only run metadata api on work nodes
add cert file in the format haproxy expects