Re-check of lab1 after Steps 4-5 (inspector on lab-mgmt, read-only gets
on lab1):
- Cluster/KCP/MD Available for 13h; no controller errors since bootstrap.
- All six autoscaler annotations on lab1-workers (copied to the
MachineSet). spec.replicas has no owner: kubectl-client-side-apply owns
only clusterName/selector/template, so re-applying lab1.yaml won't
fight cluster-autoscaler.
- Nodes Ready on v1.35.9; Node/Machine providerIDs match.
- Cilium, envoy and CoreDNS healthy. No PDBs in the cluster.
Found: cilium-operator (replicas: 1) was scheduled onto the only worker.
It is a non-DaemonSet kube-system pod without a PDB, so with CA's default
skip-nodes-with-system-pods=true the last worker could never scale to
zero (Step 7). The chart already tolerates the control-plane taint, so a
nodeSelector on node-role.kubernetes.io/control-plane pins it there.
- configs/cilium/values.yaml: operator.nodeSelector.
- phase-1 doc: Step 5 ticked, Step 4 explains why replicas: 1 isn't
enough, new troubleshooting row.
- Session note extended with the re-check.
Not applied yet: the owner runs helm upgrade with the new values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- runbook + inspector agent: ipaddresses.ipam.cluster.x-k8s.io (plain
`ipaddresses` is the built-in networking.k8s.io type on k8s 1.35)
- inspector RBAC: get/list CRDs so clusterctl describe works read-only
- phase-1 Step 3 ticked; session note with the first lab1 review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kacerrandClaude Opus 5.5