Injecting tolerations to helm properties for Portworx storage

[paparayudud]

Team,

We are trying to add tolerations to helm properties to invoke storage class for Portworx but it's not working (we don't see this in statefulset or queue manager pods when we describe the pod) to deploy IBM MQ NativeHA on AKS using Helm chart

Below is the error

Events:
Type Reason Age From Message

---

Warning FailedScheduling 10m (x22346 over 2d20h) stork failed filter with extender at URL http://stork-service.portworx:8099/filter, code 400
Warning PolicyViolation 9m59s kyverno-scan policy psa-restricted-clusterpolicy/restricted-rule fail: Validation rule 'restricted-rule' failed. It violates PodSecurity "restricted:latest": (Forbidden reason: seccompProfile, field error list: [spec.containers[0].securityContext.seccompProfile.type: Required value])
Warning FailedScheduling 2m18s (x7526 over 2d20h) stork No node found with storage driver
Warning FailedScheduling 116s (x7366 over 2d20h) stork No node found with storage driver
Warning FailedScheduling 105s (x7442 over 2d20h) stork No node found with storage driver

Below is the toleration tried to add

toleration:

• key: "px/node"
  operator: "Equal"
  value: "true"
  effect: "NoSchedule"
  nodeSelector:
  portworx.io/node-type: storageless

Please let us know if you need any additional info from us

Thanks,
Paparayudu
Fiserv

[callumpjackson]

Hi there, I had a couple of questions and observations:

1. Storage Class for NativeHA on Azure
   PortWorx is not typically used as the default storage class for NativeHA deployments on Azure. Azure Disk is generally sufficient, as NativeHA handles its own data replication. With the introduction of cross-region replication (CRR), additional storage providers like PortWorx are usually not required for cross-region support either.

2. Helm Chart Tolerations Configuration
   Could you clarify how you're attempting to configure tolerations via the Helm chart? Are you using custom values or modifying the chart directly?

[paparayudud]

Hi Team,

PFB (last lines)

license: accept
queueManager:
nativeha:
enable: true
tls:
secretName: tlssecret
mqscConfigMaps:
- name: mqsccm
items:
- mq.mqsc
qminiConfigMaps:
- name: mqsccm
items:
- mq.ini
persistence:
qmPVC:
enable: true
storageClassName: portworx-rwo-rep3
security:
context:
fsGroup: 0
image :

repository is the container repository to use

repository: fmk-prod.nexus-ci.onefiserv.net/vendor/ibm/ibm-messaging/mq

tag is the tag to use for the container repository

tag: 9.4.2.0-r1
pki:
keys:
- name: default
secret:
secretName: tlssecret
items:
- tls.key
- tls.crt
trust:
- name: default
secret:
secretName: tlssecret
items:
- app1.crt
- app2.crt
metadata:
annotations:
productName: "IBM MQ Advanced for Developers"
productID: "2f886a3eefbe4ccb89b2adb97c78b9cb"
productChargedContainers: ""
productMetric: "FREE"
route:
nodePort:
webconsole: true
mqtraffic: true
loadBalancer:
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
webconsole: true
mqtraffic: true
**toleration:

• key: "px/node"
  operator: "Equal"
  value: "true"
  effect: "NoSchedule"
  nodeSelector:
  portworx.io/node-type: storageless**

[paparayudud]

and we are using custom values and not changing chart directly and portworx is not being used for replications

[callumpjackson]

Can you provide a helm dry run output. Looking at the helm chart here you can see that we simply copy through the tolerations.
Although there shouldn't be an issue using Portworx, it shouldn't been needed either. Azure Disk would be more than adequate for most use cases.

