Skip to content

Room 33

TAINTS & TOLERATIONS

The Toxic Swamp

  • Nodes can be tainted to repel pods. Only pods with matching tolerations can schedule there.
  • A tainted node holds the password. Deploy a pod that tolerates the taint.

📜 Mission Briefing

  1. Taint a worker node: kubectl taint nodes WORKER-NODE zone=toxic:NoSchedule.
  2. Try deploying a regular pod - it won’t schedule on the tainted node.
  3. Deploy tolerant-pod.yaml with a matching toleration.
  4. The pod will schedule on the tainted node and reveal the password: taint77.
Key Commands
Command Purpose
kubectl taint nodes NODE key=value:EFFECT Add taint
kubectl taint nodes NODE key:EFFECT- Remove taint
kubectl describe node NODE \| grep Taints View taints
How Taints & Tolerations Work
# Taint effects:
# NoSchedule:         New pods won't schedule (existing stay)
# PreferNoSchedule:   Scheduler tries to avoid (soft rule)
# NoExecute:          Evict existing pods + block new ones

# Add taints
kubectl taint nodes worker-1 zone=toxic:NoSchedule
kubectl taint nodes worker-1 maintenance=true:NoExecute

# Remove taints
kubectl taint nodes worker-1 zone=toxic:NoSchedule-

# Pod with tolerations
apiVersion: v1
kind: Pod
metadata:
  name: tolerant-pod
spec:
  tolerations:
    - key: "zone"
      operator: "Equal"
      value: "toxic"
      effect: "NoSchedule"
    # Tolerate ANY taint with key "maintenance"
    - key: "maintenance"
      operator: "Exists"
      effect: "NoExecute"
      tolerationSeconds: 3600  # Evict after 1 hour
  containers:
    - name: app
      image: busybox
      command: ['sh', '-c', 'echo taint77 && sleep 3600']

# Control plane nodes are tainted by default:
# node-role.kubernetes.io/control-plane:NoSchedule

# To schedule on control plane, add toleration:
tolerations:
  - key: "node-role.kubernetes.io/control-plane"
    operator: "Exists"
    effect: "NoSchedule"

# Tolerate everything (schedule anywhere):
tolerations:
  - operator: "Exists"
Hints

Hint 1

Find worker nodes and taint one: 

kubectl get nodes
kubectl taint nodes <worker-node> zone=toxic:NoSchedule

Hint 2

kubectl apply -f tolerant-pod.yaml
kubectl get pod tolerant-pod -o wide  # Should be on tainted node

Hint 3

The password is taint77.

🔓 Unlock Room 34

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_34/README -out ../room_34/README.txt -pass pass:PASSWORD
cat ../room_34/README.txt