Skip to content

Commit

Permalink
cleanups
Browse files Browse the repository at this point in the history
  • Loading branch information
ahg-g committed Feb 1, 2021
1 parent 199ac0d commit 35b1c01
Showing 1 changed file with 12 additions and 14 deletions.
26 changes: 12 additions & 14 deletions keps/sig-scheduling/2249-pod-affinity-namespace-selector/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -274,22 +274,22 @@ We will address this concern by introducing a new quota scope named `CrossNamesp
that operators can use to limit which namespaces are allowed to have pods with affinity terms
that set the existing `namespaces` field or the proposed one `namespaceSelector`.

Using this new scope, operators can prevent certain namespaces from having pods that use
cross-namespace pod affinity by creating a resource quota object in that namespace with
`CrossNamespaceAffinity` scope and hard limit of 0:
Using this new scope, operators can prevent certain namespaces (`foo-ns` in the example below)
from having pods that use cross-namespace pod affinity by creating a resource quota object in
that namespace with `CrossNamespaceAffinity` scope and hard limit of 0:

```go
```yaml
apiVersion: v1
kind: ResourceQuota
metadata:
name: DisableCrossNamespaceAffinity
namespace: foo-ns
name: disable-cross-namespace-affinity
namespace: foo-ns
spec:
hard:
pods: "0"
scopeSelector:
matchExpressions:
- scopeName: CrossNamespaceAffinity
hard:
pods: "0"
scopeSelector:
matchExpressions:
- scopeName: CrossNamespaceAffinity
```
If operators want to disallow using `namespaces` and `namespaceSelector` by default, and
Expand Down Expand Up @@ -322,13 +322,12 @@ selectors. For example, users can do the following:
```yaml
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- namespaceSelector: {
- namespaceSelector:
matchExpressions:
- key: workload
operator: In
values:
- HPC
}
```

but can't do the following:
Expand All @@ -337,7 +336,6 @@ but can't do the following:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- namespaceSelector: {}
}
```

For more protection, admission webhooks like gatekeeper can be used to further
Expand Down

0 comments on commit 35b1c01

Please sign in to comment.