From b85b7c207e0ea8d49389b008ff157245bdbef294 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 8 Aug 2026 23:14:00 +1000 Subject: [PATCH] rke2: taint control-plane nodes NoSchedule ## Why - The 3 control-plane/etcd nodes (prodnxsr0001/0002/0003, roles::infra::k8s::control) carry NO taints, so regular workloads schedule onto the controllers. - Controllers should run only control-plane and tolerating workloads. ## How - Add `node-taint: node-role.kubernetes.io/control-plane=true:NoSchedule` to `rke2::config_hash` in `hieradata/roles/infra/k8s/control.yaml` (control role only; compute/agent nodes untouched). - `rke2::config_hash` deep-merges, so the taint layers onto the existing control config and renders into `/etc/rancher/rke2/config.yaml` node-taint list. --- hieradata/roles/infra/k8s/control.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hieradata/roles/infra/k8s/control.yaml b/hieradata/roles/infra/k8s/control.yaml index cd7c6c1..a29cca6 100644 --- a/hieradata/roles/infra/k8s/control.yaml +++ b/hieradata/roles/infra/k8s/control.yaml @@ -30,6 +30,9 @@ rke2::config_hash: - '--node-monitor-period=4s' protect-kernel-defaults: true disable-kube-proxy: false + # taint the control-plane/etcd nodes so only tolerating workloads schedule here + node-taint: + - "node-role.kubernetes.io/control-plane=true:NoSchedule" # configure consul service consul::services: