fix(t8s-cluster/workload-cluster): add missing tolerations

[cwrau]

Summary by CodeRabbit

• Improvements
  • Enhanced cluster networking component resilience by improving node scheduling tolerance handling during node initialization and readiness state transitions.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[gemini-code-assist]

Summary of Changes

Hello @cwrau, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the robustness of the Cilium CNI deployment in the t8s-cluster workload cluster by adding essential tolerations. These additions ensure that Cilium pods can be successfully scheduled on nodes that may temporarily carry specific taints, preventing potential networking issues during node initialization or readiness transitions.

Highlights

• Cilium CNI Tolerations: Added two new tolerations, node.cloudprovider.kubernetes.io/uninitialized and node.kubernetes.io/not-ready, to the Cilium CNI DaemonSet configuration within the workload cluster template.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

📝 Walkthrough

Walkthrough

Added two tolerations to the hosted control plane Cilium configuration: one for uninitialized cloud provider nodes and another for not-ready nodes. These tolerations enable pod scheduling on nodes with corresponding taints.

Changes

Cohort / File(s)	Summary
Cilium CNI Tolerations charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml	Added two new tolerations under hosted control plane: node.cloudprovider.kubernetes.io/uninitialized (NoSchedule, value: "true") and node.kubernetes.io/not-ready (NoSchedule)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• fix(t8s-cluster/workload-cluster): add toleration for cilium-operator #1930: Modifies the same Cilium CNI tolerations for hosted control planes with an alternative uninitialized taint toleration configuration.

Suggested labels

t8s-cluster

Suggested reviewers

• marvinWolff
• teutonet-bot
• tasches

Poem

🐰 Cilium now bends to node misfortune's way,
Two tolerations bloom where taints held sway,
Uninitialized clouds and not-ready states—
No longer barriers at scheduling's gates! 🚀

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding missing tolerations to the workload cluster configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR adds missing tolerations to the Cilium CNI operator configuration for hosted control plane workload clusters. The changes ensure that the Cilium operator can be scheduled on nodes that are uninitialized by the cloud provider or not yet ready, which is critical for cluster bootstrapping.

Changes:

• Added two new tolerations to the Cilium operator: one for node.cloudprovider.kubernetes.io/uninitialized and one for node.kubernetes.io/not-ready

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gemini-code-assist]

Code Review

This pull request adds tolerations for Cilium to handle uninitialized and not-ready nodes in a hosted control plane setup. The intent is correct and necessary for cluster stability. However, there are a couple of issues with the implementation. First, the tolerations for the Cilium operator are placed incorrectly in the Helm values, which will cause them to be ignored. This is a critical issue that needs to be fixed. Second, other essential Cilium components like the agent, Hubble Relay, and Hubble UI also require these tolerations to function correctly during cluster bootstrap and node lifecycle events, but they are missing. I've provided detailed comments on how to address both of these points.

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@charts/t8s-cluster/templates/workload-cluster/cni-cilium.yaml`:
- Around line 103-104: The toleration for the taint key
"node.kubernetes.io/not-ready" is using effect "NoSchedule" but should use
"NoExecute"; update the toleration entry for key node.kubernetes.io/not-ready in
the Cilium workload template (the toleration block where key:
node.kubernetes.io/not-ready is defined) to set effect: NoExecute so pods that
don't tolerate that taint will be evicted as expected; keep any existing
tolerationSeconds or operator fields intact when making this change.