[rootmaster1 workload]# kubectl get node node1.org -o yaml |grep taint -iA 10taints:effect: NoSchedulekey: studyvalue: nohardeffect: NoSchedulekey: titlevalue: srestatus:addresses:address: 192.168.3.63type: InternalIP复制代码复制代码[rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 2selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2 #注意此处labels和selector中label必须相同spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2复制代码kubectl apply -f controller-deployment2.yaml只调度到node2node1有污点不调度复制代码[rootmaster1 workload]# kubectl get pod -o wideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATEScontroller-deployment-demo-2-57ff4f59b-j8wmg 1/1 Running 0 30s 10.244.3.205 node2.orgcontroller-deployment-demo-2-57ff4f59b-sk8dt 1/1 Running 0 30s 10.244.3.206 node2.org[rootmaster1 workload]#复制代码Tolerations 容忍度属性Tolerations 是Pod上的属性Tolerations如下定义复制代码kubectl explain deployment.spec.template.spec.tolerationskubectl explain pod.spec.tolerationskey #被容忍的keyvalue #被容忍key的值,当operator为exists时,此value无需定义operator #Equal等值比较和 Exists 存在比较effect #可以容忍的节点的行为值,必须和Traint中的effect值相同或高于才能容忍tolerationSeconds #被驱逐的宽限时间默认是0就是立即被驱逐复制代码容忍度的判断方式在Pod对象上定义容忍度时它支持两种操作符operator一种是等值比较Equal表示Pod的容忍度与节点的污点必须在key、value和effect三者都完全匹配才可以容忍此为默认值一种是存在性判断Exists如果定义了key和effect表示只要存在key和effect二者相同时才容忍但不关注value就可容忍,必须不能定义valuekubectl get ds -n metallb-system -o yaml|grep -i -A 10 tolerations复制代码tolerations: - effect: NoSchedule key: node-role.kubernetes.io/master operator: Exists - effect: NoSchedule key: node-role.kubernetes.io/control-plane operator: Exists volumes: - name: memberlist secret: defaultMode: 420复制代码kubectl get node master1.org -o yaml|grep -i -A 10 taints复制代码[rootmaster1 ~]# kubectl get node master1.org -o yaml|grep -i -A 10 taintstaints:effect: NoSchedulekey: node-role.kubernetes.io/control-planestatus:addresses:address: 192.168.3.60type: InternalIPaddress: master1.orgtype: Hostnameallocatable:cpu: “2”复制代码如果只定义了effect并没有定义key表示指定effect的所有key都能容忍kubectl get ds -n kube-system kube-flannel -o yaml |grep -i -A10 tolerations复制代码tolerations: - effect: NoSchedule operator: Exists volumes: - hostPath: path: /run/flannel type: name: run - hostPath: path: /opt/cni/bin type: 复制代码如果key和effect都没有定义,表示容忍所有污点kubectl get ds -n kube-system kube-proxy -o yaml |grep -i -A3 tolerations:[rootmaster1 ~]# kubectl get ds -n kube-system kube-proxy -o yaml |grep -i -A3 tolerations:tolerations:- operator: Existsvolumes:- configMap:容忍度的匹配原则一个节点可以配置使用多个污点而一个Pod对象也可以有多个容忍度Kubernetes 处理多个污点和容忍度的过程就像一个过滤器从一个节点的所有污点开始遍历 过滤掉那些 Pod 中存在与之相匹配的容忍度的污点。余下未被过滤的污点的 effect 值决定了 Pod 是否会被分配到该节点一个节点上如果有多个污点Taint,对每个Taint 都需要容忍才能部署Pod将一个Pod对象的容忍度套用到特定节点的污点之上进行匹配度检测时将遵循如下逻辑遍历该节点的所有污点并过滤掉容忍度可匹配到的污点余下未被过滤掉的污点则由污点的effect来判定其满足状态对于剩余的不能匹配到容忍度的所有污点中若存在至少一个污点使用了NoSchedule效用标识则拒绝调度当前Pod至该节点对于不能匹配到容忍度的所有污点若都不具有NoSchedule效用标识但至少有一个污点使用了PreferNoScheduler效用标准则调度器会尽量避免将当前Pod对象调度至该节点如果至少有一个不能匹配容忍度的污点使用了NoExecute效用标识节点将立即驱逐当前Pod对象或者不允许该Pod调度至给定的节点而且即便容忍度可以匹配到使用了NoExecute效用标识的污点若在Pod上定义容忍度时同时使用tolerationSeconds属性定义了容忍时限则在超出时限后当前Pod也将会被节点所驱逐添加容忍度[rootmaster1 ~]# kubectl get deploymentNAME READY UP-TO-DATE AVAILABLE AGEcontroller-deployment-demo-2 2/2 2 2 9hExists并且没有key和value,可以容忍所有污点可以支持复制代码rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 2selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2tolerations:- operator: Exists复制代码kubectl apply -f controller-deployment2.yaml啥都可以容忍复制代码[rootmaster1 workload]# kubectl get pod -o wideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATEScontroller-deployment-demo-2-84458587c5-cczk4 1/1 Running 0 95s 10.244.1.202 node1.orgcontroller-deployment-demo-2-84458587c5-cm2zm 1/1 Running 0 95s 10.244.5.57 