spire-agent not able to run on tainted nodes

[tvonhacht-apple]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

spire-agent is not running on tainted nodes by default or does not provide option to add tolerations.

For example cilium-agent by default runs on every node as an allow all toleration is added by default. (https://github.com/cilium/cilium/blob/main/install/kubernetes/cilium/values.yaml#L168-L169)

This results in 2 problems:

• pods running on nodes that have taint can't create identities
• if cilium-operator runs on tainted node, no cilium:mutual-auth identity can be created

Cilium Version

1.14.0

Kernel Version

irrelevant to bug

Kubernetes Version

1.27

Sysdump

No response

Relevant log output

# cilium-agent


cilium-mhhj8 cilium-agent level=warning msg="Failed to authenticate request" error="failed to authenticate with auth type spire: failed to get certificate for local identity 19737: no SPIFFE ID for spiffe://spiffe.cilium/identity/19737" key="localIdentity=19737, remoteIdentity=37615, remoteNodeID=0, authType=spire" subsys=auth


# cilium-operator

```bash
cilium-operator-688f47cd6d-7rbxt cilium-operator level=error msg="Failed to watch the Workload API: rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /run/spire/sockets/agent/agent.sock: connect: no such file or directory\"" subsys=spire-client

### Anything else?

_No response_

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct