k.rennerandClaude Opus 4.7
da76201f1c
Reverts the bootstrap.sh kubectl-taint hack and fixes it properly in the Talos machine config. Talos machine.nodeTaints is silently ineffective on workers — NodeRestriction admission blocks post-join taint writes by worker kubelets. Kubelets CAN register with taints via the --register-with-taints flag, so pass it through kubelet.extraArgs and the taint lands at node registration instead of post-hoc reconcile. Also drops the workload-class nodeLabel (same NodeRestriction issue: arbitrary-namespace labels aren't kubelet-settable); only the kubernetes.io zone label stays since that one is on the allow-list. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>