Control which nodes run workspaces

Control which cluster nodes run workspace Pods by setting a nodeSelector or tolerations in the CheCluster Custom Resource. Use this to isolate workspaces on dedicated hardware.

Prerequisites

An active kubectl session with administrative permissions to the destination Kubernetes cluster. See Overview of kubectl.
The target nodes are labeled or tainted according to the scheduling rules you want to apply.

Procedure

Using NodeSelector

Che uses CheCluster Custom Resource to configure nodeSelector:
```
spec:
  devEnvironments:
    nodeSelector:
      key: value
```
This section must contain a set of key=value pairs for each node label to form the nodeSelector rule.
Using Taints and Tolerations

This works in the opposite way to nodeSelector. Instead of specifying which nodes the Pod will be scheduled on, you specify which nodes the Pod cannot be scheduled on. For more information, see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration.

Che uses CheCluster Custom Resource to configure tolerations:
```
spec:
  devEnvironments:
    tolerations:
      - effect: NoSchedule
        key: key
        value: value
        operator: Equal
```

nodeSelector must be configured during Che installation. This prevents existing workspaces from failing to run due to volumes affinity conflict caused by existing workspace PVC and Pod being scheduled in different zones.

To avoid Pods and PVCs to be scheduled in different zones on large, multizone clusters, create an additional StorageClass object (pay attention to the allowedTopologies field), which will coordinate the PVC creation process.

Pass the name of this newly created StorageClass to Che through the CheCluster Custom Resource. For more information, see: Use a custom storage provisioner.

Additional resources