whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix some links in the concepts section

Browse Source 
This PR fixes the links in the concepts section. Most of the links are
not dead links in English version because there are redirects for them.
However, these links will be broken when localized to any languages
other English.

Where appropriate. this PR also wraps some long lines which are
unfriendly to any localization team that try to catch the differences
between revisions.
This commit is contained in:
Qiming Teng
2021-06-14 20:38:10 +08:00
parent 4502d3b438
commit ad93c9a6ef
12 changed files with 181 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/architecture/controller.md
+4 -3
View File
@@ -159,11 +159,12 @@ You can run your own controller as a set of Pods,
or externally to Kubernetes. What fits best will depend on what that particular or externally to Kubernetes. What fits best will depend on what that particular
controller does. controller does.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
* Read about the [Kubernetes control plane](/docs/concepts/overview/components/#control-plane-components) * Read about the [Kubernetes control plane](/docs/concepts/overview/components/#control-plane-components)
* Discover some of the basic [Kubernetes objects](/docs/concepts/overview/working-with-objects/kubernetes-objects/) * Discover some of the basic [Kubernetes objects](/docs/concepts/overview/working-with-objects/kubernetes-objects/)
* Learn more about the [Kubernetes API](/docs/concepts/overview/kubernetes-api/) * Learn more about the [Kubernetes API](/docs/concepts/overview/kubernetes-api/)
* If you want to write your own controller, see [Extension Patterns](/docs/concepts/extend-kubernetes/extend-cluster/#extension-patterns) in Extending Kubernetes. * If you want to write your own controller, see
[Extension Patterns](/docs/concepts/extend-kubernetes/#extension-patterns)
in Extending Kubernetes.
content/en/docs/concepts/cluster-administration/flow-control.md
+50 -24
View File
@@ -33,8 +33,6 @@ the `--max-requests-inflight` flag without the API Priority and
Fairness feature enabled. Fairness feature enabled.
{{< /caution >}} {{< /caution >}}
<!-- body --> <!-- body -->
## Enabling/Disabling API Priority and Fairness ## Enabling/Disabling API Priority and Fairness
@@ -65,6 +63,7 @@ The command-line flag `--enable-priority-and-fairness=false` will disable the
API Priority and Fairness feature, even if other flags have enabled it. API Priority and Fairness feature, even if other flags have enabled it.
## Concepts ## Concepts
There are several distinct features involved in the API Priority and Fairness There are several distinct features involved in the API Priority and Fairness
feature. Incoming requests are classified by attributes of the request using feature. Incoming requests are classified by attributes of the request using
_FlowSchemas_, and assigned to priority levels. Priority levels add a degree of _FlowSchemas_, and assigned to priority levels. Priority levels add a degree of
@@ -75,12 +74,13 @@ each other, and allows for requests to be queued to prevent bursty traffic from
causing failed requests when the average load is acceptably low. causing failed requests when the average load is acceptably low.
### Priority Levels ### Priority Levels
Without APF enabled, overall concurrency in
the API server is limited by the `kube-apiserver` flags Without APF enabled, overall concurrency in the API server is limited by the
`--max-requests-inflight` and `--max-mutating-requests-inflight`. With APF `kube-apiserver` flags `--max-requests-inflight` and
enabled, the concurrency limits defined by these flags are summed and then the sum is divided up `--max-mutating-requests-inflight`. With APF enabled, the concurrency limits
among a configurable set of _priority levels_. Each incoming request is assigned defined by these flags are summed and then the sum is divided up among a
to a single priority level, and each priority level will only dispatch as many configurable set of _priority levels_. Each incoming request is assigned to a
single priority level, and each priority level will only dispatch as many
concurrent requests as its configuration allows. concurrent requests as its configuration allows.
The default configuration, for example, includes separate priority levels for The default configuration, for example, includes separate priority levels for
@@ -90,6 +90,7 @@ requests cannot prevent leader election or actions by the built-in controllers
from succeeding. from succeeding.
