Exclude robing from upgrade plan. Move vault node affinity to server nodes

plans/k3s-upgrade-plans.yaml

@@ -31,6 +31,10 @@ spec:
     matchExpressions:
     - key: node-role.kubernetes.io/control-plane
       operator: DoesNotExist
+    - key: kubernetes.io/hostname
+      operator: NotIn
+      values:
+      - robin
   prepare:
     args:
     - prepare

services/vault/vault-statefulset.yaml

@@ -18,12 +18,12 @@ spec:
       terminationGracePeriodSeconds: 10
       affinity:
         # 1. Pin the pods strictly to K3s server nodes
-        # nodeAffinity:
-        #   requiredDuringSchedulingIgnoredDuringExecution:
-        #     nodeSelectorTerms:
-        #     - matchExpressions:
-        #       - key: node-role.kubernetes.io/control-plane
-        #         operator: Exists
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
 
         # 2. Force those pods onto different physical server nodes
         podAntiAffinity: