Some K8s distributions might label control-plane nodes with
```
node-role.kubernetes.io/control-plane: "true"
```
rather than
```
node-role.kubernetes.io/control-plane: ""
```
which makes the default `nodeSelector` fail. Replacing it with a `affinity.nodeAffinity` nodeSelector fixes it.
extension-apiserver-authentication-reader role exists only in kube-system namespace.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Serge Logvinov <serge.logvinov@sinextra.dev>
