Kubernetes节点调度：如何配置节点自主选Pod及指定节点仅收特定标签Pod

1. How to configure a Kubernetes node to autonomously select the type of Pods it accepts? #

The go-to solution here is using Taints and Tolerations—Kubernetes' built-in way to let nodes "filter" which Pods can be scheduled on them.

Here's the breakdown:

• Taints are applied directly to nodes, acting as a "block" for any Pod that doesn't have a matching toleration. There are three key taint effects you can use:
  • NoSchedule: Hard rule—Kubernetes won't schedule new non-tolerant Pods here, but existing ones stay put.
  • PreferNoSchedule: Soft rule—Kubernetes will try to avoid scheduling non-tolerant Pods here, but won't enforce it strictly.
  • NoExecute: Strictest rule—Kubernetes immediately evicts existing non-tolerant Pods and blocks new ones entirely.
• Tolerations are added to Pod specs, letting them bypass the node's taint and get scheduled there.

Example workflow:

1. Add a taint to your target node (say, my-special-node) to mark it for only specific Pod types:

   kubectl taint nodes my-special-node pod-category=priority:NoSchedule
   

2. For any Pod you want to allow on this node, add a matching toleration in its YAML:

   apiVersion: v1
   kind: Pod
   metadata:
     name: priority-pod
   spec:
     containers:
     - name: nginx
       image: nginx:alpine
     tolerations:
     - key: "pod-category"
       operator: "Equal"
       value: "priority"
       effect: "NoSchedule"
   

You can pair this with node labels and node selectors to tighten the rules even more—label the node with node-role=priority and have your Pods use nodeSelector to target that label alongside the toleration.

2. Can I configure a node to only accept Pods with a specific label? #

Absolutely! You'll combine taints/tolerations with either manual Pod configuration or automated admission controls to enforce this. Here's a practical step-by-step approach:

1. First, label your restricted node and apply a taint to block all unqualified Pods:

   # Add a label to identify the restricted node
   kubectl label nodes my-restricted-node node-type=restricted
   # Apply a taint to reject Pods without matching toleration
   kubectl taint nodes my-restricted-node allow-labeled-pods=only:NoSchedule
   

2. Now, enforce that only Pods with the label pod-type=authorized can be scheduled here:
   • Option 1 (Manual setup): For every eligible Pod, add the required toleration, node selector, and mandatory label:

     apiVersion: v1
     kind: Pod
     metadata:
       name: authorized-pod
       labels:
         pod-type: authorized # Required Pod label
     spec:
       containers:
       - name: busybox
         image: busybox:latest
       tolerations:
       - key: "allow-labeled-pods"
         operator: "Equal"
         value: "only"
         effect: "NoSchedule"
       nodeSelector:
         node-type: restricted
     

   • Option 2 (Automated setup): Use a Mutating Admission Webhook (or the newer ValidatingAdmissionPolicy in Kubernetes 1.26+) to automatically add the required toleration to any Pod with the pod-type=authorized label. This eliminates manual work and ensures only labeled Pods can bypass the node's taint.

With this setup, any Pod missing the pod-type=authorized label won't have the necessary toleration, so Kubernetes will refuse to schedule it on the restricted node.

内容的提问来源于stack exchange，提问作者Jasonling