liveBook · Manning

Kubectl drain

As explained in Acing the Certified Kubernetes Administrator Exam, Second Edition

kubectl drain is a kubectl command that evicts or removes pods from a specified Kubernetes node while applying workload-controller and daemon-set handling rules.

kubectl drain prepares a node for maintenance by cordoning it, evicting eligible pods, and allowing workload controllers to recreate them elsewhere. The pods are deleted and recreated rather than literally moved. DaemonSet-managed system pods are normally ignored with --ignore-daemonsets. section 5.2 section 5.2.1

Use the command with these operational distinctions:

  • kubectl drain kind-worker --ignore-daemonsets drains the node while skipping DaemonSet-managed pods that cannot normally be evicted. section 5.2
  • Add --force when an unmanaged pod blocks draining; that pod can be deleted permanently because no controller recreates it. section 5.2.1
  • A recreated pod still follows scheduling rules. A tainted destination node can leave it Pending until a toleration is added or another suitable node exists. section 5.2.1
  • After maintenance, run kubectl uncordon kind-worker to enable scheduling on the node again. section 5.2

Drain and verify a worker node

First make a destination schedulable if necessary: kubectl taint no kind-control-plane node-role.kubernetes.io/control-plane:NoSchedule-. Then run kubectl drain kind-worker --ignore-daemonsets. Verify placement with kubectl get po -o wide; controller-managed nginx pods appear on kind-control-plane while DaemonSet warnings identify skipped pods. Finish with kubectl uncordon kind-worker. section 5.2

root@kind-control-plane:/# kubectl drain kind-worker --ignore-daemonsets
node/kind-worker already cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/kindnet-h7695, 
kube-system/kube-proxy-j8wbc
evicting pod default/nginx-76d6c9b8c-hr9z6
pod/nginx-76d6c9b8c-hr9z6 evicted
node/kind-worker drained
root@kind-control-plane:/# kubectl get po -o wide
NAME                     READY   STATUS    RESTARTS   AGE    IP           
NODE
nginx-76d6c9b8c-4494r    1/1     Running   0          52s    10.244.0.7   
kind-control-plane
nginx2-b648d744f-n6xb9   1/1     Running   0          3m6s   10.244.0.6   
kind-control-plane

Representative drain output shows the node already cordoned, DaemonSets ignored, a pod evicted, and replacement pods running on the control-plane node. section 5.2

How Acing the Certified Kubernetes Administrator Exam, Second Edition covers it

How deep it goes
Explains cordoning, eviction, recreation, DaemonSet exceptions, force deletion, taints, verification, and uncordoning through commands.
Examples
Uses a two-node kind cluster, nginx Deployments, DaemonSet system pods, drain output, pod placement, and taint removal.
What it assumes
Assumes familiarity with taints and ReplicaSets while demonstrating node scheduling, pod controllers, and maintenance commands.
What you can do after
Operate/configure node maintenance by draining, verifying pod placement, and restoring scheduling with kubectl uncordon.
How it connects
Connects kubectl drain with cordon, uncordon, DaemonSet, ReplicaSet, taints, tolerations, and Kubernetes scheduling.

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Acing the Certified Kubernetes Administrator Exam, Second Edition. The section links point to the parts of the book it draws on.