Introduction

If a DaemonSet pod is not scheduled on a master/control-plane node, the issue is usually node taints and tolerations, not DaemonSet logic itself. By default, control-plane nodes are tainted to prevent regular workloads. DaemonSets that should run there must include matching tolerations and, if needed, node selectors/affinity constraints.

This article explains the control-plane scheduling rules and how to configure DaemonSets intentionally.

Core Sections

1. Check node taints first

kubectl get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints

Common taints include:

• node-role.kubernetes.io/master:NoSchedule
• node-role.kubernetes.io/control-plane:NoSchedule

2. Add matching tolerations in DaemonSet

1spec:
2  template:
3    spec:
4      tolerations:
5        - key: node-role.kubernetes.io/master
6          operator: Exists
7          effect: NoSchedule
8        - key: node-role.kubernetes.io/control-plane
9          operator: Exists
10          effect: NoSchedule

Without these, pods will skip control-plane nodes.

3. Verify node selectors/affinity rules

nodeSelector:
  kubernetes.io/os: linux

Overly restrictive selectors can unintentionally exclude master nodes.

4. Confirm DaemonSet events and pod status

kubectl describe ds my-daemon -n kube-system
kubectl get pods -n kube-system -o wide | rg my-daemon

Events typically reveal taint mismatch or selector mismatch quickly.

5. Managed cluster caveats

Some managed control planes are not schedulable at all (control plane not exposed as worker node). In that case, no toleration can schedule workloads there.

verify provider architecture before troubleshooting tolerations

6. Validate with targeted test daemonset

Use a minimal DaemonSet manifest to verify scheduling policy in isolation.

kind: DaemonSet
metadata:
  name: ds-test

This helps separate workload-specific issues from cluster policy issues.

Common Pitfalls

• Assuming DaemonSet always schedules on every node regardless of taints.
• Adding toleration for master but not control-plane key in newer clusters.
• Forgetting restrictive selectors/affinity that filter out target nodes.
• Debugging container image/startup while scheduling constraints are the real blocker.
• Ignoring managed-provider limits where control planes are unschedulable by design.

Summary

DaemonSet pods missing on master/control-plane nodes are usually blocked by NoSchedule taints or selector constraints. Add proper tolerations, verify node constraints, and inspect DaemonSet events. Also confirm whether your cluster type allows workloads on control-plane nodes at all. With explicit scheduling policy, DaemonSet placement becomes predictable.

A practical way to make this topic robust in real systems is to define behavior contracts explicitly and test them at boundaries, not only in happy-path unit tests. For scheduler is not scheduling pod for daemonset in master node, start by documenting the accepted input forms, normalization rules, and expected outputs in edge conditions such as null values, empty collections, malformed payloads, and partial failures. Then add representative fixtures from production logs so tests reflect the real data shape rather than idealized samples. This approach catches compatibility problems early when dependencies, framework versions, or infrastructure defaults change. It also improves onboarding because new contributors can understand the rules without reverse-engineering implicit behavior from scattered call sites.

Operationally, pair implementation changes with lightweight observability so regressions are visible before they become incidents. Emit structured diagnostics around decision points with stable field names for version, environment, execution path, and outcome. Keep sensitive values redacted, but preserve enough context to trace failures quickly. During post-incident reviews, convert each root cause into a permanent regression test and a short runbook update. Over time this creates compounding reliability: fewer repeated bugs, faster triage, and safer refactoring. For teams maintaining scheduler is not scheduling pod for daemonset in master node across multiple services, centralizing shared helper logic and validating compatibility in CI before rollout usually delivers the biggest reduction in operational noise.

As a final engineering practice, keep one small benchmark or smoke test dedicated to this topic and run it in CI on dependency updates. That single guard often catches behavior drift before users notice it, and it gives maintainers a fast signal when a framework upgrade changes defaults or execution semantics.