A taint is a node attribute that repels application pods unless their specifications include a matching toleration. It commonly protects control-plane resources from ordinary workloads. A taint contains a key and effect, and may also contain a value; NoSchedule prevents scheduling without the required toleration. section 2.1.3 section 2.4
Use taints operationally to inspect node restrictions and test pod placement:
- Inspect a control-plane taint with kubectl describe node kind-control-plane | grep Taints; a typical result is node-role.kubernetes.io/control-plane:NoSchedule. section 2.1.3
- Apply a valued taint with kubectl taint node kind-worker dedicated=special-user:NoSchedule. section 2.1.3
- Add a matching toleration to a pod specification, create the pod, and verify placement with kubectl get pods -o wide. section 2.1.3
root@kind-control-plane:/# kubectl describe node kind-control-plane | grep Taints Taints: node-role.kubernetes.io/control-plane:NoSchedule
Inspect the representative kubectl output showing a NoSchedule taint on the control-plane node. section 2.1.3
