k8s || Taint && Toleration

什么是taint和toleration？

污点 Taint： 在node节点上打污点，pod在调度的时候，会选择没有污点的节点去运行
 调度器在分配pod到那个节点上的时候，会选择没有污点的节点，去启动pod
容忍度 Toleration：是pod有污点的节点服务器，任然可以调度到这个节点上去运行
调度器在调度的过程中会查看节点服务器是否有污点，然后看pod的策略里是否能容忍这个污点，如果能容忍就调度到这个节点服务器上，如果不能容忍就不调度过去。
污点和容忍度（Toleration）相互配合，可以用来避免 Pod 被分配到不合适的节点上。
    本质上可以达到想让哪些pod调度到哪些节点上

为什么master节点上没有业务pod？

    答案：因为master节点上有污点，默认业务pod都不调度到master节点

[root@k8smaster taint_toleration]# kubectl describe node k8smaster|grep -i taint
Taints:             node-role.kubernetes.io/master:NoSchedule

---

增加污点

[root@k8smaster taint_toleration]# kubectl taint nodes k8snode1 cf=tencent:NoSchedule
node/k8snode1 tainted

[root@k8smaster taint_toleration]# kubectl describe node k8snode1|grep -i taint
Taints:             cf=tencent:NoSchedule

启动nginx pod测试能否可以调度到有污点的节点上

[root@k8smaster taint_toleration]# vim nginx-deployment.yaml 
[root@k8smaster taint_toleration]# cat nginx-deployment.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-2
  labels:
    app: nginx
spec:
  replicas: 5
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.16.1
        ports:
        - containerPort: 80

[root@k8smaster taint_toleration]# kubectl apply -f nginx-deployment.yaml 
deployment.apps/nginx-deployment-2 created

[root@k8smaster taint_toleration]# kubectl get pod -o wide
NAME                                  READY   STATUS    RESTARTS   AGE    IP               NODE       NOMINATED NODE   READINESS GATES
nginx-deployment-2-559d658b74-5c5qj   1/1     Running   0          23s    10.244.185.242   k8snode2   <none>           <none>
nginx-deployment-2-559d658b74-glpkm   1/1     Running   0          23s    10.244.185.244   k8snode2   <none>           <none>
nginx-deployment-2-559d658b74-hwhtn   1/1     Running   0          23s    10.244.185.243   k8snode2   <none>           <none>
nginx-deployment-2-559d658b74-lpdl4   1/1     Running   0          23s    10.244.185.245   k8snode2   <none>           <none>
nginx-deployment-2-559d658b74-x8tb8   1/1     Running   0          23s    10.244.185.246   k8snode2   <none>           <none>

给k8snode2也打一个污点，排斥等级是NoExecute
导致所以的nginx的pod被驱逐了，状态是pending

[root@k8smaster taint_toleration]# kubectl taint nodes k8snode2 cf=tencent:NoExecute
node/k8snode2 tainted

[root@k8smaster taint_toleration]# kubectl get pod -o wide
NAME                                  READY   STATUS    RESTARTS   AGE   IP              NODE       NOMINATED NODE   READINESS GATES
nginx-deployment-2-559d658b74-2s497   0/1     Pending   0          18s   <none>          <none>     <none>           <none>
nginx-deployment-2-559d658b74-4h8d8   0/1     Pending   0          18s   <none>          <none>     <none>           <none>
nginx-deployment-2-559d658b74-7nsq6   0/1     Pending   0          19s   <none>          <none>     <none>           <none>
nginx-deployment-2-559d658b74-mzkn8   0/1     Pending   0          19s   <none>          <none>     <none>           <none>
nginx-deployment-2-559d658b74-vfkwr   0/1     Pending   0          18s   <none>          <none>     <none>           <none>

定义一个pod的容忍度能接受定义的污点

[root@k8smaster taint_toleration]# cat nginx-deployment.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-2
  labels:
    app: nginx
spec:
  replicas: 5
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.16.1
        ports:
        - containerPort: 80
      tolerations:
      - key: "cf"
        operator: "Equal"
        value: "tencent"
        effect: "NoExecute"

重新启动pod，验证容忍度

[root@k8smaster taint_toleration]# kubectl apply -f nginx-deployment.yaml 
deployment.apps/nginx-deployment-2 configured

查看pod的状态是running了，说明容忍度能够在有NoExecute的污点节点服务器上运行。

[root@k8smaster taint_toleration]# kubectl get pod -o wide
NAME                                  READY   STATUS    RESTARTS   AGE     IP               NODE       NOMINATED NODE   READINESS GATES
nginx-deployment-2-7ffb6b798c-799wq   1/1     Running   0          53s     10.244.185.247   k8snode2   <none>           <none>
nginx-deployment-2-7ffb6b798c-lmxnk   1/1     Running   0          53s     10.244.185.248   k8snode2   <none>           <none>
nginx-deployment-2-7ffb6b798c-nlcmn   1/1     Running   0          51s     10.244.185.251   k8snode2   <none>           <none>
nginx-deployment-2-7ffb6b798c-phff8   1/1     Running   0          51s     10.244.185.250   k8snode2   <none>           <none>
nginx-deployment-2-7ffb6b798c-pznxm   1/1     Running   0          53s     10.244.185.249   k8snode2   <none>           <none>

移除污点

kubectl taint nodes k8snode1 cf=tencent:NoSchedule-

[root@k8smaster taint_toleration]# kubectl taint nodes k8snode1 cf=tencent:NoSchedule-
node/k8snode1 untainted