From 35b1c010b75d9b4fee0def2eabbe51a5a8b4ae53 Mon Sep 17 00:00:00 2001 From: Abdullah Gharaibeh Date: Mon, 1 Feb 2021 17:15:41 -0500 Subject: [PATCH] cleanups --- .../README.md | 26 +++++++++---------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/keps/sig-scheduling/2249-pod-affinity-namespace-selector/README.md b/keps/sig-scheduling/2249-pod-affinity-namespace-selector/README.md index a9af06024a4a..174e7d0a0ade 100644 --- a/keps/sig-scheduling/2249-pod-affinity-namespace-selector/README.md +++ b/keps/sig-scheduling/2249-pod-affinity-namespace-selector/README.md @@ -274,22 +274,22 @@ We will address this concern by introducing a new quota scope named `CrossNamesp that operators can use to limit which namespaces are allowed to have pods with affinity terms that set the existing `namespaces` field or the proposed one `namespaceSelector`. -Using this new scope, operators can prevent certain namespaces from having pods that use -cross-namespace pod affinity by creating a resource quota object in that namespace with -`CrossNamespaceAffinity` scope and hard limit of 0: +Using this new scope, operators can prevent certain namespaces (`foo-ns` in the example below) +from having pods that use cross-namespace pod affinity by creating a resource quota object in +that namespace with `CrossNamespaceAffinity` scope and hard limit of 0: -```go +```yaml apiVersion: v1 kind: ResourceQuota metadata: - name: DisableCrossNamespaceAffinity - namespace: foo-ns + name: disable-cross-namespace-affinity + namespace: foo-ns spec: - hard: - pods: "0" - scopeSelector: - matchExpressions: - - scopeName: CrossNamespaceAffinity + hard: + pods: "0" + scopeSelector: + matchExpressions: + - scopeName: CrossNamespaceAffinity ``` If operators want to disallow using `namespaces` and `namespaceSelector` by default, and @@ -322,13 +322,12 @@ selectors. For example, users can do the following: ```yaml podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - - namespaceSelector: { + - namespaceSelector: matchExpressions: - key: workload operator: In values: - HPC - } ``` but can't do the following: @@ -337,7 +336,6 @@ but can't do the following: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - namespaceSelector: {} - } ``` For more protection, admission webhooks like gatekeeper can be used to further