{{ if eq .Values.robot_authentication "true" }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: metadata-server
spec:
  selector:
    matchLabels:
      name: metadata-server
  template:
    metadata:
      labels:
        name: metadata-server
    spec:
      hostNetwork: true
      volumes:
      - name: robot-id
        secret:
          secretName: robot-auth
          items:
          - key: json
            path: robot-id.json
      # Mounting /etc/ssl is necessary if ca-certificates is not installed in the container image.
      - name: ssl
        hostPath:
          path: /etc/ssl
      containers:
      - name: metadata-server
        securityContext:
          capabilities:
            drop:
              - all
            add:
              - NET_ADMIN
              - NET_RAW
        image: {{ .Values.registry }}{{ .Values.images.metadata_server }}
        args:
        - --port
        - "8965"
        - --robot_id_file
        - /credentials/robot-id.json
        - --source_cidr
        - "{{ .Values.pod_cidr }}"
        env:
        - name: BIND_IP
          value: "127.0.0.1"
        volumeMounts:
        - mountPath: /credentials
          name: robot-id
        - mountPath: /etc/ssl
          name: ssl
{{ end }}

{{ if eq .Values.robot_authentication "true" }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: metadata-server
spec:
  selector:
    matchLabels:
      name: metadata-server
  template:
    metadata:
      labels:
        name: metadata-server
    spec:
      hostNetwork: true
      volumes:
      - name: robot-id
        secret:
          secretName: robot-auth
          items:
          - key: json
            path: robot-id.json
      # Mounting /etc/ssl is necessary if ca-certificates is not installed in the container image.
      - name: ssl
        hostPath:
          path: /etc/ssl
      containers:
      - name: metadata-server
        securityContext:
          capabilities:
            drop:
              - all
            add:
              - NET_ADMIN
              - NET_RAW
        image: {{ .Values.registry }}{{ .Values.images.metadata_server }}
        args:
        - --port
        - "8965"
        - --robot_id_file
        - /credentials/robot-id.json
        - --source_cidr
        - "{{ .Values.pod_cidr }}"
        env:
        - name: BIND_IP
          value: "127.0.0.1"
        volumeMounts:
        - mountPath: /credentials
          name: robot-id
        - mountPath: /etc/ssl
          name: ssl
      # This daemon-set need to run on all nodes for auth to work.
      tolerations:
      - operator: "Exists"
        effect: "NoSchedule"
{{ end }}

Add toleration for special nodes to make auth work there too.
Add toleration for special nodes to make auth work there too.

Change-Id: I4b5de1ecd91b48a8a418330d2179edc6f0eaa186
GitOrigin-RevId: 4bfd7c46b106840ff3658e7650a9185c554dda36
