1KUBERNETES(1)(kubernetes) KUBERNETES(1)(kubernetes)
2Eric Paris Jan 2015
6
9 kubectl drain - Drain node in preparation for maintenance
10
14 kubectl drain [OPTIONS]
15
19 Drain node in preparation for maintenance.
20 The given node will be marked unschedulable to prevent new pods from
23 arriving. 'drain' evicts the pods if the APIServer supports http://ku‐
24 bernetes.io/docs/admin/disruptions/ . Otherwise, it will use normal
25 DELETE to delete the pods. The 'drain' evicts or deletes all pods ex‐
26 cept mirror pods (which cannot be deleted through the API server). If
27 there are DaemonSet-managed pods, drain will not proceed without --ig‐
28 nore-daemonsets, and regardless it will not delete any DaemonSet-man‐
29 aged pods, because those pods would be immediately replaced by the Dae‐
30 monSet controller, which ignores unschedulable markings. If there are
31 any pods that are neither mirror pods nor managed by ReplicationCon‐
32 troller, ReplicaSet, DaemonSet, StatefulSet or Job, then drain will not
33 delete any pods unless you use --force. --force will also allow dele‐
34 tion to proceed if the managing resource of one or more pods is miss‐
35 ing.
36 'drain' waits for graceful termination. You should not operate on the
39 machine until the command completes.
40 When you are ready to put the node back into service, use kubectl un‐
43 cordon, which will make the node schedulable again.
44 http://kubernetes.io/images/docs/kubectl_drain.svg
47
51 --delete-emptydir-data=false Continue even if there are pods using
52 emptyDir (local data that will be deleted when the node is drained).
53 --delete-local-data=false Continue even if there are pods using
56 emptyDir (local data that will be deleted when the node is drained).
57 --disable-eviction=false Force drain to use delete, even if evic‐
60 tion is supported. This will bypass checking PodDisruptionBudgets, use
61 with caution.
62 --dry-run="none" Must be "none", "server", or "client". If client
65 strategy, only print the object that would be sent, without sending it.
66 If server strategy, submit server-side request without persisting the
67 resource.
68 --force=false Continue even if there are pods not managed by a
71 ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet.
72 --grace-period=-1 Period of time in seconds given to each pod to
75 terminate gracefully. If negative, the default value specified in the
76 pod will be used.
77 --ignore-daemonsets=false Ignore DaemonSet-managed pods.
80 --ignore-errors=false Ignore errors occurred between drain nodes
83 in group.
84 --pod-selector="" Label selector to filter pods on the node
87 -l, --selector="" Selector (label query) to filter on
90 --skip-wait-for-delete-timeout=0 If pod DeletionTimestamp older
93 than N seconds, skip waiting for the pod. Seconds must be greater than
94 0 to skip.
95 --timeout=0s The length of time to wait before giving up, zero
98 means infinite
99
103 --add-dir-header=false If true, adds the file directory to the
104 header of the log messages
105 --alsologtostderr=false log to standard error as well as files
108 --application-metrics-count-limit=100 Max number of application
111 metrics to store (per container)
112 --as="" Username to impersonate for the operation
115 --as-group=[] Group to impersonate for the operation, this flag
118 can be repeated to specify multiple groups.
119 --azure-container-registry-config="" Path to the file containing
122 Azure container registry configuration information.
123 --boot-id-file="/proc/sys/kernel/random/boot_id" Comma-separated
126 list of files to check for boot-id. Use the first one that exists.
127 --cache-dir="/builddir/.kube/cache" Default cache directory
130 --certificate-authority="" Path to a cert file for the certificate
133 authority
134 --client-certificate="" Path to a client certificate file for TLS
137 --client-key="" Path to a client key file for TLS
140 --cloud-provider-gce-l7lb-src-cidrs=130.211.0.0/22,35.191.0.0/16
143 CIDRs opened in GCE firewall for L7 LB traffic proxy health
144 checks
145 --cloud-provider-gce-lb-src-cidrs=130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
148 CIDRs opened in GCE firewall for L4 LB traffic proxy health
149 checks
150 --cluster="" The name of the kubeconfig cluster to use
153 --container-hints="/etc/cadvisor/container_hints.json" location of
156 the container hints file
157 --containerd="/run/containerd/containerd.sock" containerd endpoint
160 --containerd-namespace="k8s.io" containerd namespace
163 --context="" The name of the kubeconfig context to use
166 --default-not-ready-toleration-seconds=300 Indicates the tolera‐
169 tionSeconds of the toleration for notReady:NoExecute that is added by
170 default to every pod that does not already have such a toleration.
171 --default-unreachable-toleration-seconds=300 Indicates the tolera‐
174 tionSeconds of the toleration for unreachable:NoExecute that is added
175 by default to every pod that does not already have such a toleration.
