diff --git a/content/en/docs/api-reference/placement.kubernetes-fleet.io/v1beta1.md b/content/en/docs/api-reference/placement.kubernetes-fleet.io/v1beta1.md index a97419d..f4bd422 100644 --- a/content/en/docs/api-reference/placement.kubernetes-fleet.io/v1beta1.md +++ b/content/en/docs/api-reference/placement.kubernetes-fleet.io/v1beta1.md @@ -1859,10 +1859,10 @@ _Appears in:_ | --- | --- | --- | --- | | `group` _string_ | Group name of the be selected resource.
Use an empty string to select resources under the core API group (e.g., namespaces). | | Required: \{\}
| | `version` _string_ | Version of the to be selected resource. | | Required: \{\}
| -| `kind` _string_ | Kind of the to be selected resource.
Note: When `Kind` is `namespace`, by default ALL the resources under the selected namespaces are selected. | | Required: \{\}
| +| `kind` _string_ | Kind of the to be selected resource.
Special behavior when Kind is `namespace` (ClusterResourcePlacement only):
Note: ResourcePlacement cannot select namespaces since it is namespace-scoped and selects resources within a namespace.
For ClusterResourcePlacement, you can use SelectionScope to control what gets selected:
- NamespaceOnly: Only the namespace object itself
- NamespaceWithResources: The namespace AND all resources within it (default)
- NamespaceWithResourceSelectors: The namespace AND resources specified by additional selectors
When SelectionScope is NamespaceWithResourceSelectors, you can define additional ResourceSelectorTerms
(after the namespace selector) to specify which resources to include. These additional selectors can
target both namespace-scoped resources (within the selected namespace) and cluster-scoped resources.
Important requirements for NamespaceWithResourceSelectors mode:
- Exactly one namespace selector with this mode is allowed
- The namespace selector must select by name (not by label)
- Only one namespace selector is allowed when using this mode (cannot mix with other namespace selectors)
- All requirements are validated via CEL at API validation time
- If the selected namespace is deleted after CRP creation, the controller will report an error condition
Example using NamespaceWithResourceSelectors:
- Namespace selector: \{Group: "", Version: "v1", Kind: "Namespace", Name: "prod", SelectionScope: "NamespaceWithResourceSelectors"\}
- Additional selector: \{Group: "apps", Version: "v1", Kind: "Deployment", LabelSelector: \{app: "frontend"\}\}
- Third selector: \{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "ClusterRole", Name: "admin"\}
This selects: the "prod" namespace, all Deployments with label app=frontend in "prod", and the "admin" ClusterRole. | | Required: \{\}
| | `name` _string_ | Name of the be selected resource. | | Optional: \{\}
| | `labelSelector` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#labelselector-v1-meta)_ | A label query over all the be selected resources. Resources matching the query are selected.
Note that namespace-scoped resources can't be selected even if they match the query. | | Optional: \{\}
| -| `selectionScope` _[SelectionScope](#selectionscope)_ | SelectionScope defines the scope of resource selections when the Kind is `namespace`. | NamespaceWithResources | Enum: [NamespaceOnly NamespaceWithResources]
Optional: \{\}
| +| `selectionScope` _[SelectionScope](#selectionscope)_ | SelectionScope defines the scope of resource selections when the Kind is `namespace`.
This field is only applicable when Kind is "Namespace" and is ignored for other resource kinds.
See the Kind field documentation for detailed examples and usage patterns. | NamespaceWithResources | Enum: [NamespaceOnly NamespaceWithResources NamespaceWithResourceSelectors]
Optional: \{\}
| #### ResourceSnapshot @@ -2079,7 +2079,8 @@ _Appears in:_ _Underlying type:_ _string_ -SelectionScope defines the scope of resource selections. +SelectionScope defines the scope of resource selections when selecting namespaces. +This only applies when a ResourceSelectorTerm has Kind="Namespace". @@ -2088,8 +2089,9 @@ _Appears in:_ | Field | Description | | --- | --- | -| `NamespaceOnly` | NamespaceOnly means only the namespace itself is selected.
| -| `NamespaceWithResources` | NamespaceWithResources means all the resources under the namespace including namespace itself are selected.
| +| `NamespaceOnly` | NamespaceOnly means only the namespace object itself is selected.
Use case: When you want to create/manage only the namespace without any resources inside it.
Example: Creating a namespace with specific labels/annotations on member clusters.
| +| `NamespaceWithResources` | NamespaceWithResources means the namespace and ALL resources within it are selected.
This is the default behavior for backward compatibility.
Use case: When you want to replicate an entire namespace with all its contents to member clusters.
Example: Copying a complete application stack (deployments, services, configmaps, etc.) across clusters.
Note: This is the default value. When you select a namespace without specifying SelectionScope,
this mode is used automatically.
| +| `NamespaceWithResourceSelectors` | NamespaceWithResourceSelectors allows fine-grained selection of specific resources within a namespace.
The namespace itself is always selected, and you can optionally specify which resources to include
by adding additional ResourceSelectorTerm entries after the namespace selector.
Use cases:
1. Select only specific resource types from a namespace (e.g., only Deployments and Services)
2. Select resources matching certain labels within a namespace
3. Include specific cluster-scoped resources along with namespace-scoped resources
How "additional selectors" work:
- Exactly one namespace selector with NamespaceWithResourceSelectors mode is required
- This selector must select a namespace by name (label selectors not allowed)
- ADDITIONAL selectors specify which resources to include:
- Namespace-scoped resources are filtered to only those within the selected namespace
- Cluster-scoped resources are included as specified (not limited to the namespace)
- If no additional selectors are provided, only the namespace object itself is selected
Example 1 - Select specific deployments from a namespace:
Selector 1: \{Group: "", Version: "v1", Kind: "Namespace", Name: "production", SelectionScope: "NamespaceWithResourceSelectors"\}
Selector 2: \{Group: "apps", Version: "v1", Kind: "Deployment", LabelSelector: \{tier: "frontend"\}\}
Result: The "production" namespace + all Deployments labeled tier=frontend within "production"
Example 2 - Select namespace with multiple resource types:
Selector 1: \{Group: "", Version: "v1", Kind: "Namespace", Name: "app", SelectionScope: "NamespaceWithResourceSelectors"\}
Selector 2: \{Group: "apps", Version: "v1", Kind: "Deployment"\}
Selector 3: \{Group: "", Version: "v1", Kind: "Service"\}
Result: The "app" namespace + ALL Deployments and Services within "app"
Example 3 - Include cluster-scoped resources:
Selector 1: \{Group: "", Version: "v1", Kind: "Namespace", Name: "app", SelectionScope: "NamespaceWithResourceSelectors"\}
Selector 2: \{Group: "apps", Version: "v1", Kind: "Deployment"\}
Selector 3: \{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "ClusterRole", Name: "app-admin"\}
Result: The "app" namespace + ALL Deployments in "app" + the "app-admin" ClusterRole
Important constraints:
- Exactly ONE namespace selector with NamespaceWithResourceSelectors mode is allowed
- The namespace selector must select by name (label selectors not allowed)
- Only ONE namespace selector total is allowed when using this mode (cannot mix with other namespace selectors)
- All constraints are enforced via CEL at API validation time
Runtime behavior:
- If the selected namespace is deleted after the CRP is created, the controller will detect this during
the next reconciliation and report an error condition in the CRP status
- The CRP will transition to a failed state until the namespace is recreated or the CRP is updated
| #### ServerSideApplyConfig