From 6b597a1e387197c2b2ef65d3843bc28c466facd9 Mon Sep 17 00:00:00 2001
From: Erki Aas <erki@veebkolm.ee>
Date: Mon, 21 Sep 2026 09:37:34 +0300
Subject: [PATCH] Add nodeTaintsPolicy to Passmower

---
 passmower/values.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/passmower/values.yaml b/passmower/values.yaml
index 126e319..5a5a8da 100644
--- a/passmower/values.yaml
+++ b/passmower/values.yaml
@@ -118,6 +118,12 @@ topologySpreadConstraints:
   - maxSkew: 1
     topologyKey: kubernetes.io/hostname
     whenUnsatisfiable: DoNotSchedule
+    # Without this the control-plane nodes count as domains holding zero pods,
+    # so min=0 and any surge pod on a worker computes skew=2 and is rejected,
+    # while the masters themselves are unschedulable due to their taint - the
+    # rolling update deadlocks. Honor excludes nodes whose taints we do not
+    # tolerate from the skew calculation. GA since Kubernetes 1.33.
+    nodeTaintsPolicy: Honor
     labelSelector:
       matchLabels:
         app.kubernetes.io/name: passmower