A node needs a kernel update. Two commands get the Pods off it without anyone noticing.
Cordon
sh
kubectl cordon peaks-node-2
kubectl get nodestext
NAME STATUS ROLES
peaks-node-2 Ready,SchedulingDisabled <none>A cordoned node has spec.unschedulable: true. The scheduler filters it out for every new Pod. Running Pods are untouched. Use it alone when you want a node to empty slowly, as Pods are replaced by rollouts and restarts.
Drain
sh
kubectl drain peaks-node-2 --ignore-daemonsets --delete-emptydir-datatext
node/peaks-node-2 cordoned
evicting pod peaks/market-web-7d9c4c5b7f-k2m4x
pod/market-web-7d9c4c5b7f-k2m4x evicted
node/peaks-node-2 drainedDrain cordons first, then evicts every Pod on the node. Evicted Pods are deleted; their controllers notice and create replacements, which the scheduler places on other nodes.
running on node-2
evicted
gone
ReplicaSet notices
new Pod on node-3
Drain refuses to proceed in three cases, each with a flag to override:
| Refusal | Flag | Why it asks |
|---|---|---|
| DaemonSet-managed Pods | --ignore-daemonsets | the DaemonSet would recreate them on this node immediately |
| Pods with no controller | --force | nothing would bring them back |
Pods with emptyDir | --delete-emptydir-data | the data in the volume is lost with the Pod |
Uncordon
sh
kubectl uncordon peaks-node-2The node accepts Pods again. Nothing moves back on its own; the next rollout or scale-up simply has one more node to choose from.