### Queuing ### Queuing
Even within a priority level there may be a large number of distinct sources of Even within a priority level there may be a large number of distinct sources of
traffic. In an overload situation, it is valuable to prevent one stream of traffic. In an overload situation, it is valuable to prevent one stream of
requests from starving others (in particular, in the relatively common case of a requests from starving others (in particular, in the relatively common case of a
@@ -114,15 +115,18 @@ independent flows will all make progress when total traffic exceeds capacity),
tolerance for bursty traffic, and the added latency induced by queuing. tolerance for bursty traffic, and the added latency induced by queuing.
### Exempt requests ### Exempt requests
Some requests are considered sufficiently important that they are not subject to Some requests are considered sufficiently important that they are not subject to
any of the limitations imposed by this feature. These exemptions prevent an any of the limitations imposed by this feature. These exemptions prevent an
improperly-configured flow control configuration from totally disabling an API improperly-configured flow control configuration from totally disabling an API
server. server.
## Defaults ## Defaults
The Priority and Fairness feature ships with a suggested configuration that The Priority and Fairness feature ships with a suggested configuration that
should suffice for experimentation; if your cluster is likely to should suffice for experimentation; if your cluster is likely to
experience heavy load then you should consider what configuration will work best. The suggested configuration groups requests into five priority experience heavy load then you should consider what configuration will work
best. The suggested configuration groups requests into five priority
classes: classes:
* The `system` priority level is for requests from the `system:nodes` group, * The `system` priority level is for requests from the `system:nodes` group,
@@ -180,19 +184,18 @@ If you add the following additional FlowSchema, this exempts those
requests from rate limiting. requests from rate limiting.
{{< caution >}} {{< caution >}}
Making this change also allows any hostile party to then send Making this change also allows any hostile party to then send
health-check requests that match this FlowSchema, at any volume they health-check requests that match this FlowSchema, at any volume they
like. If you have a web traffic filter or similar external security like. If you have a web traffic filter or similar external security
mechanism to protect your cluster's API server from general internet mechanism to protect your cluster's API server from general internet
traffic, you can configure rules to block any health check requests traffic, you can configure rules to block any health check requests
that originate from outside your cluster. that originate from outside your cluster.
{{< /caution >}} {{< /caution >}}
{{< codenew file="priority-and-fairness/health-for-strangers.yaml" >}} {{< codenew file="priority-and-fairness/health-for-strangers.yaml" >}}
## Resources ## Resources
The flow control API involves two kinds of resources. The flow control API involves two kinds of resources.
[PriorityLevelConfigurations](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io) [PriorityLevelConfigurations](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io)
define the available isolation classes, the share of the available concurrency define the available isolation classes, the share of the available concurrency
@@ -204,6 +207,7 @@ of the same API group, and it has the same Kinds with the same syntax and
semantics. semantics.
### PriorityLevelConfiguration ### PriorityLevelConfiguration
A PriorityLevelConfiguration represents a single isolation class. Each A PriorityLevelConfiguration represents a single isolation class. Each
PriorityLevelConfiguration has an independent limit on the number of outstanding PriorityLevelConfiguration has an independent limit on the number of outstanding
requests, and limitations on the number of queued requests. requests, and limitations on the number of queued requests.
@@ -217,6 +221,7 @@ server by restarting `kube-apiserver` with a different value for
`--max-requests-inflight` (or `--max-mutating-requests-inflight`), and all `--max-requests-inflight` (or `--max-mutating-requests-inflight`), and all
PriorityLevelConfigurations will see their maximum allowed concurrency go up (or PriorityLevelConfigurations will see their maximum allowed concurrency go up (or
down) by the same fraction. down) by the same fraction.
{{< caution >}} {{< caution >}}
With the Priority and Fairness feature enabled, the total concurrency limit for With the Priority and Fairness feature enabled, the total concurrency limit for
the server is set to the sum of `--max-requests-inflight` and the server is set to the sum of `--max-requests-inflight` and
@@ -235,8 +240,8 @@ above the threshold will be queued, with the shuffle sharding and fair queuing t
to balance progress between request flows. to balance progress between request flows.
The queuing configuration allows tuning the fair queuing algorithm for a The queuing configuration allows tuning the fair queuing algorithm for a
priority level. Details of the algorithm can be read in the [enhancement priority level. Details of the algorithm can be read in the
proposal](#whats-next), but in short: [enhancement proposal](#whats-next), but in short:
* Increasing `queues` reduces the rate of collisions between different flows, at * Increasing `queues` reduces the rate of collisions between different flows, at
the cost of increased memory usage. A value of 1 here effectively disables the the cost of increased memory usage. A value of 1 here effectively disables the
@@ -249,6 +254,7 @@ proposal](#whats-next), but in short:
* Changing `handSize` allows you to adjust the probability of collisions between * Changing `handSize` allows you to adjust the probability of collisions between
different flows and the overall concurrency available to a single flow in an different flows and the overall concurrency available to a single flow in an
overload situation. overload situation.
{{< note >}} {{< note >}}
A larger `handSize` makes it less likely for two individual flows to collide A larger `handSize` makes it less likely for two individual flows to collide
(and therefore for one to be able to starve the other), but more likely that (and therefore for one to be able to starve the other), but more likely that
@@ -258,7 +264,6 @@ proposal](#whats-next), but in short:
single flow is `handSize * queueLengthLimit`. single flow is `handSize * queueLengthLimit`.
{{< /note >}} {{< /note >}}
Following is a table showing an interesting collection of shuffle Following is a table showing an interesting collection of shuffle
sharding configurations, showing for each the probability that a sharding configurations, showing for each the probability that a
given mouse (low-intensity flow) is squished by the elephants (high-intensity flows) for given mouse (low-intensity flow) is squished by the elephants (high-intensity flows) for
@@ -319,6 +324,7 @@ considered part of a single flow. The correct choice for a given FlowSchema
depends on the resource and your particular environment. depends on the resource and your particular environment.
## Diagnostics ## Diagnostics
Every HTTP response from an API server with the priority and fairness feature Every HTTP response from an API server with the priority and fairness feature
enabled has two extra headers: `X-Kubernetes-PF-FlowSchema-UID` and enabled has two extra headers: `X-Kubernetes-PF-FlowSchema-UID` and
`X-Kubernetes-PF-PriorityLevel-UID`, noting the flow schema that matched the request `X-Kubernetes-PF-PriorityLevel-UID`, noting the flow schema that matched the request
@@ -356,6 +362,7 @@ poorly-behaved workloads that may be harming system health.
matched the request), `priority_level` (indicating the one to which matched the request), `priority_level` (indicating the one to which
the request was assigned), and `reason`. The `reason` label will be the request was assigned), and `reason`. The `reason` label will be
have one of the following values: have one of the following values:
* `queue-full`, indicating that too many requests were already * `queue-full`, indicating that too many requests were already
queued, queued,
* `concurrency-limit`, indicating that the * `concurrency-limit`, indicating that the
@@ -430,6 +437,7 @@ poorly-behaved workloads that may be harming system health.
sample to its histogram, reporting the length of the queue immediately sample to its histogram, reporting the length of the queue immediately
after the request was added. Note that this produces different after the request was added. Note that this produces different
statistics than an unbiased survey would. statistics than an unbiased survey would.
{{< note >}} {{< note >}}
An outlier value in a histogram here means it is likely that a single flow An outlier value in a histogram here means it is likely that a single flow
(i.e., requests by one user or for one namespace, depending on (i.e., requests by one user or for one namespace, depending on
@@ -450,6 +458,7 @@ poorly-behaved workloads that may be harming system health.
`priority_level` (indicating the one to which the request was `priority_level` (indicating the one to which the request was
assigned), and `execute` (indicating whether the request started assigned), and `execute` (indicating whether the request started
executing). executing).
{{< note >}} {{< note >}}
Since each FlowSchema always assigns requests to a single Since each FlowSchema always assigns requests to a single
PriorityLevelConfiguration, you can add the histograms for all the PriorityLevelConfiguration, you can add the histograms for all the
@@ -465,14 +474,19 @@ poorly-behaved workloads that may be harming system health.
