Specify node taint on node join

[andrewrynhard]

Similar to #202, we should have an option to taint a node on join. One use case is when a cluster would have a set of nodes dedicated for ingress-controllers. A DaemonSet could be deployed that can use the label option in #202, and the taint option here. Otherwise this is a manual process.

[fabriziopandini]

I'm working on a PR on this and #202

[luxas]

See my comment: #202 (comment)

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[errordeveloper]

/remove-lifecycle stale

[timothysc]

/assign @fabriziopandini @timothysc

@fabriziopandini Is there anything left todo.

[fabriziopandini]

@timothysc this is still not addressed.

Following options were considered and then discarded:

1. generate systemd drop-ins and restart kubelet
2. use dynamic kubelet config

The only option left on the table is to wait for the node to join and then send labels to the apiserver, but it is kind of risky for worker nodes - were the only identity you get is the token - (see #202 (comment) from JBeda).

IMO we can create all the necessary facilities and the let the user explicitly opt-in:

• create a new phase that generates a new RBAC role that allows to taint/label and nodes (but not assign tokens to this rule)
• let the user to use kubeadm create token to create additional tokens assigned to the above role
• modify kubeadm join for applying labels/taint or fail gracefully if the token doesn't have necessary grants.

WDYT?

[timothysc]

So the auth folks have ki-boshed this idea as a sec-hole.

kubernetes/kubernetes#63167

I think we're going to have to admin control.