Pod Security Policies have been deprecated in favour of Pod Security
Standards, which are a bit less flexible, but way easier to configure
and handle.

This patch should resovled the issue of failed descheduler cronjobs when
the descheduler binary is exiting unexpected. In the issue linked below,
some descheduler contributors recommend to use the `Deployment` kind for
descheduler, since that's what descheuler is optimised for nowadays. The
Helm chart just hasn't caught up yet.

References:
https://github.com/kubernetes-sigs/descheduler/issues/728

Since kube-system is a bit delicate when it comes to blocking, this
intial network policy tries to not block anything in order to keep
everything working. This might be the solution to the
globalnetworkpolicy issue.

Seems like this wasn't helpful, might even harmful

This reverts commit 32a2bcac.

This patch runs the metrics-server without CA validation since kubeadm
doesn't create proper certificates for kubelets by default. Therefore,
until this is fixed, this patch will work around the issue.

References:
https://v1-21.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#renew-certificates-with-the-kubernetes-certificates-api

This flag is for the kubeapiserver, not the metrics-server

This patch fixes the problem that metrics-server is unable to scrape any
node, because the certificate for that node, doesn't contain its IP
address.

It's resolved by prefer to use the hostname instead, which should also
be more future proof in general.

```
E0129 14:24:37.428987       1 scraper.go:139] "Failed to scrape node" err="Get \"https://192.168.100.10:10250/stats/summary?only_cpu_and_memory=true\": x509: cannot validate certificate for 192.168.100.10 because it doesn't contain any IP SANs" node="node01.k8s01.si-infra.de"
```

References:
https://github.com/kubernetes-sigs/metrics-server/issues/835

In order to evenly distribute load, this patch installs the descheduler
on the cluster.

References:
https://github.com/kubernetes-sigs/descheduler

This patch fixes the usage of the PodDisruptionBudget (PDB) in order to
achieve a quorum functionality for the master nodes by deploying a pause
container on all of them. Main reason to do that, is the inability of a
PDB to operate on static-pods or daemonsets. Therefore this deployment
will make sure, that only one master node will become unavailable at the
time.