<p>Is there any way to configure <code>nodeSelector</code> at the namespace level?</p>

<p>I want to run a workload only on certain nodes for this namespace.</p>

<p>To achieve this you can use <code>PodNodeSelector</code> admission controller.</p>
<p>First, you need to enable it in your <strong>kubernetes-apiserver</strong>:</p>
<ul>
<li>Edit <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code>:
<ul>
<li>find <code>--enable-admission-plugins=</code></li>
<li>add <code>PodNodeSelector</code> parameter</li>
</ul>
</li>
</ul>
<p>Now, you can specify <code>scheduler.alpha.kubernetes.io/node-selector</code> option in annotations for your namespace, example:</p>
<pre><code>apiVersion: v1
kind: Namespace
metadata:
 name: your-namespace
 annotations:
   scheduler.alpha.kubernetes.io/node-selector: env=test
spec: {}
status: {}
</code></pre>
<p>After these steps, all the pods created in this namespace will have this section automatically added:</p>
<pre><code>nodeSelector
  env: test
</code></pre>
<p>More information about the <code>PodNodeSelector</code> you can find in the official Kubernetes documentation:
<a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podnodeselector" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podnodeselector</a></p>
<hr />
<h1>kubeadm users</h1>
<p>If you deployed your cluster using kubeadm and if you want to make this configuration persistent, you have to update your kubeadm config file:</p>
<pre><code>kubectl edit cm -n kube-system kubeadm-config
</code></pre>
<p>specify <code>extraArgs</code> with custom values under <code>apiServer</code> section:</p>
<pre><code>apiServer: 
  extraArgs: 
    enable-admission-plugins: NodeRestriction,PodNodeSelector
</code></pre>
<p>then update your kube-apiserver static manifest on all control-plane nodes:</p>
<pre><code># Kubernetes 1.22 and forward:
kubectl get configmap -n kube-system kubeadm-config -o=jsonpath=&quot;{.data}&quot; &gt; kubeadm-config.yaml

# Before Kubernetes 1.22:
# &quot;kubeadmin config view&quot; was deprecated in 1.19 and removed in 1.22
# Reference: https://github.com/kubernetes/kubeadm/issues/2203
kubeadm config view &gt; kubeadm-config.yaml

# Update the manifest with the file generated by any of the above lines 
kubeadm init phase control-plane apiserver --config kubeadm-config.yaml
</code></pre>
<hr />
<h1>kubespray users</h1>
<p>You can just use <code>kube_apiserver_enable_admission_plugins</code> variable for your api-server configuration variables:</p>
<pre><code> kube_apiserver_enable_admission_plugins:
   - PodNodeSelector
</code></pre>
