unkinben
b85b7c207e
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
## Why - The 3 control-plane/etcd nodes (prodnxsr0001/0002/0003, roles::infra::k8s::control) carry NO taints, so regular workloads schedule onto the controllers. - Controllers should run only control-plane and tolerating workloads. ## How - Add `node-taint: node-role.kubernetes.io/control-plane=true:NoSchedule` to `rke2::config_hash` in `hieradata/roles/infra/k8s/control.yaml` (control role only; compute/agent nodes untouched). - `rke2::config_hash` deep-merges, so the taint layers onto the existing control config and renders into `/etc/rancher/rke2/config.yaml` node-taint list.