From 1fb9fbc5b06415c0d182d325225c8ffe1e8c22a7 Mon Sep 17 00:00:00 2001
From: Astra Logical <booksandpi@gmail.com>
Date: Thu, 11 Jun 2026 15:53:28 -0400
Subject: [PATCH] Exclude robing from upgrade plan. Move vault node affinity to
 server nodes

---
 plans/k3s-upgrade-plans.yaml          |  4 ++++
 services/vault/vault-statefulset.yaml | 12 ++++++------
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/plans/k3s-upgrade-plans.yaml b/plans/k3s-upgrade-plans.yaml
index cbf64b5..2d8d2ea 100644
--- a/plans/k3s-upgrade-plans.yaml
+++ b/plans/k3s-upgrade-plans.yaml
@@ -31,6 +31,10 @@ spec:
     matchExpressions:
     - key: node-role.kubernetes.io/control-plane
       operator: DoesNotExist
+    - key: kubernetes.io/hostname
+      operator: NotIn
+      values:
+      - robin
   prepare:
     args:
     - prepare
diff --git a/services/vault/vault-statefulset.yaml b/services/vault/vault-statefulset.yaml
index 156ff35..6d52753 100644
--- a/services/vault/vault-statefulset.yaml
+++ b/services/vault/vault-statefulset.yaml
@@ -18,12 +18,12 @@ spec:
       terminationGracePeriodSeconds: 10
       affinity:
         # 1. Pin the pods strictly to K3s server nodes
-        # nodeAffinity:
-        #   requiredDuringSchedulingIgnoredDuringExecution:
-        #     nodeSelectorTerms:
-        #     - matchExpressions:
-        #       - key: node-role.kubernetes.io/control-plane
-        #         operator: Exists
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
 
         # 2. Force those pods onto different physical server nodes
         podAntiAffinity: