NVIDIA / nodewright / 31729021845

79%

push

github

feat(operator): default runtime-required taint key to nodewright.nvidia.com (#452)

* feat(operator): default runtime-required taint key to nodewright.nvidia.com

The taint key is a coordination point with infrastructure the operator cannot
see: autoscaler and Karpenter node pools, machine templates, kubelet
--register-with-taints arguments, and tolerations on users' own workloads all
name it. Flipping the default alone would leave nodes carrying a key nothing
removes, sitting unschedulable, which is a cluster-down failure mode for anyone
using autoTaintNewNodes.

The operator therefore now separates the taint it applies from the taints it
recognises. It applies only the configured taint, but tolerates and removes the
legacy skyhook.nvidia.com key as well for the deprecation window, and treats a
node already carrying either key as gated so autoTaintNewNodes and the
post-reboot re-taint do not stack a second taint. Existing taints on existing
nodes are never rewritten.

Also fixes config/manager/manager.yaml setting RUNTIME_REQUIRED_TAINT_KEY, which
the operator never reads, so a kustomize install silently ignored the value in
the manifest and fell back to the built-in default.

The runtime-required chainsaw suite deliberately stays on the legacy key as the
deprecation-window coverage; auto-taint-new-nodes covers the current key.

Closes #439

Signed-off-by: Brian Lockwood <lockwobr@gmail.com>

* docs(operator): runtime-required does not require pre-tainted nodes with autoTaintNewNodes

The prerequisite claimed a node MUST join the cluster already carrying the
runtime-required taint. That is only true for the pre-taint path: with
autoTaintNewNodes: true the operator applies the taint itself, which is the
documented fallback for exactly the case where you cannot taint at provisioning
time. The page contradicted itself two sections later.

Spell out both paths, and note that key recognition matters for both since an
unrecognised taint is never removed. S... (continued)

52 of 52 new or added lines in 2 files covered. (100.0%)

10144 of 12859 relevant lines covered (78.89%)

7.92 hits per line