What is tainting in Kubernetes nodes

 In Kubernetes, a taint is a restriction placed on a node that prevents certain Pods from being scheduled onto it unless those Pods explicitly tolerate that restriction.

This is particularly important in a single-node Kubernetes cluster created using kubeadm, because the only node may be configured as a control-plane node.

1. Why does Kubernetes taint control-plane nodes?

Normally, Kubernetes separates responsibilities:

• Control-plane nodes: Run the API Server, etcd, Scheduler, and Controller Manager.

• Worker nodes: Run application Pods such as AI Core, API Server, and PostgreSQL.

Kubernetes often protects control-plane nodes from application workloads so that application CPU or memory consumption does not interfere with cluster management.

Control-plane node

API Server, etcd, Scheduler

Tainted: NoSchedule

Ordinary application Pods cannot be scheduled

Worker node

AI Core, API, PostgreSQL

Without this taint

Application Pods can be scheduled normally