diff --git a/pkg/apis/scheduling/types.go b/pkg/apis/scheduling/types.go index 06cceadb74d..5130d624a03 100644 --- a/pkg/apis/scheduling/types.go +++ b/pkg/apis/scheduling/types.go @@ -23,6 +23,9 @@ const ( // that do not specify any priority class and there is no priority class // marked as default. DefaultPriorityWhenNoDefaultClassExists = 0 + // SystemPriorityClassPrefix is the prefix reserved for system priority class names. Other priority + // classes are not allowed to start with this prefix. + SystemPriorityClassPrefix = "system-" ) // +genclient diff --git a/pkg/apis/scheduling/validation/validation.go b/pkg/apis/scheduling/validation/validation.go index f4fac9d9cea..c8b85ef85d4 100644 --- a/pkg/apis/scheduling/validation/validation.go +++ b/pkg/apis/scheduling/validation/validation.go @@ -17,14 +17,22 @@ limitations under the License. package validation import ( + "strings" + "k8s.io/apimachinery/pkg/util/validation/field" apivalidation "k8s.io/kubernetes/pkg/apis/core/validation" "k8s.io/kubernetes/pkg/apis/scheduling" ) -// ValidatePriorityClassName can be used to check whether the given priority -// class name is valid. -var ValidatePriorityClassName = apivalidation.NameIsDNSSubdomain +// ValidatePriorityClassName checks whether the given priority class name is valid. +func ValidatePriorityClassName(name string, prefix bool) []string { + var allErrs []string + if strings.HasPrefix(name, scheduling.SystemPriorityClassPrefix) { + allErrs = append(allErrs, "priority class names with '"+scheduling.SystemPriorityClassPrefix+"' prefix are reserved for system use only") + } + allErrs = append(allErrs, apivalidation.NameIsDNSSubdomain(name, prefix)...) + return allErrs +} // ValidatePriorityClass tests whether required fields in the PriorityClass are // set correctly. diff --git a/pkg/apis/scheduling/validation/validation_test.go b/pkg/apis/scheduling/validation/validation_test.go index 8b0cec40b6c..e35ee426936 100644 --- a/pkg/apis/scheduling/validation/validation_test.go +++ b/pkg/apis/scheduling/validation/validation_test.go @@ -53,6 +53,10 @@ func TestValidatePriorityClass(t *testing.T) { ObjectMeta: metav1.ObjectMeta{Name: "tier&1", Namespace: ""}, Value: 100, }, + "invalid system name": { + ObjectMeta: metav1.ObjectMeta{Name: scheduling.SystemPriorityClassPrefix + "test"}, + Value: 100, + }, } for k, v := range errorCases { diff --git a/plugin/pkg/admission/priority/admission.go b/plugin/pkg/admission/priority/admission.go index 686f98bb5a6..5a0c98d278c 100644 --- a/plugin/pkg/admission/priority/admission.go +++ b/plugin/pkg/admission/priority/admission.go @@ -44,6 +44,8 @@ const ( ) // SystemPriorityClasses defines special priority classes which are used by system critical pods that should not be preempted by workload pods. +// NOTE: In order to avoid conflict of names with user-defined priority classes, all the names must +// start with scheduling.SystemPriorityClassPrefix which is by default "system-". var SystemPriorityClasses = map[string]int32{ "system-cluster-critical": SystemCriticalPriority, "system-node-critical": SystemCriticalPriority + 1000,