Kubernetes

Pod Scheduling & Security Context

Build nodeSelector, affinity, tolerations and security contexts as one pod-spec fragment.

Node placement

nodeSelector

Key

Value

Exact matches only. Use affinity below for ranges, alternatives or soft preferences.

priorityClassName (optional)

Affinity

Rule 1

Kind

Enforcement

Label key

Operator

Values (comma separated)

Topology key

Weight (1-100)

Tolerations

Security context

runAsNonRoot

seccompProfile: RuntimeDefault

allowPrivilegeEscalation

readOnlyRootFilesystem

Drop all capabilities

runAsUser

runAsGroup

fsGroup

Capabilities to add back (comma separated)

Output · pod spec

readOnlyRootFilesystem means any path the process writes to needs a volume. Mount an emptyDir at /tmp if the application or its runtime writes there.