🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🎫 धडा 20 — Taints, tolerations आणि affinity: ठरवून दिलेली बैठक

📍 तुम्ही इथे आहात: धडा 20 / 26 · मागील: lesson-19-network-policies · पुढील: lesson-21-daemonsets

📦 या ब्रँचमध्ये काय आहे

आधीचे सगळे, आणि प्रत्येक pod कोणत्या बाकावर बसेल ते ठरवणे: taints ने दूर लोटा, tolerations ने परवानगी द्या, affinity ने आकर्षित करा, anti-affinity ने वेगळे करा.

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

आत्तापर्यंत वेळापत्रक बनवणारा मुलांना कोणत्याही मोकळ्या बाकावर बसवत असे. खऱ्या शाळांमध्ये बसण्याचे नियम असतात — दोन प्रकारचे:

बाकांवरच्या, मुलांना दूर लोटणाऱ्या पाट्या 🚫 (taints): शिक्षिकेच्या बाकावर पाटी आहे: "विद्यार्थ्यांसाठी नाही!" तिथे कोणतेही मूल बसू शकत नाही… जोपर्यंत त्याच्याकडे जुळणारी परवानगीची चिठ्ठी 🎫 (toleration) नाही. याच पद्धतीने Kubernetes साधे pods खास nodes पासून दूर ठेवते: GPU बाक (gpu=true:NoSchedule — फक्त ML pods कडे चिठ्ठी असते), नाहीसे होऊ शकणारे spot बाक (तिथे फक्त व्यत्यय सहन करणारे pods बसतात — धडा 15!), आणि आजारी बाक (NoExecute आधीच बसलेल्या मुलांनाही बाहेर काढतो).

मुलांवरच्या, त्यांना कुठे बसायचे आहे त्याबद्दलच्या नोंदी 🧲 (affinity):

"मला GPU असलेला बाक हवा" — nodeSelector / nodeAffinity (required = कडक नियम; preferred = तीव्र इच्छा).
"मला माझ्या जुळ्याशेजारी बसवू नका" — podAntiAffinity: दोन school-api copies वेगवेगळ्या बाकांवर, म्हणजे एक बाक मेला तरी दोन्ही जाणार नाहीत. (त्याचा सौम्य चुलत भाऊ topologySpreadConstraints — धडा 15 — इमारतींमध्ये पसरवतो; anti-affinity बाकांमध्ये वेगळे करते.)

बाकाकडून ढकलणे, मुलाकडून ओढणे. Taints इच्छांवर मात करतात: चिठ्ठी नाही, तर जागा नाही, कधीच.

🗺️ आकृती

flowchart TB
    subgraph desks["🖥️ the desks"]
        gpu["GPU desk 💎<br/>taint: gpu=true:NoSchedule"]
        spot["spot desk 🎟️<br/>taint: spot=true:NoSchedule"]
        norm["normal desks"]
    end
    ml["🤖 ML pod<br/>toleration: gpu 🎫<br/>+ nodeAffinity: WANTS gpu"]
    web["🪑 school-api ×2<br/>podAntiAffinity:<br/>never both on one desk"]
    other["🪑 ordinary pod<br/>no chit"]
    ml -->|"1 allowed + attracted"| gpu
    other -.->|"2 repelled ❌"| gpu
    other --> norm
    web -->|"3 spread across desks"| norm

❓ काय

Taint (node वर): key=value:Effect. Effects: NoSchedule (कडक), PreferNoSchedule (सौम्य), NoExecute (बाहेरही काढतो — k8s स्वतः वापरतो: node.kubernetes.io/unreachable वगैरे, याच मार्गाने pods मेलेल्या nodes वरून निघतात, आणि tolerationSeconds हा सवलतीचा timer).
Toleration (pod वर): "ही पाटी मला लागू नाही". Tolerate करणे ≠ लक्ष्य करणे — pod ने तिथेच उतरले पाहिजे असेल तर nodeAffinity सुद्धा जोडा.
nodeAffinity: node labels वर requiredDuringScheduling… (कडक) / preferredDuringScheduling… (वजन दिलेली इच्छा).
podAffinity / podAntiAffinity: labels जुळणाऱ्या pods जवळ / पासून दूर मला बसवा, एका topologyKey मध्ये (hostname = बाक, zone = इमारत). Replicas साठी kubernetes.io/hostname वर anti-affinity ही क्लासिक HA चाल आहे.
EKS मधले वास्तव: node groups ना Terraform मध्ये labels/taints मिळतात (labels = { pool = "spot" }, taint { … }) — बसण्याची policy code म्हणून.

