<ol>
<li>I have been trying to make use of Azure Spot instances on Azure Kubernetes Service (AKS) - version 1.19.11 and to enable scheduling of pods onto those nodes, I am trying to use the <code>PodTolerationRestriction</code> admission controller.</li>
<li>I can confirm that the PodTolerationRestriction controller is enabled as I am having no issues deploying a replicaset to the default namespace. This is another namespace but we are not specifically adding any tolerations while creating it.</li>
<li>I gathered from elsewhere that, along with whitelisting against a specific taint (in my case spot), it is also necessary to whitelist certain default tolerations. As a result, I have added certain annotations to my namespace.</li>
<li>I do not have any additional tolerations pre-defined for this statefulset.</li>
<li>The node has taints - the first two are taken care of through the helm chart values
<ul>
<li>RabbitMQ=true:NoSchedule</li>
<li>Allow=true:NoExecute</li>
<li>kubernetes.azure.com/scalesetpriority=spot:NoSchedule</li>
</ul>
</li>
</ol>
<p>I am wondering what additional tolerations need to be whitelisted.</p>
<p>The annotations I added -</p>
<pre><code>scheduler.alpha.kubernetes.io/defaultTolerations: '[{&quot;operator&quot;: &quot;Equal&quot;, &quot;value&quot;: &quot;spot&quot;, &quot;key&quot;: &quot;kubernetes.azure.com/scalesetpriority&quot;}]'
scheduler.alpha.kubernetes.io/tolerationsWhitelist: '[{&quot;operator&quot;: &quot;Equal&quot;, &quot;value&quot;: &quot;spot&quot;, &quot;key&quot;: &quot;kubernetes.azure.com/scalesetpriority&quot;}, {&quot;operator&quot;: &quot;Exists&quot;, &quot;effect&quot;: &quot;NoSchedule&quot;, &quot;key&quot;: &quot;node.kubernetes.io/memory-pressure&quot;}, {&quot;operator&quot;: &quot;Exists&quot;, &quot;tolerationSeconds&quot;: 300, &quot;effect&quot;: &quot;NoExecute&quot;, &quot;key&quot;: &quot;node.kubernetes.io/unreachable&quot;}, {&quot;operator&quot;: &quot;Exists&quot;, &quot;tolerationSeconds&quot;: 300, &quot;effect&quot;: &quot;NoExecute&quot;, &quot;key&quot;: &quot;node.kubernetes.io/not-ready&quot;}]'
</code></pre>
<p>Statefulset describe -</p>
<pre><code>Name:               &lt;release name&gt;
Namespace:          &lt;namespace&gt;
CreationTimestamp:  Tue, 18 Jan 2022 19:37:38 +0530
Selector:           app.kubernetes.io/instance=&lt;name&gt;,app.kubernetes.io/name=rabbitmq
Labels:             app.kubernetes.io/instance=rabbit
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=rabbitmq
                    helm.sh/chart=rabbitmq-8.6.1
Annotations:        meta.helm.sh/release-name: &lt;release name&gt;
                    meta.helm.sh/release-namespace: &lt;namespace&gt;
Replicas:           3 desired | 0 total
Update Strategy:    RollingUpdate
Pods Status:        0 Running / 0 Waiting / 0 Succeeded / 0 Failed
Pod Template:
  Labels:           app.kubernetes.io/instance=rabbit
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=rabbitmq
                    helm.sh/chart=rabbitmq-8.6.1
  Annotations:      checksum/config: 1a138ded5a3ade049cbee9f4f8e2d0fd7253c126d49b790495a492601fd9f280
                    checksum/secret: 05af38634eb4b46c2f8db5770013e1368e78b0d5af057aed5fa4fe7eec4c92de
                    prometheus.io/port: 9419
                    prometheus.io/scrape: true
  Service Account:  sa-rabbitmq
  Containers:
   rabbitmq:
    Image:       docker.io/bitnami/rabbitmq:3.8.9-debian-10-r64
    Ports:       5672/TCP, 25672/TCP, 15672/TCP, 4369/TCP, 9419/TCP
    Host Ports:  0/TCP, 0/TCP, 0/TCP, 0/TCP, 0/TCP
    Liveness:    exec [/bin/bash -ec rabbitmq-diagnostics -q ping] delay=120s timeout=200s period=30s #success=1 #failure=6
    Readiness:   exec [/bin/bash -ec rabbitmq-diagnostics -q check_running &amp;&amp; rabbitmq-diagnostics -q check_local_alarms] delay=10s timeout=200s period=30s #success=1 #failure=3
    Environment:
      &lt;multiple environment variables&gt;
    Mounts:
      /bitnami/rabbitmq/conf from configuration (rw)
      /bitnami/rabbitmq/mnesia from data (rw)
  Volumes:
   configuration:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      rabbit-rabbitmq-config
    Optional:  false
   data:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  &lt;unset&gt;
Volume Claims:  &lt;none&gt;
Events:
  Type     Reason        Age                 From                    Message
  ----     ------        ----                ----                    -------
  Warning  FailedCreate  31s (x14 over 72s)  statefulset-controller  create Pod &lt;pod-name&gt; in StatefulSet &lt;release name&gt; failed error: pod tolerations (possibly merged with namespace default tolerations) conflict with its namespace whitelist
</code></pre>

<p>I had the same issue. Fixed it with:</p>
<ol>
<li><p>removed whitelist annotation from ns.</p>
</li>
<li><p>deployed the pod.</p>
</li>
<li><p><code>kubectl get pod &lt;pod name&gt; -o yaml</code></p>
<p>in my case, I had a couple of extra toleration injected without me realizing.</p>
</li>
<li><p>revert 1 (annotations on ns).</p>
</li>
</ol>
