CKAD field manual
Kubernetes node drain example
A node takes Pods until you mark it, taint it, or cordon it. drain moves the workloads off. uncordon opens it again.
kubectl get nodes
kubectl describe node node-1
kubectl label node node-1 disk=ssd
kubectl label node node-1 disk-
kubectl taint node node-1 dedicated=batch:NoSchedule
kubectl taint node node-1 dedicated=batch:NoSchedule-
kubectl cordon node-1
kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data
kubectl uncordon node-1
spec:
nodeSelector:
disk: ssd
tolerations:
- key: dedicated
operator: Equal
value: batch
effect: NoSchedule
Fields
- kubectl get
- STATUS Ready,SchedulingDisabled means cordoned and still healthy. The name in the first column is what drain takes.
- kubectl describe
- Taints, labels, and conditions are on the node. Allocated resources explains a Pending Pod.
- kubectl label
- key=value sets it. key- removes it. The trailing minus is the removal. A Pod nodeSelector requires the key.
- kubectl taint
- key=value:NoSchedule adds it. The same spec with a trailing minus removes it. key, value, and effect all have to match.
- kubectl cordon
- Marks the node unschedulable. Pods already running stay. New Pods go elsewhere.
- kubectl drain
- Cordons, then evicts. --ignore-daemonsets skips DaemonSet Pods. --delete-emptydir-data drops emptyDir data.
- kubectl uncordon
- Clears the unschedulable mark. A taint you added is still there.
- nodeSelector
- Exact labels on the node. The Pod stays Pending until the node carries every key.
- tolerations
- Lets this Pod onto a tainted node. operator Exists ignores the value. The effect has to match the taint.
Watch
- cordon marks the node unschedulable and leaves running Pods in place. drain cordons, then evicts. uncordon clears that mark and leaves any taint you added yourself.
- drain stops when a DaemonSet Pod is present, unless you pass --ignore-daemonsets. It stops for emptyDir data unless you pass --delete-emptydir-data. That flag deletes the emptyDir contents.
- NoSchedule blocks new Pods without a matching toleration. NoExecute also evicts Pods that lack one. A NoSchedule taint on the only node leaves new Pods Pending.
- kubectl label node node-1 disk- removes the label. A Pod nodeSelector disk: ssd runs only on a node that has it. The taint removal is the same spec with a trailing minus, and the key, value, and effect must match.
Official docs Drain a node Taints and Tolerations