added taints to keep regular workloads of master nodes

03-k8s-infra/index.ts

@@ -143,7 +143,7 @@ const longhorn = new k8s.helm.v3.Release(
 );
 
 // Patches Longhorn instances to use the mountend Longhorn storage on the worker nodes.
-const workerLonghornDiskPatches = ["k3s-worker-1", "k3s-worker-2"].map(
+["k3s-worker-1", "k3s-worker-2"].forEach(
   (nodeName) =>
     new k8s.apiextensions.CustomResourcePatch(
       `${nodeName}-longhorn-disks`,
@@ -181,6 +181,22 @@ const controlPlaneTolerations = [
   { key: "node-role.kubernetes.io/control-plane", effect: "NoSchedule" },
 ];
 
+// Keeps regular workloads off the master nodes; kube-vip and
+// kube-vip-cloud-provider below explicitly tolerate these same taints.
+["k3s-master-1", "k3s-master-2", "k3s-master-3"].forEach((nodeName) => {
+  new k8s.core.v1.NodePatch(
+    `${nodeName}-control-plane-taint`,
+    {
+      metadata: {
+        name: nodeName,
+        annotations: { "pulumi.com/patchForce": "true" },
+      },
+      spec: { taints: controlPlaneTolerations },
+    },
+    opts(),
+  );
+});
+
 const kubeVipServiceAccount = new k8s.core.v1.ServiceAccount(
   "kube-vip",
   { metadata: { name: "kube-vip", namespace: kubeVipNamespace } },