From 188ccc220b8383fbb6fb73314e8a85b4199fa161 Mon Sep 17 00:00:00 2001
From: Weiping Cai <weiping.cai@daocloud.io>
Date: Thu, 28 Jan 2021 16:38:55 +0800
Subject: [PATCH] Clairly Resourcequota limit for PriorityClass

Signed-off-by: Weiping Cai <weiping.cai@daocloud.io>
---
 .../docs/concepts/policy/resource-quotas.md   | 27 +++++++++++++------
 .../policy/priority-class-resourcequota.yaml  | 10 +++++++
 2 files changed, 29 insertions(+), 8 deletions(-)
 create mode 100644 content/en/examples/policy/priority-class-resourcequota.yaml

diff --git a/content/en/docs/concepts/policy/resource-quotas.md b/content/en/docs/concepts/policy/resource-quotas.md
index 0edb1be338..d5c94d99cf 100644
--- a/content/en/docs/concepts/policy/resource-quotas.md
+++ b/content/en/docs/concepts/policy/resource-quotas.md
@@ -610,17 +610,28 @@ plugins:
         values: ["cluster-services"]
 ```
 
-Now, "cluster-services" pods will be allowed in only those namespaces where a quota object with a matching `scopeSelector` is present.
-For example:
+Then, create a resource quota object in the `kube-system` namespace:
 
-```yaml
-    scopeSelector:
-      matchExpressions:
-      - scopeName: PriorityClass
-        operator: In
-        values: ["cluster-services"]
+{{< codenew file="policy/priority-class-resourcequota.yaml" >}}
+
+```shell
+$ kubectl apply -f https://k8s.io/examples/policy/priority-class-resourcequota.yaml -n kube-system
 ```
 
+```
+resourcequota/pods-cluster-services created
+```
+
+In this case, a pod creation will be allowed if:
+
+1.  the Pod's `priorityClassName` is not specified.
+1.  the Pod's `priorityClassName` is specified to a value other than `cluster-services`.
+1.  the Pod's `priorityClassName` is set to `cluster-services`, it is to be created
+   in the `kube-system` namespace, and it has passed the resource quota check.
+
+A Pod creation request is rejected if its `priorityClassName` is set to `cluster-services`
+and it is to be created in a namespace other than `kube-system`.
+
 ## {{% heading "whatsnext" %}}
 
 - See [ResourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_resource_quota.md) for more information.
diff --git a/content/en/examples/policy/priority-class-resourcequota.yaml b/content/en/examples/policy/priority-class-resourcequota.yaml
new file mode 100644
index 0000000000..7350d00c8f
--- /dev/null
+++ b/content/en/examples/policy/priority-class-resourcequota.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: pods-cluster-services
+spec:
+  scopeSelector:
+    matchExpressions:
+      - operator : In
+        scopeName: PriorityClass
+        values: ["cluster-services"]
\ No newline at end of file