Taints and tolerations work together to control which pods land on which nodes. Taints go on nodes and repel pods. Tolerations go on pods and let them ignore specific taints.

Taint effects

There are three effects:

  • NoSchedule — pods without a matching toleration won’t be scheduled on the node. Existing pods are unaffected.
  • PreferNoSchedule — the scheduler avoids the node but will use it if there’s nowhere else.
  • NoExecute — pods without a matching toleration are evicted from the node and won’t be rescheduled there.

Applying taints

# Add a taint
kubectl taint nodes node1 example-key=example-value:NoSchedule

# Remove a taint
kubectl taint nodes node1 example-key=example-value:NoSchedule-

# Multiple taints at once
kubectl taint nodes node1 key1=value1:NoSchedule key2=value2:PreferNoSchedule

View taints on a node:

kubectl describe nodes node1

Tolerations in pod specs

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx
  tolerations:
  - key: "example-key"
    operator: "Exists"
    effect: "NoSchedule"

The operator field can be Equal (key and value must match exactly) or Exists (only the key must match, value is ignored).

Common use cases

Dedicated nodes — taint a node so only specific workloads run on it. Useful for GPU nodes or nodes handling sensitive data.

kubectl taint nodes gpu-node1 dedicated=gpu:NoSchedule

High-priority workloads — reserve nodes for critical pods by tainting them and only giving the critical pods the matching toleration.

Draining problematic nodes — taint a struggling node with PreferNoSchedule to stop new pods landing there, or NoExecute to evict existing pods and free resources.