- 3 replicas with pod anti-affinity on physical-host topology key - Tolerate control-plane taint so pods can schedule on cp nodes