stage
master
- Mask kubelet service entirely before nixos-rebuild to prevent systemd from restarting it during switch - Unmask kubelet in th-kubeadm-init/join scripts before starting