[paparayudud]

Hi,

With toleration and tolerations -- attached helm dry run output

---

When we use tolerations in yaml file --> we are getting below error

Error: INSTALLATION FAILED: 1 error occurred:
* StatefulSet in version "v1" cannot be handled as a StatefulSet: json: cannot unmarshal bool into Go struct field Toleration.spec.template.spec.tolerations.value of type string

---

When we use toleration in yaml file --> we are getting below error

Warning FailedScheduling 10m (x22346 over 2d20h) stork failed filter with extender at URL http://stork-service.portworx:8099/filter, code 400
Warning PolicyViolation 9m59s kyverno-scan policy psa-restricted-clusterpolicy/restricted-rule fail: Validation rule 'restricted-rule' failed. It violates PodSecurity "restricted:latest": (Forbidden reason: seccompProfile, field error list: [spec.containers[0].securityContext.seccompProfile.type: Required value])
Warning FailedScheduling 2m18s (x7526 over 2d20h) stork No node found with storage driver
Warning FailedScheduling 116s (x7366 over 2d20h) stork No node found with storage driver
Warning FailedScheduling 105s (x7442 over 2d20h) stork No node found with storage driver

---

---

With tolerations :

NAME: nativehamq
LAST DEPLOYED: Tue Nov 4 16:05:28 2025
NAMESPACE: ibmmq-dev-app
STATUS: pending-install
REVISION: 1
TEST SUITE: None
HOOKS:
MANIFEST:

Source: ibm-mq/templates/serviceaccount.yaml

© Copyright IBM Corporation 2021, 2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: ServiceAccount
metadata:
name: nativehamq-ibm-mq
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
imagePullSecrets:

• name: ibm-entitlement-key

---

Source: ibm-mq/templates/metrics-service.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

This is a separate service, because Prometheus will try and gather metrics

from the MQ port (1414) if it's included in the same service.

apiVersion: v1
kind: Service
metadata:
annotations:
prometheus.io/scrape: 'true'
prometheus.io/port: '9157'
name: 'nativehamq-ibm-mq-metrics'
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• targetPort: 9157
  port: 9157
  protocol: TCP
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service-loadbalancer.yaml

© Copyright IBM Corporation 2022, 2023

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-loadbalancer
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm

Additional annotations to be added to the load balancer annotations

annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
type: LoadBalancer
ports:

• port: 1414
  name: qmgr
• port: 9443
  name: console-https
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service-nativeha.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-replica-0
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9414
  name: qmgr
  publishNotReadyAddresses: true
  selector:
  statefulset.kubernetes.io/pod-name: nativehamq-ibm-mq-0

---

Source: ibm-mq/templates/service-nativeha.yaml

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-replica-1
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9414
  name: qmgr
  publishNotReadyAddresses: true
  selector:
  statefulset.kubernetes.io/pod-name: nativehamq-ibm-mq-1

---

Source: ibm-mq/templates/service-nativeha.yaml

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-replica-2
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9414
  name: qmgr
  publishNotReadyAddresses: true
  selector:
  statefulset.kubernetes.io/pod-name: nativehamq-ibm-mq-2

---

Source: ibm-mq/templates/service-qm.yaml

© Copyright IBM Corporation 2021,2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-qm
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: NodePort
ports:

• port: 1414
  name: qmgr
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service-web.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-web
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: NodePort
ports:

• port: 9443
  name: console-https
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service.yaml

© Copyright IBM Corporation 2021,2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9443
  name: console-https
• port: 1414
  name: qmgr
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/stateful-set.yaml

