{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/community/pulls/comments/190717506","pull_request_review_id":123155582,"id":190717506,"diff_hunk":"@@ -0,0 +1,516 @@\n+# Scheduling Policy\n+\n+_Status: Draft_\n+\n+_Authors: @arnaudmz, @yastij_\n+\n+_Reviewers: @bsalamat, @liggitt_\n+\n+# Objectives\n+\n+-  Define the concept of scheduling policies\n+-  Propose their initial design and scope\n+\n+## Non-Goals\n+\n+-  How taints / tolerations work.\n+-  How NodeSelector works.\n+-  How node / pod affinity / anti-affinity rules work.\n+-  How several schedulers can be used within a single cluster.\n+-  How priority classes work.\n+-  How to set defaults in Kubernetes.\n+\n+# Background\n+\n+During real-life Kubernetes architecturing we encountered contexts where role-isolation (between administration and simple namespace usage in a multi-tenant context) could be improved. So far, no restriction is possible on toleration, priority class usage, nodeSelector, anti-affinity depending on user permissions (RBAC).\n+\n+Identified use-cases aim to ensure that administrators have a way to restrict users or namespaces, it allows administrators to:\n+\n+-  Restrict execution for specific applications (which are namespace scoped) into certain nodes\n+-  Create policies that prevent users from even attempting to schedule workloads onto masters to maximize security\n+-  require that a pods under a namespace run on dedicated nodes\n+-  Restrict usage of some `PriorityClass`\n+-  Restrict usage to a specific set of schedulers.\n+-  placing pods on specific nodes (master roles for instance).\n+-  using specific priority classes.\n+-  expressing pod affinity or anti-affinity rules.\n+\n+Also Mandatory (and optionally default) values must also be enforced by scheduling policies in case of:\n+\n+-  mutli-arch (amd64, arm64) of multi-os (Linux, Windows) clusters\n+-  multi-az / region / failure domain clusters\n+\n+# Overview\n+\n+### syntaxic standards\n+\n+```yaml\n+apiVersion: policy/v1alpha1\n+kind: <POLICY_KIND>\n+metadata:\n+  name: <POLICY_NAME>\n+spec:\n+  bindingMode: <BINDING_MODE>            # Describes a bindingMode (any or all)\n+  namespaces:                            # a list of namespaces that the policy targets (optional)","path":"contributors/design-proposals/scheduling/scheduling-policy.md","position":54,"original_position":54,"commit_id":"aad9f2fcad32b42ceb0df074028962b2b8c76f01","original_commit_id":"d129432b0dd6bd0932cbce34aa2e10204254232f","user":{"login":"easeway","id":1752146,"avatar_url":"https://avatars2.githubusercontent.com/u/1752146?v=4","gravatar_id":"","url":"https://api.github.com/users/easeway","html_url":"https://github.com/easeway","followers_url":"https://api.github.com/users/easeway/followers","following_url":"https://api.github.com/users/easeway/following{/other_user}","gists_url":"https://api.github.com/users/easeway/gists{/gist_id}","starred_url":"https://api.github.com/users/easeway/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/easeway/subscriptions","organizations_url":"https://api.github.com/users/easeway/orgs","repos_url":"https://api.github.com/users/easeway/repos","events_url":"https://api.github.com/users/easeway/events{/privacy}","received_events_url":"https://api.github.com/users/easeway/received_events","type":"User","site_admin":false},"body":"+1\r\n\r\nAs I know, currently it's very difficult (impossible) to select namespaces using names if no specific labels are created. For example, how to select the namespace `kube-system` without using labels? So I guess that's the intention behind that. But regarding the scenario using scheduling policy, I feel labelSelector should be sufficient for most of the use cases, based on explicit requirement for labeling, before the select_beyond_labels problem is solved.","created_at":"2018-05-24T20:17:16Z","updated_at":"2018-05-24T20:17:16Z","html_url":"https://github.com/kubernetes/community/pull/1937#discussion_r190717506","pull_request_url":"https://api.github.com/repos/kubernetes/community/pulls/1937","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/community/pulls/comments/190717506"},"html":{"href":"https://github.com/kubernetes/community/pull/1937#discussion_r190717506"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/community/pulls/1937"}},"in_reply_to_id":185485508},"pull_request":{"url":"https://api.github.com/repos/kubernetes/community/pulls/1937","id":175487860,"html_url":"https://github.com/kubernetes/community/pull/1937","diff_url":"https://github.com/kubernetes/community/pull/1937.diff","patch_url":"https://github.com/kubernetes/community/pull/1937.patch","issue_url":"https://api.github.com/repos/kubernetes/community/issues/1937","number":1937,"state":"open","locked":false,"title":"Add