Taints and tolerations in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the effect of a NoSchedule taint

What happens when a node has a taint with effect=NoSchedule and a pod does not have a matching toleration?

A The pod will not be scheduled on the node until it has a matching toleration.

B The pod will be scheduled but evicted immediately after starting.

C The pod will be scheduled on the node regardless of the taint.

D The pod will be scheduled only if the node has enough resources.

💡 Hint

Think about what NoSchedule means for pod placement.

A NoSchedule taint prevents pods without matching tolerations from being scheduled on the node. Pods must tolerate the taint to be placed there.

💻 Command Output

intermediate

Output of kubectl describe node with taints

What is the output of kubectl describe node node1 if the node has a taint key=example, value=reserved, effect=NoSchedule?

Kubernetes

kubectl describe node node1

A Taints: example=reserved:NoExecute

B Taints: example=reserved:NoSchedule

C Taints: example:NoSchedule

D Taints: None

💡 Hint

Check the format of taints in the node description.

The taint is shown as key=value:effect. Here, example=reserved:NoSchedule is the correct format.

❓ Configuration

advanced

Correct toleration YAML for NoExecute taint

Which YAML snippet correctly adds a toleration for a NoExecute taint with key special and value true?

A

tolerations:
- key: "special"
  operator: "Equal"
  value: "false"
  effect: "NoExecute"

B

tolerations:
- key: "special"
  operator: "Exists"
  effect: "NoExecute"
  tolerationSeconds: 300

C

tolerations:
- key: "special"
  value: "true"
  effect: "NoSchedule"

D

tolerations:
- key: "special"
  operator: "Equal"
  value: "true"
  effect: "NoExecute"
  tolerationSeconds: 300

💡 Hint

Remember that NoExecute tolerations can specify tolerationSeconds to limit eviction time.

Option D correctly specifies key, operator, value, effect, and tolerationSeconds for a NoExecute taint toleration.

❓ Troubleshoot

advanced

Pod not scheduled despite toleration present

A pod has a toleration for a taint key=zone, value=west, effect=NoSchedule but is still not scheduled on the node with that taint. What could be the reason?

A The toleration's operator is 'Exists' but the taint has a value, so it does not match.

B The pod's toleration effect is 'NoExecute' instead of 'NoSchedule'.

C The toleration's value does not match the taint's value exactly.

D The node is out of CPU resources.

💡 Hint

Check if the toleration's value matches the taint's value exactly.

Tolerations with operator 'Equal' require exact value match. If the values differ, the toleration does not match the taint, so the pod won't schedule.

✅ Best Practice

expert

Choosing the right taint effect for temporary node maintenance

You want to prevent new pods from scheduling on a node temporarily for maintenance but allow existing pods to continue running. Which taint effect should you use?

A NoSchedule

B NoExecute

C PreferNoSchedule

D NoStart

💡 Hint

Consider the difference between preventing scheduling and evicting pods.

NoSchedule prevents new pods from scheduling but does not evict existing pods. NoExecute evicts existing pods. PreferNoSchedule is a soft preference. NoStart is not a valid effect.

Practice

1. What is the main purpose of a taint in Kubernetes?

easy

A. To repel pods from nodes unless they have matching tolerations

B. To allow pods to run on any node without restrictions

C. To label pods for easier identification

D. To increase node resource limits automatically

Solution

1. Step 1: Understand what a taint does

   A taint is applied to a node to repel pods that do not tolerate it.

2. Step 2: Compare with other options

   Options B, C, and D describe unrelated features: pod scheduling without restrictions, pod labeling, and resource limits, which are not taint functions.

3. Final Answer:

   To repel pods from nodes unless they have matching tolerations -> Option A

4. Quick Check:

   Taints repel pods without tolerations = A [OK]

Hint: Taints push pods away; tolerations allow pods to stay [OK]

Common Mistakes:

• Confusing taints with labels
• Thinking taints increase resources
• Assuming taints allow all pods

2. Which of the following is the correct syntax to add a taint to a node named node1 that repels pods without the matching toleration?

easy

A. kubectl taint nodes node1 key=value:NoSchedule

B. kubectl label nodes node1 key=value:NoSchedule

C. kubectl taint pods node1 key=value:NoSchedule

D. kubectl tolerate nodes node1 key=value:NoSchedule

Solution

1. Step 1: Identify the correct command for tainting nodes

   The command to add a taint is kubectl taint nodes followed by node name and taint details.