© Copyright IBM Corporation 2021,2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: apps/v1
kind: StatefulSet
metadata:
name: nativehamq-ibm-mq
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
selector:
matchLabels:
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
serviceName: qm
podManagementPolicy: Parallel
updateStrategy:
type: OnDelete
replicas: 3
template:
metadata:
annotations:
productChargedContainers: ""
productID: 2f886a3eefbe4ccb89b2adb97c78b9cb
productMetric: FREE
productName: IBM MQ Advanced for Developers
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
statefulSetName: nativehamq-ibm-mq
spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: statefulSetName
operator: In
values:
- nativehamq-ibm-mq
topologyKey: kubernetes.io/hostname
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/arch
operator: In
values:
- "amd64"
- "s390x"
- "ppc64le"
- key: kubernetes.io/os
operator: In
values:
- "linux"
tolerations:
- key: px/node
operator: Equal
value: true
effect: NoSchedule
serviceAccountName: nativehamq-ibm-mq
securityContext:
fsGroup: 0
supplementalGroups:
volumes:
- name: ha-tls
secret:
secretName: tlssecret
defaultMode: 288
- name: trust0
secret:
secretName: tlssecret
defaultMode: 0440
items:
- key: app1.crt
path: app1.crt
- key: app2.crt
path: app2.crt
- name: default
secret:
secretName: tlssecret
defaultMode: 0440
items:
- key: tls.key
path: tls.key
- key: tls.crt
path: tls.crt
- name: mqsc-cm-mqsccm
configMap:
name: mqsccm
defaultMode: 420
items:
- key: mq.mqsc
path: mq.mqsc
- name: ini-cm-mqsccm
configMap:
name: mqsccm
defaultMode: 420
items:
- key: mq.ini
path: mq.ini
terminationGracePeriodSeconds: 30
containers:
- name: qmgr
image: "fmk-prod.nexus-ci.onefiserv.net/vendor/ibm/ibm-messaging/mq:9.4.2.0-r1"
imagePullPolicy: IfNotPresent
terminationMessagePath: "/run/termination-log"
ports:
- containerPort: 1414
- containerPort: 9443
- containerPort: 9157
- containerPort: 9414
env:
- name: LICENSE
value: accept
- name: MQ_QMGR_NAME
value: "nativehamq"
- name: MQ_NATIVE_HA
value: "true"
- name: MQ_NATIVE_HA_INSTANCE_0_NAME
value: nativehamq-ibm-mq-0
- name: MQ_NATIVE_HA_INSTANCE_0_REPLICATION_ADDRESS
value: nativehamq-ibm-mq-replica-0(9414)
- name: MQ_NATIVE_HA_INSTANCE_1_NAME
value: nativehamq-ibm-mq-1
- name: MQ_NATIVE_HA_INSTANCE_1_REPLICATION_ADDRESS
value: nativehamq-ibm-mq-replica-1(9414)
- name: MQ_NATIVE_HA_INSTANCE_2_NAME
value: nativehamq-ibm-mq-2
- name: MQ_NATIVE_HA_INSTANCE_2_REPLICATION_ADDRESS
value: nativehamq-ibm-mq-replica-2(9414)
- name: MQ_NATIVE_HA_TLS
value: "true"
- name: MQ_NATIVE_HA_CIPHERSPEC
value: "ANY_TLS12_OR_HIGHER"
- name: MQ_LOGGING_CONSOLE_FORMAT
value: basic
- name: MQ_ENABLE_METRICS
value: "true"
- name: DEBUG
value: "false"
- name: MQ_ENABLE_TRACE_STRMQM
value: "false"
- name: MQ_ENABLE_TRACE_CRTMQDIR
value: "false"
- name: MQ_ENABLE_TRACE_CRTMQM
value: "false"
- name: MQ_EPHEMERAL_PREFIX
value: "/run/mqm"
- name: MQ_GRACE_PERIOD
value: "29"
volumeMounts:
- name: ha-tls
readOnly: true
mountPath: /etc/mqm/ha/pki/keys/ha
- name: trust0
mountPath: "/etc/mqm/pki/trust/0"
readOnly: true
- name: default
mountPath: "/etc/mqm/pki/keys/default"
readOnly: true
- name: mqsc-cm-mqsccm
mountPath: "/etc/mqm/mq.mqsc"
subPath: "mq.mqsc"
readOnly: true
- name: ini-cm-mqsccm
mountPath: "/etc/mqm/mq.ini"
subPath: "mq.ini"
readOnly: true
- mountPath: "/mnt/mqm"
name: qm
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: true
privileged: false
capabilities:
drop:
- ALL
# Set liveness probe to determine if the queue manager is running
livenessProbe:
exec:
command:
- chkmqhealthy
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
# Set readiness probe to determine if the MQ listener is running
readinessProbe:
exec:
command:
- chkmqready
initialDelaySeconds: 0
periodSeconds: 5
timeoutSeconds: 3
failureThreshold: 1
startupProbe:
exec:
command:
- chkmqstarted
timeoutSeconds: 5
periodSeconds: 5
successThreshold: 1
failureThreshold: 24
resources:
limits:
cpu: 500m
memory: 1024Mi
requests:
cpu: 100m
memory: 512Mi
volumeClaimTemplates:

• metadata:
  name: qm
  labels:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq
  app.kubernetes.io/managed-by: Helm
  spec:

  If present, use the storageClassName from the values.yaml, else use the

  default storageClass setup by Kubernetes Administrator

  Setting storageClassName to nil means use the default storage class

  storageClassName: "portworx-rwo-rep3"
  accessModes: [ "ReadWriteOnce" ]
  resources:
  requests:
  storage: "2Gi"

---

Source: ibm-mq/templates/pvc-data.yaml

© Copyright IBM Corporation 2022

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/pvc-log.yaml

© Copyright IBM Corporation 2022

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/route-qm.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/route-web.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/service-ingress.yaml

© Copyright IBM Corporation 2023, 2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

cert-manager.io/cluster-issuer: travelers-cluster-issuer

cert-manager.io/common-name: travelors-mq-eks.ekslb.aws.travp.net

NOTES:
Get the MQ Console URL by running these commands:
export CONSOLE_PORT=$(kubectl get services nativehamq-ibm-mq-web -n ibmmq-dev-app -o jsonpath="{.spec.ports[?(@.port=="9443")].nodePort}")
export CONSOLE_IP=$(kubectl get nodes -o jsonpath='{..addresses[1].address}' | awk '{print $1}')
echo https://$CONSOLE_IP:$CONSOLE_PORT/ibmmq/console

Get the load balancer exposed MQ Console URL by running these commands:
export CONSOLE_PORT=9443
export CONSOLE_IP=$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..hostname}")$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..ip}")
echo https://$CONSOLE_IP:$CONSOLE_PORT/ibmmq/console

Get the load balancer exposed MQ queueManager URL by running these commands:
export MQ_PORT=1414
export MQSERVER_IP=$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..hostname}")$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..ip}")
echo "$MQSERVER_IP($MQ_PORT)"
The MQ connection information for clients inside the cluster is as follows:
nativehamq-ibm-mq:1414

---

with toleration

NAME: nativehamq
LAST DEPLOYED: Tue Nov 4 16:03:30 2025
NAMESPACE: ibmmq-dev-app
STATUS: pending-install
REVISION: 1
TEST SUITE: None
HOOKS:
MANIFEST:

Source: ibm-mq/templates/serviceaccount.yaml

© Copyright IBM Corporation 2021, 2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: ServiceAccount
metadata:
name: nativehamq-ibm-mq
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
imagePullSecrets:

• name: ibm-entitlement-key

---

Source: ibm-mq/templates/metrics-service.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

This is a separate service, because Prometheus will try and gather metrics

from the MQ port (1414) if it's included in the same service.

apiVersion: v1
kind: Service
metadata:
annotations:
prometheus.io/scrape: 'true'
prometheus.io/port: '9157'
name: 'nativehamq-ibm-mq-metrics'
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• targetPort: 9157
  port: 9157
  protocol: TCP
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service-loadbalancer.yaml

© Copyright IBM Corporation 2022, 2023

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-loadbalancer
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm

Additional annotations to be added to the load balancer annotations

annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
type: LoadBalancer
ports:

• port: 1414
  name: qmgr
• port: 9443
  name: console-https
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service-nativeha.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-replica-0
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9414
  name: qmgr
  publishNotReadyAddresses: true
  selector:
  statefulset.kubernetes.io/pod-name: nativehamq-ibm-mq-0

---

Source: ibm-mq/templates/service-nativeha.yaml

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-replica-1
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9414
  name: qmgr
  publishNotReadyAddresses: true
  selector:
  statefulset.kubernetes.io/pod-name: nativehamq-ibm-mq-1

---

Source: ibm-mq/templates/service-nativeha.yaml

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-replica-2
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9414
  name: qmgr
  publishNotReadyAddresses: true
  selector:
  statefulset.kubernetes.io/pod-name: nativehamq-ibm-mq-2

---

Source: ibm-mq/templates/service-qm.yaml

© Copyright IBM Corporation 2021,2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-qm
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: NodePort
ports:

• port: 1414
  name: qmgr
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service-web.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq-web
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: NodePort
ports:

• port: 9443
  name: console-https
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/service.yaml

© Copyright IBM Corporation 2021,2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: v1
kind: Service
metadata:
name: nativehamq-ibm-mq
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:

• port: 9443
  name: console-https
• port: 1414
  name: qmgr
  selector:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq

