After creating an infrastructure machine set, the
infra roles are applied to new infra nodes. The
worker role is required for infra nodes during startup. Nodes with the
infra role applied are not counted toward the total number of subscriptions that are required to run the environment, even when the
worker role is also applied.
However, with an infra node being assigned as a worker, there is a chance user workloads could get inadvertently assigned to an infra node. To avoid this, you must apply a taint to the infra node and tolerations for the pods you want to control.
Binding infrastructure node workloads using taints and tolerations
If you have an infra node that has the
worker roles assigned, you must configure the node so that user workloads are not assigned to it.
Use the following command to add a taint to the infra node to prevent scheduling user workloads on it:
$ oc adm taint nodes <node_name> <key>:<effect>
$ oc adm taint nodes node1 node-role.kubernetes.io/infra:NoSchedule
This example places a taint on
node1 that has key
node-role.kubernetes.io/infra and taint effect
NoSchedule. Nodes with the
NoSchedule effect schedule only pods that tolerate the taint, but allow existing pods to remain scheduled on the node.
If a descheduler is used, pods violating node taints could be evicted from the cluster.
Add tolerations for the pod configurations you want to schedule on the infra node, like router, registry, and monitoring workloads. Add the following code to the
Pod object specification:
- effect: NoSchedule (1)
key: node-role.kubernetes.io/infra (2)
operator: Exists (3)
||Specify the effect that you added to the node.
||Specify the key that you added to the node.
Exists Operator to require a taint with the key
node-role.kubernetes.io/infra to be present on the node.
This toleration matches the taint created by the
oc adm taint command. A pod with this toleration can be scheduled onto the infra node.
Moving pods for an Operator installed via OLM to an infra node is not always possible. The capability to move Operator pods depends on the configuration of each Operator.
Schedule the pod to the infra node using a scheduler. See the documentation for Controlling pod placement onto nodes for details.