You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/blog/_posts/2024-08-16-matchlabelkeys-podaffinity.md
+30-30Lines changed: 30 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,25 +7,25 @@ author: >
7
7
Kensei Nakada (Tetrate)
8
8
---
9
9
10
-
Kubernetes 1.29 introduced new fields `MatchLabelKeys` and `MismatchLabelKeys` in PodAffinity and PodAntiAffinity.
10
+
Kubernetes 1.29 introduced new fields `matchLabelKeys` and `mismatchLabelKeys` in `podAffinity` and `podAntiAffinity`.
11
11
12
12
In Kubernetes 1.31, this feature moves to beta and the corresponding feature gate (`MatchLabelKeysInPodAffinity`) gets enabled by default.
13
13
14
-
## `MatchLabelKeys` - Enhanced scheduling for versatile rolling updates
14
+
## `matchLabelKeys` - Enhanced scheduling for versatile rolling updates
15
15
16
-
During a workload's (e.g., Deployment) rolling update, a cluster may have Pods from multiple versions at the same time.
17
-
However, the scheduler cannot distinguish between old and new versions based on the `LabelSelector` specified in PodAffinity or PodAntiAffinity. As a result, it will co-locate or disperse Pods regardless of their versions.
16
+
During a workload's (e.g., Deployment) rolling update, a cluster may have Pods from multiple versions at the same time.
17
+
However, the scheduler cannot distinguish between old and new versions based on the `labelSelector` specified in `podAffinity` or `podAntiAffinity`. As a result, it will co-locate or disperse Pods regardless of their versions.
18
18
19
19
This can lead to sub-optimal scheduling outcome, for example:
20
-
- New version Pods are co-located with old version Pods (PodAffinity), which will eventually be removed after rolling updates.
21
-
- Old version Pods are distributed across all available topologies, preventing new version Pods from finding nodes due to PodAntiAffinity.
20
+
- New version Pods are co-located with old version Pods (`podAffinity`), which will eventually be removed after rolling updates.
21
+
- Old version Pods are distributed across all available topologies, preventing new version Pods from finding nodes due to `podAntiAffinity`.
22
22
23
-
`MatchLabelKeys` is a set of Pod label keys and addresses this problem.
24
-
The scheduler looks up the values of these keys from the new Pod's labels and combines them with `LabelSelector`
25
-
so that PodAffinity matches Pods that have the same key-value in labels.
23
+
`matchLabelKeys` is a set of Pod label keys and addresses this problem.
24
+
The scheduler looks up the values of these keys from the new Pod's labels and combines them with `labelSelector`
25
+
so that podAffinity matches Pods that have the same key-value in labels.
26
26
27
-
By using label [pod-template-hash](/docs/concepts/workloads/controllers/deployment/#pod-template-hash-label) in `MatchLabelKeys`,
28
-
you can ensure that only Pods of the same version are evaluated for PodAffinity or PodAntiAffinity.
27
+
By using label [pod-template-hash](/docs/concepts/workloads/controllers/deployment/#pod-template-hash-label) in `matchLabelKeys`,
28
+
you can ensure that only Pods of the same version are evaluated for `podAffinity` or `podAntiAffinity`.
29
29
30
30
```yaml
31
31
apiVersion: apps/v1
@@ -43,11 +43,11 @@ metadata:
43
43
values:
44
44
- database
45
45
topologyKey: topology.kubernetes.io/zone
46
-
matchLabelKeys:
46
+
matchLabelKeys:
47
47
- pod-template-hash
48
48
```
49
49
50
-
The above matchLabelKeys will be translated in Pods like:
50
+
The above `matchLabelKeys` will be translated in Pods like:
51
51
52
52
```yaml
53
53
kind: Pod
@@ -68,26 +68,26 @@ metadata:
68
68
- key: pod-template-hash # Added from matchLabelKeys; Only Pods from the same replicaset will match this affinity.
69
69
operator: In
70
70
values:
71
-
- xyz
71
+
- xyz
72
72
topologyKey: topology.kubernetes.io/zone
73
-
matchLabelKeys:
73
+
matchLabelKeys:
74
74
- pod-template-hash
75
75
```
76
76
77
-
## `MismatchLabelKeys` - Service isolation
77
+
## `mismatchLabelKeys` - Service isolation
78
78
79
-
`MismatchLabelKeys`is a set of Pod label keys, like `MatchLabelKeys`,
80
-
which looks up the values of these keys from the new Pod's labels, and merge them with `LabelSelector` as `key notin (value)`
81
-
so that PodAffinity does _not_ match Pods that have the same key-value in labels.
79
+
`mismatchLabelKeys`is a set of Pod label keys, like `matchLabelKeys`,
80
+
which looks up the values of these keys from the new Pod's labels, and merge them with `labelSelector` as `key notin (value)`
81
+
so that `podAffinity` does _not_ match Pods that have the same key-value in labels.
82
82
83
-
Suppose all Pods for each tenant get `tenant` label via a controller or a manifest management tool like Helm.
83
+
Suppose all Pods for each tenant get `tenant` label via a controller or a manifest management tool like Helm.
84
84
85
-
Although the value of `tenant` label is unknown when composing each workload's manifest,
85
+
Although the value of `tenant` label is unknown when composing each workload's manifest,
86
86
the cluster admin wants to achieve exclusive 1:1 tenant to domain placement for a tenant isolation.
87
87
88
-
`MismatchLabelKeys`works for this usecase;
89
-
By applying the following affinity globally using a mutating webhook,
90
-
the cluster admin can ensure that the Pods from the same tenant will land on the same domain exclusively,
88
+
`mismatchLabelKeys`works for this usecase;
89
+
By applying the following affinity globally using a mutating webhook,
90
+
the cluster admin can ensure that the Pods from the same tenant will land on the same domain exclusively,
91
91
meaning Pods from other tenants won't land on the same domain.
92
92
93
93
```yaml
@@ -108,7 +108,7 @@ affinity:
108
108
topologyKey: node-pool
109
109
```
110
110
111
-
The above matchLabelKeys and mismatchLabelKeys will be translated to like:
111
+
The above `matchLabelKeys` and `mismatchLabelKeys` will be translated to like:
112
112
113
113
```yaml
114
114
kind: Pod
@@ -140,17 +140,17 @@ spec:
140
140
- key: tenant
141
141
operator: NotIn
142
142
values:
143
-
- service-a
143
+
- service-a
144
144
topologyKey: node-pool
145
145
```
146
146
147
-
## Getting involved
147
+
## Getting involved
148
148
149
149
These features are managed by Kubernetes [SIG Scheduling](https://github.com/kubernetes/community/tree/master/sig-scheduling).
150
150
151
151
Please join us and share your feedback. We look forward to hearing from you!
152
152
153
-
## How can I learn more?
153
+
## How can I learn more?
154
154
155
-
- [The official document of PodAffinity](/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity)
156
-
- [KEP-3633: Introduce MatchLabelKeys and MismatchLabelKeys to PodAffinity and PodAntiAffinity](https://github.com/kubernetes/enhancements/blob/master/keps/sig-scheduling/3633-matchlabelkeys-to-podaffinity/README.md#story-2)
155
+
- [The official document of podAffinity](/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity)
156
+
- [KEP-3633: Introduce matchLabelKeys and mismatchLabelKeys to podAffinity and podAntiAffinity](https://github.com/kubernetes/enhancements/blob/master/keps/sig-scheduling/3633-matchlabelkeys-to-podaffinity/README.md#story-2)
0 commit comments