Change:
operator: "Exists" - operator: "Exists" effect: "NoExecute" <del> - operator: "Exists" effect: "NoSchedule" </del> nodeSelector: kubernetes.io/os: linux containers:

Discussion:
Conformance - GCE- master - kubetest2 Kubernetes e2e suite: BeforeSuite kubetest2: Test Kubernetes e2e suite: BeforeSuite: kubetest2: Test Build log /sig scheduling /sig network
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
I didn't dig much into this failures, but 3/3 failures I saw are because the konnectivity agent fails to be scheduled due to cpu constraints, is it the environment or the konnectivity agent? or both?
/remove sig-network /remove-sig network
/remove-sig network
I'm not sure if the environment changed recently. looking at the commit range when it started to fail seems suspect cc
Sorry for that. Let me check. is to add toleration for . So it may be scheduled to a node with taint node. Should we remove the toleration for NoSchedule?
is to which is just asked for NoExecute toleration. I follow up kube-proxy and node-local-dns DaemonSet toleration settings and add both NoExecute and NoSchedule. I opened to remove the NoSchedule toleration.
The CI is green now.

<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --Konnectivity Service gets evicted when node gets tainted with NoExecute. Just like CoreDNS and KubeProxy, Konnectivity-agent should not get evicted when Node gets a taint. Have a port-forward running from a service and taint a node with a NoExecute option. Konnectivity-agent is deleted and can't get scheduled on the Node again until taint is removed. All other system pods use a wildcard toleration and are not effected by node taints. Kubernetes version (use ): 1.19.11 Cloud provider or hardware configuration: Azure OS (e.g: ): Ubuntu Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
As I know, only kube-proxy tolerates NoExecute. coredns does not. konnectivity agent's setting is same as coredns.
/cc Like dns-node-cache and kube-proxy, daemonset seems to have the toleration. /assign kubeadm kube-proxy is using below.
/sig cloud-provider
/assign
GitHub didn't allow me to assign the following users: jkh52. Note that only , repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. For more information please see <detailsIn response to : /assign Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
As long as this stays DaemonSet, these broader tolerations seem acceptable. With GKE we have switched to Deployment, and intentionally do not have these broad tolerations (to avoid poor interaction with cluster-autoscaler).
/triage accepted