diff --git a/content/en/docs/concepts/policy/resource-quotas.md b/content/en/docs/concepts/policy/resource-quotas.md index 0edb1be338047..1a0714d763dd5 100644 --- a/content/en/docs/concepts/policy/resource-quotas.md +++ b/content/en/docs/concepts/policy/resource-quotas.md @@ -610,17 +610,29 @@ plugins: values: ["cluster-services"] ``` -Now, "cluster-services" pods will be allowed in only those namespaces where a quota object with a matching `scopeSelector` is present. -For example: +Then, create a corresponding resource quota object in `kube-system` namespace: -```yaml +```shell +$ cat ./quota.yml +- apiVersion: v1 + kind: ResourceQuota + metadata: + name: pods-cluster-services + spec: scopeSelector: matchExpressions: - - scopeName: PriorityClass - operator: In + - operator : In + scopeName: PriorityClass values: ["cluster-services"] +$ kubectl create -f ./quota.yml -n kube-system` ``` +In this case, a pod creation will be allowed if: +1. Pod has no priority class and created in any namespace. +2. Pod has priority class other than `cluster-services` and created in any namespace. +3. Pod has priority class `cluster-services` and created in `kube-system` namespace, and passed resource quota check. +Pod creation will be rejected if pod has priority class `cluster-services` and created in namespace other than `kube-system` + ## {{% heading "whatsnext" %}} - See [ResourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_resource_quota.md) for more information.