k3s/docs/yaml/kubectl/kubectl_drain.yaml

name: drain
synopsis: Drain node in preparation for maintenance
description: |
  Drain node in preparation for maintenance.

  The given node will be marked unschedulable to prevent new pods from arriving.
  Then drain deletes all pods except mirror pods (which cannot be deleted through
  the API server).  If there are DaemonSet-managed pods, drain will not proceed
  without --ignore-daemonsets, and regardless it will not delete any
  DaemonSet-managed pods, because those pods would be immediately replaced by the
  DaemonSet controller, which ignores unschedulable markings.  If there are any
  pods that are neither mirror pods nor managed--by ReplicationController,
  DaemonSet or Job--, then drain will not delete any pods unless you use --force.

  When you are ready to put the node back into service, use kubectl uncordon, which
  will make the node schedulable again.
options:
- name: force
  default_value: "false"
  usage: |
    Continue even if there are pods not managed by a ReplicationController, Job, or DaemonSet.
- name: grace-period
  default_value: "-1"
  usage: |
    Period of time in seconds given to each pod to terminate gracefully. If negative, the default value specified in the pod will be used.
- name: ignore-daemonsets
  default_value: "false"
  usage: Ignore DaemonSet-managed pods.
inherited_options:
- name: alsologtostderr
  default_value: "false"
  usage: log to standard error as well as files
- name: api-version
  usage: |
    DEPRECATED: The API version to use when talking to the server
- name: certificate-authority
  usage: Path to a cert. file for the certificate authority.
- name: client-certificate
  usage: Path to a client certificate file for TLS.
- name: client-key
  usage: Path to a client key file for TLS.
- name: cluster
  usage: The name of the kubeconfig cluster to use
- name: context
  usage: The name of the kubeconfig context to use
- name: insecure-skip-tls-verify
  default_value: "false"
  usage: |
    If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure.
- name: kubeconfig
  usage: Path to the kubeconfig file to use for CLI requests.
- name: log-backtrace-at
  default_value: :0
  usage: when logging hits line file:N, emit a stack trace
- name: log-dir
  usage: If non-empty, write log files in this directory
- name: log-flush-frequency
  default_value: 5s
  usage: Maximum number of seconds between log flushes
- name: logtostderr
  default_value: "true"
  usage: log to standard error instead of files
- name: match-server-version
  default_value: "false"
  usage: Require server version to match client version
- name: namespace
  usage: If present, the namespace scope for this CLI request.
- name: password
  usage: Password for basic authentication to the API server.
- name: server
  shorthand: s
  usage: The address and port of the Kubernetes API server
- name: stderrthreshold
  default_value: "2"
  usage: logs at or above this threshold go to stderr
- name: token
  usage: Bearer token for authentication to the API server.
- name: user
  usage: The name of the kubeconfig user to use
- name: username
  usage: Username for basic authentication to the API server.
- name: v
  default_value: "0"
  usage: log level for V logs
- name: vmodule
  usage: |
    comma-separated list of pattern=N settings for file-filtered logging
example: |
  # Drain node "foo", even if there are pods not managed by a ReplicationController, Job, or DaemonSet on it.
  $ kubectl drain foo --force

  # As above, but abort if there are pods not managed by a ReplicationController, Job, or DaemonSet, and use a grace period of 15 minutes.
  $ kubectl drain foo --grace-period=900
see_also:
- kubectl