Taints and Tolerations
Prevent Pods from being scheduled on specific nodes using taints and allow certain Pods to tolerate them.
Taints and Tolerations is a free DevOps Bootcamp lesson on CoddyKit. This is lesson 3 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, and your progress syncs across the web and the CoddyKit app. The DevOps Bootcamp course includes 4 lessons in total.
What are Taints?
Imagine you have special nodes in your Kubernetes cluster, perhaps with specific hardware like GPUs, or reserved for certain workloads. You wouldn't want just any Pod to land there, right?
This is where Taints come in! A Taint is a property applied to a node that prevents Pods from being scheduled on it, unless those Pods explicitly "tolerate" that taint.
Reasons to Use Taints
Taints are super useful for managing where Pods run:
- Dedicated Nodes: Reserve nodes for specific teams or applications.
- Special Hardware: Isolate nodes with GPUs or high-performance SSDs for Pods that need them.
- Maintenance: Mark a node for maintenance, preventing new Pods from being scheduled there temporarily.
How Taints Work
Think of a Taint as a "no trespassing" sign on a node. A Pod can only ignore this sign if it has a matching "permit" called a Toleration.
A Taint consists of a key, a value, and an effect. For example: key=value:effect.
Understanding Taint Effects
The "effect" part of a Taint tells Kubernetes what to do with Pods that don't tolerate it. There are three main effects:
NoSchedulePreferNoScheduleNoExecute
Let's look at each one.
Taint Effect: NoSchedule
The NoSchedule effect is the strictest. If a node has a taint with NoSchedule, no Pod will be scheduled on that node unless it has a matching toleration.
Existing Pods already running on the node are NOT affected by a new NoSchedule taint.
Taint Effect: PreferNoSchedule
PreferNoSchedule is a "soft" version of NoSchedule. Kubernetes will try its best to avoid scheduling Pods on a tainted node, but it's not a hard requirement.
If there are no other suitable nodes, a Pod might still be scheduled on a PreferNoSchedule tainted node, even without a toleration.
Taint Effect: NoExecute
The NoExecute effect is unique because it affects *already running* Pods. If a node has a NoExecute taint:
- Pods without a matching toleration are *immediately evicted*.
- New Pods without a matching toleration cannot be scheduled.
This is often used for draining nodes or handling node failures.
Introducing Tolerations
While Taints are applied to nodes, Tolerations are applied to Pods. A Pod's toleration allows it to be scheduled on a node that has a matching taint.
Without a matching toleration, a Pod cannot (or prefers not to) be scheduled on a tainted node.
Tolerations in Pod Manifests
You define tolerations within a Pod's YAML manifest, under the spec section. Here's how a Pod tolerates a taint with key=value:NoSchedule:
apiVersion: v1
kind: Pod
metadata:
name: my-tolerated-pod
spec:
containers:
- name: nginx
image: nginx
tolerations:
- key: "special-purpose"
operator: "Equal"
value: "gpu"
effect: "NoSchedule"How Taints & Tolerations Match
For a Pod to be scheduled on a tainted node, its toleration must match the node's taint. The match involves:
- Key: Must be the same.
- Value: Must be the same if
operator: Equal. - Effect: Must be the same.
- Operator: Can be
EqualorExists(meaning any value for the key).
A special toleration key: "" operator: Exists tolerates *any* taint.
Quick Check: Taints
A node has the taint env=production:NoSchedule. Which Pod configuration would allow it to be scheduled on this node?
Recap: Taints & Tolerations
You've learned about Taints and Tolerations!
- Taints are applied to nodes to repel Pods.
- Tolerations are applied to Pods to allow them to be scheduled on tainted nodes.
- Key taint effects are
NoSchedule,PreferNoSchedule, andNoExecute. - Tolerations must match the taint's key, value, and effect for a Pod to be scheduled.
These tools give you fine-grained control over Pod placement!
Learn DevOps Bootcamp with an AI tutor — free
Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.
- Courses
- 142
- Lessons
- 568
Frequently Asked Questions
Is the “Taints and Tolerations” lesson free?
Yes — any 3 lessons of the DevOps Bootcamp learning path, including “Taints and Tolerations”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The DevOps Bootcamp course includes 4 lessons in total.
What will I learn in “Taints and Tolerations”?
Prevent Pods from being scheduled on specific nodes using taints and allow certain Pods to tolerate them. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.
How long does the “Taints and Tolerations” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Resource Requests and Limits
- Node Selectors and Affinity
- Taints and Tolerations
- Pod Priority and Preemption