Repository: vmware-tanzu/tanzu-framework (language: go)

Issue:
Missing control plane toleration for aad-pod-identity
**Bug description**
The aad-pod-identity component does not have a control plane toleration which means the DaemonSet pods of capz-nmi will not be scheduled to the control plane nodes.
But the capz controller manger has the control plane taints that allow the pod to get scheduled to the the control plane node and in such situations when the capz controller manager get scheduled to the control plane node and the capz-nmi pod is not due to absence of toleration, the authentication with azure cloud will fail with token refresh error. 
**Affected product area (please put an X in all that apply)**

- ( ) APIs
- ( ) Addons
- (x) CLI
- ( ) Docs
- ( ) IAM
- ( ) Installation
- ( ) Plugin
- ( ) Security
- ( ) Test and Release
- ( ) User Experience
- ( ) Developer Experience

**Expected behavior**
The aad-pod-identity has a capz-nmi DaemonSet which should have tolerations so that it is able to schedule pod on control plane node as weel.

**Steps to reproduce the bug**

**Version** (include the SHA if the version is not obvious)

**Environment where the bug was observed (cloud, OS, etc)**
Reported Downstream

**Relevant Debug Output (Logs, manifests, etc)**



Discussion / hints:

Fix patch:
diff --git a/hack/providers-sync-tools/cluster-api-provider-azure/overlay/add-tolerations.yaml b/hack/providers-sync-tools/cluster-api-provider-azure/overlay/add-tolerations.yaml
new file mode 100644
index 0000000000..6dcaae66db
--- /dev/null
+++ b/hack/providers-sync-tools/cluster-api-provider-azure/overlay/add-tolerations.yaml
@@ -0,0 +1,14 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:overlay", "overlay")
+
+#@overlay/match by=overlay.subset({"kind": "DaemonSet", "metadata": {"name": "capz-nmi"}})
+---
+spec:
+  template:
+    spec:
+      #@overlay/match missing_ok=True
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
diff --git a/providers/infrastructure-azure/v1.5.3/infrastructure-components.yaml b/providers/infrastructure-azure/v1.5.3/infrastructure-components.yaml
index 99ac58d571..bba09b272e 100644
--- a/providers/infrastructure-azure/v1.5.3/infrastructure-components.yaml
+++ b/providers/infrastructure-azure/v1.5.3/infrastructure-components.yaml
@@ -8638,6 +8638,11 @@ spec:
           path: /etc/default/kubelet
           type: FileOrCreate
         name: kubelet-config
+      tolerations:
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
   updateStrategy:
     type: RollingUpdate
 ---


Test patch: