[anthr76]

Why

Deploying #153 on worker-1 (manual nixos-upgrade, 2026-10-24 20:55 UTC) knocked it out of the cluster:

• The switch changed only scuttle.service, so switch-to-configuration restarted scuttle and left kubelet alone.
• Stopping scuttle drains and deletes the Node. kubelet only registers its Node at startup, so with kubelet still running the Node never came back (uncordon error: nodes "worker-1" not found, Node worker-1 not found after 2 minutes; not recording a uid).
• Its OSD went down, its mon was replaced, and all its pods were garbage-collected, until kubelet was restarted (worker-1 was rebooted).

This hits every worker tonight: their scheduled auto-upgrades (0N:40 UTC) will pull #153, change only scuttle, and delete each Node in turn.

Change

systemd.services.scuttle.restartIfChanged = false. A changed scuttle unit is no longer restarted by a switch; the new definition takes effect the next time kubelet restarts (scuttle is BindsTo kubelet) or on reboot. switch-to-configuration reads X-RestartIfChanged from the new unit, so this also protects the switch that deploys it.

Verification

nix eval of worker-2's scuttle.service unit: X-RestartIfChanged=false, After=... containerd.service (from #153) still present. Not tested on a live node.