Taints and tolerations in Kubernetes - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a taint in Kubernetes?

A taint is a property applied to a node that prevents pods from being scheduled on it unless those pods have matching tolerations.

beginner

What does a toleration do in Kubernetes?

A toleration allows a pod to be scheduled on a node that has matching taints, effectively 'tolerating' the taint.

intermediate

Explain the effect field in a taint.

The effect field defines what happens to pods that do not tolerate the taint. Common effects are NoSchedule (don't schedule), PreferNoSchedule (try not to schedule), and NoExecute (evict existing pods).

intermediate

How do taints and tolerations help in node management?

They help control which pods can run on which nodes, allowing separation of workloads, reserving nodes for special tasks, or isolating nodes for maintenance.

beginner

Give an example of a taint command to prevent pods without tolerations from scheduling on a node named 'worker1'.

kubectl taint nodes worker1 key=value:NoSchedule

What happens if a node has a taint but a pod does not have a matching toleration?

A The pod will ignore the taint and run.

B The pod will be scheduled on that node anyway.

C The pod will be deleted immediately.

D The pod will not be scheduled on that node.

Pods without matching tolerations cannot be scheduled on nodes with taints.

Which effect in a taint causes existing pods without tolerations to be evicted from the node?

A NoExecute

B PreferNoSchedule

C NoSchedule

D Evict

NoExecute evicts existing pods that do not tolerate the taint.

How do you remove a taint from a node named 'node1' with key 'key1' and value 'value1'?

A kubectl taint nodes node1 key1=value1:NoSchedule-

B kubectl remove taint node1 key1=value1

C kubectl delete taint node1 key1=value1

D kubectl clear taint node1 key1=value1

The '-' suffix removes the taint from the node.

Which command adds a toleration to a pod spec?

A kubectl add toleration pod

B Add tolerations field in pod YAML under spec

C kubectl taint pod

D kubectl tolerate pod

Tolerations are added in the pod YAML under the spec section.

What is the main purpose of using taints and tolerations together?

A To delete pods automatically

B To force all pods to run on all nodes

C To control pod scheduling on specific nodes

D To increase pod resource limits

Taints and tolerations control which pods can be scheduled on which nodes.

Describe how taints and tolerations work together to control pod scheduling in Kubernetes.

Think about how nodes can repel pods and how pods can accept that.

Explain the difference between the NoSchedule and NoExecute effects in taints.

Consider when pods are blocked or removed.

Practice

1. What is the main purpose of a taint in Kubernetes?

easy

A. To repel pods from nodes unless they have matching tolerations

B. To allow pods to run on any node without restrictions

C. To label pods for easier identification

D. To increase node resource limits automatically

Solution

1. Step 1: Understand what a taint does

   A taint is applied to a node to repel pods that do not tolerate it.

2. Step 2: Compare with other options

   Options B, C, and D describe unrelated features: pod scheduling without restrictions, pod labeling, and resource limits, which are not taint functions.

3. Final Answer:

   To repel pods from nodes unless they have matching tolerations -> Option A

4. Quick Check:

   Taints repel pods without tolerations = A [OK]

Hint: Taints push pods away; tolerations allow pods to stay [OK]

Common Mistakes:

• Confusing taints with labels
• Thinking taints increase resources
• Assuming taints allow all pods

2. Which of the following is the correct syntax to add a taint to a node named node1 that repels pods without the matching toleration?

easy

A. kubectl taint nodes node1 key=value:NoSchedule

B. kubectl label nodes node1 key=value:NoSchedule

C. kubectl taint pods node1 key=value:NoSchedule

D. kubectl tolerate nodes node1 key=value:NoSchedule

Solution

1. Step 1: Identify the correct command for tainting nodes

   The command to add a taint is kubectl taint nodes followed by node name and taint details.

2. Step 2: Check the options

   kubectl taint nodes node1 key=value:NoSchedule uses the correct syntax. kubectl label nodes node1 key=value:NoSchedule uses label instead of taint. kubectl taint pods node1 key=value:NoSchedule tries to taint pods, which is invalid. kubectl tolerate nodes node1 key=value:NoSchedule uses a non-existent command.

3. Final Answer:

   kubectl taint nodes node1 key=value:NoSchedule -> Option A

4. Quick Check:

   Use kubectl taint nodes for taints = A [OK]

Hint: Use 'kubectl taint nodes' to add taints, not labels or pods [OK]

Common Mistakes:

• Using 'label' instead of 'taint'
• Trying to taint pods instead of nodes
• Using wrong command like 'tolerate'

3. Given the following pod spec snippet, what will happen if the node has the taint key=value:NoSchedule?

tolerations:
- key: "key"
  operator: "Equal"
  value: "value"
  effect: "NoSchedule"

medium

A. The pod will be scheduled but evicted immediately

B. The pod will be scheduled on the tainted node

C. The pod will be rejected and not scheduled

D. The pod will ignore the taint and schedule anywhere

Solution

1. Step 1: Understand the pod toleration

   The pod tolerates the taint with matching key, value, and effect, so it can be scheduled on the node.

2. Step 2: Analyze the taint effect

   The taint effect is NoSchedule, which prevents pods without tolerations from scheduling. Since this pod has the matching toleration, it is allowed.

3. Final Answer:

   The pod will be scheduled on the tainted node -> Option B

4. Quick Check:

   Matching toleration allows scheduling despite taint = C [OK]

Hint: Matching toleration lets pod schedule on tainted node [OK]

Common Mistakes:

• Ignoring the value match in toleration
• Confusing NoSchedule with NoExecute
• Assuming tolerations always allow scheduling

4. You applied the taint key=value:NoSchedule to a node, but pods without tolerations are still scheduling on it. What is the most likely cause?

medium

A. Pods have tolerations matching the taint

B. Taints do not affect scheduling

C. The node is in a NotReady state

D. The taint was applied with a typo in the key or value

Solution

1. Step 1: Check taint correctness

   If pods without tolerations schedule on a tainted node, the taint might have a typo or was not applied correctly.

2. Step 2: Evaluate other options

   Pods have tolerations matching the taint means pods tolerate the taint, which contradicts the question. The node is in a NotReady state is unrelated to taints. Taints do not affect scheduling is false because taints do affect scheduling.

3. Final Answer:

   The taint was applied with a typo in the key or value -> Option D

4. Quick Check:

   Incorrect taint syntax causes scheduling errors = B [OK]

Hint: Check taint spelling carefully if pods ignore it [OK]

Common Mistakes:

• Assuming taints don't affect scheduling
• Ignoring typos in taint keys or values
• Confusing node status with taint issues

5. You want to ensure that only pods with a specific toleration can run on a node, and all other pods are evicted if already running. Which taint effect should you use?

hard

A. NoSchedule

B. PreferNoSchedule

C. NoExecute

D. NoEvict

Solution

1. Step 1: Understand taint effects

   NoSchedule prevents new pods without tolerations from scheduling. PreferNoSchedule tries to avoid scheduling but doesn't guarantee. NoExecute evicts existing pods without tolerations and prevents new ones. NoEvict is not a valid effect.

2. Step 2: Match requirement to effect

   Since you want to evict existing pods without tolerations, NoExecute is the correct effect.

3. Final Answer:

   NoExecute -> Option C

4. Quick Check:

   Evict pods without tolerations = NoExecute = D [OK]

Hint: Use NoExecute to evict pods lacking tolerations [OK]

Common Mistakes:

• Choosing NoSchedule which doesn't evict existing pods
• Confusing PreferNoSchedule with eviction
• Using invalid effect NoEvict