When we want to remove scheduling gates from a pod, it requires an update. Also, the Security Context Constraints (SCC) admission check needs the same SCC permission for updating a pod as it does for creating one. However, the weird part is that taking away scheduling gates doesn't really change a pod's privileges.

The issue becomes clearer when you see that we can freely add scheduling gates to any pod in any namespace without SCC privileges using a mutating webhook configuration. But, if we want to remove scheduling gates from pods that have privileges, we're stuck – it's not allowed without the specific SCC privileges.

Scheduling gates play a crucial role in implementing custom resourceQuota functionality and are essential for incorporating logic into scheduling processes based on administrative requirements. Presently, using scheduling gates with SCC is challenging unless we include ourselves in the privileged SCC, which grants unnecessary privileges and poses a security risk.

    1.
    2.
    3.