Make sure calico aws-node gets scheduled on all nodes.

[dng-dev]

changed tolerations for calico-node and calico-typha to be sure it gets deployed also to nodes with custom taints like NoExecute and NoSchedule

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[liwenwu-amazon]

@caseydavenport I don't think this is needed for calico policy

[nckturner]

@liwenwu-amazon If the aws CNI is going to tolerate everything, shouldn't the calico policy do the same?

[nckturner]

LGTM.

[discordianfish]

LGTM (fwiw)

[nckturner]

@dng-dev can you rebase?

[stevenpall]

I was just wondering if this will be pulled into kops? I spent a good amount of time trying to figure out why networking was not coming up correctly on a node group with a taint. Had to manually modify the aws-node daemonset to tolerate said taint, but I like the above solution better.

[cjbottaro]

And how do I use this with EKS? I spent 2 days figuring out that adding a NoExecute taint on a node killed the networking container. Frustrating.

[liwenwu-amazon]

@cjbottaro , v1.1.0 should fix this. How old is your eks cluster? All EKS clusters created after Jul26 should have v1.1.0. Can you show me the output of kubectl get ds aws-node -n kube-system -o yaml ?

[cjbottaro]

Definitely created before Jul26.

Please tell me there is a way to upgrade this besides recreating my EKS cluster... :/

Running that command definitely shows:

image: 602401143452.dkr.ecr.us-east-1.amazonaws.com/amazon-k8s-cni:1.0.0

I guess I can kubectl edit -n kube-system ds aws-node and change the image. 👍