whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove requirement for unsupported k8s version for NodeRestriction. (#17331)

Browse Source
This commit is contained in:
Mitesh Jain
2019-11-01 06:34:54 +05:30
committed by Kubernetes Prow Robot
parent f7428bd0b0
commit 0019c593dc
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/configuration/assign-pod-node.md
+2 -3
View File
@@ -99,9 +99,8 @@ and influencing the scheduler to schedule workloads to the compromised node.
The `NodeRestriction` admission plugin prevents kubelets from setting or modifying labels with a `node-restriction.kubernetes.io/` prefix. The `NodeRestriction` admission plugin prevents kubelets from setting or modifying labels with a `node-restriction.kubernetes.io/` prefix.
To make use of that label prefix for node isolation: To make use of that label prefix for node isolation:
1. Check that you're using Kubernetes v1.11+ so that NodeRestriction is available. 1. Ensure you are using the [Node authorizer](/docs/reference/access-authn-authz/node/) and have _enabled_ the [NodeRestriction admission plugin](/docs/reference/access-authn-authz/admission-controllers/#noderestriction).
2. Ensure you are using the [Node authorizer](/docs/reference/access-authn-authz/node/) and have _enabled_ the [NodeRestriction admission plugin](/docs/reference/access-authn-authz/admission-controllers/#noderestriction). 2. Add labels under the `node-restriction.kubernetes.io/` prefix to your Node objects, and use those labels in your node selectors.
3. Add labels under the `node-restriction.kubernetes.io/` prefix to your Node objects, and use those labels in your node selectors.
For example, `example.com.node-restriction.kubernetes.io/fips=true` or `example.com.node-restriction.kubernetes.io/pci-dss=true`. For example, `example.com.node-restriction.kubernetes.io/fips=true` or `example.com.node-restriction.kubernetes.io/pci-dss=true`.
## Affinity and anti-affinity ## Affinity and anti-affinity