Kubernetes · Orchestration under pressure
How do taints and tolerations control scheduling?
Short answer
Taints repel pods from nodes unless the pod has a matching toleration. Tolerations allow scheduling but do not guarantee it, and NoExecute also evicts running pods.
A taint is applied to a node and has an effect: NoSchedule blocks new pods without a toleration, PreferNoSchedule is a soft discouragement, and NoExecute evicts existing pods that do not tolerate it. A toleration matches on key, value and effect, with operators such as Equal and Exists.
- Taints keep workloads out; tolerations let specific workloads in
- A toleration is not a node selector; other pods can still schedule there unless tainted
- Use dedicated nodes with taints for GPUs, compliance or system workloads
- NoExecute eviction can be delayed with tolerationSeconds
- Tainting all nodes without tolerating system daemons can break cluster add-ons
tolerations:
- key: dedicated
operator: Equal
value: gpu
effect: NoSchedule
- key: node.kubernetes.io/not-ready
operator: Exists
effect: NoExecute
tolerationSeconds: 120The pairing that actually dedicates nodes is taint plus affinity or nodeSelector: taint keeps others out, and affinity keeps the intended workload on those nodes. Without the second half, a tolerating pod can land anywhere, and without the taint, other pods can consume the reserved capacity.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What is the difference between NoSchedule and NoExecute?
- 2Does a toleration guarantee the pod lands on the tainted node?
- 3How do you dedicate a node pool to one team?
- 4Why do DaemonSets need tolerations?
Say it in the interview
Taints repel pods and tolerations allow exceptions. NoSchedule blocks new placements, while NoExecute evicts running pods that do not tolerate the taint. A toleration alone does not pin a pod to that node, so for dedicated pools I combine taints with affinity or nodeSelector. I also tune tolerationSeconds carefully because it controls how long pods linger on unhealthy nodes.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Kubernetes mock interview and get scored feedback on depth, clarity and confidence.