### Debug endpoints ### Debug endpoints
When you enable the API Priority and Fairness feature, the kube-apiserver serves the following additional paths at its HTTP[S] ports. When you enable the API Priority and Fairness feature, the `kube-apiserver`
serves the following additional paths at its HTTP[S] ports.
- `/debug/api_priority_and_fairness/dump_priority_levels` - a listing of
all the priority levels and the current state of each. You can fetch like this:
- `/debug/api_priority_and_fairness/dump_priority_levels` - a listing of all the priority levels and the current state of each. You can fetch like this:
```shell ```shell
kubectl get --raw /debug/api_priority_and_fairness/dump_priority_levels kubectl get --raw /debug/api_priority_and_fairness/dump_priority_levels
``` ```
The output is similar to this: The output is similar to this:
```
```none
PriorityLevelName, ActiveQueues, IsIdle, IsQuiescing, WaitingRequests, ExecutingRequests, PriorityLevelName, ActiveQueues, IsIdle, IsQuiescing, WaitingRequests, ExecutingRequests,
workload-low, 0, true, false, 0, 0, workload-low, 0, true, false, 0, 0,
global-default, 0, true, false, 0, 0, global-default, 0, true, false, 0, 0,
@@ -483,12 +497,16 @@ When you enable the API Priority and Fairness feature, the kube-apiserver serves
workload-high, 0, true, false, 0, 0, workload-high, 0, true, false, 0, 0,
``` ```
- `/debug/api_priority_and_fairness/dump_queues` - a listing of all the queues and their current state. You can fetch like this: - `/debug/api_priority_and_fairness/dump_queues` - a listing of all the
queues and their current state. You can fetch like this:
```shell ```shell
kubectl get --raw /debug/api_priority_and_fairness/dump_queues kubectl get --raw /debug/api_priority_and_fairness/dump_queues
``` ```
The output is similar to this: The output is similar to this:
```
```none
PriorityLevelName, Index, PendingRequests, ExecutingRequests, VirtualStart, PriorityLevelName, Index, PendingRequests, ExecutingRequests, VirtualStart,
workload-high, 0, 0, 0, 0.0000, workload-high, 0, 0, 0, 0.0000,
workload-high, 1, 0, 0, 0.0000, workload-high, 1, 0, 0, 0.0000,
@@ -498,25 +516,33 @@ When you enable the API Priority and Fairness feature, the kube-apiserver serves
leader-election, 15, 0, 0, 0.0000, leader-election, 15, 0, 0, 0.0000,
``` ```
- `/debug/api_priority_and_fairness/dump_requests` - a listing of all the requests that are currently waiting in a queue. You can fetch like this: - `/debug/api_priority_and_fairness/dump_requests` - a listing of all the requests
that are currently waiting in a queue. You can fetch like this:
```shell ```shell
kubectl get --raw /debug/api_priority_and_fairness/dump_requests kubectl get --raw /debug/api_priority_and_fairness/dump_requests
``` ```
The output is similar to this: The output is similar to this:
```
```none
PriorityLevelName, FlowSchemaName, QueueIndex, RequestIndexInQueue, FlowDistingsher, ArriveTime, PriorityLevelName, FlowSchemaName, QueueIndex, RequestIndexInQueue, FlowDistingsher, ArriveTime,
exempt, <none>, <none>, <none>, <none>, <none>, exempt, <none>, <none>, <none>, <none>, <none>,
system, system-nodes, 12, 0, system:node:127.0.0.1, 2020-07-23T15:26:57.179170694Z, system, system-nodes, 12, 0, system:node:127.0.0.1, 2020-07-23T15:26:57.179170694Z,
``` ```
In addition to the queued requests, the output includes one phantom line for each priority level that is exempt from limitation. In addition to the queued requests, the output includes one phantom line
for each priority level that is exempt from limitation.