2. Step 2: Check the options

   kubectl taint nodes node1 key=value:NoSchedule uses the correct syntax. kubectl label nodes node1 key=value:NoSchedule uses label instead of taint. kubectl taint pods node1 key=value:NoSchedule tries to taint pods, which is invalid. kubectl tolerate nodes node1 key=value:NoSchedule uses a non-existent command.

3. Final Answer:

   kubectl taint nodes node1 key=value:NoSchedule -> Option A

4. Quick Check:

   Use kubectl taint nodes for taints = A [OK]

Hint: Use 'kubectl taint nodes' to add taints, not labels or pods [OK]

Common Mistakes:

• Using 'label' instead of 'taint'
• Trying to taint pods instead of nodes
• Using wrong command like 'tolerate'

3. Given the following pod spec snippet, what will happen if the node has the taint key=value:NoSchedule?

tolerations:
- key: "key"
  operator: "Equal"
  value: "value"
  effect: "NoSchedule"

medium

A. The pod will be scheduled but evicted immediately

B. The pod will be scheduled on the tainted node

C. The pod will be rejected and not scheduled

D. The pod will ignore the taint and schedule anywhere

Solution

1. Step 1: Understand the pod toleration

   The pod tolerates the taint with matching key, value, and effect, so it can be scheduled on the node.

2. Step 2: Analyze the taint effect

   The taint effect is NoSchedule, which prevents pods without tolerations from scheduling. Since this pod has the matching toleration, it is allowed.

3. Final Answer:

   The pod will be scheduled on the tainted node -> Option B

4. Quick Check:

   Matching toleration allows scheduling despite taint = C [OK]

Hint: Matching toleration lets pod schedule on tainted node [OK]

Common Mistakes:

• Ignoring the value match in toleration
• Confusing NoSchedule with NoExecute
• Assuming tolerations always allow scheduling

4. You applied the taint key=value:NoSchedule to a node, but pods without tolerations are still scheduling on it. What is the most likely cause?

medium

A. Pods have tolerations matching the taint

B. Taints do not affect scheduling

C. The node is in a NotReady state

D. The taint was applied with a typo in the key or value

Solution

1. Step 1: Check taint correctness

   If pods without tolerations schedule on a tainted node, the taint might have a typo or was not applied correctly.

2. Step 2: Evaluate other options

   Pods have tolerations matching the taint means pods tolerate the taint, which contradicts the question. The node is in a NotReady state is unrelated to taints. Taints do not affect scheduling is false because taints do affect scheduling.

3. Final Answer:

   The taint was applied with a typo in the key or value -> Option D

4. Quick Check:

   Incorrect taint syntax causes scheduling errors = B [OK]

Hint: Check taint spelling carefully if pods ignore it [OK]

Common Mistakes:

• Assuming taints don't affect scheduling
• Ignoring typos in taint keys or values
• Confusing node status with taint issues

5. You want to ensure that only pods with a specific toleration can run on a node, and all other pods are evicted if already running. Which taint effect should you use?

hard

A. NoSchedule

B. PreferNoSchedule

C. NoExecute

D. NoEvict

Solution

1. Step 1: Understand taint effects

   NoSchedule prevents new pods without tolerations from scheduling. PreferNoSchedule tries to avoid scheduling but doesn't guarantee. NoExecute evicts existing pods without tolerations and prevents new ones. NoEvict is not a valid effect.

2. Step 2: Match requirement to effect

   Since you want to evict existing pods without tolerations, NoExecute is the correct effect.

3. Final Answer:

   NoExecute -> Option C

4. Quick Check:

   Evict pods without tolerations = NoExecute = D [OK]

Hint: Use NoExecute to evict pods lacking tolerations [OK]

Common Mistakes:

• Choosing NoSchedule which doesn't evict existing pods
• Confusing PreferNoSchedule with eviction
• Using invalid effect NoEvict