Currently support for nodeselectors for the control plane components can be implemented at the namespace/project level in k8s/OpenShift. However, nodeselectors don't prevent other workload from landing on the same node.

For certain security conscious customers who want to isolate the control plane from workload, support for taints/tolerations would be needed. A cluster administrator would create nodes with taints for the control plane pods to run, but the pods would need to declare their toleration for the taints.

Right now you could set the toleration in the CR but it would not cause the toleration to be passed down to the instantiated deployments/pods/etc.