You can get a more detailed listing with a command like this: You can get a more detailed listing with a command like this:
```shell ```shell
kubectl get --raw '/debug/api_priority_and_fairness/dump_requests?includeRequestDetails=1' kubectl get --raw '/debug/api_priority_and_fairness/dump_requests?includeRequestDetails=1'
``` ```
The output is similar to this: The output is similar to this:
```
```none
PriorityLevelName, FlowSchemaName, QueueIndex, RequestIndexInQueue, FlowDistingsher, ArriveTime, UserName, Verb, APIPath, Namespace, Name, APIVersion, Resource, SubResource, PriorityLevelName, FlowSchemaName, QueueIndex, RequestIndexInQueue, FlowDistingsher, ArriveTime, UserName, Verb, APIPath, Namespace, Name, APIVersion, Resource, SubResource,
system, system-nodes, 12, 0, system:node:127.0.0.1, 2020-07-23T15:31:03.583823404Z, system:node:127.0.0.1, create, /api/v1/namespaces/scaletest/configmaps, system, system-nodes, 12, 0, system:node:127.0.0.1, 2020-07-23T15:31:03.583823404Z, system:node:127.0.0.1, create, /api/v1/namespaces/scaletest/configmaps,
system, system-nodes, 12, 1, system:node:127.0.0.1, 2020-07-23T15:31:03.594555947Z, system:node:127.0.0.1, create, /api/v1/namespaces/scaletest/configmaps, system, system-nodes, 12, 1, system:node:127.0.0.1, 2020-07-23T15:31:03.594555947Z, system:node:127.0.0.1, create, /api/v1/namespaces/scaletest/configmaps,
@@ -528,4 +554,4 @@ When you enable the API Priority and Fairness feature, the kube-apiserver serves
For background information on design details for API priority and fairness, see For background information on design details for API priority and fairness, see
the [enhancement proposal](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1040-priority-and-fairness). the [enhancement proposal](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1040-priority-and-fairness).
You can make suggestions and feature requests via [SIG API Machinery](https://github.com/kubernetes/community/tree/master/sig-api-machinery) You can make suggestions and feature requests via [SIG API Machinery](https://github.com/kubernetes/community/tree/master/sig-api-machinery)
or the feature's [slack channel](http://kubernetes.slack.com/messages/api-priority-and-fairness). or the feature's [slack channel](https://kubernetes.slack.com/messages/api-priority-and-fairness).
content/en/docs/concepts/cluster-administration/kubelet-garbage-collection.md
+30 -18
View File
@@ -1,5 +1,4 @@
--- ---
reviewers:
title: Garbage collection for container images title: Garbage collection for container images
content_type: concept content_type: concept
weight: 70 weight: 70
@@ -7,12 +6,13 @@ weight: 70
<!-- overview --> <!-- overview -->
Garbage collection is a helpful function of kubelet that will clean up unused [images](/docs/concepts/containers/#container-images) and unused [containers](/docs/concepts/containers/). Kubelet will perform garbage collection for containers every minute and garbage collection for images every five minutes. Garbage collection is a helpful function of kubelet that will clean up unused
[images](/docs/concepts/containers/#container-images) and unused
External garbage collection tools are not recommended as these tools can potentially break the behavior of kubelet by removing containers expected to exist. [containers](/docs/concepts/containers/). Kubelet will perform garbage collection
for containers every minute and garbage collection for images every five minutes.
External garbage collection tools are not recommended as these tools can potentially
break the behavior of kubelet by removing containers expected to exist.
<!-- body --> <!-- body -->
@@ -28,10 +28,24 @@ threshold has been met.
## Container Collection ## Container Collection
The policy for garbage collecting containers considers three user-defined variables. `MinAge` is the minimum age at which a container can be garbage collected. `MaxPerPodContainer` is the maximum number of dead containers every single The policy for garbage collecting containers considers three user-defined variables.
pod (UID, container name) pair is allowed to have. `MaxContainers` is the maximum number of total dead containers. These variables can be individually disabled by setting `MinAge` to zero and setting `MaxPerPodContainer` and `MaxContainers` respectively to less than zero. `MinAge` is the minimum age at which a container can be garbage collected.
`MaxPerPodContainer` is the maximum number of dead containers every single
pod (UID, container name) pair is allowed to have.
