Kubernetes Taints and Tolerations: How Nodes Control Which Pods They Accept

In Kubernetes, taints are applied to nodes to repel pods by default, while tolerations are configured on pods to override that repulsion and allow scheduling. The mechanism works as the inverse of node selectors and affinity, where instead of pods choosing nodes, nodes push away unwanted pods. Three taint effects govern behavior: NoSchedule blocks new pods entirely, PreferNoSchedule discourages but permits scheduling under resource pressure, and NoExecute can also evict already-running pods that lack the matching toleration. A tolerationSeconds field lets operators define a grace period before NoExecute evicts a pod after a taint is applied. Common real-world uses include protecting control-plane nodes from regular workloads and reserving specialized hardware like GPU nodes for only the appropriate workloads.