Node Taint

A pod specification that allows but does not require scheduling onto a tainted node. Tolerations are the counterpoint to taints—a taint repels pods, and a toleration permits specific pods to ignore that repulsion.

• Defined in spec.tolerations with matching key, operator, value, and effect fields
• The Equal operator requires an exact value match; Exists matches any value for the key
• Critical for GPU workloads: AI inference pods must tolerate nvidia.com/gpu:NoSchedule to land on GPU nodes
• Tolerations do not guarantee scheduling—they only remove the taint barrier; use node affinity for attraction

The enforcement action taken when a pod lacks a matching toleration. Three effects control how aggressively the scheduler and node controller respond to taint violations.

• NoSchedule: Hard barrier—the scheduler will not place new pods without tolerations onto the node. Existing pods remain unaffected
• PreferNoSchedule: Soft preference—the scheduler tries to avoid placing intolerant pods but may do so if no other nodes are available
• NoExecute: Active eviction—intolerant pods already running on the node are immediately evicted, and new pods are blocked

Use NoExecute with a tolerationSeconds field to allow a grace period before eviction, useful for draining nodes during maintenance.

A scheduling rule that attracts pods to nodes based on labels, complementing the repelling behavior of taints. While taints enforce exclusivity, affinity expresses preference or requirement.

• requiredDuringSchedulingIgnoredDuringExecution: Hard requirement—pod will only schedule on matching nodes
• preferredDuringSchedulingIgnoredDuringExecution: Soft preference—scheduler weights nodes by match score
• Common label: node.kubernetes.io/instance-type=gpu-a100 to steer inference workloads
• Combine with taints: taint GPU nodes with gpu=true:NoSchedule and use affinity to attract GPU-tolerant pods to the same nodes

The simplest scheduling constraint—a pod field that restricts scheduling to nodes with exactly matching labels. Less expressive than affinity but sufficient for basic hardware targeting.

• Defined in spec.nodeSelector as a flat key-value map
• All specified labels must match for the node to be eligible
• Example: accelerator: nvidia-tesla-a100 ensures pods only land on A100-equipped nodes
• Limitation: No OR logic, no soft preferences, no anti-affinity—for complex GPU topology rules, use node affinity instead

Node selectors are often combined with taints to create a two-layer isolation: taints prevent unauthorized pods, and selectors direct authorized pods to the correct hardware tier.

A mechanism that assigns relative importance to pods, enabling the scheduler to evict lower-priority pods to make room for critical workloads. Works alongside taints for resource isolation.

• PriorityClasses define integer values—higher values indicate greater importance
• When a high-priority pod is unschedulable, the scheduler may preempt lower-priority pods
• Interaction with taints: A preempting pod must still tolerate the target node's taints; preemption does not bypass taint enforcement
• Use case: production inference pods with priority 1000 can preempt development pods on GPU nodes, but only if both tolerate the GPU taint

Configure preemptionPolicy: Never on non-critical pods to prevent unnecessary eviction churn in stable AI serving clusters.

A scheduling policy that distributes pods evenly across failure domains such as zones, nodes, or racks. Essential for high-availability AI serving where GPU nodes span multiple physical locations.

• maxSkew defines the maximum allowed imbalance between domains
• topologyKey specifies the domain label, e.g., topology.kubernetes.io/zone
• whenUnsatisfiable: DoNotSchedule enforces strict balancing; ScheduleAnyway applies best-effort
• Combined with taints: spread constraints operate only on nodes the pod can already schedule onto—taints filter the candidate pool first

For sovereign AI deployments, use topology spread to ensure inference replicas are distributed across physical racks or power domains within the air-gapped cluster.