Support removal of node labels via inventory variables

[broboa]

What would you like to be added

The node_labels inventory variables should support removal operations:

Allow null values to remove labels

node_labels:
  remove_this: null

Currently, kubespray only adds/updates labels. Removing them requires manual kubectl commands.

Proposed Change

--- a/roles/kubernetes/node-label/tasks/main.yml
+++ b/roles/kubernetes/node-label/tasks/main.yml
@@ -24,7 +24,7 @@

 - name: Populate inventory node label
   set_fact:
-    inventory_node_labels: "{{ inventory_node_labels + ['%s=%s' | format(item.key, item.value)] }}"
+    inventory_node_labels: "{{ inventory_node_labels + [('%s-' | format(item.key)) if item.value is none else ('%s=%s' | format(item.key, item.value))] }}"
   loop: "{{ node_labels | d({}) | dict2items }}"
   when:
     - node_labels is defined

Why is this needed

When managing node labels declaratively through inventory, there's no way to remove previously applied labels without manual intervention. This breaks the declarative model and requires out-of-band operations to clean up obsolete labels/taints.

Supporting removal syntax allows full lifecycle management of node labels through kubespray inventory.

[VannTen]

Note: I think node labels removal should work with SSA (unlike taints :/ ) so that we only remove the labels we applied and not some applied by other controllers 🤔

[broboa]

Not sure what SSA is, but at least I need it to remove the node.kubernetes.io/exclude-from-external-load-balancers which certainly isn't created by Kubespray.

[VannTen]

SSA is server side apply, sorry for the acronym.

So it's not about previously declared labels then. I'm not sure we should interfere with other client labeling the nodes ; which controller / thing is applying that specific label ?

[broboa]

I think it's created by default on the control plane nodes. I have a use-case where I might need MetalLB Virtual IP announcements to happen from the control plane nodes, and by default MetalLB won't do that if it finds that label on a node.

But IMO; leave it up to users to decide which labels to manage or not - no matter if they weren't originally applied by Kubespray.