feat: add option to control workload scheduled on control nodes

defaults/main.yml

@@ -23,6 +23,7 @@ k3s_server_nodes:
 k3s_server_flannel_backend_enabled: True
 k3s_server_network_policy_enabled: True
 k3s_server_cloud_controller_enabled: True
+k3s_server_workload_enabled: True
 k3s_server_feature_gates: []
 
 k3s_server_manifests_templates: []

molecule/rocky9/converge.yml

@@ -8,6 +8,7 @@
     k3s_server_flannel_backend_enabled: False
     k3s_server_network_policy_enabled: False
     k3s_server_cloud_controller_enabled: True
+    k3s_server_workload_enabled: True
     k3s_server_manifests_templates:
       - "calico-installation.yaml.j2"
     k3s_server_manifests_urls:

templates/_internal/node-taint.yaml.j2

@@ -0,0 +1,6 @@
+#jinja2: lstrip_blocks: True
+{% if k3s_server | bool %}
+{% if not k3s_server_workload_enabled | bool %}
+- CriticalAddonsOnly=true:NoExecute
+{% endif %}
+{% endif %}

templates/etc/rancher/k3s/config.yaml.j2

@@ -2,9 +2,14 @@
 ---
 {% set __k3s_kube_apiserver_arg = lookup('template', '_internal/apiserver-arg.yaml.j2') | from_yaml %}
 {% set __k3s_kubelet_arg = lookup('template', '_internal/kubelet-arg.yaml.j2') | from_yaml %}
+{% set __k3s_node_taint = lookup('template', '_internal/node-taint.yaml.j2') | from_yaml %}
 token: "{{ k3s_token }}"
 node-name: "{{ k3s_node_name }}"
 node-ip: "{{ k3s_node_ip }}"
+{% if __k3s_node_taint is iterable %}
+node-taint:
+  {{ __k3s_node_taint | to_nice_yaml(indent=2) | indent(2, False) }}
+{% endif %}
 {% if __k3s_kubelet_arg is iterable %}
 kubelet-arg:
   {{ __k3s_kubelet_arg | to_nice_yaml(indent=2) | indent(2, False) }}