Is there any way to configure nodeSelector
at the namespace level?
I want to run a workload only on certain nodes for this namespace.
To achieve this you can use PodNodeSelector
admission controller.
First, you need to enable it in your kubernetes-apiserver:
/etc/kubernetes/manifests/kube-apiserver.yaml
:--enable-admission-plugins=
PodNodeSelector
parameterNow, you can specify scheduler.alpha.kubernetes.io/node-selector
option in annotations for your namespace, example:
apiVersion: v1
kind: Namespace
metadata:
name: your-namespace
annotations:
scheduler.alpha.kubernetes.io/node-selector: env=test
spec: {}
status: {}
After these steps, all the pods created in this namespace will have this section automatically added:
nodeSelector
env: test
More information about the PodNodeSelector
you can find in the official Kubernetes documentation: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podnodeselector
If you deployed your cluster using kubeadm and if you want to make this configuration persistent, you have to update your kubeadm config file:
kubectl edit cm -n kube-system kubeadm-config
specify extraArgs
with custom values under apiServer
section:
apiServer:
extraArgs:
enable-admission-plugins: NodeRestriction,PodNodeSelector
then update your kube-apiserver static manifest on all control-plane nodes:
kubeadm config view > kubeadm-config.yaml
kubeadm init phase control-plane apiserver --config kubeadm-config.yaml
You can just use kube_apiserver_enable_admission_plugins
variable for your api-server configuration variables:
kube_apiserver_enable_admission_plugins:
- PodNodeSelector
I totally agree with the @kvaps answer but something is missing : it is necessary to add a label in your node :
kubectl label node <yournode> env=test
Like that, the pod created in the namespace with scheduler.alpha.kubernetes.io/node-selector: env=test
will be schedulable only on node with env=test
label