I’m using the latest multi-node playground for k8s and I see that the NodeRestrction admission plugin is enabled there.
But for some reason, I’m still able to set labels from the control plane node on node01 and vice versa.
Why is it possible?
I think you misunderstand what this plugin does.
It does not restrict the administrator from labelling nodes. It prevents kubelet itself from creating/modifying certain labels.
There are various situations where the kublet may modify labels itself…
When the node runs out of resources (e.g., disk or memory), the Kubelet may enter a state where it triggers garbage collection. This can modify labels or node conditions, such as node.kubernetes.io/disk-pressure.
In general, most labels on a node are statically assigned by the cluster administrator or the cloud provider. However, Kubelet automatically manages some dynamic labels related to the node’s operational status, resource pressure, or readiness.