A NamespaceSelector is an Anthos Config Management (ACM) object that selects namespaces by their Kubernetes labels. A namespace-scoped configuration can reference the selector instead of naming one namespace, allowing a Role, ConfigMap, or other object to apply to the matching namespaces. section 11.2.2
Selectors are primarily useful in unstructured policy repositories. There, every namespace-scoped object must specify either metadata.namespace or a NamespaceSelector annotation. In a hierarchy repository, a selector further restricts inheritance: a namespace must both match the selector and be a child of the folder containing the object. section 11.2.1 section 11.3.1
kind: NamespaceSelector
apiVersion: configmanagement.gke.io/v1
metadata:
name: production
spec:
selector:
matchLabels:
env: production
This definition names a selector production and matches namespaces labeled env: production. section 11.3.1
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: prod-developer annotations: configmanagement.gke.io/namespace-selector: production rules: - apiGroups: [""] resources: ["pods", "configmaps"] verbs: ["get", "watch", "list"] - apiGroups: ["apps", "extensions"] resources: ["deployments", "replicasets"] verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["secrets"] verbs: ["list"]
This Role uses the configmanagement.gke.io/namespace-selector annotation to reference production, so one role configuration targets matching namespaces. section 11.3.1
Namespace labels therefore determine where selector-targeted objects land. If a policy depends on labels such as env and team, validate those labels and their permitted values; a required-labels constraint is one way to enforce that convention. section 11.3.1
