UPSTREAM: <carry>: noderestrictions: add node-role.kubernetes.io/* to allowed node labels

Server side validation of node labels was added in kubernetes#90307. We only disabled kubelet-side validation before to make our node role labels work.

UPSTREAM: <carry>: add control plane to allow roles

OpenShift-Rebase-Source: 38bfed3
OpenShift-Rebase-Source: aff4434

Author: sttts

staging/src/k8s.io/kubelet/pkg/apis/well_known_labels.go

@@ -45,6 +45,12 @@ var kubeletLabels = sets.NewString(
 
 	LabelOS,
 	LabelArch,
+
+	// These are special for OpenShift:
+	"node-role.kubernetes.io/control-plane",
+	"node-role.kubernetes.io/master",
+	"node-role.kubernetes.io/worker",
+	"node-role.kubernetes.io/etcd",
 )
 
 var kubeletLabelNamespaces = sets.NewString(