diff --git a/plugin/pkg/admission/priority/admission.go b/plugin/pkg/admission/priority/admission.go index 686f98bb5a6..ab39703b74d 100644 --- a/plugin/pkg/admission/priority/admission.go +++ b/plugin/pkg/admission/priority/admission.go @@ -19,6 +19,7 @@ package admission import ( "fmt" "io" + "strings" "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/labels" @@ -41,6 +42,9 @@ const ( HighestUserDefinablePriority = 1000000000 // SystemCriticalPriority is the beginning of the range of priority values for critical system components. SystemCriticalPriority = 2 * HighestUserDefinablePriority + // SystemPriorityClassPrefix is the prefix reserved for system priority class names. Other priority + // classes are not allowed to start with this prefix. + SystemPriorityClassPrefix = "system-" ) // SystemPriorityClasses defines special priority classes which are used by system critical pods that should not be preempted by workload pods. @@ -203,6 +207,9 @@ func (p *PriorityPlugin) validatePriorityClass(a admission.Attributes) error { if pc.Value > HighestUserDefinablePriority { return admission.NewForbidden(a, fmt.Errorf("maximum allowed value of a user defined priority is %v", HighestUserDefinablePriority)) } + if strings.HasPrefix(pc.Name, SystemPriorityClassPrefix) { + return admission.NewForbidden(a, fmt.Errorf("priority class names with '%v' prefix are reserved for system use only: %v", SystemPriorityClassPrefix, pc.Name)) + } if _, ok := SystemPriorityClasses[pc.Name]; ok { return admission.NewForbidden(a, fmt.Errorf("the name of the priority class is a reserved name for system use only: %v", pc.Name)) } diff --git a/plugin/pkg/admission/priority/admission_test.go b/plugin/pkg/admission/priority/admission_test.go index c9122ac63f0..0066c2a731f 100644 --- a/plugin/pkg/admission/priority/admission_test.go +++ b/plugin/pkg/admission/priority/admission_test.go @@ -127,6 +127,21 @@ func TestPriorityClassAdmission(t *testing.T) { systemClass, true, }, + { + "forbidden system name prefix", + []*scheduling.PriorityClass{}, + &scheduling.PriorityClass{ + TypeMeta: metav1.TypeMeta{ + Kind: "PriorityClass", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: "system-something", + }, + Value: 5, + Description: "Name with 'system-' prefix is reserved for system use", + }, + true, + }, } for _, test := range tests {