A Pod that needs a particular kind of node should not be placed on just any node. A node selector sets a scheduling requirement in the Pod specification: the node must have the specified label and value. For example, selecting kubernetes.io/arch: arm64 restricts a Pod to Arm-based nodes. section 8.1.1
Listing 8.1 Chapter08/8.1.1_NodeSelection/deploy_nodeselector.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: timeserver
spec:
replicas: 1
selector:
matchLabels:
pod: timeserver-pod
template:
metadata:
labels:
pod: timeserver-pod
spec:
nodeSelector: #1
kubernetes.io/arch: arm64 #1
containers:
- name: timeserver-container
image: docker.io/wdenniss/timeserver:5
#1 Selects nodes with the arm64 architecture
The Deployment places nodeSelector under the Pod template’s spec. Its arm64 requirement applies to the Pods the Deployment creates. section 8.1.1
The matching nodes must exist and carry the label. On a supported fully managed platform, specifying a feature label may be enough to obtain a suitable node. On a more traditional platform, provision nodes with that feature separately, such as through a node pool. Check placement with kubectl get pods -o wide, then inspect the chosen node’s labels. section 8.1.1
Choose the constraint that matches the job:
- Use a node selector for a required label match. Node affinity can express the same Arm requirement and offers more expressive matching logic. section 8.1.1
- Use a toleration to permit placement on a tainted node; it does not require placement there. For a GPU workload, combine a selector targeting GPU nodes with a taint and toleration that keep ordinary workloads off them. section 8.1.3
Listing 8.8 Chapter08/8.1.4_WorkloadSeparation/deploy_group1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: timeserver1
spec:
replicas: 5
selector:
matchLabels:
pod: timeserver1-pod
template:
metadata:
labels:
pod: timeserver1-pod
spec:
tolerations: #1
- key: group #1
operator: Equal #1
value: "1" #1
effect: NoSchedule #1
nodeSelector: #2
group: "1" #2
containers:
- name: timeserver-container
image: docker.io/wdenniss/timeserver:5
#1 Tolerate the group=1 taint
#2 Select the group=1 label
This Deployment selects nodes labeled group=1 and separately tolerates a group=1 taint. The equal values do not make labels and taints the same mechanism. section 8.1.4
Selectors can also separate workloads rather than target hardware. Label and taint dedicated node groups, then give each workload the corresponding selector and toleration. This can keep stable coordinator Pods apart from changing worker Pods, or reduce competition between workloads on a node. Without the required node label, the selector cannot target that group. section 8.1.4
