<p>I have a security pod that needs to run everywhere including master.  I do not want, however, master to run any other (non kubernetes) pods. 
I know I can taint master node, and I know I can setup affinity for a pod.  Yet (unless I am misunderstanding something) that isn't quite what I want.</p>

<p>What I want is to setup affinity in a way that  this security pod runs on every single node including master as a part of same daemon set.   It is important that I only have a single definition due to how this security pod gets deployed. </p>

<p>Can this be done?</p>

<p>I am running Kubernetes 1.8</p>

<p>I think this is more or less duplicate to this <a href="https://stackoverflow.com/questions/48495263/scheduler-is-not-scheduling-pod-for-daemonset-in-master-node/48496629#48496629">question</a>.</p>

<p>What you need is a combination of two features:</p>

<ul>
<li><a href="https://kubernetes.io/docs/concepts/workloads/controllers/daemonset" rel="nofollow noreferrer">DaemonSet</a> will allow you to schedule Pod to run on every node</li>
<li><a href="https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/" rel="nofollow noreferrer">Tolerations</a> in the DaemonSet Pods will allow this workload to run even on the node which has the master taint.</li>
</ul>

<p>That way your security pods will run everywhere even on the master with the taint because they can tolerate it. I think there is an example directly on the <a href="https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/#create-a-daemonset" rel="nofollow noreferrer">DaemonSet website</a>.</p>

<p>But other pods without this toleration will not be scheduled on master because they do not tolerate the taint. </p>
