@@ -465,7 +465,7 @@ from getting scheduled in a failure domain.
465
465
466
466
Using this scope operators can prevent certain namespaces (`foo-ns` in the example below)
467
467
from having pods that use cross-namespace pod affinity by creating a resource quota object in
468
- that namespace with `CrossNamespaceAffinity ` scope and hard limit of 0:
468
+ that namespace with `CrossNamespacePodAffinity ` scope and hard limit of 0:
469
469
470
470
```yaml
471
471
apiVersion: v1
@@ -478,11 +478,12 @@ spec:
478
478
pods: "0"
479
479
scopeSelector:
480
480
matchExpressions:
481
- - scopeName: CrossNamespaceAffinity
481
+ - scopeName: CrossNamespacePodAffinity
482
+ operator: Exists
482
483
```
483
484
484
485
If operators want to disallow using ` namespaces ` and ` namespaceSelector ` by default, and
485
- only allow it for specific namespaces, they could configure ` CrossNamespaceAffinity `
486
+ only allow it for specific namespaces, they could configure ` CrossNamespacePodAffinity `
486
487
as a limited resource by setting the kube-apiserver flag --admission-control-config-file
487
488
to the path of the following configuration file:
488
489
@@ -497,12 +498,13 @@ plugins:
497
498
limitedResources :
498
499
- resource : pods
499
500
matchScopes :
500
- - scopeName : CrossNamespaceAffinity
501
+ - scopeName : CrossNamespacePodAffinity
502
+ operator : Exists
501
503
` ` `
502
504
503
505
With the above configuration, pods can use ` namespaces` and `namespaceSelector` in pod affinity only
504
506
if the namespace where they are created have a resource quota object with
505
- ` CrossNamespaceAffinity ` scope and a hard limit greater than or equal to the number of pods using those fields.
507
+ ` CrossNamespacePodAffinity ` scope and a hard limit greater than or equal to the number of pods using those fields.
506
508
507
509
# # Requests compared to Limits {#requests-vs-limits}
508
510
0 commit comments