<p>I have a namespace in k8s with the setting:
scheduler.alpha.kubernetes.io/defaultTolerations:
      '[{"key": "role_va", "operator": "Exists"}]'</p>

<p>If I am not mistaken all pods that are created in this namespace must get this toleration.
But the pods don't get it.
I read <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podtolerationrestriction" rel="nofollow noreferrer">this</a> and understood that I must enable the PodTolerationRestriction controller.
How can I do this on gloud?</p>

<p>In order to enable <code>PodTolerationRestriction</code> you might be required to set <code>--enable-admission-plugins</code> flag in <code>kube-apiserver</code> configuration. This is according to the official <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">documentation</a>, as by default this plugin is not included in admission controller plugins list. </p>

<p>However, in <a href="https://cloud.google.com/kubernetes-engine/" rel="nofollow noreferrer">GKE</a> there is no possibility to adapt any specific flag for the current API server run-time configuration, because Kubernetes cluster engine core components are not exposed to any user purpose actions (related Stackoverflow <a href="https://stackoverflow.com/questions/49451780/denyescalatingexec-when-under-gke">thread</a>). </p>

<p>Assuming that, you can consider using <a href="https://cloud.google.com/compute/?utm_source=google&amp;utm_medium=cpc&amp;utm_campaign=emea-pl-all-en-dr-bkws-all-all-trial-e-gcp-1003963&amp;utm_content=text-ad-none-any-DEV_c-CRE_253508655583-ADGP_Hybrid%20%7C%20AW%20SEM%20%7C%20BKWS%20~%20EXA_M:1_PL_EN_Compute_Compute%20Engine_gce%20google-KWID_43700016289387310-kwd-79074734358-userloc_9067401&amp;utm_term=KW_gce%20google-ST_gce%20google&amp;ds_rl=1242853&amp;ds_rl=1245734&amp;ds_rl=1245734&amp;gclid=CN_YhMegouECFTtTwgodRD8Img" rel="nofollow noreferrer">GCE</a> and bootstrap cluster with any cluster building <a href="https://kubernetes.io/docs/setup/pick-right-solution/#local-machine-solutions" rel="nofollow noreferrer">solutions</a>, depending on your preference, within a particular GCE VM. </p>
