You might notice on‑demand nodes running in Flexera Ocean for AKS virtual node groups even when Spot percentage is set to 100 percent or fallback to regular instances is turned off. This behavior can look unexpected, but it is required for certain Kubernetes system components to function correctly.

Understanding why this happens can help you distinguish expected behavior from actual configuration issues.

Why this happens

Ocean AKS relies on Kubernetes admission control to inject Spot tolerations into pods. These tolerations allow workloads to run on Spot virtual machines. However, some pods are created before the admission controller can inject tolerations.

Common scenarios include:

• Kubernetes system pods in the kube-system namespace
  These pods are created by Kubernetes itself and are required for core cluster functionality, such as networking, DNS, and control plane communication.

• Admission controller dependency
  AKS only launches Spot nodes when the admission controller is enabled and Spot tolerations are injected into pods.
  If tolerations are missing, Kubernetes schedules those pods onto on‑demand nodes to ensure cluster stability.

Because system pods must run regardless of Spot availability, Ocean allows on‑demand nodes to be launched so the cluster can operate correctly.

What to expect

• Application workloads with injected Spot tolerations can still run on Spot nodes.

• Kubernetes system pods may continue to run on on‑demand nodes.

• This behavior can occur even when Spot percentage is set to 100 percent and fallback is disabled.

This design ensures the AKS cluster remains functional while still maximizing Spot usage where supported.