Merge pull request #4279 from k8s-infra-cherrypick-robot/cherry-pick-4262-to-release-2.1

[release-2.1] Zero csi driver aws credentials to fallback to use instance profile role

Author: k8s-ci-robot

test/e2e/data/infrastructure-aws/withoutclusterclass/kustomize_sources/addons/csi/data/aws-ebs-csi-external.yaml

@@ -4,8 +4,8 @@ metadata:
   name: aws-secret
   namespace: kube-system
 stringData:
-  key_id: ${AWS_ACCESS_KEY_ID}
-  access_key: ${AWS_SECRET_ACCESS_KEY}
+  key_id: ""
+  access_key: ""
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -381,6 +381,14 @@ spec:
     spec:
       affinity:
         nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: Exists
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: Exists
           preferredDuringSchedulingIgnoredDuringExecution:
             - preference:
                 matchExpressions:
@@ -590,6 +598,10 @@ spec:
         - effect: NoExecute
           operator: Exists
           tolerationSeconds: 300
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
       volumes:
         - emptyDir: {}
           name: socket-dir