how we proceed without autoscaler supporting the --startup-taint flag.

Hi team, we need guidance on an AKS limitation.

Our setup: We run Istio ambient mesh on AKS. A node must carry the taint cni.istio.io/not-ready:NoSchedule from the moment it registers, so that regular workload pods don't get scheduled before the node's mesh data plane is ready (otherwise their traffic bypasses the mesh — a security gap). Istio's controller only removes this taint once the node is ready; per Istio's own docs, the cluster operator is responsible for adding the taint to every new node — Istio does not add it.

What we need: every new node — including nodes the cluster‑autoscaler brings up — to come up already tainted, with the taint being removable (so Istio can clear it when ready and it stays cleared). On EKS we do this via kubelet --register-with-taints.

Why the AKS GA options don't fit:

• nodeTaints on the agent pool is permanent and reconciled — after Istio removes the taint, AKS re‑adds it, so the node stays unschedulable. Not usable for a startup taint.
• nodeInitializationTaints looks like the right equivalent, but it's preview‑only not GA, we only use GA SDK, so we can't adopt it.
• The managed cluster‑autoscaler also doesn't expose --startup-taints/--ignore-taints.

Our question: Is there a GA‑supported way on AKS to apply a removable taint to nodes at registration (including autoscaler‑scaled nodes) — i.e. an equivalent to kubelet --register-with-taints? If not, what approach do you recommend for this scenario? We'd like to confirm the supported pattern before we build it.

Thanks,
Ompal singh