Kubernetes资源配额
配额
1、给namespace设置Pod配额
# 编写 quota-pod.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
name: pod-quato
spec:
hard:
pods: "2"
#给andriy-dang设置pod配额
kubectl create -f quota-pod.yaml --namespace=andriy-dang
#查看配额信息
kubectl get resourcequota pod-quato --namespace=andriy-dang --output=yaml
apiVersion: v1
kind: ResourceQuota
metadata:
creationTimestamp: 2018-03-14T05:34:26Z
name: pod-quato
namespace: andriy-dang
resourceVersion: "209063"
selfLink: /api/v1/namespaces/andriy-dang/resourcequotas/pod-quato
uid: 5be0e7f4-2749-11e8-ad43-d00d8f137bac
spec:
hard:
pods: "2"
status:
hard:
pods: "2"
used:
pods: "1"
#创建deployment验证pod配额
编写quota-deploy.yaml
apiVersion: apps/v1beta1
kind: Deployment
metadata:
name: deploy-quota-demo
namespace: andriy-dang
spec:
replicas: 3
template:
metadata:
labels:
purpose: quota-demo
spec:
containers:
- name: pod-quota-demo
image: nginx
#创建deployment
kubectl create -f quota-deploy.yaml
#查看deployment详细信息(可以看出只创建了一个pod)
kubectl get deployment -n andriy-dang deploy-quota-demo -o yaml
status:
availableReplicas: 1
kubectl describe deployment deploy-quota-demo -n andriy-dang
Name: deploy-quota-demo
Namespace: andriy-dang
CreationTimestamp: Wed, 14 Mar 2018 13:45:08 +0800
Labels: purpose=quota-demo
Annotations: deployment.kubernetes.io/revision=1
Selector: purpose=quota-demo
Replicas: 3 desired | 1 updated | 1 total | 1 available | 2 unavailable
StrategyType: RollingUpdate
MinReadySeconds: 0
RollingUpdateStrategy: 25% max unavailable, 25% max surge
Pod Template:
Labels: purpose=quota-demo
Containers:
pod-quota-demo:
Image: nginx
Port:
Environment:
Mounts:
Volumes:
Conditions:
Type Status Reason
---- ------ ------
Available False MinimumReplicasUnavailable
ReplicaFailure True FailedCreate
Progressing True ReplicaSetUpdated
OldReplicaSets:
NewReplicaSet: deploy-quota-demo-6fc6b469cb (1/3 replicas created)
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal ScalingReplicaSet 24s deployment-controller Scaled up replica set deploy- quota-demo-6fc6b469cb to 3
2、为namespace设置CPU配额
#设置cpu资源配额(请求为0.5，最大为1)
编写 quota-cpu.yaml
apiVersion: v1
kind: LimitRange
metadata:
name: cpu-limit-range
spec:
limits:
- default:
cpu: 1
defaultRequest:
cpu: 0.5
type: Container
#为andriy-dang设置配额
kubectl create -f quota-cpu.yaml --namespace=andriy-dang
#创建Pod(不指定CPU值，该容器会被赋予一个默认的CPU请求值0.5和一个默认的CPU限额值1)
编写 cpu-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: cpu-test
namespace: andriy-dang
spec:
containers:
- name: cpu-test
image: nginx
#查看Pod配置
kubectl get pod -n andriy-dang cpu-test -o yaml
spec:
containers:
- image: nginx
imagePullPolicy: Always
name: cpu-test
resources:
limits:
cpu: "1"
requests:
cpu: 500m
#如果指定了最大值，为指定请求值，Pod的请求值会等于最大值
apiVersion: v1
kind: Pod
metadata:
name: cpu-test-2
spec:
containers:
- name: cpu-test-2
image: nginx
resources:
limits:
cpu: "1"
输出：
resources:
limits:
cpu: "1"
requests:
cpu: "1"
#如果指定了请求值，为指定最大值，Pod的CPU最大值会默认为1
apiVersion: v1
kind: Pod
metadata:
name: cpu-test-3
spec:
containers:
- name: cpu-test-3
image: nginx
resources:
requests:
cpu: "0.75"
输出：
resources:
limits:
cpu: "1"
requests:
cpu: 750m
3、为 Namespace 配置默认的内存请求与限额
#创建 quota-mem.yaml
apiVersion: v1
