I have a GKE cluster with two node pools. One of those is a tainted node pools for use by specific pods.

After adding the tainted node pool, I realised that Kubernetes was trying to schedule a kube-dns pod on the nodes of the pool, but couldn't.

From what I understood, all nodes should have kube-dns deployed if I want DNS resolution to work. Maybe this is an incorrect assumption?

Since kube-dns (and other things in kube-system) are managed by GKE and not by me, I have no idea how to either:

  • if it's needed, tell kube-dns to tolerate my node pool, or
  • if it's not needed, tell kube-dns not to be scheduled on it.

By the way kube-dns lives in kube-system namespace. Taint your nodes to be available to schedule pods in this namespace because it is needed for normal work of your cluster.

  • Could you expand on this? I'm not exactly clear what you mean. How can I express that the nodes are available for the kube-system namespace? – Victor Noël Feb 5 at 16:04
  • For the record, there are some of the kube-system pods running on the tainted nodes, but just not kube-dns. For example there is fluentd and kube-proxy. – Victor Noël Feb 5 at 16:06
  • Kube-dns deployment doesn't have appropriate tolerations by default and therefore can't be scheduled on master node or any other tainted worker node. So to get it scheduled, it's required either to have at least one node without taints or add tolerations to the kube-dns deployment <kubectl edit deployment kube-dns -n kube-system>. – VAS Feb 13 at 13:22

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.