Exempt FlowSchema breaks kwok deployment in AWS

[wonderyl]

How to use it?

• kwok
• kwokctl --runtime=docker (default runtime)
• kwokctl --runtime=binary
• kwokctl --runtime=nerdctl
• kwokctl --runtime=kind

What happened?

I got the following error when trying to deploy Kwok in AWS. Azure works fine.

##[error]2025-11-18 04:14:38 - utils.retries - ERROR - Attempt 1 failed with error: Error applying manifest from https://github.com/kubernetes-sigs/kwok/releases/download/v0.7.0/kwok.yaml: Error creating FlowSchema: (400)
Reason: Bad Request
HTTP response headers: HTTPHeaderDict({'Audit-Id': 'f19a56b8-e3bd-4e6f-96ac-b72f3481e428', 'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'X-Kubernetes-Pf-Flowschema-Uid': 'abf026b0-2645-4f1f-96e2-5a616d912b0b', 'X-Kubernetes-Pf-Prioritylevel-Uid': 'b101e080-0765-45c6-85d8-4ab3665e02f2', 'Date': 'Tue, 18 Nov 2025 04:14:38 GMT', 'Content-Length': '239'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"creation or update of FlowSchema object kwok-controller that references the exempt PriorityLevelConfiguration is not allowed","reason":"BadRequest","code":400}

What did you expect to happen?

Deploy successfully

How can we reproduce it (as minimally and precisely as possible)?

1. create an EKS cluster
2. deploy Kwok

Anything else we need to know?

No response

Kwok version

v0.7.0

OS version

Irrelevant

[wzshiming]

It looks like it's due to insufficient permissions. It doesn't look like you deployed using kubectl? If so, kubectl should just report an error and continue creating the rest.
It just tells apiserver to allow kwok to make more requests, which you can find a way to ignore.