initial design proposal for Scheduling Policy","user":{"login":"arnaudmz","id":1323980,"avatar_url":"https://avatars3.githubusercontent.com/u/1323980?v=4","gravatar_id":"","url":"https://api.github.com/users/arnaudmz","html_url":"https://github.com/arnaudmz","followers_url":"https://api.github.com/users/arnaudmz/followers","following_url":"https://api.github.com/users/arnaudmz/following{/other_user}","gists_url":"https://api.github.com/users/arnaudmz/gists{/gist_id}","starred_url":"https://api.github.com/users/arnaudmz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arnaudmz/subscriptions","organizations_url":"https://api.github.com/users/arnaudmz/orgs","repos_url":"https://api.github.com/users/arnaudmz/repos","events_url":"https://api.github.com/users/arnaudmz/events{/privacy}","received_events_url":"https://api.github.com/users/arnaudmz/received_events","type":"User","site_admin":false},"body":"Ref: kubernetes/kubernetes#61185\r\n\r\n/assign @bsalamat @liggitt \r\n/cc @yastij ","created_at":"2018-03-16T10:05:18Z","updated_at":"2018-05-24T20:17:16Z","closed_at":null,"merged_at":null,"merge_commit_sha":"000ec45ef34b2e0300fa4e91999c47358614e519","assignee":{"login":"liggitt","id":980082,"avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"assignees":[{"login":"liggitt","id":980082,"avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},{"login":"bsalamat","id":14308438,"avatar_url":"https://avatars3.githubusercontent.com/u/14308438?v=4","gravatar_id":"","url":"https://api.github.com/users/bsalamat","html_url":"https://github.com/bsalamat","followers_url":"https://api.github.com/users/bsalamat/followers","following_url":"https://api.github.com/users/bsalamat/following{/other_user}","gists_url":"https://api.github.com/users/bsalamat/gists{/gist_id}","starred_url":"https://api.github.com/users/bsalamat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsalamat/subscriptions","organizations_url":"https://api.github.com/users/bsalamat/orgs","repos_url":"https://api.github.com/users/bsalamat/repos","events_url":"https://api.github.com/users/bsalamat/events{/privacy}","received_events_url":"https://api.github.com/users/bsalamat/received_events","type":"User","site_admin":false},{"login":"tallclair","id":29742491,"avatar_url":"https://avatars1.githubusercontent.com/u/29742491?v=4","gravatar_id":"","url":"https://api.github.com/users/tallclair","html_url":"https://github.com/tallclair","followers_url":"https://api.github.com/users/tallclair/followers","following_url":"https://api.github.com/users/tallclair/following{/other_user}","gists_url":"https://api.github.com/users/tallclair/gists{/gist_id}","starred_url":"https://api.github.com/users/tallclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tallclair/subscriptions","organizations_url":"https://api.github.com/users/tallclair/orgs","repos_url":"https://api.github.com/users/tallclair/repos","events_url":"https://api.github.com/users/tallclair/events{/privacy}","received_events_url":"https://api.github.com/users/tallclair/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":486032367,"url":"https://api.github.com/repos/kubernetes/community/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":653942785,"url":"https://api.github.com/repos/kubernetes/community/labels/kind/design","name":"kind/design","color":"c7def8","default":false},{"id":653942820,"url":"https://api.github.com/repos/kubernetes/community/labels/needs-ok-to-test","name":"needs-ok-to-test","color":"b60205","default":false},{"id":653942870,"url":"https://api.github.com/repos/kubernetes/community/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":653942904,"url":"https://api.github.com/repos/kubernetes/community/labels/sig/scheduling","name":"sig/scheduling","color":"d2b48c","default":false},{"id":653942920,"url":"https://api.github.com/repos/kubernetes/community/labels/size/XL","name":"size/XL","color":"ee5500","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/community/pulls/1937/commits","review_comments_url":"https://api.github.com/repos/kubernetes/community/pulls/1937/comments","review_comment_url":"https://api.github.com/repos/kubernetes/community/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/community/issues/1937/comments","statuses_url":"https://api.github.com/repos/kubernetes/community/statuses/aad9f2fcad32b42ceb0df074028962b2b8c76f01","head":{"label":"arnaudmz:scheduling-policy","ref":"scheduling-policy","sha":"aad9f2fcad32b42ceb0df074028962b2b8c76f01","user":{"login":"arnaudmz","id":1323980,"avatar_url":"https://avatars3.githubusercontent.com/u/1323980?v=4","gravatar_id":"","url":"https://api.github.com/users/arnaudmz","html_url":"https://github.com/arnaudmz","followers_url":"https://api.github.com/users/arnaudmz/followers","following_url":"https://api.github.com/users/arnaudmz/following{/other_user}","gists_url":"https://api.github.com/users/arnaudmz/gists{/gist_id}","starred_url":"https://api.github.com/users/arnaudmz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arnaudmz/subscriptions","organizations_url":"https://api.github.com/users/arnaudmz/orgs","repos_url":"https://api.github.com/users/arnaudmz/repos","events_url":"https://api.github.com/users/arnaudmz/events{/privacy}","received_events_url":"https://api.github.com/users/arnaudmz/received_events","type":"User","site_admin":false},"repo":{"id":125497835,"name":"community","full_name":"arnaudmz/community","owner":{"login":"arnaudmz","id":1323980,"avatar_url":"https://avatars3.githubusercontent.com/u/1323980?v=4","gravatar_id":"","url":"https://api.github.com/users/arnaudmz","html_url":"https://github.com/arnaudmz","followers_url":"https://api.github.com/users/arnaudmz/followers","following_url":"https://api.github.com/users/arnaudmz/following{/other_user}","gists_url":"https://api.github.com/users/arnaudmz/gists{/gist_id}","starred_url":"https://api.github.com/users/arnaudmz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arnaudmz/subscriptions","organizations_url":"https://api.github.com/users/arnaudmz/orgs","repos_url":"https://api.github.com/users/arnaudmz/repos","events_url":"https://api.github.com/users/arnaudmz/events{/privacy}","received_events_url":"https://api.github.com/users/arnaudmz/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/arnaudmz/community","description":"Kubernetes community content","fork":true,"url":"https://api.github.com/repos/arnaudmz/community","forks_url":"https://api.github.com/repos/arnaudmz/community/forks","keys_url":"https://api.github.com/repos/arnaudmz/community/keys{/key_id}","collaborators_url":"https://api.github.com/repos/arnaudmz/community/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/arnaudmz/community/teams","hooks_url":"https://api.github.com/repos/arnaudmz/community/hooks","issue_events_url":"https://api.github.com/repos/arnaudmz/community/issues/events{/number}","events_url":"https://api.github.com/repos/arnaudmz/community/events","assignees_url":"https://api.github.com/repos/arnaudmz/community/assignees{/user}","branches_url":"https://api.github.com/repos/arnaudmz/community/branches{/branch}","tags_url":"https://api.github.com/repos/arnaudmz/community/tags","blobs_url":"https://api.github.com/repos/arnaudmz/community/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/arnaudmz/community/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/arnaudmz/community/git/refs{/sha}","trees_url":"https://api.github.com/repos/arnaudmz/community/git/trees{/sha}","statuses_url":"https://api.github.com/repos/arnaudmz/community/statuses/{sha}","languages_url":"https://api.github.com/repos/arnaudmz/community/languages","stargazers_url":"https://api.github.com/repos/arnaudmz/community/stargazers","contributors_url":"https://api.github.com/repos/arnaudmz/community/contributors","subscribers_url":"https://api.github.com/repos/arnaudmz/community/subscribers","subscription_url":"https://api.github.com/repos/arnaudmz/community/subscription","commits_url":"https://api.github.com/repos/arnaudmz/community/commits{/sha}","git_commits_url":"https://api.github.com/repos/arnaudmz/community/git/commits{/sha}","comments_url":"https://api.github.com/repos/arnaudmz/community/comments{/number}","issue_comment_url":"https://api.github.com/repos/arnaudmz/community/issues/comments{/number}","contents_url":"https://api.github.com/repos/arnaudmz/community/contents/{+path}","compare_url":"https://api.github.com/repos/arnaudmz/community/compare/{base}...{head}","merges_url":"https://api.github.com/repos/arnaudmz/community/merges","archive_url":"https://api.github.com/repos/arnaudmz/community/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/arnaudmz/community/downloads","issues_url":"https://api.github.com/repos/arnaudmz/community/issues{/number}","pulls_url":"https://api.github.com/repos/arnaudmz/community/pulls{/number}","milestones_url":"https://api.github.com/repos/arnaudmz/community/milestones{/number}","notifications_url":"https://api.github.com/repos/arnaudmz/community/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/arnaudmz/community/labels{/name}","releases_url":"https://api.github.com/repos/arnaudmz/community/releases{/id}","deployments_url":"https://api.github.com/repos/arnaudmz/