adjust calico-kube-controller to non-hostnetwork pod (#9465)

Signed-off-by: cyclinder <qifeng.guo@daocloud.io>

Signed-off-by: cyclinder <qifeng.guo@daocloud.io>

roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-controllers.yml.j2

@@ -21,9 +21,10 @@ spec:
     spec:
       nodeSelector:
         {{ calico_policy_controller_deployment_nodeselector }}
-      hostNetwork: true
       serviceAccountName: calico-kube-controllers
       tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
         - key: node-role.kubernetes.io/master
           effect: NoSchedule
         - key: node-role.kubernetes.io/control-plane