Taints and tolerance are used to set restrictions on what parts can be scheduled on a node.
No restrictions: Pods: A B C D Nodes: Node1 Node2 Node3
Pods can reside on any of the nodes.
If taint=bue on Node1, none of the pods can be placed on Node1
If taint=blue on Node1 and toleration for blue on pod D Then Pod D can only be placed on Node1 Pod A C are sent to Node2 and Pod B to Node 3
kubectl taint nodes node-name key=value:taint-effect
//taint-effct:
//NoSchedule: Pods will not be scheduled
//PreferNoSchedule: system will try not to place the pod on the node but not guranteed
//NoExecute: New pods will not be placed on the node and older pods will be evicted if they are taint. These pods were placed before the taint was applied to the node
kubectl taint nodes node1 app=blue:NoSchedule
Tolerations are added to pods in the pod definition of the file.
apiVersion:v1
kind: Pod
metadata:
name:myapp-pod
spec:
containers:
- name: nginx-container
image: nginx
tolerations:
- key: "app"
operator: "Equal"
value: "blue"
effect: "NoSchedule"
Taint with effect NoExecute to Node1 and toleration to Pod D will evict any other pod but Pod D from Node1. However, Pod D can be placed on other nodes as well.
On master nods a taint is setup by default which restricts any pod to get hosted on it. Its is best practice not to deploy workloads on the master node.
//to see the taint
kunectl describe node kubemaster | grep Taint
//untain controlplane
kubectl taint nodes controlplane node-role.kubernetes.io/control-plane:NoSchedule-