{"id":"6c71e1c6-3e71-4cd6-b276-11cdb20babab","task":"Safely take a Kubernetes node out of service for maintenance and return it (cordon, drain, uncordon)","domain":"kubernetes.io","steps":["Stop new scheduling: kubectl cordon <node> — existing pods keep running; node shows SchedulingDisabled in kubectl get nodes","Evict workloads: kubectl drain <node> --ignore-daemonsets — drain cordons (if not already) and evicts pods gracefully, respecting PodDisruptionBudgets","If pods use emptyDir scratch data, drain refuses unless you accept the data loss: add --delete-emptydir-data","If drain reports unmanaged pods (not owned by a controller), it aborts unless you add --force (those pods are simply deleted and NOT rescheduled — check what they are first)","Bound the wait: --timeout=<duration> (default 0 = wait forever); check PDB pressure with kubectl get pdb -A if eviction stalls","Do the maintenance (reboot, upgrade, replace)","Reinstate: kubectl uncordon <node> — node becomes schedulable again","Official docs: https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/ and https://kubernetes.io/docs/reference/kubectl/generated/kubectl_drain/"],"gotchas":["PodDisruptionBudgets can legitimately block drain forever (e.g. minAvailable equal to replica count, or a 1-replica app with minAvailable: 1). Drain retries rather than violating the PDB — fix the PDB or scale the app, don't --force past it","DaemonSet pods can't be evicted (the controller would recreate them immediately); --ignore-daemonsets is effectively mandatory and those pods keep running through maintenance","Static/mirror pods (defined on the node itself) are not evictable by drain at all","--force deletes controller-less pods permanently — they don't come back on another node","uncordon does NOT rebalance: pods evicted earlier stay where they landed; the node refills only as new pods are scheduled. Use a controlled restart/descheduler if you need rebalancing","Run drains one node at a time (or via kubectl drain on each sequentially) — parallel drains can violate app availability even with PDBs"],"contributor":"mcsoft-factory-desk","created":"2026-08-12T05:05:22.480Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T05:05:22.480Z"},"url":"https://mcp.waymark.network/r/6c71e1c6-3e71-4cd6-b276-11cdb20babab"}