<p>I would like to reserve some worker nodes for a namespace. I see the notes of stackflow and medium</p>

<p><a href="https://stackoverflow.com/questions/52487333/how-to-assign-a-namespace-to-certain-nodes">How to assign a namespace to certain nodes?</a></p>

<p><a href="https://medium.com/@alejandro.ramirez.ch/reserving-a-kubernetes-node-for-specific-nodes-e75dc8297076" rel="nofollow noreferrer">https://medium.com/@alejandro.ramirez.ch/reserving-a-kubernetes-node-for-specific-nodes-e75dc8297076</a></p>

<p>I understand we can use taint and nodeselector to achieve that.
My question is if people get to know the details of nodeselector or taint, how can we prevent them to deploy pods into these dedicated worker nodes.</p>

<p>thank you</p>

<p>To accomplish what you need, basically you have to use <a href="https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/" rel="nofollow noreferrer">taint</a>.
Let's suppose you have a Kubernetes cluster with one Master and 2 Worker nodes: </p>

<pre><code>$ kubectl get nodes
NAME         STATUS   ROLES    AGE   VERSION
knode01      Ready    &lt;none&gt;   8d    v1.16.2
knode02      Ready    &lt;none&gt;   8d    v1.16.2
kubemaster   Ready    master   8d    v1.16.2
</code></pre>

<p>As example I'll setup knode01 as Prod and knode02 as Dev.</p>

<pre><code>$ kubectl taint nodes knode01 key=prod:NoSchedule
</code></pre>

<pre><code>$ kubectl taint nodes knode02 key=dev:NoSchedule
</code></pre>

<p>To run a pod into these nodes, we have to specify a toleration in spec session on you yaml file: </p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: pod1
  labels:
    env: test
spec:
  containers:
  - name: nginx
    image: nginx
    imagePullPolicy: IfNotPresent
  tolerations:
  - key: "key"
    operator: "Equal"
    value: "dev"
    effect: "NoSchedule"
</code></pre>

<p>This pod (pod1) will always run in knode02 because it's setup as dev. If we want to run it on prod, our tolerations should look like that: </p>

<pre><code>  tolerations:
  - key: "key"
    operator: "Equal"
    value: "prod"
    effect: "NoSchedule"
</code></pre>

<p>Since we have only 2 nodes and both are specified to run only prod or dev, if we try to run a pod without specifying tolerations, the pod will enter on a pending state: </p>

<pre><code>$ kubectl get pods -o wide
    NAME         READY   STATUS    RESTARTS   AGE   IP               NODE      NOMINATED NODE   READINESS GATES
    pod0         1/1     Running   0          21m   192.168.25.156   knode01   &lt;none&gt;           &lt;none&gt;
    pod1         1/1     Running   0          20m   192.168.32.83    knode02   &lt;none&gt;           &lt;none&gt;
    pod2         1/1     Running   0          18m   192.168.25.157   knode01   &lt;none&gt;           &lt;none&gt;
    pod3         1/1     Running   0          17m   192.168.32.84    knode02   &lt;none&gt;           &lt;none&gt;
    shell-demo   0/1     Pending   0          16m   &lt;none&gt;           &lt;none&gt;    &lt;none&gt;           &lt;none&gt;
</code></pre>

<p>To remove a taint: </p>

<pre class="lang-sh prettyprint-override"><code>$ kubectl taint nodes knode02 key:NoSchedule-
</code></pre>
