Taints & tolerations
Repelling pods from nodes, and opting back in.
In plain terms
A taint is a “wet paint — keep off” sign on a node. A toleration is the one worker allowed to sit there anyway. It’s how you reserve special benches for the people who belong on them.
Taints and tolerations are the repel mechanism. A taint on a node says “keep pods off unless they explicitly tolerate this.” It is how you reserve nodes — GPU hardware, or the control plane — for the workloads that belong on them.
terminal
# taint a node so only tolerating pods may land$ kubectl taint node gpu-1 workload=gpu:NoSchedule# the pod opts in with a matching toleration:# spec:# tolerations:# - { key: workload, operator: Equal, value: gpu, effect: NoSchedule }
The three effects escalate: NoSchedule blocks new pods, PreferNoSchedule merely avoids, and NoExecute also evicts already-running pods that do not tolerate it. Control-plane nodes carry a NoSchedule taint by default — which is precisely why your workloads never land on them.
Tolerating is not attracting
A toleration only permits a pod onto a tainted node; it does not send it there. To pull pods toward specific nodes you also need node affinity — the next topic.