Missing tolerations for hcloud-csi-controller Deployment

[geo-schloesser]

TL;DR

The hcloud-csi-node DaemonSet in deploy/kubernetes/hcloud-csi.yml includes tolerations, but the hcloud-csi-controller Deployment doesnt.

This causes the controller to fail scheduling in clusters where control-plane nodes are tainted by default.

I am using version 2.18.3, but the problem still exists in 2.19.1

Expected behavior

kubectl get pods -n kube-system | grep csi

hcloud-csi-controller-xxxxxxxxx-xxxxx 5/5 Running 0 5m
hcloud-csi-node-xxxxx 3/3 Running 0 5m

Observed behavior

kubectl get pods -n kube-system | grep csi

hcloud-csi-controller-xxxxxxxxx-xxxxx 0/5 Pending 0 5m
hcloud-csi-node-xxxxx 3/3 Running 0 5m

Minimal working example

Add the tolerations to the hcloud-csi-controller Deployment

tolerations:
  - key: CriticalAddonsOnly
    operator: Exists

Log output

Additional information

No response

[lukasmetzner]

This causes the controller to fail scheduling in clusters where control-plane nodes are tainted by default.

CriticalAddonsOnly does not bypass the node-role.kubernetes.io/control-plane:NoSchedule taint. We would additionally need to tolerate node-role.kubernetes.io/control-plane:NoSchedule.

The Deployment and DaemonSet do not specify a priorityClassName, so the CriticalAddonsOnly tolerations should also no work as expected.

In conclusion, we probably want to add the priorityClassName to the Deploment and DaemonSet and add the CriticalAddonsOnly toleration to the Deployment.

We can evaluate if tolerating the control-plane taint is necessary/wanted by default.