WRKLDS-1015: tolerate node-role.kubernetes.io/control-plane:NoExecute

[knelasevero]

Required to be able to advise customers to follow workflow described in openshift/enhancements#1583. If they want to taint control-plane nodes to avoid any other thing to run there (while enforcing it further with validating admission policies), control plane workloads need to tolerate that taint.

[openshift-ci-robot]

@knelasevero: This pull request references WRKLDS-1015 which is a valid jira issue.

In response to this:

Required to be able to advise customers to follow workflow described in openshift/enhancements#1583. If they want to taint control-plane nodes to avoid any other thing to run there (while enforcing it further with validating admission policies), control plane workloads need to tolerate that taint.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[knelasevero]

Not sure if there is some other place where the taint needs to be tolerated

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign elmiko for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[JoelSpeed]

Please update the test suite to ensure that all pods tolerate this taint (we already have examples of this).

What is the status of the EP? It's not merged yet and looks like it still needs substantial review? When are you hoping to merge the EP and the feature in general?

[knelasevero]

/retest

[knelasevero]

Please update the test suite to ensure that all pods tolerate this taint (we already have examples of this).

What is the status of the EP? It's not merged yet and looks like it still needs substantial review? When are you hoping to merge the EP and the feature in general?

The EP started as a feature that we would provide as a new admission plugin/controller, but after review what we are instead providing is basically already available out of the box (well, at least tech preview with ValidatingAdmisionPolicies with CEL). So the EP is now mostly up to have a reference of this workflow that we are/will recommend customers to follow (through documentation).

I will get the EP merged soon.

[knelasevero]

Will update the tests

[openshift-ci]

@knelasevero: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ibmcloud-ovn	d70a33e	link	false	/test e2e-ibmcloud-ovn
ci/prow/vet	d70a33e	link	true	/test vet
ci/prow/e2e-vsphere-ovn	d70a33e	link	false	/test e2e-vsphere-ovn
ci/prow/e2e-openstack-ovn	d70a33e	link	false	/test e2e-openstack-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.