community/deployments","created_at":"2018-03-16T09:58:00Z","updated_at":"2018-03-16T10:01:33Z","pushed_at":"2018-05-17T18:21:06Z","git_url":"git://github.com/arnaudmz/community.git","ssh_url":"git@github.com:arnaudmz/community.git","clone_url":"https://github.com/arnaudmz/community.git","svn_url":"https://github.com/arnaudmz/community","homepage":"","size":19616,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"b092b6a92e3593101ee1c68ddd1147b9040c384d","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars2.githubusercontent.com/u/13629408?v=4","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":57939112,"name":"community","full_name":"kubernetes/community","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars2.githubusercontent.com/u/13629408?v=4","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/community","description":"Kubernetes community content","fork":false,"url":"https://api.github.com/repos/kubernetes/community","forks_url":"https://api.github.com/repos/kubernetes/community/forks","keys_url":"https://api.github.com/repos/kubernetes/community/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/community/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/community/teams","hooks_url":"https://api.github.com/repos/kubernetes/community/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/community/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/community/events","assignees_url":"https://api.github.com/repos/kubernetes/community/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/community/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/community/tags","blobs_url":"https://api.github.com/repos/kubernetes/community/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/community/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/community/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/community/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/community/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/community/languages","stargazers_url":"https://api.github.com/repos/kubernetes/community/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/community/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/community/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/community/subscription","commits_url":"https://api.github.com/repos/kubernetes/community/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/community/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/community/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/community/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/community/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/community/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/community/merges","archive_url":"https://api.github.com/repos/kubernetes/community/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/community/downloads","issues_url":"https://api.github.com/repos/kubernetes/community/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/community/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/community/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/community/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/community/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/community/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/community/deployments","created_at":"2016-05-03T03:36:05Z","updated_at":"2018-05-24T17:44:50Z","pushed_at":"2018-05-24T17:44:34Z","git_url":"git://github.com/kubernetes/community.git","ssh_url":"git@github.com:kubernetes/community.git","clone_url":"https://github.com/kubernetes/community.git","svn_url":"https://github.com/kubernetes/community","homepage":"","size":20932,"stargazers_count":1897,"watchers_count":1897,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1186,"mirror_url":null,"archived":false,"open_issues_count":202,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":1186,"open_issues":202,"watchers":1897,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/community/pulls/1937"},"html":{"href":"https://github.com/kubernetes/community/pull/1937"},"issue":{"href":"https://api.github.com/repos/kubernetes/community/issues/1937"},"comments":{"href":"https://api.github.com/repos/kubernetes/community/issues/1937/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/community/pulls/1937/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/community/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/community/pulls/1937/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/community/statuses/aad9f2fcad32b42ceb0df074028962b2b8c76f01"}},"author_association":"NONE"}}
{"actor":{"display_login":"easeway"}}