atlas-iac/infrastructure/core/node-prefer-noschedule-cronjob.yaml

# infrastructure/core/node-prefer-noschedule-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: node-prefer-noschedule
  namespace: kube-system
spec:
  schedule: "* * * * *"
  concurrencyPolicy: Replace
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 0
      template:
        spec:
          serviceAccountName: node-prefer-noschedule
          restartPolicy: Never
          containers:
            - name: taint
              image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
              command:
                - /usr/bin/env
                - bash
                - -ceu
                - |
                  KUBE_TOKEN_PATH="/var/run/secrets/kubernetes.io/serviceaccount/token"
                  KUBE_CA_PATH="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
                  KUBE_SERVER="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS:-443}"

                  k() {
                    kubectl \
                      --server="${KUBE_SERVER}" \
                      --certificate-authority="${KUBE_CA_PATH}" \
                      --token="$(cat "${KUBE_TOKEN_PATH}")" \
                      --request-timeout=10s \
                      "$@"
                  }

                  clear_worker() {
                    local node="${1}"
                    local hardware="${2}"
                    if k get node "${node}" >/dev/null 2>&1; then
                      k label node "${node}" node-role.kubernetes.io/worker=true "hardware=${hardware}" --overwrite=true || true
                      k label node "${node}" node-role.kubernetes.io/storage-backbone- || true
                      k label node "${node}" atlas.bstein.dev/spillover- || true
                      # Recovery cordons are owned by Ananke, not this role reconciler.
                    else
                      echo "skipping missing node ${node}"
                    fi
                  }

                  clear_worker titan-04 rpi5
                  clear_worker titan-05 rpi5
                  clear_worker titan-07 rpi5
                  clear_worker titan-08 rpi5
                  clear_worker titan-11 rpi5
                  clear_worker titan-12 rpi4
                  clear_worker titan-14 rpi4
                  clear_worker titan-18 rpi4
                  clear_worker titan-22 amd64
                  clear_worker titan-24 amd64

                  if k get node titan-22 >/dev/null 2>&1; then
                    k label node titan-22 \
                      atlas.bstein.dev/general-compute=last-resort \
                      atlas.bstein.dev/media-primary=true \
                      --overwrite=true || true
                    # Keep spare capacity available without letting routine pods displace media service.
                    k taint node titan-22 atlas.bstein.dev/media-primary=true:PreferNoSchedule --overwrite=true || true
                  fi

                  if k get node titan-24 >/dev/null 2>&1; then
                    # titan-24 (amd64, RTX 3080) co-hosts the out-of-cluster Sui
                    # validator (docker-compose at /opt/sui-validator). It joins as a
                    # worker so the native amd64 hermes-agent image leg can build here,
                    # but a soft guard taint keeps routine pods from crowding the
                    # validator. GPU workloads pinned to titan-24 by hostname are
                    # unaffected (PreferNoSchedule never blocks a pinned pod); the
                    # amd64 build pod tolerates this taint explicitly.
                    k label node titan-24 \
                      atlas.bstein.dev/general-compute=last-resort \
                      atlas.bstein.dev/sui-validator=true \
                      --overwrite=true || true
                    k taint node titan-24 atlas.bstein.dev/sui-validator=true:PreferNoSchedule --overwrite=true || true
                  fi

                  if k get node titan-23 >/dev/null 2>&1; then
                    k label node titan-23 \
                      veles.bstein.dev/simulation=true \
                      veles.bstein.dev/node-pool=oceanus \
                      cassandra.bstein.dev/simulation=true \
                      cassandra.bstein.dev/node-pool=oceanus \
                      node-role.kubernetes.io/veles-sim=true \
                      node-role.kubernetes.io/cassandra-sim=true \
                      longhorn-host=true \
                      hardware=oceanus \
                      --overwrite=true || true
                    k label node titan-23 node-role.kubernetes.io/worker- || true
                    k taint node titan-23 veles.bstein.dev/simulation=true:NoSchedule --overwrite=true || true
                  else
                    echo "skipping missing node titan-23"
                  fi

                  if k get node titan-21 >/dev/null 2>&1; then
                    # The Tegra iSCSI initiator cannot host Longhorn engines.
                    k label node titan-21 longhorn-host- || true
                  else
                    echo "skipping missing node titan-21"
                  fi

                  for node in titan-13 titan-15 titan-17 titan-19; do
                    if k get node "${node}" >/dev/null 2>&1; then
                      k label node "${node}" \
                        atlas.bstein.dev/spillover=true \
                        longhorn-host=true \
                        node-role.kubernetes.io/worker=true \
                        node-role.kubernetes.io/storage-backbone=true \
                        --overwrite=true || true
                      k taint node "${node}" longhorn=true:PreferNoSchedule --overwrite=true || true
                      k taint node "${node}" atlas.bstein.dev/spillover=true:PreferNoSchedule --overwrite=true || true
                    else
                      echo "skipping missing node ${node}"
                    fi
                  done