Ensure taint configuration for secondary control-plane nodes (#8363)

roles/kubernetes/control-plane/templates/kubeadm-controlplane.v1beta2.yaml.j2

@@ -19,3 +19,10 @@ controlPlane:
 nodeRegistration:
   name: {{ kube_override_hostname|default(inventory_hostname) }}
   criSocket: {{ cri_socket }}
+{% if inventory_hostname in groups['kube_control_plane'] and inventory_hostname not in groups['kube_node'] %}
+  taints:
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/master
+{% else %}
+  taints: []
+{% endif %}