1. apiserver 启用准入控制 PodNodeSelector

vim /etc/kubernetes/manifests/kube-apiserver.yaml

spec:containers:- command:- kube-apiserver- --advertise-address=192.88.1.172- --enable-admission-plugins=NodeRestriction,PodNodeSelector

2. namespace 添加注解 scheduler.alpha.kubernetes.io/node-selector

kubectl get ns xx -o yaml > xx.yaml
vim xx.yaml

加入 注解

annotations:scheduler.alpha.kubernetes.io/node-selector: tenant-xx=true

kubectl apply -f xx.yaml

最后xx namespace yaml如下：

apiVersion: v1
kind: Namespace
metadata:annotations:scheduler.alpha.kubernetes.io/node-selector: tenant-xx=truename: xx
spec:finalizers:- kubernetes

3. label node

kubectl label nodes node01 tenant-xx=true