Weird, if I add a taint in /etc/rancher/rke2/config.yaml to an already running node in a cluster, restart rke2-server then the taint is not applied.

node-taint:
  - "CriticalAddonsOnly=true:NoExecute"

Though, kubelet is started with what I assume is the correct argument.

--register-with-taints=CriticalAddonsOnly=true:NoExecute

Adding the taint with kubectl works fine.

it’s called

--register-with-taints

. not

--add-taints-after-registered

Ah ok, so I need to add it as an argument to kubelet instead of using node-taint in config.yaml?

no, after it’s registered you need to use kubectl to change the taints or labels

Got it, thanks for helping 🙂

https://docs.rke2.io/advanced/#node-labels-and-taints

RKE2 agents can be configured with the options

node-label

and

node-taint

which adds a label and taint to the kubelet. The two options only add labels and/or taints at registration time, and can only be added once and not removed after that through rke2 commands.

If you want to change node labels and taints after node registration you should use

kubectl

. Refer to the official Kubernetes documentation for details on how to add taints and node labels.

Not sure how I missed that 😞