🤔 का

एकसारख्या बाकांचा एकच pool, ज्या दिवशी तुम्ही GPUs, spot instances, किंवा latency-sensitive API शेजारी गोंगाट करणारा batch workload जोडता, त्या दिवशी चालणे बंद होतो. बसण्याच्या नियमांमुळेच एकच cluster वेगवेगळी अर्थव्यवस्था (spot vs on-demand), वेगवेगळे hardware, आणि एकमेकांना त्रास देणारे tenants सांभाळू शकतो — वेगळ्या शाळा विकत न घेता.

🧪 करून पाहा

NODE=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')

# put a "wet paint" sign on the desk:
kubectl taint node $NODE wetpaint=true:NoSchedule

# ordinary pod → Pending (lesson 16 drill: describe tells you exactly why!)
kubectl -n school run nochit --image=nginxdemos/hello:plain-text
kubectl -n school describe pod nochit | grep -A3 Events | tail -3

# pod WITH the chit → seated happily:
kubectl -n school run haschit --image=nginxdemos/hello:plain-text \
  --overrides='{"spec":{"tolerations":[{"key":"wetpaint","operator":"Equal","value":"true","effect":"NoSchedule"}]}}'
kubectl -n school get pods -o wide | grep chit

# clean the sign and the kids:
kubectl taint node $NODE wetpaint=true:NoSchedule-
kubectl -n school delete pod nochit haschit

🔧 या धड्यासाठी kubectl

kubectl taint · kubectl describe node (Taints) · kubectl get pods -o wide

🔗 यावर आधारित: 🪪 AWS L08 (instance types — GPU बाक)

✅ तपासा — तुम्हाला काय दिसले पाहिजे

साधा pod tainted node वर Pending राहतो; toleration + affinity असलेला pod त्यावर जाऊन बसतो.

🧹 साफसफाई

kubectl taint nodes NODE gpu- (वजा चिन्ह काढून टाकते)

⚠️ नेहमीच्या चुका

प्रत्येक node ला taint करून, काहीच schedule का होत नाही असा विचार करणे
nodes पेक्षा जास्त replicas सह required anti-affinity — कायम Pending

⏭️ पुढे

काही मदतनीस प्रत्येक मजल्यावर बसलेच पाहिजेत, अपवाद नाही — log collectors, node agents: DaemonSets.

git checkout lesson-21-daemonsets

🎫 Lesson 20 — Taints, tolerations & affinity: assigned seating

📍 You are here: Lesson 20 of 26 · Previous: lesson-19-network-policies · Next: lesson-21-daemonsets

📦 What's in this branch

Everything before, plus steering WHICH desk each pod sits at: repel with taints, permit with tolerations, attract with affinity, separate with anti-affinity.

🧒 Explain like I'm 5

Until now the timetable-maker seated kids at any free desk. Real schools have seating rules — two kinds:

Signs on DESKS that push kids away 🚫 (taints): the teacher's desk has a sign: "not for students!" No kid may sit there… unless they carry a matching permission chit 🎫 (a toleration). That's how Kubernetes keeps normal pods off special nodes: GPU desks (gpu=true:NoSchedule — only ML pods carry the chit), spot desks that can vanish (only interruption-tolerant pods sit there — lesson 15!), and sick desks (NoExecute even evicts the kids already sitting).

