From 80c90ba8fbd4be66071603ca45e2f36eb98b991d Mon Sep 17 00:00:00 2001 From: Vincent Date: Sat, 24 Jun 2017 05:03:07 +0800 Subject: [PATCH] fixed #3968 (#4105) * fixed #3968 * advise from @chenopis --- docs/concepts/configuration/assign-pod-node.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/concepts/configuration/assign-pod-node.md b/docs/concepts/configuration/assign-pod-node.md index c608f021d2..495bd4665a 100644 --- a/docs/concepts/configuration/assign-pod-node.md +++ b/docs/concepts/configuration/assign-pod-node.md @@ -190,13 +190,14 @@ flavor and the `preferredDuringSchedulingIgnoredDuringExecution` flavor. As with node affinity, the legal operators for pod affinity and anti-affinity are `In`, `NotIn`, `Exists`, `DoesNotExist`, `Gt`, `Lt`. -In principle, the `topologyKey` can be any legal label value. However, -for performance reasons, only a limited set of topology keys are allowed. -By default the allowed topology keys are: +In principle, the `topologyKey` can be any legal label-key. However, +for performance and security reasons, there are some constraints on topologyKey: -* `kubernetes.io/hostname` -* `failure-domain.beta.kubernetes.io/zone` -* `failure-domain.beta.kubernetes.io/region` +1. For affinity and for `RequiredDuringScheduling` pod anti-affinity, +empty `topologyKey` is not allowed. +2. For `RequiredDuringScheduling` pod anti-affinity, the admission controller `LimitPodHardAntiAffinityTopology` was introduced to limit `topologyKey` to `kubernetes.io/hostname`. If you want to make it available for custom topologies, you may modify the admission controller, or simply disable it. +3. For `PreferredDuringScheduling` pod anti-affinity, empty `topologyKey` is interpreted as "all topologies" ("all topologies" here is now limited to the combination of `kubernetes.io/hostname`, `failure-domain.beta.kubernetes.io/zone` and `failure-domain.beta.kubernetes.io/region`). +4. Except for the above cases, the `topologyKey` can be any legal label-key. In addition to `labelSelector` and `topologyKey`, you can optionally specify a list `namespaces` of namespaces which the `labelSelector` should match against (this goes at the same level of the definition as `labelSelector` and `topologyKey`).