metropolis/node/kubernetes: move worker services to KubernetesWorker nodes

This finalizes the Big Split. After this change, nodes will only run a
kubelet (and related services) if they have a KubernetesWorker role
attached.

The first node in a new cluster now starts out with KubernetesController
and ConsensusMember. All joined nodes start with no roles attached.

Change-Id: I25a059318450b7d2dd3c19f3653fc15367867693
Reviewed-on: https://review.monogon.dev/c/monogon/+/1380
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/metropolis/cli/metroctl/test/test.go b/metropolis/cli/metroctl/test/test.go
index 872f7b3..064390b 100644
--- a/metropolis/cli/metroctl/test/test.go
+++ b/metropolis/cli/metroctl/test/test.go
@@ -280,44 +280,49 @@
 		})
 	})
 	t.Run("set/unset role", func(t *testing.T) {
-		util.TestEventual(t, "metroctl set/unset role KubernetesController", ctx, 10*time.Second, func(ctx context.Context) error {
+		util.TestEventual(t, "metroctl set/unset role KubernetesWorker", ctx, 10*time.Second, func(ctx context.Context) error {
 			nid := cl.NodeIDs[1]
 			naddr := cl.Nodes[nid].ManagementAddress
 
 			// In this test we'll unset a node role, make sure that it's been in fact
 			// unset, then set it again, and check again. This exercises commands of
-			// the form "metroctl set/unset role KubernetesController [NodeID, ...]".
+			// the form "metroctl set/unset role KubernetesWorker [NodeID, ...]".
 
-			// Check that KubernetesController role is set initially.
+			// Check that KubernetesWorker role is absent initially.
 			var describeArgs []string
 			describeArgs = append(describeArgs, commonOpts...)
 			describeArgs = append(describeArgs, endpointOpts...)
 			describeArgs = append(describeArgs, "node", "describe", "--filter", fmt.Sprintf("node.status.external_address==\"%s\"", naddr))
-			if err := mctlFailIfMissing(t, ctx, describeArgs, "KubernetesController"); err != nil {
+			if err := mctlFailIfFound(t, ctx, describeArgs, "KubernetesWorker"); err != nil {
 				return err
 			}
-			// Remove the role.
+			// Add the role.
+			var setArgs []string
+			setArgs = append(setArgs, commonOpts...)
+			setArgs = append(setArgs, endpointOpts...)
+			setArgs = append(setArgs, "node", "add", "role", "KubernetesWorker", nid)
+			if err := mctlRun(t, ctx, setArgs); err != nil {
+				return err
+			}
+			// Check that the role is set.
+			if err := mctlFailIfMissing(t, ctx, describeArgs, "KubernetesWorker"); err != nil {
+				return err
+			}
+
+			// Remove the role back to the initial value.
 			var unsetArgs []string
 			unsetArgs = append(unsetArgs, commonOpts...)
 			unsetArgs = append(unsetArgs, endpointOpts...)
-			unsetArgs = append(unsetArgs, "node", "remove", "role", "KubernetesController", nid)
+			unsetArgs = append(unsetArgs, "node", "remove", "role", "KubernetesWorker", nid)
 			if err := mctlRun(t, ctx, unsetArgs); err != nil {
 				return err
 			}
 			// Check that the role is unset.
-			if err := mctlFailIfFound(t, ctx, describeArgs, "KubernetesController"); err != nil {
+			if err := mctlFailIfFound(t, ctx, describeArgs, "KubernetesWorker"); err != nil {
 				return err
 			}
-			// Set the role back to the initial value.
-			var setArgs []string
-			setArgs = append(setArgs, commonOpts...)
-			setArgs = append(setArgs, endpointOpts...)
-			setArgs = append(setArgs, "node", "add", "role", "KubernetesController", nid)
-			if err := mctlRun(t, ctx, setArgs); err != nil {
-				return err
-			}
-			// Chack that the role is set.
-			return mctlFailIfMissing(t, ctx, describeArgs, "KubernetesController")
+
+			return nil
 		})
 	})
 }