Re-check of lab1 after Steps 4-5 (inspector on lab-mgmt, read-only gets
on lab1):
- Cluster/KCP/MD Available for 13h; no controller errors since bootstrap.
- All six autoscaler annotations on lab1-workers (copied to the
MachineSet). spec.replicas has no owner: kubectl-client-side-apply owns
only clusterName/selector/template, so re-applying lab1.yaml won't
fight cluster-autoscaler.
- Nodes Ready on v1.35.9; Node/Machine providerIDs match.
- Cilium, envoy and CoreDNS healthy. No PDBs in the cluster.
Found: cilium-operator (replicas: 1) was scheduled onto the only worker.
It is a non-DaemonSet kube-system pod without a PDB, so with CA's default
skip-nodes-with-system-pods=true the last worker could never scale to
zero (Step 7). The chart already tolerates the control-plane taint, so a
nodeSelector on node-role.kubernetes.io/control-plane pins it there.
- configs/cilium/values.yaml: operator.nodeSelector.
- phase-1 doc: Step 5 ticked, Step 4 explains why replicas: 1 isn't
enough, new troubleshooting row.
- Session note extended with the re-check.
Not applied yet: the owner runs helm upgrade with the new values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ipam.mode=kubernetes, operator.replicas=1 (default 2 would pin one on a
worker and block scale-to-zero). Keys checked against chart 1.20.2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kacerrandClaude Opus 5.5