176 --disable-root-cgroup-stats=false Disable collecting root Cgroup
179 stats
180 --docker="unix:///var/run/docker.sock" docker endpoint
183 --docker-env-metadata-whitelist="" a comma-separated list of envi‐
186 ronment variable keys matched with specified prefix that needs to be
187 collected for docker containers
188 --docker-only=false Only report docker containers in addition to
191 root stats
192 --docker-root="/var/lib/docker" DEPRECATED: docker root is read
195 from docker info (this is a fallback, default: /var/lib/docker)
196 --docker-tls=false use TLS to connect to docker
199 --docker-tls-ca="ca.pem" path to trusted CA
202 --docker-tls-cert="cert.pem" path to client certificate
205 --docker-tls-key="key.pem" path to private key
208 --enable-load-reader=false Whether to enable cpu load reader
211 --event-storage-age-limit="default=0" Max length of time for which
214 to store events (per type). Value is a comma separated list of key val‐
215 ues, where the keys are event types (e.g.: creation, oom) or "default"
216 and the value is a duration. Default is applied to all non-specified
217 event types
218 --event-storage-event-limit="default=0" Max number of events to
221 store (per type). Value is a comma separated list of key values, where
222 the keys are event types (e.g.: creation, oom) or "default" and the
223 value is an integer. Default is applied to all non-specified event
224 types
225 --global-housekeeping-interval=1m0s Interval between global house‐
228 keepings
229 --housekeeping-interval=10s Interval between container housekeep‐
232 ings
233 --insecure-skip-tls-verify=false If true, the server's certificate
236 will not be checked for validity. This will make your HTTPS connections
237 insecure
238 --kubeconfig="" Path to the kubeconfig file to use for CLI re‐
241 quests.
242 --log-backtrace-at=:0 when logging hits line file:N, emit a stack
245 trace
246 --log-cadvisor-usage=false Whether to log the usage of the cAdvi‐
249 sor container
250 --log-dir="" If non-empty, write log files in this directory
253 --log-file="" If non-empty, use this log file
256 --log-file-max-size=1800 Defines the maximum size a log file can
259 grow to. Unit is megabytes. If the value is 0, the maximum file size is
260 unlimited.
261 --log-flush-frequency=5s Maximum number of seconds between log
264 flushes
265 --logtostderr=true log to standard error instead of files
268 --machine-id-file="/etc/machine-id,/var/lib/dbus/machine-id"
271 Comma-separated list of files to check for machine-id. Use the
272 first one that exists.
273 --match-server-version=false Require server version to match
276 client version
277 -n, --namespace="" If present, the namespace scope for this CLI
280 request
281 --one-output=false If true, only write logs to their native sever‐
284 ity level (vs also writing to each lower severity level)
285 --password="" Password for basic authentication to the API server
288 --profile="none" Name of profile to capture. One of
291 (none|cpu|heap|goroutine|threadcreate|block|mutex)
292 --profile-output="profile.pprof" Name of the file to write the
295 profile to
296 --referenced-reset-interval=0 Reset interval for referenced bytes
299 (container_referenced_bytes metric), number of measurement cycles after
300 which referenced bytes are cleared, if set to 0 referenced bytes are
301 never cleared (default: 0)
302 --request-timeout="0" The length of time to wait before giving up
305 on a single server request. Non-zero values should contain a corre‐
306 sponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't time‐
307 out requests.
308 -s, --server="" The address and port of the Kubernetes API server
311 --skip-headers=false If true, avoid header prefixes in the log
314 messages
315 --skip-log-headers=false If true, avoid headers when opening log
318 files
319 --stderrthreshold=2 logs at or above this threshold go to stderr
322 --storage-driver-buffer-duration=1m0s Writes in the storage driver
325 will be buffered for this duration, and committed to the non memory
326 backends as a single transaction
327 --storage-driver-db="cadvisor" database name
330 --storage-driver-host="localhost:8086" database host:port
333 --storage-driver-password="root" database password
336 --storage-driver-secure=false use secure connection with database
339 --storage-driver-table="stats" table name
342 --storage-driver-user="root" database username
345 --tls-server-name="" Server name to use for server certificate
348 validation. If it is not provided, the hostname used to contact the
349 server is used
350 --token="" Bearer token for authentication to the API server
353 --update-machine-info-interval=5m0s Interval between machine info
356 updates.
357 --user="" The name of the kubeconfig user to use
360 --username="" Username for basic authentication to the API server
363 -v, --v=0 number for the log level verbosity
366 --version=false Print version information and quit
369 --vmodule= comma-separated list of pattern=N settings for
372 file-filtered logging
373 --warnings-as-errors=false Treat warnings received from the server
376 as errors and exit with a non-zero exit code
377
381 # Drain node "foo", even if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet on it.
382 $ kubectl drain foo --force
383 # As above, but abort if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet, and use a grace period of 15 minutes.
385 $ kubectl drain foo --grace-period=900
386
391 kubectl(1),
392
396 January 2015, Originally compiled by Eric Paris (eparis at redhat dot
397 com) based on the kubernetes source material, but hopefully they have
398 been automatically generated since!
399Manuals User KUBERNETES(1)(kubernetes)
