Taints와 Tolerations — 특정 노드에 Pod을 제한하거나 허용하는 방법

# 노드에 Taint 추가
kubectl taint nodes node-1 gpu=true:NoSchedule

# 노드의 Taint 확인
kubectl describe node node-1 | grep Taint

# Taint 제거 (끝에 '-' 추가)
kubectl taint nodes node-1 gpu=true:NoSchedule-

kubectl taint nodes node-1 dedicated=ml:NoSchedule

kubectl taint nodes node-1 preference=lowpriority:PreferNoSchedule

kubectl taint nodes node-1 maintenance=true:NoExecute

spec:
  tolerations:
    # 정확한 매칭 (Equal)
    - key: "gpu"
      operator: "Equal"
      value: "true"
      effect: "NoSchedule"

    # 키만 매칭 (Exists) — value 무시
    - key: "dedicated"
      operator: "Exists"
      effect: "NoSchedule"

    # NoExecute + 유예 시간
    - key: "maintenance"
      operator: "Equal"
      value: "true"
      effect: "NoExecute"
      tolerationSeconds: 300  # 300초 후 퇴출 (유예 시간)

tolerations:
  - operator: "Exists"  # key, value, effect 모두 생략 → 모든 Taint 허용

# GPU 노드에 Taint와 레이블 추가
kubectl taint nodes gpu-node-1 nvidia.com/gpu=true:NoSchedule
kubectl label nodes gpu-node-1 accelerator=nvidia-a100

# ML 워크로드 — Toleration + nodeSelector 조합
apiVersion: v1
kind: Pod
metadata:
  name: ml-training
spec:
  tolerations:
    - key: "nvidia.com/gpu"
      operator: "Equal"
      value: "true"
      effect: "NoSchedule"
  nodeSelector:
    accelerator: nvidia-a100
  containers:
    - name: training
      image: pytorch:2.0
      resources:
        limits:
          nvidia.com/gpu: 1

# 1. 새 Pod 스케줄 차단 (cordon)
kubectl cordon node-1
# node/node-1 cordoned

# 2. 기존 Pod 안전하게 퇴출 (drain)
kubectl drain node-1 \
  --ignore-daemonsets \          # DaemonSet Pod은 무시
  --delete-emptydir-data \       # emptyDir 데이터 삭제 허용
  --grace-period=60              # Graceful Shutdown 60초

# 3. 유지보수 수행...

# 4. 노드 복귀 (uncordon)
kubectl uncordon node-1

# 노드: Taint + 레이블
# kubectl taint nodes spot-1 node-type=spot:NoSchedule
# kubectl label nodes spot-1 node-type=spot

# Pod: Toleration + nodeAffinity
spec:
  tolerations:
    - key: "node-type"
      operator: "Equal"
      value: "spot"
      effect: "NoSchedule"
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: node-type
                operator: In
                values: ["spot"]

tolerations:
  - key: "node-role.kubernetes.io/control-plane"
    operator: "Exists"
    effect: "NoSchedule"