Clairly Resourcequota limit for PriorityClass

Signed-off-by: Weiping Cai <weiping.cai@daocloud.io>

content/en/docs/concepts/policy/resource-quotas.md

@@ -610,17 +610,28 @@ plugins:
         values: ["cluster-services"]
 ```
 
-Now, "cluster-services" pods will be allowed in only those namespaces where a quota object with a matching `scopeSelector` is present.
+Then, create a resource quota object in the `kube-system` namespace:
-For example:
 
-```yaml
+{{< codenew file="policy/priority-class-resourcequota.yaml" >}}
-    scopeSelector:
+
-      matchExpressions:
+```shell
-      - scopeName: PriorityClass
+$ kubectl apply -f https://k8s.io/examples/policy/priority-class-resourcequota.yaml -n kube-system
-        operator: In
-        values: ["cluster-services"]
 ```
 
+```
+resourcequota/pods-cluster-services created
+```
+
+In this case, a pod creation will be allowed if:
+
+1.  the Pod's `priorityClassName` is not specified.
+1.  the Pod's `priorityClassName` is specified to a value other than `cluster-services`.
+1.  the Pod's `priorityClassName` is set to `cluster-services`, it is to be created
+   in the `kube-system` namespace, and it has passed the resource quota check.
+
+A Pod creation request is rejected if its `priorityClassName` is set to `cluster-services`
+and it is to be created in a namespace other than `kube-system`.
+
 ## {{% heading "whatsnext" %}}
 
 - See [ResourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_resource_quota.md) for more information.

content/en/examples/policy/priority-class-resourcequota.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: pods-cluster-services
+spec:
+  scopeSelector:
+    matchExpressions:
+      - operator : In
+        scopeName: PriorityClass
+        values: ["cluster-services"]