Lab: Kubernetes Taints and Tolerations

Introduction
Node affinity, is a property of Pods that attracts them to a set of nodes (either as a preference
or a hard requirement). Taints are the opposite -- they allow a node to repel a set of pods.
Tolerations are applied to pods, and allow (but do not require) the pods to schedule onto
nodes with matching taints.
Taints and tolerations work together to ensure that pods are not scheduled onto inappropriate
nodes. One or more taints are applied to a node; this marks that the node should not accept
any pods that do not tolerate the taints.
In this Lab, you will learn below items:

Objective:

• Taint Nodes
• View Taints
• Create Tolerations
• Remove Taints
• Cleanup

Note: Ensure you have running cluster deployed

1. Ensure that you have logged-in as root user with password as linux on kube-master node.

1.1 Let us taint the nodes to noschedule, by executing the below command.

# kubectl taint node kube-master kube-node1 kube-node2

myKey=myValue:NoSchedule

Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
1.2 Let us verify the taint applied to nodes, by executing the below command.

# kubectl describe node kube-master kube-node1 kube-node2 |

egrep "Name:|Taints:"

Output:

1.3 Let us create a pod with out any toleration, by executing the below command.

kubectl create deployment nginx --image=nginx

Output:

1.4 Let us verify the pod details, by executing the below command.

# kubectl get pods -o wide

Output:

1.5 Let us retrieve the events, by executing the below command.

# kubectl describe pods | grep Events -A 10

Output:

Note: It tells us that the POD could not find a node without taint that it didn’t tolerate.

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
1.6 Let us remove the taint from the kube-master node, by executing the below command.

# kubectl taint node kube-master myKey=myValue:NoSchedule-

Output:

1.7 Let us verify if the pod is running on the kube-master node, by executing the below
command.

# kubectl get pods -o wide

Output:

1.8 Let us remove the taints from worker nodes as well, by executing the below command.

# kubectl taint node kube-node1 kube-node2 myKey-

Output:

1.9 Let us verify if the POD is still running on the Master

# kubectl get pods -o wide

Output:

Note: The existing PODs will still be running on the kube-master.

1.10 Let us add the pod by Scaling the Deployment, by executing the below command.

# kubectl scale deployment nginx --replicas=3

Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
1.11 Let us verify the Pods are scaled and placed on different nodes.

# kubectl get pods -o wide

Output:

1.12 Let us delete the nginx deployment, by executing the below command.

# kubectl delete deployment nginx

Output:

2. Tolerate Taints

Let see how PODs can be configured to tolerate a taint, i.e. we will configure the PODs to be scheduled
on a node, even if the node has a taint.

2.1 Let us add Taint to worker nodes, by executing the below command.

# kubectl taint node kube-node1 kube-node2 myKey=myValue:NoSchedule

Output:

2.2 Let us clone the git repository which contains manifests required for this exercise, by executing the
below command.

# git clone https://github.com/EyesOnCloud/k8s-taints.git

Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
2.3 Let us view the manifest to create PODs with taint toleration.

# cat -n ~/k8s-taints/pod-tolerations.yaml
Output:

2.4 Let us create the pod, by executing the below command.

# kubectl create -f ~/k8s-taints/pod-tolerations.yaml

Output:

2.5 Let us verify the pod details, by executing the below command.

# kubectl get pods -o wide

Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
Note: Even though worker nodes are tainted, the 5 PODs are distributed among worker nodes.

2.6 Let us delete the pods, by executing the below command.

# kubectl delete -f ~/k8s-taints/pod-tolerations.yaml
Output:

2.7 Let us change toleration value, by executing the below command.

# sed -i 's/myValue/OtherValue/g' ~/k8s-taints/pod-tolerations.yaml

2.8 Let us create the pods, by executing the below command.

# kubectl create -f ~/k8s-taints/pod-tolerations.yaml

Output:

2.9 Let us verify the pod details, by executing the below command

# kubectl get pods -o wide

Output:

2.10 Let us check the taint on the worker node and verify that toleration does not match the taint of
worker nodes

# kubectl describe nodes kube-node1 kube-node2 | egrep

"Name:|Taints:"
Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
Note: This is the reason, all the pods running on worker nodes are migrated to kube-master

2.11 Let us delete nginx-deployment, by executing the below command.

# kubectl delete deployment nginx-deployment

Output:

3. Let us migrate running PODs from a Nodes that are already running on a node by applying a taint
with “NoExecute“effect on the node.

# kubectl describe nodes kube-master kube-node1 kube-node2 | egrep

"Name:|Taints:"

Output:

3.1 Let us remove taint on worker nodes, by executing the below command.

# kubectl taint node kube-node1 kube-node2

myKey=myValue:NoSchedule-
Output:

3.2 Let us Run PODs without any Toleration

# kubectl create deploy nginx --image=nginx

Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
3.3 Let us verify the pod, by executing the below command.

# kubectl get pod -o wide

Output:

3.4 Let us add NoSchedule taint on the master and NoExecute taint on worker nodes

# kubectl taint node kube-master myKey=myValue:NoSchedule

Output:

# kubectl taint node kube-node1 kube-node2 myKey=myValue:NoExecute

Output:

3.5 Verify that the PODs running on kube-node2 are terminated and placed in pending state.

# kubectl get pods

Output:

Note:A taint with “NoExecute“ effect will terminate any running POD that has no matching toleration

3.6 The POD is pending since it cannot find a node without taint

# kubectl describe pods nginx-6799fc88d8-zjtkc | grep -A 10 Events

Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/
3.7 Let us remove the taint of the kube-master, by executing the below command.

# kubectl taint node kube-master myKey=myValue:NoSchedule-

Output:

3.8 Let us list the pod, by executing the below command.

# kubectl get pods -o wide

Output:

3.9 Let us remove the taint of the Worker nodes, by executing the below command.

# kubectl taint node kube-node1 kube-node2 myKey=myValue:NoExecute-

Output:

4. Let us cleanup, by executing the below command.

# kubectl delete deployment nginx

Output:

4.1 Let us verify there are no taints on any nodes, by executing the below command.

# kubectl describe node kube-master kube-node1 kube-node2 |

egrep "Name:|Taints:"
Output:

Student Material – Do Not Re-distribute. For any queries contact:

naushad.p.tech@gmail.com or https://www.linkedin.com/in/naushadpasha/