fix(unraid): place ordinary system workloads off IMP

clusters/unraid-lab/apps/external-secrets/values.yaml

@@ -3,6 +3,42 @@
 # into the secret this subchart mounts by default.
 bitwarden-sdk-server:
   enabled: true
+  tolerations: &control_plane_toleration
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  affinity: &non_imp_affinity
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: imp.dev/runner
+                operator: DoesNotExist
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+
+global:
+  tolerations: *control_plane_toleration
+  affinity: *non_imp_affinity
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi
+
+webhook:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+
+certController:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
 
 serviceMonitor:
   enabled: false # no Prometheus Operator CRDs on this cluster

values/clusters/unraid-lab/cert-manager.yaml

@@ -1,14 +1,42 @@
-# Keep cert-manager off the Imp runner. It may use a control-plane node.
+# Keep cert-manager on the two non-IMP control-plane nodes.
 tolerations: &control_plane_toleration
   - key: node-role.kubernetes.io/control-plane
     operator: Exists
     effect: NoSchedule
 
+affinity: &non_imp_affinity
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: imp.dev/runner
+              operator: DoesNotExist
+
+resources: &controller_resources
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
 webhook:
   tolerations: *control_plane_toleration
+  affinity: *non_imp_affinity
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
 
 cainjector:
   tolerations: *control_plane_toleration
+  affinity: *non_imp_affinity
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
 
 startupapicheck:
   tolerations: *control_plane_toleration
+  affinity: *non_imp_affinity
+  resources:
+    requests:
+      cpu: 10m
+      memory: 32Mi

values/clusters/unraid-lab/radar.yaml

@@ -9,3 +9,22 @@ ingress:
   tls:
     - hosts:
         - radar-unraid-lab.wind-bearded.ts.net
+
+# Radar may use general control-plane nodes, never the IMP runner.
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: imp.dev/runner
+              operator: DoesNotExist
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi

values/clusters/unraid-lab/tailscale-operator.yaml

@@ -1,3 +1,21 @@
 # Unraid Talos cluster identity.
 proxyConfig:
   defaultTags: "tag:k8s-operator"
+
+# The operator may use general control-plane nodes, never the IMP runner.
+operatorConfig:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: imp.dev/runner
+                operator: DoesNotExist
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi

values/types/homelab-kvm/metrics-server.yaml

@@ -0,0 +1,18 @@
+# Metrics Server may use general control-plane nodes, never the IMP runner.
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: imp.dev/runner
+              operator: DoesNotExist
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 200Mi