Kubernetes / Deployments, Scheduling & Batch Workloads
Explain why a toleration permits scheduling but does not guarantee placement
A Pod can tolerate a taint and still fail other constraints, or be excluded by an untolerated taint. Compare both sides explicitly.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl describe node node01
kubectl -n app get pod web-0 -o jsonpath='{.spec.tolerations}'Read the result
Node taints and Pod tolerations describe one scheduling filter. Capacity, selectors, affinity and other policies still matter.
Resolve and verify
Match the exact taint key, value and effect with the workload's approved isolation design. Correct only the demonstrated mismatch and verify readiness.
Before changing production
Do not add wildcard tolerations or remove control-plane protection to make a regular workload fit.