fix: tolerate control-plane taint when pinning Flux to cp1

Flux bootstrap patches the controllers onto k8s-cluster-cp-1, but the
control-plane node is tainted NoSchedule. Add the matching toleration in both
the checked-in patch manifest and the bootstrap workflow so the controllers can
actually schedule and roll out on cp-1.

.gitea/workflows/deploy.yml

@@ -214,11 +214,12 @@ jobs:
           kubectl apply -f clusters/prod/flux-system/gitrepository-platform.yaml
           kubectl apply -f clusters/prod/flux-system/kustomization-infrastructure.yaml
           kubectl apply -f clusters/prod/flux-system/kustomization-apps.yaml
-          # Patch Flux controllers to run on cp-1 only
+          # Patch Flux controllers to run on cp-1 and tolerate the control-plane taint
-          kubectl -n flux-system patch deployment source-controller --type='merge' -p='{"spec":{"template":{"spec":{"nodeSelector":{"kubernetes.io/hostname":"k8s-cluster-cp-1"}}}}}'
+          PATCH='{"spec":{"template":{"spec":{"nodeSelector":{"kubernetes.io/hostname":"k8s-cluster-cp-1"},"tolerations":[{"key":"node-role.kubernetes.io/control-plane","operator":"Exists","effect":"NoSchedule"}]}}}}'
-          kubectl -n flux-system patch deployment kustomize-controller --type='merge' -p='{"spec":{"template":{"spec":{"nodeSelector":{"kubernetes.io/hostname":"k8s-cluster-cp-1"}}}}}'
+          kubectl -n flux-system patch deployment source-controller --type='merge' -p="$PATCH"
-          kubectl -n flux-system patch deployment helm-controller --type='merge' -p='{"spec":{"template":{"spec":{"nodeSelector":{"kubernetes.io/hostname":"k8s-cluster-cp-1"}}}}}'
+          kubectl -n flux-system patch deployment kustomize-controller --type='merge' -p="$PATCH"
-          kubectl -n flux-system patch deployment notification-controller --type='merge' -p='{"spec":{"template":{"spec":{"nodeSelector":{"kubernetes.io/hostname":"k8s-cluster-cp-1"}}}}}'
+          kubectl -n flux-system patch deployment helm-controller --type='merge' -p="$PATCH"
+          kubectl -n flux-system patch deployment notification-controller --type='merge' -p="$PATCH"
           kubectl -n flux-system rollout status deployment/source-controller --timeout=180s
           kubectl -n flux-system rollout status deployment/kustomize-controller --timeout=180s
           kubectl -n flux-system rollout status deployment/helm-controller --timeout=180s

clusters/prod/flux-system/gotk-controller-cp1-patches.yaml

@@ -8,6 +8,10 @@ spec:
     spec:
       nodeSelector:
         kubernetes.io/hostname: k8s-cluster-cp-1
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -19,6 +23,10 @@ spec:
     spec:
       nodeSelector:
         kubernetes.io/hostname: k8s-cluster-cp-1
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -30,6 +38,10 @@ spec:
     spec:
       nodeSelector:
         kubernetes.io/hostname: k8s-cluster-cp-1
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -41,3 +53,7 @@ spec:
     spec:
       nodeSelector:
         kubernetes.io/hostname: k8s-cluster-cp-1
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule