Merge pull request #17116 from aveshagarwal/master-pod-toleration-res…

…trictions-issues

Automatic merge from submit-queue.

Allow override of cluster level (default, whitelist) tolerations by namespace level empty (default, whitelist) tolerations.

Currently In PodTolerationRestriction admission plugin, if namespace level default and whitelist of tolerations are nil or empty, they do not override cluster level default and whitelist tolerations.

This PR fixes the plugin to not override cluster level tolerations only when namespace level toleration are nil. IOW, if namespace level toleration are empty, they override cluster level tolerations. To be more clear, if following annotations are set to empty, they override cluster level tolerations.

```
scheduler.alpha.kubernetes.io/defaultTolerations : ""
scheduler.alpha.kubernetes.io/tolerationsWhitelist: ""
```

This behavior is inline with PodNodeSelector admission plugin too.

@sjenning 

I think its important to get it fixed for 3.7 so creating this backport PR even though the upstream PR is not merged yet.