<p>My kubernetes cluster looks as follow: </p>

<pre><code>k get nodes
NAME    STATUS   ROLES    AGE     VERSION
k8s-1   Ready    master   2d22h   v1.16.2
k8s-2   Ready    master   2d22h   v1.16.2
k8s-3   Ready    master   2d22h   v1.16.2
k8s-4   Ready    master   2d22h   v1.16.2
k8s-5   Ready    &lt;none&gt;   2d22h   v1.16.2
k8s-6   Ready    &lt;none&gt;   2d22h   v1.16.2
k8s-7   Ready    &lt;none&gt;   2d22h   v1.16.2
</code></pre>

<p>As you can see, the cluster consists of 4 master and 3 nodes. </p>

<p>These are the running pods: </p>

<pre><code>NAMESPACE      NAME                                      READY   STATUS    RESTARTS   AGE     IP             NODE    NOMINATED NODE   READINESS GATES
default        greeter-service-v1-8d97f9bcd-2hf4x        2/2     Running   0          47h     10.233.69.7    k8s-6   &lt;none&gt;           &lt;none&gt;
default        greeter-service-v1-8d97f9bcd-gnsvp        2/2     Running   0          47h     10.233.65.3    k8s-2   &lt;none&gt;           &lt;none&gt;
default        greeter-service-v1-8d97f9bcd-lkt6p        2/2     Running   0          47h     10.233.68.9    k8s-7   &lt;none&gt;           &lt;none&gt;
default        helloweb-77c9476f6d-7f76v                 2/2     Running   0          47h     10.233.64.3    k8s-1   &lt;none&gt;           &lt;none&gt;
default        helloweb-77c9476f6d-pj494                 2/2     Running   0          47h     10.233.69.8    k8s-6   &lt;none&gt;           &lt;none&gt;
default        helloweb-77c9476f6d-tnqfb                 2/2     Running   0          47h     10.233.70.7    k8s-5   &lt;none&gt;           &lt;none&gt;
</code></pre>

<p>Why the pods greeter-service-v1-8d97f9bcd-gnsvp and helloweb-77c9476f6d-7f76v are running on the master?</p>

<p>By default, there is no restriction for Pod to be scheduled on master unless there is a <code>Taint</code> like <code>node-role.kubernetes.io/master:NoSchedule</code>.</p>

<p>You can verify if there is any taint on master node using 
<code>kubectl describe k8s-1</code></p>

<p>or
<code>kubectl get node k8s-secure-master.linxlabs.com -o jsonpath={.spec.taints[]} &amp;&amp; echo</code></p>

<p>If you want to put a taint then use below </p>

<p><code>kubectl taint node k8s-1 node-role.kubernetes.io/master="":NoSchedule</code></p>

<p>After adding taint, no new pods will be scheduled on this node unless there is matching toleration on Pod spec.</p>

<p>Read more about Taints and Tolerations <a href="https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/" rel="nofollow noreferrer">here</a></p>
