From 62dff97c98650294ada1caf461c10d2348c94c68 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 8 Aug 2026 23:19:12 +1000 Subject: [PATCH] rke2: taint control-plane nodes NoSchedule (#517) --- hieradata/roles/infra/k8s/control.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hieradata/roles/infra/k8s/control.yaml b/hieradata/roles/infra/k8s/control.yaml index cd7c6c1..a29cca6 100644 --- a/hieradata/roles/infra/k8s/control.yaml +++ b/hieradata/roles/infra/k8s/control.yaml @@ -30,6 +30,9 @@ rke2::config_hash: - '--node-monitor-period=4s' protect-kernel-defaults: true disable-kube-proxy: false + # taint the control-plane/etcd nodes so only tolerating workloads schedule here + node-taint: + - "node-role.kubernetes.io/control-plane=true:NoSchedule" # configure consul service consul::services: