From 189fe17cf64aad74ae56990198dbb969561f34cb Mon Sep 17 00:00:00 2001
From: kasun <kasun.jayatilaka@gmail.com>
Date: Sun, 5 Jul 2026 19:17:54 +0200
Subject: [PATCH] added taints to keep regular workloads of master nodes

---
 03-k8s-infra/index.ts | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/03-k8s-infra/index.ts b/03-k8s-infra/index.ts
index 1af3eab..cc901ab 100644
--- a/03-k8s-infra/index.ts
+++ b/03-k8s-infra/index.ts
@@ -143,7 +143,7 @@ const longhorn = new k8s.helm.v3.Release(
 );
 
 // Patches Longhorn instances to use the mountend Longhorn storage on the worker nodes.
-const workerLonghornDiskPatches = ["k3s-worker-1", "k3s-worker-2"].map(
+["k3s-worker-1", "k3s-worker-2"].forEach(
   (nodeName) =>
     new k8s.apiextensions.CustomResourcePatch(
       `${nodeName}-longhorn-disks`,
@@ -181,6 +181,22 @@ const controlPlaneTolerations = [
   { key: "node-role.kubernetes.io/control-plane", effect: "NoSchedule" },
 ];
 
+// Keeps regular workloads off the master nodes; kube-vip and
+// kube-vip-cloud-provider below explicitly tolerate these same taints.
+["k3s-master-1", "k3s-master-2", "k3s-master-3"].forEach((nodeName) => {
+  new k8s.core.v1.NodePatch(
+    `${nodeName}-control-plane-taint`,
+    {
+      metadata: {
+        name: nodeName,
+        annotations: { "pulumi.com/patchForce": "true" },
+      },
+      spec: { taints: controlPlaneTolerations },
+    },
+    opts(),
+  );
+});
+
 const kubeVipServiceAccount = new k8s.core.v1.ServiceAccount(
   "kube-vip",
   { metadata: { name: "kube-vip", namespace: kubeVipNamespace } },