DevOps Bootcamp · Lesson

Taints and Tolerations

Prevent Pods from being scheduled on specific nodes using taints and allow certain Pods to tolerate them.

Taints and Tolerations is a free DevOps Bootcamp lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What are Taints?

Imagine you have special nodes in your Kubernetes cluster, perhaps with specific hardware like GPUs, or reserved for certain workloads. You wouldn't want just any Pod to land there, right?

This is where Taints come in! A Taint is a property applied to a node that prevents Pods from being scheduled on it, unless those Pods explicitly "tolerate" that taint.

Reasons to Use Taints

Taints are super useful for managing where Pods run:

Dedicated Nodes: Reserve nodes for specific teams or applications.
Special Hardware: Isolate nodes with GPUs or high-performance SSDs for Pods that need them.
Maintenance: Mark a node for maintenance, preventing new Pods from being scheduled there temporarily.

How Taints Work

Think of a Taint as a "no trespassing" sign on a node. A Pod can only ignore this sign if it has a matching "permit" called a Toleration.

A Taint consists of a key, a value, and an effect. For example: key=value:effect.

Understanding Taint Effects

The "effect" part of a Taint tells Kubernetes what to do with Pods that don't tolerate it. There are three main effects:

NoSchedule
PreferNoSchedule
NoExecute

Let's look at each one.

Taint Effect: NoSchedule

The NoSchedule effect is the strictest. If a node has a taint with NoSchedule, no Pod will be scheduled on that node unless it has a matching toleration.

Existing Pods already running on the node are NOT affected by a new NoSchedule taint.

Taint Effect: PreferNoSchedule

PreferNoSchedule is a "soft" version of NoSchedule. Kubernetes will try its best to avoid scheduling Pods on a tainted node, but it's not a hard requirement.

If there are no other suitable nodes, a Pod might still be scheduled on a PreferNoSchedule tainted node, even without a toleration.

Taint Effect: NoExecute

The NoExecute effect is unique because it affects *already running* Pods. If a node has a NoExecute taint:

Pods without a matching toleration are *immediately evicted*.
New Pods without a matching toleration cannot be scheduled.

This is often used for draining nodes or handling node failures.

Introducing Tolerations

While Taints are applied to nodes, Tolerations are applied to Pods. A Pod's toleration allows it to be scheduled on a node that has a matching taint.

Without a matching toleration, a Pod cannot (or prefers not to) be scheduled on a tainted node.

Tolerations in Pod Manifests

You define tolerations within a Pod's YAML manifest, under the spec section. Here's how a Pod tolerates a taint with key=value:NoSchedule:

apiVersion: v1
kind: Pod
metadata:
  name: my-tolerated-pod
spec:
  containers:
  - name: nginx
    image: nginx
  tolerations:
  - key: "special-purpose"
    operator: "Equal"
    value: "gpu"
    effect: "NoSchedule"

How Taints & Tolerations Match

For a Pod to be scheduled on a tainted node, its toleration must match the node's taint. The match involves:

Key: Must be the same.
Value: Must be the same if operator: Equal.
Effect: Must be the same.
Operator: Can be Equal or Exists (meaning any value for the key).

A special toleration key: "" operator: Exists tolerates *any* taint.

Quick Check: Taints

A node has the taint env=production:NoSchedule. Which Pod configuration would allow it to be scheduled on this node?

Recap: Taints & Tolerations

You've learned about Taints and Tolerations!

Taints are applied to nodes to repel Pods.
Tolerations are applied to Pods to allow them to be scheduled on tainted nodes.
Key taint effects are NoSchedule, PreferNoSchedule, and NoExecute.
Tolerations must match the taint's key, value, and effect for a Pod to be scheduled.

These tools give you fine-grained control over Pod placement!

Frequently asked questions

Is the “Taints and Tolerations” lesson free?

Yes — the full text of “Taints and Tolerations” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Taints and Tolerations”?

Prevent Pods from being scheduled on specific nodes using taints and allow certain Pods to tolerate them. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Taints and Tolerations” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to DevOps Bootcamp