node3.orgcontroller-deployment-demo-2-84458587c5-kj794 1/1 Running 0 95s 10.244.0.56 master1.orgcontroller-deployment-demo-2-84458587c5-nwzgp 1/1 Running 0 95s 10.244.3.211 node2.org复制代码复制代码[rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 4selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2tolerations:- effect: NoScheduleoperator: Existskey: title- key: studyoperator: Exists复制代码kubectl apply -f controller-deployment2.yaml不调度到master1.org复制代码[rootmaster1 workload]# kubectl get pod -o wideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATEScontroller-deployment-demo-2-ff9cdbb4d-c76mx 1/1 Running 0 13s 10.244.5.59 node3.orgcontroller-deployment-demo-2-ff9cdbb4d-g8fwg 1/1 Running 0 13s 10.244.3.212 node2.orgcontroller-deployment-demo-2-ff9cdbb4d-h27sc 1/1 Running 0 13s 10.244.5.58 node3.orgcontroller-deployment-demo-2-ff9cdbb4d-vdm5j 1/1 Running 0 13s 10.244.1.203 node1.org复制代码#删除污点kubectl taint node [:]-kubectl taint node node1.org study-复制代码[rootmaster1 workload]# kubectl get node node1.org -o yaml |grep taint -iA 10taints:effect: NoSchedulekey: titlevalue: srestatus:addresses:address: 192.168.3.63type: InternalIPaddress: node1.orgtype: Hostnameallocatable:复制代码kubectl taint node node1.org title-#cordon封锁节点,即添加污点node.kubernetes.io/unschedulable:NoSchedule,只影响新创建Pod调度kubectl cordonkubectl cordon node1.org添加污点复制代码rootmaster1 workload]# kubectl get node node1.org -o yaml|grep -i -A 10 taintstaints:effect: NoSchedulekey: node.kubernetes.io/unschedulabletimeAdded: “2026-07-17T00:33:29Z”unschedulable: truestatus:addresses:address: 192.168.3.63type: InternalIPaddress: node1.orgtype: Hostname复制代码复制代码[rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 4selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2
[rootmaster1 workload]# kubectl get node node1.org -o yaml |grep taint -iA 10taints:effect: NoSchedulekey: studyvalue: nohardeffect: NoSchedulekey: titlevalue: srestatus:addresses:address: 192.168.3.63type: InternalIP复制代码复制代码[rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 2selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2 #注意此处labels和selector中label必须相同spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2复制代码kubectl apply -f controller-deployment2.yaml只调度到node2node1有污点不调度复制代码[rootmaster1 workload]# kubectl get pod -o wideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATEScontroller-deployment-demo-2-57ff4f59b-j8wmg 1/1 Running 0 30s 10.244.3.205 node2.orgcontroller-deployment-demo-2-57ff4f59b-sk8dt 1/1 Running 0 30s 10.244.3.206 node2.org[rootmaster1 workload]#复制代码Tolerations 容忍度属性Tolerations 是Pod上的属性Tolerations如下定义复制代码kubectl explain deployment.spec.template.spec.tolerationskubectl explain pod.spec.tolerationskey #被容忍的keyvalue #被容忍key的值,当operator为exists时,此value无需定义operator #Equal等值比较和 Exists 存在比较effect #可以容忍的节点的行为值,必须和Traint中的effect值相同或高于才能容忍tolerationSeconds #被驱逐的宽限时间默认是0就是立即被驱逐复制代码容忍度的判断方式在Pod对象上定义容忍度时它支持两种操作符operator一种是等值比较Equal表示Pod的容忍度与节点的污点必须在key、value和effect三者都完全匹配才可以容忍此为默认值一种是存在性判断Exists如果定义了key和effect表示只要存在key和effect二者相同时才容忍但不关注value就可容忍,必须不能定义valuekubectl get ds -n metallb-system -o yaml|grep -i -A 10 tolerations复制代码tolerations: - effect: NoSchedule key: node-role.kubernetes.io/master operator: Exists - effect: NoSchedule key: node-role.kubernetes.io/control-plane operator: Exists volumes: - name: memberlist secret: defaultMode: 420复制代码kubectl get node master1.org -o yaml|grep -i -A 10 taints复制代码[rootmaster1 ~]# kubectl get node master1.org -o yaml|grep -i -A 10 taintstaints:effect: NoSchedulekey: node-role.kubernetes.io/control-planestatus:addresses:address: 192.168.3.60type: InternalIPaddress: master1.orgtype: Hostnameallocatable:cpu: “2”复制代码如果只定义了effect并没有定义key表示指定effect的所有key都能容忍kubectl get ds -n kube-system kube-flannel -o yaml |grep -i -A10 tolerations复制代码tolerations: - effect: NoSchedule operator: Exists volumes: - hostPath: path: /run/flannel type: name: run - hostPath: path: /opt/cni/bin type: 复制代码如果key和effect都没有定义,表示容忍所有污点kubectl get ds -n kube-system kube-proxy -o yaml |grep -i -A3 tolerations:[rootmaster1 ~]# kubectl get ds -n kube-system kube-proxy -o yaml |grep -i -A3 tolerations:tolerations:- operator: Existsvolumes:- configMap:容忍度的匹配原则一个节点可以配置使用多个污点而一个Pod对象也可以有多个容忍度Kubernetes 处理多个污点和容忍度的过程就像一个过滤器从一个节点的所有污点开始遍历 过滤掉那些 Pod 中存在与之相匹配的容忍度的污点。余下未被过滤的污点的 effect 值决定了 Pod 是否会被分配到该节点一个节点上如果有多个污点Taint,对每个Taint 都需要容忍才能部署Pod将一个Pod对象的容忍度套用到特定节点的污点之上进行匹配度检测时将遵循如下逻辑遍历该节点的所有污点并过滤掉容忍度可匹配到的污点余下未被过滤掉的污点则由污点的effect来判定其满足状态对于剩余的不能匹配到容忍度的所有污点中若存在至少一个污点使用了NoSchedule效用标识则拒绝调度当前Pod至该节点对于不能匹配到容忍度的所有污点若都不具有NoSchedule效用标识但至少有一个污点使用了PreferNoScheduler效用标准则调度器会尽量避免将当前Pod对象调度至该节点如果至少有一个不能匹配容忍度的污点使用了NoExecute效用标识节点将立即驱逐当前Pod对象或者不允许该Pod调度至给定的节点而且即便容忍度可以匹配到使用了NoExecute效用标识的污点若在Pod上定义容忍度时同时使用tolerationSeconds属性定义了容忍时限则在超出时限后当前Pod也将会被节点所驱逐添加容忍度[rootmaster1 ~]# kubectl get deploymentNAME READY UP-TO-DATE AVAILABLE AGEcontroller-deployment-demo-2 2/2 2 2 9hExists并且没有key和value,可以容忍所有污点可以支持复制代码rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 2selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2tolerations:- operator: Exists复制代码kubectl apply -f controller-deployment2.yaml啥都可以容忍复制代码[rootmaster1 workload]# kubectl get pod -o wideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATEScontroller-deployment-demo-2-84458587c5-cczk4 1/1 Running 0 95s 10.244.1.202 node1.orgcontroller-deployment-demo-2-84458587c5-cm2zm 1/1 Running 0 95s 10.244.5.57 node3.orgcontroller-deployment-demo-2-84458587c5-kj794 1/1 Running 0 95s 10.244.0.56 master1.orgcontroller-deployment-demo-2-84458587c5-nwzgp 1/1 Running 0 95s 10.244.3.211 node2.org复制代码复制代码[rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 4selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2tolerations:- effect: NoScheduleoperator: Existskey: title- key: studyoperator: Exists复制代码kubectl apply -f controller-deployment2.yaml不调度到master1.org复制代码[rootmaster1 workload]# kubectl get pod -o wideNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATEScontroller-deployment-demo-2-ff9cdbb4d-c76mx 1/1 Running 0 13s 10.244.5.59 node3.orgcontroller-deployment-demo-2-ff9cdbb4d-g8fwg 1/1 Running 0 13s 10.244.3.212 node2.orgcontroller-deployment-demo-2-ff9cdbb4d-h27sc 1/1 Running 0 13s 10.244.5.58 node3.orgcontroller-deployment-demo-2-ff9cdbb4d-vdm5j 1/1 Running 0 13s 10.244.1.203 node1.org复制代码#删除污点kubectl taint node [:]-kubectl taint node node1.org study-复制代码[rootmaster1 workload]# kubectl get node node1.org -o yaml |grep taint -iA 10taints:effect: NoSchedulekey: titlevalue: srestatus:addresses:address: 192.168.3.63type: InternalIPaddress: node1.orgtype: Hostnameallocatable:复制代码kubectl taint node node1.org title-#cordon封锁节点,即添加污点node.kubernetes.io/unschedulable:NoSchedule,只影响新创建Pod调度kubectl cordonkubectl cordon node1.org添加污点复制代码rootmaster1 workload]# kubectl get node node1.org -o yaml|grep -i -A 10 taintstaints:effect: NoSchedulekey: node.kubernetes.io/unschedulabletimeAdded: “2026-07-17T00:33:29Z”unschedulable: truestatus:addresses:address: 192.168.3.63type: InternalIPaddress: node1.orgtype: Hostname复制代码复制代码[rootmaster1 workload]# cat controller-deployment2.yamlapiVersion: apps/v1kind: Deploymentmetadata:name: controller-deployment-demo-2spec:replicas: 4selector:matchLabels:app: myapp2template:metadata:labels:app: myapp2spec:containers:- name: deployment-2image: registry.cn-beijing.aliyuncs.com/wangxiaochun/pod-test:v0.2
)
)
