How do taints and tolerations work in Kubernetes, and in what scenarios do you use them?

In Kubernetes, taints and tolerations are used to control on which nodes pods can be scheduled.

Taints are labels on nodes that prevent pods from being scheduled on them unless the pod has a matching toleration. It's a kind of "prohibition" on placement.

Tolerations are properties of a pod that allow it to "tolerate" (ignore) taints and be scheduled on such nodes.

How it works

• If a node has a taint, for example key=value:NoSchedule, then pods without a matching toleration with the same key and value will not be scheduled on that node.
• If a pod contains a toleration that matches a taint, it can be scheduled on that node.

Use cases

• Node isolation: for example, dedicating nodes for special tasks (e.g., GPU, high-performance, or restricted access).
• Protection of system nodes: tainting system nodes so that regular pods are not scheduled there.
• Failure handling: temporarily tainting a node to prevent new pods from being scheduled on it during maintenance.

Example of a taint:

kubectl taint nodes node1 key=value:NoSchedule

Example of toleration in a pod manifest:

tolerations:
- key: "key"
  operator: "Equal"
  value: "value"
  effect: "NoSchedule"

Thus, taints and tolerations allow flexible management of pod placement and ensure necessary isolation and resource control.