`MaxContainers` is the maximum number of total dead containers.
These variables can be individually disabled by setting `MinAge` to zero and
setting `MaxPerPodContainer` and `MaxContainers` respectively to less than zero.
Kubelet will act on containers that are unidentified, deleted, or outside of the boundaries set by the previously mentioned flags. The oldest containers will generally be removed first. `MaxPerPodContainer` and `MaxContainer` may potentially conflict with each other in situations where retaining the maximum number of containers per pod (`MaxPerPodContainer`) would go outside the allowable range of global dead containers (`MaxContainers`). `MaxPerPodContainer` would be adjusted in this situation: A worst case scenario would be to downgrade `MaxPerPodContainer` to 1 and evict the oldest containers. Additionally, containers owned by pods that have been deleted are removed once they are older than `MinAge`. Kubelet will act on containers that are unidentified, deleted, or outside of
the boundaries set by the previously mentioned flags. The oldest containers
will generally be removed first. `MaxPerPodContainer` and `MaxContainer` may
potentially conflict with each other in situations where retaining the maximum
number of containers per pod (`MaxPerPodContainer`) would go outside the
allowable range of global dead containers (`MaxContainers`).
`MaxPerPodContainer` would be adjusted in this situation: A worst case
scenario would be to downgrade `MaxPerPodContainer` to 1 and evict the oldest
containers. Additionally, containers owned by pods that have been deleted are
removed once they are older than `MinAge`.
Containers that are not managed by kubelet are not subject to container garbage collection. Containers that are not managed by kubelet are not subject to container garbage collection.
@@ -40,18 +54,18 @@ Containers that are not managed by kubelet are not subject to container garbage
You can adjust the following thresholds to tune image garbage collection with the following kubelet flags : You can adjust the following thresholds to tune image garbage collection with the following kubelet flags :
1. `image-gc-high-threshold`, the percent of disk usage which triggers image garbage collection. 1. `image-gc-high-threshold`, the percent of disk usage which triggers image garbage collection.
Default is 85%. Default is 85%.
2. `image-gc-low-threshold`, the percent of disk usage to which image garbage collection attempts 2. `image-gc-low-threshold`, the percent of disk usage to which image garbage collection attempts
to free. Default is 80%. to free. Default is 80%.
You can customize the garbage collection policy through the following kubelet flags: You can customize the garbage collection policy through the following kubelet flags:
1. `minimum-container-ttl-duration`, minimum age for a finished container before it is 1. `minimum-container-ttl-duration`, minimum age for a finished container before it is
garbage collected. Default is 0 minute, which means every finished container will be garbage collected. garbage collected. Default is 0 minute, which means every finished container will be garbage collected.
2. `maximum-dead-containers-per-container`, maximum number of old instances to be retained 2. `maximum-dead-containers-per-container`, maximum number of old instances to be retained
per container. Default is 1. per container. Default is 1.
3. `maximum-dead-containers`, maximum number of old instances of containers to retain globally. 3. `maximum-dead-containers`, maximum number of old instances of containers to retain globally.
Default is -1, which means there is no global limit. Default is -1, which means there is no global limit.
Containers can potentially be garbage collected before their usefulness has expired. These containers Containers can potentially be garbage collected before their usefulness has expired. These containers
can contain logs and other data that can be useful for troubleshooting. A sufficiently large value for can contain logs and other data that can be useful for troubleshooting. A sufficiently large value for
@@ -77,10 +91,8 @@ Including:
| `--low-diskspace-threshold-mb` | `--eviction-hard` or `eviction-soft` | eviction generalizes disk thresholds to other resources | | `--low-diskspace-threshold-mb` | `--eviction-hard` or `eviction-soft` | eviction generalizes disk thresholds to other resources |
| `--outofdisk-transition-frequency` | `--eviction-pressure-transition-period` | eviction generalizes disk pressure transition to other resources | | `--outofdisk-transition-frequency` | `--eviction-pressure-transition-period` | eviction generalizes disk pressure transition to other resources |
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
See [Configuring Out Of Resource Handling](/docs/concepts/scheduling-eviction/node-pressure-eviction/)
See [Configuring Out Of Resource Handling](/docs/tasks/administer-cluster/out-of-resource/) for more details. for more details.
