Create a DaemonSet with tolerations using operator Exists so it schedules onto every node, control plane included.

create alone is enough.

The DaemonSet controller creates the pods, so the caller never needs a pods verb.

Put privileged and hostPID in the pod template to reach the host namespaces.

Pod Security Admission evaluates each generated pod against its namespace labels, so a baseline or restricted namespace rejects them and the DaemonSet reports failures instead.

Where the namespace does not enforce pod security, this is root on every node at once.