title: Kubeadm and the Risks of Scheduling Pods on Master Node (Pods always Pending)
body: <p>While following the kubernetes article on <a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="noreferrer">Using kubeadm to Create a Cluster</a>, I was stuck when the AddOn pods I was trying to install (Nginx, Tiller, Grafana, InfluxDB, Dashboard) would always stay in a state of <strong>Pending</strong>. </p>
  
  <p>Checking the message from <code>kubectl describe pod tiller-deploy-df4fdf55d-jwtcz --namespace=kube-system</code> resulted in the following message:</p>
  
  <pre><code>Type     Reason            Age                From               Message
  ----     ------            ----               ----               -------
  Warning  FailedScheduling  51s (x15 over 3m)  default-scheduler  0/1 nodes are available: 1 node(s) had taints that the pod didn't tolerate.
  </code></pre>
  
  <p>When I ran the command from the <strong>Master Isolation</strong> section <code>kubectl taint nodes --all node-role.kubernetes.io/master-</code>, the AddOns would install as expected.</p>
  
  <p>At this point I can only suspect (because they are already installed on the master node) that the reason was that I hadn't connected a worker node to the cluster yet for the scheduler to schedule the pods on.</p>
  
  <p>The documentation states "your cluster will not schedule pods on the master for security reasons". I know that this is a non-production environment so there is little risk in this situation but what is the risk of removing that taint in a production cluster?</p>
  
  <p>Follow-up: If this is a risk, how can I re-add that taint so I can then uninstall the AddOn pods and try to have the scheduler install them on my Worker Node?</p>
  
  <p>Environment Details: Operating System - CentOS 7.4.1708 (Core) Kubernetes Version - 1.10</p>