Add pod anti-affinity to apiserver-webhook

This PS adds pod anti-affinity to apiserver-webhook pods,
so that the scheduler can constrain pods against labels on other pods
running on the node. The default soft rule is in place so that if the
scheduler can’t satisfy the requirement, the pod will still
be scheduled.

Change-Id: I8c118410b822d4fed44693b8a0308c8eff103978

charts/apiserver-webhook/templates/deployment.yaml

@@ -117,6 +117,8 @@ spec:
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
     spec:
+      affinity:
+{{ tuple $envAll "kubernetes-keystone-webhook" "api" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
       dnsPolicy: ClusterFirst
       containers:
         - name: apiserver

charts/apiserver-webhook/values.yaml

@@ -187,6 +187,12 @@ pod:
     kubernetes_apiserver:
       init_container: null
       kubernetes_apiserver:
+  affinity:
+    anti:
+      type:
+        default: preferredDuringSchedulingIgnoredDuringExecution
+      topologyKey:
+        default: kubernetes.io/hostname
   replicas:
     apiserver: 1
     api: 1