feat: label the k3s server nodes as capable of fronting traffic

The idea here is that only k3s nodes can/should handle certificate requests. While users may wish to force these onto dedicated lb nodes in the future, at least for now, separating app workloads with routing seems like an okay trade-off.

plugins/scheduler-k3s/subcommands.go

@@ -246,6 +246,20 @@ func CommandInitialize(taintScheduling bool) error {
 	if upgradeCmd.ExitCode != 0 {
 		return fmt.Errorf("Invalid exit code from kubectl command: %d", upgradeCmd.ExitCode)
 	}
+	common.LogInfo2Quiet("Labeling node svccontroller.k3s.cattle.io/enablelb=true")
+	clientset, err := NewKubernetesClient()
+	if err != nil {
+		return fmt.Errorf("Unable to create kubernetes client: %w", err)
+	}
+
+	err = clientset.LabelNode(context.Background(), LabelNodeInput{
+		Name:  nodeName,
+		Key:   "svccontroller.k3s.cattle.io/enablelb",
+		Value: "true",
+	})
+	if err != nil {
+		return fmt.Errorf("Unable to patch node: %w", err)
+	}
 
 	common.LogVerboseQuiet("Done")
 
@@ -511,6 +525,16 @@ func CommandClusterAdd(role string, remoteHost string, allowUknownHosts bool, ta
 		if err != nil {
 			return fmt.Errorf("Unable to patch node: %w", err)
 		}
+	} else {
+		common.LogInfo2Quiet("Labeling node svccontroller.k3s.cattle.io/enablelb=true")
+		err = clientset.LabelNode(ctx, LabelNodeInput{
+			Name:  nodes[0].Name,
+			Key:   "svccontroller.k3s.cattle.io/enablelb",
+			Value: "true",
+		})
+		if err != nil {
+			return fmt.Errorf("Unable to patch node: %w", err)
+		}
 	}
 
 	common.LogInfo2Quiet("Annotating node with connection information")