...
This field is optional and ignored for services deployed to a device or a namespace scoped node <=== seems like it violates the principal principle of least astonishment.
This field is optional and ignored for services deployed to a device. If a deployment policy constraint expression chooses a namespace scoped node as a deployment target, this field acts as a built-in constraint that causes namespace scoped nodes in namespaces other than the one specified by this field to be eliminated as deployment targets. The deploycheck CLI MUST detect this case. <=== there is no way for this built-in constraint to become an OR condition, it is essentially an AND tacked onto all the user specified constraints, therefore this behavior might force the user to create additional deployment policies.
...
The third problem is detected by the deployment publish CLI and returns an error to the user. <=== violates separation of concerns between service developer and deployer by not allowing the deployer to have control of a deployment concept, the deployer would have to ask the developer to change the operator definition in the service def before the service can be deployed.
The third problem is handled by treating the "cluster_namespace" as an override of the operator definition. <=== deployer gets control of something that is in the scope of deployment.
----------------------------------------------------------------------------------------------------------------------------------
A namespace specified in the deployment policy overrides any namespace defined in the operator definition.
...