OC-ADM-TAINT(1)

📦
version 4.22.0 · 2 versions
, in nixpkgs unstable

💅 OC ADM TAINT 💅

okay bestie, welcome to oc adm taint — part of the OC ADM(1) manual fam, dated June 2016, and no cap this page is gonna make you a taint expert in like five minutes. grab a strawberry 🍓 and let's go.

✨ NAME ✨

oc adm taint — update the taints on one or more nodes 💅

🦋 SYNOPSIS 🦋

oc adm taint [OPTIONS]

that's it. that's the whole vibe. options are where the drama lives tho 👀

🌸 DESCRIPTION 🌸

Update the taints on one or more nodes. that's the whole mission, literally.

the way this works is a whole lil art form, so here's the tea ☕:

  • a taint is made of three things: a key, a value, and an effect. when you pass it as an argument, you write it like key=value:effect.
  • the key has to start with a letter or a number, and after that it can have letters, numbers, hyphens, dots, and underscores, up to 253 characters. so many characters. iconic.
  • bonus round: the key can optionally start with a DNS subdomain prefix and a single /, like example.com/my-app. fancy ✨
  • the value is optional. if you do give one, it must start with a letter or number, and it can contain letters, numbers, hyphens, dots, and underscores, up to 63 characters. shorter than the key, we respect the hierarchy 🙈
  • the effect has to be one of NoSchedule, PreferNoSchedule, or NoExecute. those three. no fourth option, don't try it 💀
  • and rn? currently taint can only apply to node. that's the limit, that's the boundary, we stay in our lane 🫶

💖 OPTIONS 💖

  • --all=false — select all nodes in the cluster. the whole group chat, not just one person 📣
  • --allow-missing-template-keys=true — if true, just ignore any errors in templates when a field or map key is missing from the template. lowkey forgiving. only applies to golang and jsonpath output formats tho.
  • --dry-run="none" — must be "none", "server", or "client". if it's the client strategy, it only prints the object that would be sent, without actually sending it (window shopping 🛍️). if it's the server strategy, it submits a server-side request without persisting the resource. nothing gets saved, it's giving dress rehearsal.
  • --field-manager="kubectl-taint" — name of the manager used to track field ownership. this is the lil name tag on your changes 🏷️
  • -o, --output="" — output format. one of: json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file. pick your aesthetic.
  • --overwrite=false — if true, allow taints to be overwritten. otherwise it rejects taint updates that would overwrite existing taints. default is no touchy 🙅‍♀️
  • -l, --selector="" — selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'. e.g. -l key1=value1,key2=value2,key3 in (value3). matching objects must satisfy all of the specified label constraints — everybody has to agree, it's a group decision 💜
  • --show-managed-fields=false — if true, keep the managedFields when printing objects in JSON or YAML format. only then. only those formats.
  • --template="" — template string or path to template file to use when -o=go-template, -o=go-template-file. the template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview]. go read the docs, i believe in you 🧚
  • --validate="ignore" — must be one of: strict (or true), warn, ignore (or false). here's the breakdown fr fr:
    • "true" or "strict" will use a schema to validate the input and fail the request if invalid. it'll do server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if it's not. strict is strict, she does not bend 😤
    • "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behaves as "ignore" otherwise. she's just looking out for you, gently 🥺
    • "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields. silent. dropping. gone. be careful bestie 💀

👑 OPTIONS INHERITED FROM PARENT COMMANDS 👑

these came from the parent command, they're like hand-me-downs but make it kubernetes:

  • --as="" — username to impersonate for the operation. user could be a regular user or a service account in a namespace. dress up as someone else, legally 🎭
  • --as-group=[] — group to impersonate for the operation. this flag can be repeated to specify multiple groups. collect them all.
  • --as-uid="" — UID to impersonate for the operation.
  • --as-user-extra=[] — user extras to impersonate for the operation. this flag can be repeated to specify multiple values for the same key.
  • --cache-dir="/homeless-shelter/.kube/cache" — default cache directory. yes that's the literal path, don't @ me.
  • --certificate-authority="" — path to a cert file for the certificate authority.
  • --client-certificate="" — path to a client certificate file for TLS.
  • --client-key="" — path to a client key file for TLS. 🔑
  • --cluster="" — the name of the kubeconfig cluster to use.
  • --context="" — the name of the kubeconfig context to use.
  • --disable-compression=false — if true, opt-out of response compression for all requests to the server. uncompressed and unbothered ✨
  • --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity. this will make your HTTPS connections insecure. like, actually insecure. i'm not being dramatic, the manpage says it 😭
⚠️ real talk: this one is genuinely risky, it says "insecure" right there in the name. use with caution, bestie.
  • --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
  • --kuberc="" — path to the kuberc file to use for preferences. this can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off. two ways to say no 🚫
  • --match-server-version=false — require server version to match client version. they have to be twinning or it's not happening 💅
  • -n, --namespace="" — if present, the namespace scope for this CLI request.
  • --profile="none" — name of profile to capture. one of (none|cpu|heap|goroutine|threadcreate|block|mutex). pick your profile, main character 🎀
  • --profile-output="profile.pprof" — name of the file to write the profile to.
  • --request-timeout="0" — the length of time to wait before giving up on a single server request. non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). a value of zero means don't timeout requests. zero = infinite patience, she'll wait forever 🕰️
  • -s, --server="" — the address and port of the Kubernetes API server.
  • --tls-server-name="" — server name to use for server certificate validation. if it's not provided, the hostname used to contact the server is used. default behavior, cute.
  • --token="" — bearer token for authentication to the API server.
  • --user="" — the name of the kubeconfig user to use.
  • --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code. warnings get promoted to full problems, glow-up gone wrong 😬

🌈 EXAMPLE 🌈

here's where it gets fun, copy-paste these, they're all literally verbatim:

# Update node 'foo' with a taint with key 'dedicated' and value 'special-user' and effect 'NoSchedule'
# If a taint with that key and effect already exists, its value is replaced as specified
oc adm taint nodes foo dedicated=special-user:NoSchedule

# Remove from node 'foo' the taint with key 'dedicated' and effect 'NoSchedule' if one exists
oc adm taint nodes foo dedicated:NoSchedule-

# Remove from node 'foo' all the taints with key 'dedicated'
oc adm taint nodes foo dedicated-

# Add a taint with key 'dedicated' on nodes having label myLabel=X
oc adm taint node -l myLabel=X  dedicated=foo:PreferNoSchedule

# Add to node 'foo' a taint with key 'bar' and no value
oc adm taint nodes foo bar:NoSchedule

see that trailing - on the second and third ones? that's the "remove" energy. minus sign = bye bye taint 👋 and peep the double space in -l myLabel=X dedicated=foo:PreferNoSchedule — yes it's really there in the original, keep it, it's part of the lore.

🎀 SEE ALSO 🎀

  • oc-adm(1), — the parent page, go say hi to the family 🫶

🧚 HISTORY 🧚

June 2016 — ported from the Kubernetes man-doc generator. vintage. retro. a classic 💜

ok that's the whole page bestie, you're officially taint-pilled 💅✨ no cap, go taint some nodes responsibly.

Openshift — Openshift CLI User Manuals — OC ADM(1) — June 2016 🎀 that's the source, the manual, and the date, all cozy in a lil sign-off. mwah. 🫶

📦 where this page comes from