World map

 

BM

World K5: Lunch Rush

Taints, tolerations and spread

You will learn: how to lock a stall, give some trays the key, and spread trays out.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

Stall dev-worker2 has the big oven. It is for oven dishes only. But shop trays keep landing there. How do you keep them out?

Watch

You are here: cluster kind-dev namespace default

A taint: A lock on a stall. Trays without the key stay away. is a lock on a stall. This one came from kubectl taint nodes dev-worker2 oven=big:NoSchedule. All shop trays went to dev-worker.

Try it

A toleration: A key on a tray. It opens a stall's lock, but does not pull the tray there. is the key, carried by the tray. Hand the oven key to oven-tray. Then place every tray.

Tap a tray, then tap a stall. Or drag the tray.

Waiting trays

Keys (tolerations)

  • stall-a
    CPU 0 of 2
    Memory 0Mi of 4Gi
    • oven-stall
      oven=big oven=big:NoSchedule
      CPU 0 of 2
      Memory 0Mi of 4Gi
      • Pending

        Trays that fit on no stall wait here.

        Predict

        A tray has the oven key, but no sign (no nodeSelector). Where can it land?

        Try it

        oven.yaml has both: the key and the sign. Apply it. Then check which stall it chose.

        You are here: cluster kind-dev namespace default
        dev-control-planeOpenManager

        No trays here.

        dev-workerOpen
        • shop·bcbf7
        • shop·tbgr4
        • shop·w6dzr
        dev-worker2Open

        No trays here.

        Time: +0s (sped up)

        Watch

        Don’t put all trays in one stall. topology spread: Spread trays across stalls, so one closing stall hurts less. keeps stalls even. maxSkew: 1 means stall counts differ by 1 at most. 4 trays, 2 stalls: which split is allowed?

        In YAML, inside the pod template:

        topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: kubernetes.io/hostname
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels: { app: shop }

        Check

        True or not? Sort each sentence.

        Drag a card into a box. Or tap the card, then tap the box.

            You did it!

            You can now lock a stall, hand out keys, and spread trays out.

            Go deeper (optional)

            Effects: NoSchedule, PreferNoSchedule (try to avoid) and NoExecute (also evicts). A minus at the end removes a taint: kubectl taint nodes dev-worker2 oven=big:NoSchedule-. With whenUnsatisfiable: DoNotSchedule, spread becomes a hard rule. Then a locked stall can still count as a domain. Read the docs before you use it.

            Real rep (optional): taint a kind worker, then remove it again.