kubeadm: cleanup the "master" taint on CP nodes during upgrade

- iniconfiguration.go: stop applying the "master" taint
for new clusters; update related unit tests in _test.go
- apply.go: Remove logic related to cleanup of the "master" label
during upgrade
- apply.go: Add cleanup of the "master" taint on CP nodes
during upgrade
- controlplane_nodes_test.go: remove test for old "master" taint
on nodes (this needs backport to 1.24, because we have a kubeadm
1.25 vs kubernetes test suite 1.24 e2e test)

cmd/kubeadm/app/cmd/upgrade/apply.go

@@ -155,20 +155,13 @@ func runApply(flags *applyFlags, args []string) error {
 		return errors.Wrap(err, "[upgrade/apply] FATAL")
 	}
 
+	// Clean this up in 1.26
 	// TODO: https://github.com/kubernetes/kubeadm/issues/2200
-	fmt.Printf("[upgrade/postupgrade] Removing the deprecated label %s='' from all control plane Nodes. "+
+	fmt.Printf("[upgrade/postupgrade] Removing the old taint %s from all control plane Nodes. "+
-		"After this step only the label %s='' will be present on control plane Nodes.\n",
+		"After this step only the %s taint will be present on control plane Nodes.\n",
-		kubeadmconstants.LabelNodeRoleOldControlPlane, kubeadmconstants.LabelNodeRoleControlPlane)
+		kubeadmconstants.OldControlPlaneTaint.String(),
-	if err := upgrade.RemoveOldControlPlaneLabel(client); err != nil {
+		kubeadmconstants.ControlPlaneTaint.String())
-		return err
+	if err := upgrade.RemoveOldControlPlaneTaint(client); err != nil {
-	}
-
-	// TODO: https://github.com/kubernetes/kubeadm/issues/2200
-	fmt.Printf("[upgrade/postupgrade] Adding the new taint %s to all control plane Nodes. "+
-		"After this step both taints %s and %s should be present on control plane Nodes.\n",
-		kubeadmconstants.ControlPlaneTaint.String(), kubeadmconstants.ControlPlaneTaint.String(),
-		kubeadmconstants.OldControlPlaneTaint.String())
-	if err := upgrade.AddNewControlPlaneTaint(client); err != nil {
 		return err
 	}
 

cmd/kubeadm/app/phases/upgrade/postupgrade.go

@@ -238,10 +238,10 @@ func RemoveOldControlPlaneLabel(client clientset.Interface) error {
 	return nil
 }
 
-// AddNewControlPlaneTaint finds all nodes with the new "control-plane" node-role label
+// RemoveOldControlPlaneTaint finds all nodes with the new "control-plane" node-role label
-// and adds the new "control-plane" taint to them.
+// and removes the old "control-plane" taint to them.
 // TODO: https://github.com/kubernetes/kubeadm/issues/2200
-func AddNewControlPlaneTaint(client clientset.Interface) error {
+func RemoveOldControlPlaneTaint(client clientset.Interface) error {
 	selectorControlPlane := labels.SelectorFromSet(labels.Set(map[string]string{
 		kubeadmconstants.LabelNodeRoleControlPlane: "",
 	}))
@@ -253,22 +253,21 @@ func AddNewControlPlaneTaint(client clientset.Interface) error {
 	}
 
 	for _, n := range nodes.Items {
-		// Check if the node has the old / new taints
+		// Check if the node has the old taint
 		hasOldTaint := false
-		hasNewTaint := false
+		taints := []v1.Taint{}
 		for _, t := range n.Spec.Taints {
-			switch t.String() {
+			if t.String() == kubeadmconstants.OldControlPlaneTaint.String() {
-			case kubeadmconstants.OldControlPlaneTaint.String():
 				hasOldTaint = true
-			case kubeadmconstants.ControlPlaneTaint.String():
+				continue
-				hasNewTaint = true
 			}
+			// Collect all other taints
+			taints = append(taints, t)
 		}
-		// If the old taint is present and the new taint is missing, patch the node with the new taint.
+		// If the old taint is present remove it
-		// When the old taint is missing, assume the user has manually untainted the node and take no action.
+		if hasOldTaint {
-		if !hasNewTaint && hasOldTaint {
 			err = apiclient.PatchNode(client, n.Name, func(n *v1.Node) {
-				n.Spec.Taints = append(n.Spec.Taints, kubeadmconstants.ControlPlaneTaint)
+				n.Spec.Taints = taints
 			})
 			if err != nil {
 				return err

cmd/kubeadm/app/util/config/initconfiguration.go

@@ -105,8 +105,7 @@ func SetNodeRegistrationDynamicDefaults(cfg *kubeadmapi.NodeRegistrationOptions,
 
 	// Only if the slice is nil, we should append the control-plane taint. This allows the user to specify an empty slice for no default control-plane taint
 	if controlPlaneTaint && cfg.Taints == nil {
-		// TODO: https://github.com/kubernetes/kubeadm/issues/2200
+		cfg.Taints = []v1.Taint{kubeadmconstants.ControlPlaneTaint}
-		cfg.Taints = []v1.Taint{kubeadmconstants.OldControlPlaneTaint, kubeadmconstants.ControlPlaneTaint}
 	}
 
 	if cfg.CRISocket == "" {

cmd/kubeadm/app/util/config/initconfiguration_test.go

@@ -122,7 +122,7 @@ func TestDefaultTaintsMarshaling(t *testing.T) {
 					Kind:       constants.InitConfigurationKind,
 				},
 			},
-			expectedTaintCnt: 2,
+			expectedTaintCnt: 1,
 		},
 		{
 			desc: "Uninitialized taints field produces expected taints",
@@ -133,7 +133,7 @@ func TestDefaultTaintsMarshaling(t *testing.T) {
 				},
 				NodeRegistration: kubeadmapiv1.NodeRegistrationOptions{},
 			},
-			expectedTaintCnt: 2,
+			expectedTaintCnt: 1,
 		},
 		{
 			desc: "Forsing taints to an empty slice produces no taints",

test/e2e_kubeadm/controlplane_nodes_test.go

@@ -32,9 +32,6 @@ import (
 
 const (
 	controlPlaneLabel = "node-role.kubernetes.io/control-plane"
-	// TODO: remove the legacy label in 1.25:
-	// https://github.com/kubernetes/kubeadm/issues/2200
-	controlPlaneLabelLegacy = "node-role.kubernetes.io/master"
 )
 
 // Define container for all the test specification aimed at verifying
@@ -59,11 +56,8 @@ var _ = Describe("control-plane node", func() {
 		gomega.Expect(controlPlanes.Items).NotTo(gomega.BeEmpty(), "at least one node with label %s should exist. if you are running test on a single-node cluster, you can skip this test with SKIP=multi-node", controlPlaneLabel)
 
 		// checks that the control-plane nodes have the expected taints
-		// TODO: remove the legacy taint check in 1.25:
-		// https://github.com/kubernetes/kubeadm/issues/2200
 		for _, cp := range controlPlanes.Items {
 			framework.ExpectNodeHasTaint(f.ClientSet, cp.GetName(), &corev1.Taint{Key: controlPlaneLabel, Effect: corev1.TaintEffectNoSchedule})
-			framework.ExpectNodeHasTaint(f.ClientSet, cp.GetName(), &corev1.Taint{Key: controlPlaneLabelLegacy, Effect: corev1.TaintEffectNoSchedule})
 		}
 	})
 })