From 440aec861e4657d2c5f3bfb1bff5ed5dc7c31380 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Wed, 20 May 2026 19:18:34 -0300
Subject: [PATCH] comms(mas): keep auth service off control plane

---
 services/comms/mas-deployment.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/services/comms/mas-deployment.yaml b/services/comms/mas-deployment.yaml
index e5387e23..4d82aed4 100644
--- a/services/comms/mas-deployment.yaml
+++ b/services/comms/mas-deployment.yaml
@@ -68,8 +68,16 @@ spec:
             - "othrys-synapse-matrix-synapse.comms.svc.cluster.local"
       nodeSelector:
         hardware: rpi5
+        node-role.kubernetes.io/worker: "true"
       affinity:
         nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+                  - key: node-role.kubernetes.io/master
+                    operator: DoesNotExist
           preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 50
               preference: