As discussed in 

https://redhat-internal.slack.com/archives/CC3CZCQHM/p1714068850544919?thread_ts=1713794008.195589&cid=CC3CZCQHM

Something like 

rules: - apiGroups: [""] resources: ["node-role.kubernetes.io/control-plane"] verbs: ["NoExecute"] - apiGroups: [""] resources: ["node.kubernetes.io/not-ready"] verbs: ["NoExecute"] - apiGroups: [""] resources: ["node.kubernetes.io/unreachable"] verbs: ["NoExecute"] [...]
not using the composite variables, just the expression
 

• expression: "object.spec.tolerations.all(toleration, ( toleration.effect != 'NoExecute' || (toleration.effect == 'NoExecute' && (auhorizer.serviceAccount(object.metadata.namespace, object.spec.serviceAccountName).group('').resource(toleration.key).namespace(object.metadata.namespace).check(toleration.effect).allowed()))))"

And rovide it as a static file through https://github.com/openshift/cluster-kube-scheduler-operator/blob/master/pkg/operator/starter.go#L108-L123