controller: drain: extract node taint and pod drain primitives

charts/gpu-base-operator/templates/role.yaml

@@ -31,6 +31,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/eviction
+  verbs:
+  - create
 - apiGroups:
   - admissionregistration.k8s.io
   resources:

cmd/main.go

@@ -17,6 +17,7 @@ limitations under the License.
 package main
 
 import (
+	"context"
 	"crypto/tls"
 	"flag"
 	"os"
@@ -346,6 +347,13 @@ func main() {
 		ModuleLoaderServiceAccountName: moduleLoaderSAName,
 	}
 
+	// Registered here rather than in a controller's SetupWithManager: the index is shared by
+	// every controller that drains a node, and controller-runtime allows only one registration.
+	if err := controller.SetupDrainIndices(context.Background(), mgr); err != nil {
+		setupLog.Error(err, "unable to set up drain cache indexes")
+		os.Exit(1)
+	}
+
 	if err := (&controller.ClusterPolicyReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),

config/rbac/role.yaml

@@ -31,6 +31,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/eviction
+  verbs:
+  - create
 - apiGroups:
   - admissionregistration.k8s.io
   resources: