Taints, Tolerations, and Node Affinity

Taints and tolerations

• Taint on node → repels Pods without matching toleration
• Toleration on Pod → allowed on tainted node
• Taints do not guarantee placement: only who may run there

kubectl taint nodes node1 app=blue:NoSchedule
kubectl taint nodes node1 app=blue:NoSchedule-   # remove (trailing -)

tolerations:
- key: app
  operator: Equal    # or Exists
  value: blue
  effect: NoSchedule

Node selector

nodeSelector:
  size: Large

Limitation: no OR / NOT; use nodeAffinity for complex rules.

Node affinity

• Operators: In, NotIn, Exists, DoesNotExist, Gt, Lt

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: size
          operator: In
          values: [Large, Medium]

Pod affinity and anti-affinity

• podAffinity: co-locate with matching Pods (e.g. app + cache on same node)
• podAntiAffinity: spread them (e.g. HA replicas across nodes)
• topologyKey: defines the domain (kubernetes.io/hostname = per-node, topology.kubernetes.io/zone = per-zone)
• labelSelector matches other running Pods, not nodes

affinity:
  podAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    - labelSelector:
        matchLabels:
          app: cache          # schedule ON SAME NODE as pods with app=cache
      topologyKey: kubernetes.io/hostname
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
    - weight: 100
      podAffinityTerm:
        labelSelector:
          matchLabels:
            app: web          # PREFER different node from other app=web pods
        topologyKey: kubernetes.io/hostname

When to use what

Exam gotchas

• Taints =/= guaranteed placement: pair with node affinity for dedicated workloads
• Remove taint: append - (app=blue:NoSchedule-)
• Pod affinity uses labelSelector on Pods, not nodes
• topologyKey is required in pod affinity/anti-affinity rules
• preferredDuringScheduling requires a weight (1-100)