Taints and Tolerations vs Node Affinity

​

Scenario

• A cluster contains many nodes and pods from multiple teams.
• We have three color-specific nodes and three pods: blue, red, and green.
• Goal: schedule the blue pod on the blue node, the red pod on the red node, and the green pod on the green node.
• Additional requirement: prevent other teams’ pods from being scheduled onto our three color-specific nodes, and prevent our pods from being scheduled onto other (non-colored) nodes.

​

First approach — Taints and Tolerations

kubectl taint nodes node-blue color=blue:NoSchedule

apiVersion: v1
kind: Pod
metadata:
  name: pod-blue
spec:
  containers:
  - name: nginx
    image: nginx
  tolerations:
  - key: "color"
    operator: "Equal"
    value: "blue"
    effect: "NoSchedule"

• The blue pod can be scheduled on the blue node because it tolerates the blue taint.
• Tolerations only allow placement on tainted nodes; they do not force placement onto specific nodes.
• A pod with the toleration may still be scheduled onto any other node that meets scheduling constraints (including untainted nodes).
• Therefore, taints + tolerations alone do not guarantee that pods will end up only on the intended labeled nodes.

​

Second approach — Node Affinity

kubectl label node node-blue color=blue
kubectl label node node-red  color=red
kubectl label node node-green color=green

apiVersion: v1
kind: Pod
metadata:
  name: pod-blue
spec:
  containers:
  - name: nginx
    image: nginx
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: color
            operator: In
            values:
            - blue

• Required node affinity forces the pod to be scheduled only on nodes whose labels satisfy the rule (e.g., nodes labeled color=blue).
• Node affinity alone does not prevent other pods from being scheduled onto the same nodes. Other teams’ pods can still land on the blue node unless they are repelled.

​

Recommended approach — Combine Taints/Tolerations with Node Affinity

• Taint each color node to repel all pods that do not tolerate that taint.
• Label each node with its color.
• Add a toleration to only the corresponding color pod so it can be scheduled onto the tainted node.
• Use required node affinity in the pod spec so the pod can only schedule onto the correctly labeled node.

1. Taint the node:

kubectl taint nodes node-blue color=blue:NoSchedule

2. Label the node:

kubectl label node node-blue color=blue

3. Pod spec includes both tolerations and required node affinity:

apiVersion: v1
kind: Pod
metadata:
  name: pod-blue
spec:
  containers:
  - name: nginx
    image: nginx
  tolerations:
  - key: "color"
    operator: "Equal"
    value: "blue"
    effect: "NoSchedule"
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: color
            operator: In
            values:
            - blue

• The taint prevents unrelated pods (without the matching toleration) from being scheduled onto the node.
• The pod’s toleration allows it to be scheduled onto the tainted node.
• The pod’s required node affinity forces it to target the specifically labeled node.
• Together, this creates an effectively dedicated node for that pod (repeat same configuration for red and green).

​

Comparison at a glance

​

Links and references

• Kubernetes Scheduling: Taints and Tolerations — https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
• Kubernetes Scheduling: Node Affinity — https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity