PodTopologyConstraints - DoNotSchedule not working as expected - kubernetes

Question

I tried to use PodTopologySpreadConstraint to organize our deployment engine, and to spread replicas across zones.
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
spec:
selector:
matchLabels:
app: nginx
replicas: 4
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:alpine
ports:
- containerPort: 80
topologySpreadConstraints:
- maxSkew: 1
topologyKey: topology.kubernetes.io/zone
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app: nginx
tolerations:
- effect: NoSchedule
key: platform
operator: Equal
value: "true"
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: nodes
operator: In
values:
- platform
I expected that, if I have just one node labeled "platform", the scheduler needs to run just one replica of Nginx, and others need to be in a "pending" state because "DoNotSchedule" constraint is not satisfied.
But the deployment running the 4 replicas in the same node/zone, even that "DoNotSchedule" defined.
➜ kubectl get pods -o wide | grep nginx-deployment
nginx-deployment-6cbbb547c-6qvrg 1/1 Running 0 15m 192.168.33.28 ip-192-168-42-2.sa-east-1.compute.internal <none> <none>
nginx-deployment-6cbbb547c-cgbcf 1/1 Running 0 15m 192.168.37.251 ip-192-168-42-2.sa-east-1.compute.internal <none> <none>
nginx-deployment-6cbbb547c-dlqvd 1/1 Running 0 15m 192.168.47.173 ip-192-168-42-2.sa-east-1.compute.internal <none> <none>
nginx-deployment-6cbbb547c-hkgzc 1/1 Running 0 15m 192.168.39.27 ip-192-168-42-2.sa-east-1.compute.internal <none> <none>
and i just have one node labeled "platform"
➜ kubectl get nodes -l app=platform
NAME STATUS ROLES AGE VERSION
ip-192-168-42-2.sa-east-1.compute.internal Ready <none> 4h45m v1.22.15-eks-fb459a0
Does anyone have any idea what I made wrong?