kind: LimitRange
metadata:
name: mem-quota
spec:
limits:
- default:
memory: 512Mi
defaultRequest:
memory: 256Mi
type: Container
#为andriy-dang设置配额
kubectl create -f quota-mem.yaml --namespace=andriy-dang
#创建Pod(不指定memory值时，容器会配置默认namespace的配额)
编写 mem-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: mem-test
namespace: andriy-dang
spec:
containers:
- name: mem-test
image: nginx
#查看Pod信息
kubectl get pod -n andriy-dang mem-test -o yaml
spec:
containers:
- image: nginx
imagePullPolicy: Always
name: mem-test
resources:
limits:
memory: 512Mi
requests:
memory: 256Mi
#如果指定了最大值，为指定请求值，容器的最大值及请求值均为最大值
apiVersion: v1
kind: Pod
metadata:
name: mem-test-2
spec:
containers:
- name: mem-test-2
image: nginx
resources:
limits:
memory: "1Gi"
输出：
resources:
limits:
memory: 1Gi
requests:
memory: 1Gi
#如果指定了请求值，为指定最大值，容器的最大值为namespace的最大值
apiVersion: v1
kind: Pod
metadata:
name: mem-test-3
spec:
containers:
- name: mem-test-3
image: nginx
resources:
requests:
memory: "128Mi"
输出：
resources:
limits:
memory: 512Mi
requests:
memory: 128Mi
4、为 Namespace 设置最小和最大内存限制
#创建 quota-mem-max-min.yaml
apiVersion: v1
kind: LimitRange
metadata:
name: mem-min-max
spec:
limits:
- max:
memory: 1Gi
min:
memory: 500Mi
type: Container
#为andriy-dang设置限制
kubectl create -f quota-mem-max-min.yaml --namespace=andriy-dang
#查看限制信息
kubectl get limitrange mem-min-max --namespace=andriy-dang -o yaml
apiVersion: v1
kind: LimitRange
metadata:
creationTimestamp: 2018-03-14T08:06:58Z
name: mem-min-max
namespace: andriy-dang
resourceVersion: "220491"
selfLink: /api/v1/namespaces/andriy-dang/limitranges/mem-min-max
uid: aad20856-275e-11e8-ad43-d00d8f137bac
spec:
limits:
- default:
memory: 1Gi
defaultRequest:
memory: 1Gi
max:
memory: 1Gi
min:
memory: 500Mi
type: Container
现在，每当在 andriy-dang namespace 中创建一个容器时，Kubernetes 都会执行下列步骤：
- 如果容器没有指定自己的内存请求（request）和限制（limit），系统将会为其分配默认值。
- 验证容器的内存请求大于等于 500 MiB。
- 验证容器的内存限制小于等于 1 GiB。
使用以下不同限制的yaml创建pod
1、配置符合 LimitRange 施加的最小和最大内存限制
# mem-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: men-test
namespace: andriy-dang
spec:
containers:
- name: mem-test
image: nginx
resources:
limits:
memory: "800Mi"
requests:
memory: "600Mi"
#输出结果：创建成功
spec:
containers:
- image: nginx
imagePullPolicy: Always
name: mem-test
resources:
limits:
memory: 800Mi
requests:
memory: 600Mi
2、创建一个超过最大内存限制的 Pod
# mem-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: men-test
namespace: andriy-dang
spec:
containers:
- name: mem-test
image: nginx
resources:
limits:
memory: "1.5Gi"
requests:
memory: "600Mi"
#输出结果：kubectl create -f mem-max-min-test.yaml
Error from server (Forbidden): error when creating "mem-max-min-test.yaml": pods "men-test" is forbidden: maximum memory usage per Container is 1Gi, but limit is 1536Mi.
3、创建一个不符合最小内存请求的 Pod
# mem-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: men-test
namespace: andriy-dang
spec:
containers:
- name: mem-test
image: nginx
resources:
limits:
memory: "800Mi"
requests:
memory: "100Mi"
输出结果：kubectl create -f mem-max-min-test.yaml
Error from server (Forbidden): error when creating "mem-max-min-test.yaml": pods "men-test" is forbidden: minimum memory usage per Container is 500Mi, but request is 100Mi.
