioner’s capabilities still determine which modes are available.

## DSE recommendation

DSE recommends checking the volume’s binding mode whenever a stateful Pod and its claim remain pending together. Review node affinity, selectors, capacity, and storage topology as one placement problem. Avoid assigning nodeName as a quick fix unless its consequences have been deliberately accepted. Document the intended failure-domain placement and use a policy that allows the scheduler and provisioner to coordinate. Keep backend eligibility information with the workload runbook so replacement nodes do not silently fall outside the storage’s reachable topology.

## Verification

In a nonproduction namespace, inspect the sequence from claim creation through Pod scheduling and binding. Compare an approved selector-based Pod with a deliberately bypassed scheduler case. Confirm that the documented configuration resolves placement without forcing an inaccessible volume onto a node. Retain the StorageClass, effective selector and claim events as one record. Ask the storage owner to identify the provisioner capability used and the point at which the selected node’s topology influenced the binding decision.

## Official reference

[Kubernetes documentation — Storage Classes](https://kubernetes.io/docs/concepts/storage/storage-classes/). Reviewed October 20, 2026.

## Primary reference

- Name: Kubernetes documentation — Storage Classes
- Authority: kubernetes.io
- URL: https://kubernetes.io/docs/concepts/storage/storage-classes/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use WaitForFirstConsumer without bypassing the Kubernetes scheduler,” DSE Security, https://update.dsesecurity.com/updates/use-waitforfirstconsumer-without-bypassing-the-kubernetes-scheduler/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.