Handbooks / Kubernetes / Chapter 7
7 pages · ~4 min✓ Reviewed
Builds on Scaling and Health. Next up: NetworkPolicies.
FailedScheduling event| Tools | Effect | |
|---|---|---|
| Attraction | nodeSelector, node affinity, pod affinity | pull pods toward nodes |
| Repulsion | taints, pod anti-affinity | push pods away |
IgnoredDuringExecution: later label changes do not evict running podsA tolerating pod can still land on any untainted node. To steer it, add nodeSelector or affinity.
# kubectl label node worker-1 disktype=ssd
spec:
nodeSelector:
disktype: ssdlabel the node first, then select it
| Hard | Soft | |
|---|---|---|
| Field | requiredDuringSchedulingIgnoredDuringExecution | preferredDuringSchedulingIgnoredDuringExecution |
| No match | Pending | Still scheduled |
| Weight | none | 1-100, added to node score |
In, NotIn, Exists, DoesNotExist, Gt, LtnodeSelectorTerms are ORedmatchExpressions inside one term are ANDedRules apply only at placement. Later node label changes never evict running pods.
labelSelectortopologyKey is required: it picks the domain| topologyKey | Domain |
|---|---|
kubernetes.io/hostname | per node |
topology.kubernetes.io/zone | per zone |
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels: {app: web}
topologyKey: kubernetes.io/hostnameone web replica per node
weight (1-100): best-effort spread, scale-out never blockedlabelSelector must match the target pods' labels, not the pod's ownThe selector only matches pods in the pod's own namespace by default. Set namespaces to widen it.
kubectl taint nodes node1 key=value:NoSchedule kubectl taint nodes node1 key=value:NoSchedule-
trailing minus removes the taint
Exists with no key tolerates every taint| Effect | New pods | Running pods |
|---|---|---|
NoSchedule | blocked | left alone |
PreferNoSchedule | avoided if possible (soft) | left alone |
NoExecute | blocked | evicted |
tolerationSeconds delays NoExecute eviction by that many secondsnode-role.kubernetes.io/control-plane:NoSchedulenot-ready and unreachable as NoExecuteA toleration only permits a node. It never attracts the pod there.
maxSkew, topologyKey, whenUnsatisfiable, labelSelectorDoNotSchedule = hard, pod stays Pending; ScheduleAnyway = softmaxSkew: 1 across zones = even spreadtopologySpreadConstraints:
- maxSkew: 1
topologyKey: topology.kubernetes.io/zone
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels: {app: web}balance app=web pods across zones
| Topology spread | Anti-affinity | |
|---|---|---|
| Result | balanced across domains | max one per domain |
| HA across zones | better | blocks extra replicas |
Insufficient cpu/memory| Requests | QoS class | Eviction |
|---|---|---|
| equal limits | Guaranteed | last |
| below limits | Burstable | middle |
| none set | BestEffort | first |
Placement and QoS both come from requests. A node full of requests is full, even when it is idle.
kubectl describe pod <name>
kubectl get nodes --show-labels
kubectl describe node <n> | grep -i taintEvents show FailedScheduling reasons; then check labels and taints
nodeSelector or affinity| Goal | Use |
|---|---|
| Pin to a node type | nodeSelector or node affinity |
| Co-locate or separate pods | pod affinity or anti-affinity |
| Reserve nodes | taint + toleration + nodeSelector |
A taint alone only keeps others out. A toleration never attracts. Add nodeSelector or node affinity to pull your pods in.
| Effect | Behaviour |
|---|---|
NoSchedule | block new pods only |
PreferNoSchedule | avoid if possible |
NoExecute | block new and evict existing |
gpu=true:NoSchedule. Your pod tolerates it and has no nodeSelector. Will it land on that node?kubernetes.io/hostname. The cluster has 3 nodes. What happens?ScheduleAnyway.Insufficient cpu.