Notes on KIDS about where they want to sit 🧲 (affinity):

"I need a desk with a GPU" — nodeSelector / nodeAffinity (required = hard rule; preferred = strong wish).
"Don't seat me next to my twin" — podAntiAffinity: the two school-api copies on different desks, so one desk dying can't take both. (Its softer cousin topologySpreadConstraints — lesson 15 — spreads across buildings; anti-affinity separates across desks.)

Push from the desk, pull from the kid. Taints beat wishes: no chit, no seat, ever.

🗺️ Diagram

flowchart TB
    subgraph desks["🖥️ the desks"]
        gpu["GPU desk 💎<br/>taint: gpu=true:NoSchedule"]
        spot["spot desk 🎟️<br/>taint: spot=true:NoSchedule"]
        norm["normal desks"]
    end
    ml["🤖 ML pod<br/>toleration: gpu 🎫<br/>+ nodeAffinity: WANTS gpu"]
    web["🪑 school-api ×2<br/>podAntiAffinity:<br/>never both on one desk"]
    other["🪑 ordinary pod<br/>no chit"]
    ml -->|"1 allowed + attracted"| gpu
    other -.->|"2 repelled ❌"| gpu
    other --> norm
    web -->|"3 spread across desks"| norm

❓ What

Taint (on node): key=value:Effect. Effects: NoSchedule (hard), PreferNoSchedule (soft), NoExecute (also evicts — used by k8s itself: node.kubernetes.io/unreachable etc., which is HOW pods leave dead nodes, with tolerationSeconds as the grace timer).
Toleration (on pod): "the sign doesn't apply to me". Tolerating ≠ targeting — add nodeAffinity too if the pod must LAND there.
nodeAffinity: requiredDuringScheduling… (hard) / preferredDuringScheduling… (weighted wish) on node labels.
podAffinity / podAntiAffinity: seat me near / away from pods matching labels, within a topologyKey (hostname = desk, zone = building). Anti-affinity on kubernetes.io/hostname for replicas is the classic HA move.
EKS reality: node groups get labels/taints in Terraform (labels = { pool = "spot" }, taint { … }) — seating policy as code.

🤔 Why

One pool of identical desks stops working the day you add GPUs, spot instances, or a noisy batch workload next to a latency-sensitive API. Seating rules are how ONE cluster hosts different economics (spot vs on-demand), different hardware, and mutually-annoying tenants — without buying separate schools.

🧪 Try it

NODE=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')

# put a "wet paint" sign on the desk:
kubectl taint node $NODE wetpaint=true:NoSchedule

# ordinary pod → Pending (lesson 16 drill: describe tells you exactly why!)
kubectl -n school run nochit --image=nginxdemos/hello:plain-text
kubectl -n school describe pod nochit | grep -A3 Events | tail -3

# pod WITH the chit → seated happily:
kubectl -n school run haschit --image=nginxdemos/hello:plain-text \
  --overrides='{"spec":{"tolerations":[{"key":"wetpaint","operator":"Equal","value":"true","effect":"NoSchedule"}]}}'
kubectl -n school get pods -o wide | grep chit

# clean the sign and the kids:
kubectl taint node $NODE wetpaint=true:NoSchedule-
kubectl -n school delete pod nochit haschit

🔧 kubectl for this lesson

kubectl taint · kubectl describe node (Taints) · kubectl get pods -o wide

🔗 Builds on: 🪪 AWS L08 (instance types — the GPU desk)

✅ Verify — what you should see

the ordinary pod stays Pending on the tainted node; the pod with the toleration + affinity lands on it.

🧹 Clean up

kubectl taint nodes NODE gpu- (minus removes)

⚠️ Common mistakes

tainting every node and wondering why nothing schedules
required anti-affinity with more replicas than nodes — Pending forever

⏭️ Next

Some helpers must sit on EVERY floor, no exceptions — log collectors, node agents: DaemonSets.

git checkout lesson-21-daemonsets

← Previousnetwork policies Next →daemonsets

This page is the lesson's README from the lesson-20-taints-affinity branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.