What are taints and tolerations in Kubernetes?
Learn how Kubernetes taints and tolerations control pod scheduling: NoSchedule, PreferNoSchedule and NoExecute effects, and how they differ from node affinity.
Expected Interview Answer
Taints are markers placed on nodes that repel pods, and tolerations are properties on pods that let them be scheduled onto tainted nodes; together they control which pods are allowed to land on which nodes.
A taint has a key, value, and effect (NoSchedule, PreferNoSchedule, or NoExecute). By default a taint repels all pods unless a pod carries a matching toleration. NoSchedule blocks new pods, PreferNoSchedule is a soft avoidance, and NoExecute both blocks and evicts existing pods that don't tolerate it. Taints/tolerations only repel — they don't attract; use node affinity if you also want to pull pods toward specific nodes, for example to dedicate GPU nodes or isolate control-plane nodes.
- Reserve nodes for specific workloads (e.g. GPU or dedicated tenants)
- Keep general workloads off control-plane nodes
- Evict pods automatically from unhealthy nodes via NoExecute
- Combine with node affinity for precise placement
- Prevent noisy-neighbour pods from crowding sensitive nodes
AI Mentor Explanation
Think of a specialist practice net reserved for fast bowlers. A taint is the sign on the net that says keep out; a toleration is the fast-bowler pass that lets those players in. Batters without the pass are turned away, so the net stays free for the bowlers it was set aside for, while anyone holding the pass is allowed to train there.
Step-by-Step Explanation
Step 1
Taint the node
Apply a taint with kubectl taint nodes <node> key=value:Effect, choosing NoSchedule, PreferNoSchedule, or NoExecute.
Step 2
Understand the effect
NoSchedule blocks new pods; PreferNoSchedule softly avoids; NoExecute blocks and evicts non-tolerating pods.
Step 3
Add a toleration
In the pod spec, add a tolerations entry matching the taint's key, value, and effect (with an operator of Equal or Exists).
Step 4
Schedule respects the match
Only pods with a matching toleration can land on the tainted node; all others are repelled.
Step 5
Pair with affinity if needed
Add node affinity to actively attract tolerating pods to those nodes, since tolerations alone only permit, not attract.
What Interviewer Expects
- That taints repel pods and tolerations permit them
- Knowing the three effects: NoSchedule, PreferNoSchedule, NoExecute
- That NoExecute evicts already-running pods
- The distinction from node affinity (repel vs attract)
- A real use case such as dedicating GPU or control-plane nodes
Common Mistakes
- Thinking a toleration forces a pod onto a node (it only permits)
- Confusing taints/tolerations with node affinity
- Forgetting NoExecute evicts running pods
- Mismatching the key, value, or effect between taint and toleration
- Assuming a toleration alone attracts pods to the node
Best Answer (HR Friendly)
“Taints are like a reserved sign a node puts up to keep most workloads away, and tolerations are the special pass a workload carries to be allowed onto that reserved node. Teams use them to set aside certain machines for specific jobs, like keeping general apps off the cluster's control-plane servers.”
Code Example
# Repel all pods that don't tolerate this taint
kubectl taint nodes gpu-node-1 dedicated=gpu:NoSchedule
# Evict non-tolerating pods too
kubectl taint nodes bad-node hardware=failing:NoExecute
# Remove a taint (note the trailing dash)
kubectl taint nodes gpu-node-1 dedicated=gpu:NoSchedule-apiVersion: v1
kind: Pod
metadata:
name: gpu-job
spec:
tolerations:
- key: "dedicated"
operator: "Equal"
value: "gpu"
effect: "NoSchedule"
containers:
- name: trainer
image: myorg/trainer:1.0
resources:
limits:
nvidia.com/gpu: 1Follow-up Questions
- What is the difference between taints/tolerations and node affinity?
- What does the NoExecute effect do to running pods?
- How does tolerationSeconds work with NoExecute?
- How does Kubernetes use built-in taints for node conditions like not-ready?
- How would you dedicate a node pool to a single team?
MCQ Practice
1. What does a taint do to a node?
A taint repels pods unless they carry a matching toleration.
2. Which taint effect evicts already-running pods that don't tolerate it?
NoExecute both blocks scheduling and evicts existing non-tolerating pods.
3. Does adding a toleration guarantee a pod runs on a tainted node?
Tolerations only allow scheduling onto a tainted node; they do not pull the pod toward it.
Flash Cards
What is a taint? — A marker on a node that repels pods unless they tolerate it.
What is a toleration? — A pod property that lets it be scheduled onto a node with a matching taint.
Three taint effects? — NoSchedule, PreferNoSchedule, NoExecute.
What does NoExecute add over NoSchedule? — It also evicts already-running pods that don't tolerate the taint.
Taints vs node affinity? — Taints repel (opt-out); affinity attracts (opt-in). Tolerations only permit, not attract.