kacerrandClaude Opus 5.5
81462e0e0f
Re-check of lab1 after Steps 4-5 (inspector on lab-mgmt, read-only gets on lab1): - Cluster/KCP/MD Available for 13h; no controller errors since bootstrap. - All six autoscaler annotations on lab1-workers (copied to the MachineSet). spec.replicas has no owner: kubectl-client-side-apply owns only clusterName/selector/template, so re-applying lab1.yaml won't fight cluster-autoscaler. - Nodes Ready on v1.35.9; Node/Machine providerIDs match. - Cilium, envoy and CoreDNS healthy. No PDBs in the cluster. Found: cilium-operator (replicas: 1) was scheduled onto the only worker. It is a non-DaemonSet kube-system pod without a PDB, so with CA's default skip-nodes-with-system-pods=true the last worker could never scale to zero (Step 7). The chart already tolerates the control-plane taint, so a nodeSelector on node-role.kubernetes.io/control-plane pins it there. - configs/cilium/values.yaml: operator.nodeSelector. - phase-1 doc: Step 5 ticked, Step 4 explains why replicas: 1 isn't enough, new troubleshooting row. - Session note extended with the re-check. Not applied yet: the owner runs helm upgrade with the new values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 lines
567 B
YAML
9 lines
567 B
YAML
# helm upgrade --install cilium cilium/cilium --version 1.20.2 -n kube-system -f values.yaml
|
|
# into the workload cluster (lab1), not the management cluster
|
|
ipam:
|
|
mode: kubernetes # use the node podCIDRs from Cluster.spec.clusterNetwork (10.244.0.0/16), not 10.0.0.0/8
|
|
operator:
|
|
replicas: 1 # default 2 with node anti-affinity would pin one to a worker and block scale-to-zero
|
|
nodeSelector: # replicas: 1 alone still let the scheduler pick the worker; chart tolerates the CP taint
|
|
node-role.kubernetes.io/control-plane: ""
|