---

Source: ibm-mq/templates/stateful-set.yaml

© Copyright IBM Corporation 2021,2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

apiVersion: apps/v1
kind: StatefulSet
metadata:
name: nativehamq-ibm-mq
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
spec:
selector:
matchLabels:
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
serviceName: qm
podManagementPolicy: Parallel
updateStrategy:
type: OnDelete
replicas: 3
template:
metadata:
annotations:
productChargedContainers: ""
productID: 2f886a3eefbe4ccb89b2adb97c78b9cb
productMetric: FREE
productName: IBM MQ Advanced for Developers
labels:
helm.sh/chart: ibm-mq-12.0.1
app.kubernetes.io/name: ibm-mq
app.kubernetes.io/instance: nativehamq
app.kubernetes.io/version: "9.4.2.0"
app.kubernetes.io/managed-by: Helm
statefulSetName: nativehamq-ibm-mq
spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: statefulSetName
operator: In
values:
- nativehamq-ibm-mq
topologyKey: kubernetes.io/hostname
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/arch
operator: In
values:
- "amd64"
- "s390x"
- "ppc64le"
- key: kubernetes.io/os
operator: In
values:
- "linux"
serviceAccountName: nativehamq-ibm-mq
securityContext:
fsGroup: 0
supplementalGroups:
volumes:
- name: ha-tls
secret:
secretName: tlssecret
defaultMode: 288
- name: trust0
secret:
secretName: tlssecret
defaultMode: 0440
items:
- key: app1.crt
path: app1.crt
- key: app2.crt
path: app2.crt
- name: default
secret:
secretName: tlssecret
defaultMode: 0440
items:
- key: tls.key
path: tls.key
- key: tls.crt
path: tls.crt
- name: mqsc-cm-mqsccm
configMap:
name: mqsccm
defaultMode: 420
items:
- key: mq.mqsc
path: mq.mqsc
- name: ini-cm-mqsccm
configMap:
name: mqsccm
defaultMode: 420
items:
- key: mq.ini
path: mq.ini
terminationGracePeriodSeconds: 30
containers:
- name: qmgr
image: "fmk-prod.nexus-ci.onefiserv.net/vendor/ibm/ibm-messaging/mq:9.4.2.0-r1"
imagePullPolicy: IfNotPresent
terminationMessagePath: "/run/termination-log"
ports:
- containerPort: 1414
- containerPort: 9443
- containerPort: 9157
- containerPort: 9414
env:
- name: LICENSE
value: accept
- name: MQ_QMGR_NAME
value: "nativehamq"
- name: MQ_NATIVE_HA
value: "true"
- name: MQ_NATIVE_HA_INSTANCE_0_NAME
value: nativehamq-ibm-mq-0
- name: MQ_NATIVE_HA_INSTANCE_0_REPLICATION_ADDRESS
value: nativehamq-ibm-mq-replica-0(9414)
- name: MQ_NATIVE_HA_INSTANCE_1_NAME
value: nativehamq-ibm-mq-1
- name: MQ_NATIVE_HA_INSTANCE_1_REPLICATION_ADDRESS
value: nativehamq-ibm-mq-replica-1(9414)
- name: MQ_NATIVE_HA_INSTANCE_2_NAME
value: nativehamq-ibm-mq-2
- name: MQ_NATIVE_HA_INSTANCE_2_REPLICATION_ADDRESS
value: nativehamq-ibm-mq-replica-2(9414)
- name: MQ_NATIVE_HA_TLS
value: "true"
- name: MQ_NATIVE_HA_CIPHERSPEC
value: "ANY_TLS12_OR_HIGHER"
- name: MQ_LOGGING_CONSOLE_FORMAT
value: basic
- name: MQ_ENABLE_METRICS
value: "true"
- name: DEBUG
value: "false"
- name: MQ_ENABLE_TRACE_STRMQM
value: "false"
- name: MQ_ENABLE_TRACE_CRTMQDIR
value: "false"
- name: MQ_ENABLE_TRACE_CRTMQM
value: "false"
- name: MQ_EPHEMERAL_PREFIX
value: "/run/mqm"
- name: MQ_GRACE_PERIOD
value: "29"
volumeMounts:
- name: ha-tls
readOnly: true
mountPath: /etc/mqm/ha/pki/keys/ha
- name: trust0
mountPath: "/etc/mqm/pki/trust/0"
readOnly: true
- name: default
mountPath: "/etc/mqm/pki/keys/default"
readOnly: true
- name: mqsc-cm-mqsccm
mountPath: "/etc/mqm/mq.mqsc"
subPath: "mq.mqsc"
readOnly: true
- name: ini-cm-mqsccm
mountPath: "/etc/mqm/mq.ini"
subPath: "mq.ini"
readOnly: true
- mountPath: "/mnt/mqm"
name: qm
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: true
privileged: false
capabilities:
drop:
- ALL
# Set liveness probe to determine if the queue manager is running
livenessProbe:
exec:
command:
- chkmqhealthy
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
# Set readiness probe to determine if the MQ listener is running
readinessProbe:
exec:
command:
- chkmqready
initialDelaySeconds: 0
periodSeconds: 5
timeoutSeconds: 3
failureThreshold: 1
startupProbe:
exec:
command:
- chkmqstarted
timeoutSeconds: 5
periodSeconds: 5
successThreshold: 1
failureThreshold: 24
resources:
limits:
cpu: 500m
memory: 1024Mi
requests:
cpu: 100m
memory: 512Mi
volumeClaimTemplates:

• metadata:
  name: qm
  labels:
  app.kubernetes.io/name: ibm-mq
  app.kubernetes.io/instance: nativehamq
  app.kubernetes.io/managed-by: Helm
  spec:

  If present, use the storageClassName from the values.yaml, else use the

  default storageClass setup by Kubernetes Administrator

  Setting storageClassName to nil means use the default storage class

  storageClassName: "portworx-rwo-rep3"
  accessModes: [ "ReadWriteOnce" ]
  resources:
  requests:
  storage: "2Gi"

---

Source: ibm-mq/templates/pvc-data.yaml

© Copyright IBM Corporation 2022

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/pvc-log.yaml

© Copyright IBM Corporation 2022

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/route-qm.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/route-web.yaml

© Copyright IBM Corporation 2021

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

---

Source: ibm-mq/templates/service-ingress.yaml

© Copyright IBM Corporation 2023, 2025

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

cert-manager.io/cluster-issuer: travelers-cluster-issuer

cert-manager.io/common-name: travelors-mq-eks.ekslb.aws.travp.net

NOTES:
Get the MQ Console URL by running these commands:
export CONSOLE_PORT=$(kubectl get services nativehamq-ibm-mq-web -n ibmmq-dev-app -o jsonpath="{.spec.ports[?(@.port=="9443")].nodePort}")
export CONSOLE_IP=$(kubectl get nodes -o jsonpath='{..addresses[1].address}' | awk '{print $1}')
echo https://$CONSOLE_IP:$CONSOLE_PORT/ibmmq/console

Get the load balancer exposed MQ Console URL by running these commands:
export CONSOLE_PORT=9443
export CONSOLE_IP=$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..hostname}")$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..ip}")
echo https://$CONSOLE_IP:$CONSOLE_PORT/ibmmq/console

Get the load balancer exposed MQ queueManager URL by running these commands:
export MQ_PORT=1414
export MQSERVER_IP=$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..hostname}")$(kubectl get services nativehamq-ibm-mq-loadbalancer -n ibmmq-dev-app -o jsonpath="{..ip}")
echo "$MQSERVER_IP($MQ_PORT)"
The MQ connection information for clients inside the cluster is as follows:
nativehamq-ibm-mq:1414

---

Regards,
Paparayudu

[callumpjackson]

I've tried to recreate on my own environment with the following tolerations:

tolerations:
  - key: "px/node"
    operator: "Equals"
    value: "true"
    effect: "NoSchedule"

This generates the expected statefulset as shown below:

.....
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - "amd64"
                - "s390x"
                - "ppc64le"
              - key: kubernetes.io/os
                operator: In
                values:
                - "linux"
      tolerations:
      - key: px/node
        operator: Equals
        value: true
        effect: NoSchedule
....

In your example you appear to have any additional attribute:

nodeSelector: portworx.io/node-type: storageless

Which is not a toleration, but instead a nodeSelector. Can you try again without the nodeSelector and see if that resolves your issue.

[paparayudud]

Hi,

Tried without nodeSelector

With tolerations :

Error: INSTALLATION FAILED: 1 error occurred:
* StatefulSet in version "v1" cannot be handled as a StatefulSet: json: cannot unmarshal bool into Go struct field Toleration.spec.template.spec.tolerations.value of type string

---

With toleration :

Events:
Type Reason Age From Message

---

Warning PolicyViolation 61s kyverno-admission policy psa-restricted-clusterpolicy/restricted-rule fail: Validation rule 'restricted-rule' failed. It violates PodSecurity "restricted:latest": (Forbidden reason: seccompProfile, field error list: [spec.containers[0].securityContext.seccompProfile.type: Required value])
Warning FailedScheduling 61s stork 0/18 nodes are available: pod has unbound immediate PersistentVolumeClaims. preemption: 0/18 nodes are available: 18 Preemption is not helpful for scheduling.
Warning FailedScheduling 60s stork failed filter with extender at URL http://stork-service.portworx:8099/filter, code 400
Warning FailedScheduling 52s (x2 over 57s) stork failed filter with extender at URL http://stork-service.portworx:8099/filter, code 400
Warning PolicyViolation 31s kyverno-scan policy psa-restricted-clusterpolicy/restricted-rule fail: Validation rule 'restricted-rule' failed. It violates PodSecurity "restricted:latest": (Forbidden reason: seccompProfile, field error list: [spec.containers[0].securityContext.seccompProfile.type: Required value])
Warning FailedScheduling 32s stork No node found with storage driver
Warning FailedScheduling 21s (x3 over 57s) stork No node found with storage driver
Warning FailedScheduling 10s (x3 over 60s) stork No node found with storage driver

[callumpjackson]

Based on the error message I think you are hitting the following helm issue reported here. I don't think I'm hitting the issue due to different version of helm. If you escape it should work.

[paparayudud]

Partially our issue got resolved

Tried without nodeSelector

and passed below

tolerations:

• key: "px/node"
  operator: "Equal"
  value: '"true"' # this helped to fix the issue without nodeselector
  effect: "NoSchedule"
  nodeSelector:
  portworx.io/node-type: storageless

---

But when tried with nodeselector

Pod is getting created but when we describe the pod, below is the error

Events:
Type Reason Age From Message

---

Warning PolicyViolation 3m49s kyverno-admission policy psa-restricted-clusterpolicy/restricted-rule fail: Validation rule 'restricted-rule' failed. It violates PodSecurity "restricted:latest": (Forbidden reason: seccompProfile, field error list: [spec.containers[0].securityContext.seccompProfile.type: Required value])
Warning FailedScheduling 3m49s stork 0/18 nodes are available: pod has unbound immediate PersistentVolumeClaims. preemption: 0/18 nodes are available: 18 Preemption is not helpful for scheduling.
Normal Scheduled 3m48s stork Successfully assigned ibmmq-dev-app/nativehamq-ibm-mq-0 to aks-pxusernpaz2s-32474481-vmss000000
Warning PolicyViolation 3m19s kyverno-scan policy psa-restricted-clusterpolicy/restricted-rule fail: Validation rule 'restricted-rule' failed. It violates PodSecurity "restricted:latest": (Forbidden reason: seccompProfile, field error list: [spec.containers[0].securityContext.seccompProfile.type: Required value])
Normal Pulled 3m46s kubelet Container image "fmk-prod.nexus-ci.onefiserv.net/vendor/ibm/ibm-messaging/mq:9.4.2.0-r1" already present on machine
Normal Created 3m46s kubelet Created container: qmgr
Normal Started 3m46s kubelet Started container qmgr
Warning Unhealthy 3m21s (x5 over 3m41s) kubelet Startup probe failed:
Warning Unhealthy 3m16s kubelet Readiness probe failed:

Seems the reason is as nodeselector is not there in helm chart, it's throwing error

Will you inject nodeselector in helm chart in later versions?

Please check and analyze

[callumpjackson]

Please take a look here, you will see an option for affinity.nodeAffinity.matchExpressions.

[paparayudud]

We are not able to access

affinity.nodeAffinity.matchExpressions

Force deployments to particular nodes. Corresponds to the Kubernetes specification for NodeSelectorRequirement

[callumpjackson]

Try this link. There is also some additional documentation here and here.