KCS article on how to protect control-plane nodes before OCP provides the protection by default (for 4.16 and down)

Compose a KCS article that will guide user to:

• adjust every workload eligible for running on any control plane node to tolerate node-role.kubernetes.io/control-plane:NoExecute
• taint every control-plane node with node-role.kubernetes.io/control-plane:NoExecute
• deploy ValidatingAdmissionPolicy and its binding to make sure only pods eligible for running on any control plane node can tolerate node-role.kubernetes.io/control-plane:NoExecute