4、创建一个没有指定任何内存请求和限制的 Pod
# mem-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: men-test
namespace: andriy-dang
spec:
containers:
- name: mem-test
image: nginx
#输出结果：创建成功
spec:
containers:
- image: nginx
imagePullPolicy: Always
name: mem-test
resources:
limits:
memory: 1Gi
requests:
memory: 1Gi
5、为 Namespace 配置CPU和内存配额
#创建ResourceQuota对象 quota-mem-cpu.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
name: mem-cpu-test
spec:
hard:
requests.cpu: "1"
requests.memory: 1Gi
limits.cpu: "2"
limits.memory: 2Gi
#为andriy-dang设置mem、CPU配额
kubectl create -f quota-mem-cpu.yaml -n andriy-dang
#查看配额信息
kubectl get resourcequota -n andriy-dang mem-cpu-test -o yaml
apiVersion: v1
kind: ResourceQuota
metadata:
creationTimestamp: 2018-03-15T03:01:54Z
name: mem-cpu-test
namespace: andriy-dang
resourceVersion: "303347"
selfLink: /api/v1/namespaces/andriy-dang/resourcequotas/mem-cpu-test
uid: 3746b8bb-27fd-11e8-ad43-d00d8f137bac
spec:
hard:
limits.cpu: "2"
limits.memory: 2Gi
requests.cpu: "1"
requests.memory: 1Gi
status:
hard:
limits.cpu: "2"
limits.memory: 2Gi
requests.cpu: "1"
requests.memory: 1Gi
used:
limits.cpu: "0"
limits.memory: "0"
requests.cpu: "0"
requests.memory: "0"
1、创建一个Pod
# mem-cpu-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: mem-cpu-test
namespace: andriy-dang
spec:
containers:
- name: mem-cpu-test
image: nginx
resources:
limits:
memory: "800Mi"
cpu: "800m"
requests:
memory: "600Mi"
cpu: "400m"
#查看资源配额使用情况
kubectl get resourcequota -n andriy-dang mem-cpu-test -o yaml
apiVersion: v1
kind: ResourceQuota
metadata:
creationTimestamp: 2018-03-15T03:01:54Z
name: mem-cpu-test
namespace: andriy-dang
resourceVersion: "303742"
selfLink: /api/v1/namespaces/andriy-dang/resourcequotas/mem-cpu-test
uid: 3746b8bb-27fd-11e8-ad43-d00d8f137bac
spec:
hard:
limits.cpu: "2"
limits.memory: 2Gi
requests.cpu: "1"
requests.memory: 1Gi
status:
hard:
limits.cpu: "2"
limits.memory: 2Gi
requests.cpu: "1"
requests.memory: 1Gi
used:
limits.cpu: 800m
limits.memory: 800Mi
requests.cpu: 400m
requests.memory: 600Mi
2、创建第二个Pod
# mem-cpu-test02.yaml
apiVersion: v1
kind: Pod
metadata:
name: mem-cpu-test02
spec:
containers:
- name: mem-cpu-test02
image: redis
resources:
limits:
memory: "1Gi"
cpu: "800m"
requests:
memory: "700Mi"
cpu: "400m"
# 输出结果：创建失败
kubectl create -f mem-cpu-test02.yaml
Error from server (Forbidden): error when creating "mem-cpu-test02.yaml": pods "mem-cpu-test02" is forbidden: exceeded quota: mem-cpu-test, requested: requests.memory=700Mi, used: requests.memory=600Mi, limited: requests.memory=1Gi
6、为 Namespace 配置最小和最大 CPU 限制
#创建一个 LimitRange：quota-cpu-max-min.yaml
apiVersion: v1
kind: LimitRange
metadata:
name: cpu-min-max-test
spec:
limits:
- max:
cpu: "800m"
min:
cpu: "200m"
type: Container
#为andriy-dang设置最大最小限制
kubectl create -f quota-cpu-max-min.yaml -n andriy-dang
#查看限制信息
kubectl get limitrange -n andriy-dang cpu-min-max-test -o yaml
apiVersion: v1
kind: LimitRange
metadata:
creationTimestamp: 2018-03-15T03:18:01Z
name: cpu-min-max-test
namespace: andriy-dang
resourceVersion: "304549"
selfLink: /api/v1/namespaces/andriy-dang/limitranges/cpu-min-max-test
uid: 77cb378a-27ff-11e8-ad43-d00d8f137bac
