kubectl cordon & drain: Command Reference for CI/CD

Stop scheduling on a node, then safely evict its pods.

kubectl cordon marks a node unschedulable; drain cordons and then evicts pods honouring PodDisruptionBudgets; uncordon reverses cordon. Together they bracket node maintenance in automation. This reference covers the flags that keep a drain from hanging.

Common flags and usage

• cordon <node>: stop new pods landing (running pods stay)
• drain <node>: cordon then evict pods via the eviction API
• --ignore-daemonsets: required; DaemonSet pods are not evicted
• --delete-emptydir-data: allow evicting pods with emptyDir data
• --timeout=5m: cap the drain so a PDB block fails the step
• uncordon <node>: make the node schedulable again

Example

kubectl cordon ip-10-0-1-5
kubectl drain ip-10-0-1-5 --ignore-daemonsets \
  --delete-emptydir-data --timeout=5m
# ... node maintenance ...
kubectl uncordon ip-10-0-1-5

In CI

A drain blocks on a PodDisruptionBudget ("Cannot evict pod ... violates the disruption budget") until another replica is Ready, so pass --timeout to fail instead of hanging. Always uncordon in a trap/finally block; a forgotten uncordon leaves the node piling up Pending pods.

Key takeaways

• drain needs --ignore-daemonsets and usually --delete-emptydir-data.
• A PDB can block a drain; cap it with --timeout so CI fails fast.
• Always uncordon in a trap; a forgotten cordon strands new pods.

Related guides