From 8ddff9b626d9c902cfe8b9961b2b0fab293d31bc Mon Sep 17 00:00:00 2001 From: jenkins Date: Tue, 25 Aug 2026 11:05:42 -0300 Subject: [PATCH] infra(core): join titan-24 as an amd64 worker for the image build leg The native amd64 hermes-agent image leg builds on titan-24. Worker membership in this cluster is reconciled by the node-prefer-noschedule CronJob (kubectl label), not Ansible, so add titan-24 there: - clear_worker titan-24 amd64 -> node-role.kubernetes.io/worker=true + hardware=amd64 - a soft PreferNoSchedule guard taint (atlas.bstein.dev/sui-validator=true) mirroring titan-22's media guard, so routine pods do not crowd the out-of-cluster Sui validator that co-hosts titan-24. GPU workloads pinned to titan-24 by hostname are unaffected (PreferNoSchedule never blocks a pinned pod), and the amd64 build pod tolerates this taint explicitly. Operator note: this reconciler does not manage cordons (owned by Ananke recovery). titan-24 is on the recovery uncordon denylist, so the operator must ensure titan-24 is uncordoned/schedulable before the first amd64 build. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf --- .../core/node-prefer-noschedule-cronjob.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/infrastructure/core/node-prefer-noschedule-cronjob.yaml b/infrastructure/core/node-prefer-noschedule-cronjob.yaml index 3e6c092d..0ad10d95 100644 --- a/infrastructure/core/node-prefer-noschedule-cronjob.yaml +++ b/infrastructure/core/node-prefer-noschedule-cronjob.yaml @@ -59,6 +59,7 @@ spec: clear_worker titan-14 rpi4 clear_worker titan-18 rpi4 clear_worker titan-22 amd64 + clear_worker titan-24 amd64 if k get node titan-22 >/dev/null 2>&1; then k label node titan-22 \ @@ -69,6 +70,21 @@ spec: k taint node titan-22 atlas.bstein.dev/media-primary=true:PreferNoSchedule --overwrite=true || true fi + if k get node titan-24 >/dev/null 2>&1; then + # titan-24 (amd64, RTX 3080) co-hosts the out-of-cluster Sui + # validator (docker-compose at /opt/sui-validator). It joins as a + # worker so the native amd64 hermes-agent image leg can build here, + # but a soft guard taint keeps routine pods from crowding the + # validator. GPU workloads pinned to titan-24 by hostname are + # unaffected (PreferNoSchedule never blocks a pinned pod); the + # amd64 build pod tolerates this taint explicitly. + k label node titan-24 \ + atlas.bstein.dev/general-compute=last-resort \ + atlas.bstein.dev/sui-validator=true \ + --overwrite=true || true + k taint node titan-24 atlas.bstein.dev/sui-validator=true:PreferNoSchedule --overwrite=true || true + fi + if k get node titan-23 >/dev/null 2>&1; then k label node titan-23 \ veles.bstein.dev/simulation=true \