Exclude master-node

[Halogenmake]

Good day, I have installed Trivy-Operator 0.19.4 on my cluster. There are 3 master nodes in the cluster, and I would like to prevent the "scan-vulnerabilityreport-*****" jobs from running on these nodes. How can I do this?

[chen-keinan]

@Halogenmake the easy is adding taints to this nodes, so scan-jobs will not schedule to it

[Halogenmake]

@chen-keinan The problem is that although taints are set on these nodes, the jobs are still being launched on them.

[Halogenmake]

Also, with these settings, the node-collector remains in a pending state with the following error: 0/21 nodes are available: 18 node(s) didn't match Pod's node affinity/selector, 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate.

[Halogenmake]

My master nodes has next taints:

  taints:
    - key: node-role.kubernetes.io/master
      effect: NoSchedule

[chen-keinan]

try to add another taint to master node, it should do the work:

kubectl taint nodes <node name> key1=value1:NoSchedule

[Halogenmake]

Unfortunately, I cannot do that as it may disrupt the operation of the installed applications.

[chen-keinan]

another option is adding scanJobAffinity , will it work for you ?