[0xmichalis]

Summary

• The cordon and taint adapters are controllers, so controller-runtime runs them on the leader only. Every replica serves the eviction webhook, though, and standInReady consults that replica's own in-memory signal.Registry. On a replica without the lease the registry never holds cordon or taint dooms. With replicaCount: 2, the production recommendation, an eviction served by the standby is admitted while the only ready stand-in sits on another cordoned or tainted node (a node pool upgrade or a multi-node drain), where the leader would correctly keep holding.
• Set NeedLeaderElection: false on both adapters. They only read nodes from the shared cache and write the in-memory registry, so running them on every replica is safe and adds no API writes.
• Docs: README Safety and how-it-works Failure behaviour now say every replica watches node signals.
• Out of scope: doom signals from the eviction webhook itself stay per replica, so the leader learns of an eviction-only drainer from the retries it serves.

Verification

• New envtest spec starts a second manager whose leader lease is held by another identity. On main its registry never sees a cordoned or a tainted node (the spec times out). With this change both appear, and the manager never becomes leader.
• make test lint build and the ARGO_ROLLOUTS_CRD= "Optional Rollout API" run: passed, no generated-file drift.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.