CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Associate

Taints and Tolerations: NoSchedule and NoExecute

A taint is a node saying no. A toleration is a Pod's exemption from one specific no. The part that catches people is that the effect matters as much as the key: NoSchedule only applies to scheduling decisions not yet made, while NoExecute reaches Pods already running and removes them. Both are applied to the same node here, to the same workload, so the difference is a single command apart.

Scheduling and Placement Guide 15 of 46 Intermediate

The scheduler's message changed wording across releases. On 1.36 it reports 2 node(s) had untolerated taint(s) without naming which taint - older output quoted the key and value. kubectl describe node remains the reliable way to see what a node is actually carrying.

This is the only guide in the path that changes NODE state. It runs on the two-node cka3001 cluster rather than the shared four-node one, because NoExecute evicts every Pod on the node that does not tolerate it - not only the one this guide created.
Server NameIP AddressOSRolesCPURAMHDD
CKA3001192.168.0.185Ubuntu 26.04 LTSControl Plane Node2 Core4 GB50 GB
CKA3001-NODE01192.168.0.186Ubuntu 26.04 LTSWorker Node (tainted and untainted during this guide)2 Core4 GB50 GB

This guide includes

Use this when Pods will not schedule onto a node, or when running Pods are suddenly evicted from one. This matters because NoSchedule and NoExecute look almost identical in a manifest and do very different things - one blocks new Pods, the other removes those already running.

Before you start

  1. A worker with nothing against it

  2. Taint it, and nothing can be placed

  3. One toleration and it lands

  4. The effect that does not wait for next time

  5. Put the node back

Official sources

← All KCNA guides