From e2cbbd6963c92077c5b47d65773d829589efeec4 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Tue, 5 May 2026 13:34:46 -0300
Subject: [PATCH] scheduling: keep singleton apps off storage nodes

---
 infrastructure/vault-injector/helmrelease.yaml   | 9 +++++++++
 services/bstein-dev-home/backend-deployment.yaml | 9 +++++++++
 services/jenkins/vault-sync-deployment.yaml      | 9 +++++++++
 services/mailu/helmrelease.yaml                  | 9 +++++++++
 4 files changed, 36 insertions(+)

diff --git a/infrastructure/vault-injector/helmrelease.yaml b/infrastructure/vault-injector/helmrelease.yaml
index 6a9c0fd7..db7864be 100644
--- a/infrastructure/vault-injector/helmrelease.yaml
+++ b/infrastructure/vault-injector/helmrelease.yaml
@@ -41,3 +41,12 @@ spec:
         failurePolicy: Ignore
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: NotIn
+                    values: ["titan-13", "titan-15", "titan-17", "titan-19"]
diff --git a/services/bstein-dev-home/backend-deployment.yaml b/services/bstein-dev-home/backend-deployment.yaml
index ba7d6f80..e27d7081 100644
--- a/services/bstein-dev-home/backend-deployment.yaml
+++ b/services/bstein-dev-home/backend-deployment.yaml
@@ -49,6 +49,15 @@ spec:
       nodeSelector:
         kubernetes.io/arch: arm64
         node-role.kubernetes.io/worker: "true"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: NotIn
+                    values: ["titan-13", "titan-15", "titan-17", "titan-19"]
       imagePullSecrets:
         - name: harbor-regcred
       containers:
diff --git a/services/jenkins/vault-sync-deployment.yaml b/services/jenkins/vault-sync-deployment.yaml
index 6abcacef..c2c5e00f 100644
--- a/services/jenkins/vault-sync-deployment.yaml
+++ b/services/jenkins/vault-sync-deployment.yaml
@@ -18,6 +18,15 @@ spec:
       nodeSelector:
         kubernetes.io/arch: arm64
         node-role.kubernetes.io/worker: "true"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: NotIn
+                    values: ["titan-13", "titan-15", "titan-17", "titan-19"]
       containers:
         - name: sync
           image: alpine:3.20
diff --git a/services/mailu/helmrelease.yaml b/services/mailu/helmrelease.yaml
index 0249c589..999f6832 100644
--- a/services/mailu/helmrelease.yaml
+++ b/services/mailu/helmrelease.yaml
@@ -764,6 +764,15 @@ spec:
               spec:
                 template:
                   spec:
+                    affinity:
+                      nodeAffinity:
+                        preferredDuringSchedulingIgnoredDuringExecution:
+                          - weight: 100
+                            preference:
+                              matchExpressions:
+                                - key: kubernetes.io/hostname
+                                  operator: NotIn
+                                  values: ["titan-13", "titan-15", "titan-17", "titan-19"]
                     containers:
                       - name: tika
                         env: