> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/manage-nodes-in-a-cluster.md). # Manage nodes in a cluster If you deployed your Cortex XSOAR environment starting with three nodes, using the textual UI menu in your VM you can add a node, taint a node, remove a node, drain a node, and uncordon a node. {% hint style="info" %} ### Important * If you deployed your Cortex XSOAR environment as a standalone (single node), you cannot add nodes to it and switch to a cluster. * A Kubernetes cluster consists of a control plane and one or more worker nodes. For Cortex XSOAR, in standalone (one VM), the VM acts as both control plane and as a worker node. In multi-node clusters, the first three nodes act as both control plane and as worker nodes, and any additional node added acts as a worker node. If you remove one of the original three nodes in the cluster (one of the control planes), you cannot perform actions such as upgrade or scaling up. When you add a new node, Cortex XSOAR automatically assigns the new node as a control plane with the same IP address as the node that was removed. * You need to set the host again and reestablish trust between all the nodes if you want to add more nodes to the cluster after completing installation. {% endhint %} **Add a node** Add a node to a cluster to increase its capacity and improve robustness for better load distribution. For example, by adding more nodes, playbook runs can be divided among them. This reduces the strain on each node and lowers the risk of system overload, while the workload capacity remains the same within the cluster. 1. From the textual UI menu in your VM, select **Cluster Administration**. 2. Set the host again and reestablish trust between all nodes in the cluster, including the new node (see Task 5. Establish trust between all nodes in a cluster). 3. Select **Add Node**. 4. Enter the **IP Address** and click **Add**. **Taint a node** Tainting a node marks the node as out of service for internal K8s functions. Taint a node to stop applications from running on it. 1. From the textual UI menu in your VM, select **Cluster Administration**. 2. Select the IP address of the node you want to taint. 3. Select **Taint**. In the list of nodes in the **Cluster Administration** menu, the node IP will display as **Ready,SchedulingDisabled**. **Remove a node** Remove a node from a cluster to reduce resources, perform maintenance, or decommission the node, ensuring the cluster operates efficiently without unnecessary or malfunctioning components. 1. From the textual UI menu in your VM, select **Cluster Administration**. 2. Drain the node. 1. Select the IP address of the node you want to drain. 2. Select **Drain**. In the list of nodes in the **Cluster Administration** menu, the node IP will display as **Ready,SchedulingDisabled**. 3. Remove the node. 1. Select the IP address of the node you want to remove. 2. Select **Remove**. In the list of nodes in the **Cluster Administration** menu, the node IP will display as **Ready**. **Drain a node** Draining a node pauses the node activity in the cluster and marks it as unschedulable. Draining a node safely removes workloads from it, ensuring that running applications are gracefully terminated or moved to other nodes without disrupting service availability before you perform maintenance on the node. 1. From the textual UI menu in your VM, select **Cluster Administration**. 2. Select the IP address of the node you want to drain. 3. Select **Drain**. In the list of nodes in the **Cluster Administration** menu, the node IP will display as **Ready,SchedulingDisabled**. **Uncordon a node** Uncordon a node in a cluster to make it available again for scheduling new workloads, for example after maintenance or troubleshooting is complete. 1. From the textual UI menu in your VM, select **Cluster Administration**. 2. Select the IP address of the node you want to uncordon. 3. Select **Uncordon**. In the list of nodes in the **Cluster Administration** menu, the node IP will display as **Ready**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/manage-nodes-in-a-cluster.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.