spec:
limits:
- default:
cpu: 800m
defaultRequest:
cpu: 800m
max:
cpu: 800m
min:
cpu: 200m
type: Container
现在，每当在 andriy-dang namespace 中创建一个容器时，Kubernetes 都会执行下列步骤：
- 如果容器没有指定自己的 CPU 请求（CPU request）和限制（CPU limit），系统将会为其分配默认值。
- 验证容器的 CPU 请求大于等于 200 millicpu。
- 验证容器的 CPU 限制小于等于 800 millicpu。
使用以下不同限制的yaml创建pod
1、配置符合 LimitRange 施加的最小和最大内存限制
# cpu-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: cpu-test
namespace: andriy-dang
spec:
containers:
- name: cpu-test
image: nginx
resources:
limits:
cpu: "800m"
requests:
cpu: "500m"
#输出结果：创建成功
spec:
containers:
- image: nginx
imagePullPolicy: Always
name: cpu-test
resources:
limits:
cpu: 800m
requests:
cpu: 500m
2、创建一个超过最大CPU限制的 Pod
# cpu-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: cpu-test
namespace: andriy-dang
spec:
containers:
- name: cpu-test
image: nginx
resources:
limits:
cpu: "1.5"
requests:
cpu: "500m"
#输出结果：kubectl create -f cpu-max-min-test.yaml
Error from server (Forbidden): error when creating "cpu-max-min-test.yaml": pods "cpu-test" is forbidden: maximum cpu usage per Container is 800m, but limit is 1500m.
3、创建一个不符合最小CPU请求的 Pod
# cpu-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: cpu-test
namespace: andriy-dang
spec:
containers:
- name: cpu-test
image: nginx
resources:
limits:
cpu: "800m"
requests:
cpu: "100m"
输出结果：kubectl create -f cpu-max-min-test.yaml
Error from server (Forbidden): error when creating "cpu-max-min-test.yaml": pods "cpu-test" is forbidden: minimum cpu usage per Container is 200m, but request is 100m.
4、创建一个没有指定任何内存请求和限制的 Pod
# cpu-max-min-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: cpu-test
namespace: andriy-dang
spec:
containers:
- name: cpu-test
image: nginx
#输出结果：创建成功
spec:
containers:
- image: nginx
imagePullPolicy: Always
name: cpu-test
resources:
limits:
cpu: 800m
requests:
cpu: 800m
7、给Pod配置服务质量等级
1、创建一个 Pod 并分配 QoS 等级为 Guaranteed
想要给 Pod 分配 QoS 等级为 Guaranteed:
-
Pod 里的每个容器都必须有内存限制和请求，而且必须是一样的。
-
Pod 里的每个容器都必须有 CPU 限制和请求，而且必须是一样的。
qos-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: qos-test
namespace: andriy-dang
spec:
containers:
- name: qos-test
image: nginx
resources:
limits:
memory: “200Mi”
cpu: “700m”
requests:
memory: “200Mi”
cpu: “700m”
2、创建一个 Pod 并分配 QoS 等级为 Burstable
当出现下面的情况时，则是一个 Pod 被分配了 QoS 等级为 Burstable :
-
该 Pod 不满足 QoS 等级 Guaranteed 的要求。
-
Pod 里至少有一个容器有内存或者 CPU 请求。
qos-pod2.yaml
apiVersion: v1
kind: Pod
metadata:
name: qos-test-2
namespace: andriy-dang
spec:
containers:
- name: qos-test-2
image: nginx
resources:
limits:
memory: “200Mi”
requests:
memory: “100Mi”
3、创建一个 Pod 并分配 QoS 等级为 BestEffort
要给一个 Pod 配置 BestEffort 的 QoS 等级, Pod 里的容器必须没有任何内存或者 CPU 的限制或请求。
# qos-pod3.yaml
apiVersion: v1
kind: Pod
metadata:
name: qos-test-3
namespace: andriy-dang
spec:
containers:
- name: qos-test-3
image: nginx
4、创建一个拥有两个容器的 Pod
这是一个含有两个容器的 Pod 的配置文件，其中一个容器指定了内存申请为 200MB ，另外一个没有任何申请或限制。（QoS 等级为 Burstable）
# qos-pod4.yaml
apiVersion: v1
kind: Pod
metadata:
name: qos-test-4
spec:
containers:
- name: qos-test-4-1
image: nginx
resources:
requests:
memory: "200Mi"
- name: qos-test-4-2
image: redis
8、删除配额
# 删除对应namespace的配额
kubectl delete quota -n andriy-dang --all