content/en/docs/concepts/policy/pid-limiting.md
+13 -6
View File
@@ -10,7 +10,8 @@ weight: 40
{{< feature-state for_k8s_version="v1.20" state="stable" >}} {{< feature-state for_k8s_version="v1.20" state="stable" >}}
Kubernetes allow you to limit the number of process IDs (PIDs) that a {{< glossary_tooltip term_id="Pod" text="Pod" >}} can use. Kubernetes allow you to limit the number of process IDs (PIDs) that a
{{< glossary_tooltip term_id="Pod" text="Pod" >}} can use.
You can also reserve a number of allocatable PIDs for each {{< glossary_tooltip term_id="node" text="node" >}} You can also reserve a number of allocatable PIDs for each {{< glossary_tooltip term_id="node" text="node" >}}
for use by the operating system and daemons (rather than by Pods). for use by the operating system and daemons (rather than by Pods).
@@ -84,7 +85,9 @@ gate](/docs/reference/command-line-tools-reference/feature-gates/)
Kubernetes allows you to limit the number of processes running in a Pod. You Kubernetes allows you to limit the number of processes running in a Pod. You
specify this limit at the node level, rather than configuring it as a resource specify this limit at the node level, rather than configuring it as a resource
limit for a particular Pod. Each Node can have a different PID limit. limit for a particular Pod. Each Node can have a different PID limit.
To configure the limit, you can specify the command line parameter `--pod-max-pids` to the kubelet, or set `PodPidsLimit` in the kubelet [configuration file](/docs/tasks/administer-cluster/kubelet-config-file/). To configure the limit, you can specify the command line parameter `--pod-max-pids`
to the kubelet, or set `PodPidsLimit` in the kubelet
[configuration file](/docs/tasks/administer-cluster/kubelet-config-file/).
{{< note >}} {{< note >}}
Before Kubernetes version 1.20, PID resource limiting for Pods required enabling Before Kubernetes version 1.20, PID resource limiting for Pods required enabling
@@ -95,9 +98,12 @@ the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
## PID based eviction ## PID based eviction
You can configure kubelet to start terminating a Pod when it is misbehaving and consuming abnormal amount of resources. You can configure kubelet to start terminating a Pod when it is misbehaving and consuming abnormal amount of resources.
This feature is called eviction. You can [Configure Out of Resource Handling](/docs/tasks/administer-cluster/out-of-resource) for various eviction signals. This feature is called eviction. You can
[Configure Out of Resource Handling](/docs/concepts/scheduling-eviction/node-pressure-eviction/)
for various eviction signals.
Use `pid.available` eviction signal to configure the threshold for number of PIDs used by Pod. Use `pid.available` eviction signal to configure the threshold for number of PIDs used by Pod.
You can set soft and hard eviction policies. However, even with the hard eviction policy, if the number of PIDs growing very fast, You can set soft and hard eviction policies.
However, even with the hard eviction policy, if the number of PIDs growing very fast,
node can still get into unstable state by hitting the node PIDs limit. node can still get into unstable state by hitting the node PIDs limit.
Eviction signal value is calculated periodically and does NOT enforce the limit. Eviction signal value is calculated periodically and does NOT enforce the limit.
@@ -112,6 +118,7 @@ when one Pod is misbehaving.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
- Refer to the [PID Limiting enhancement document](https://github.com/kubernetes/enhancements/blob/097b4d8276bc9564e56adf72505d43ce9bc5e9e8/keps/sig-node/20190129-pid-limiting.md) for more information. - Refer to the [PID Limiting enhancement document](https://github.com/kubernetes/enhancements/blob/097b4d8276bc9564e56adf72505d43ce9bc5e9e8/keps/sig-node/20190129-pid-limiting.md) for more information.
- For historical context, read [Process ID Limiting for Stability Improvements in Kubernetes 1.14](/blog/2019/04/15/process-id-limiting-for-stability-improvements-in-kubernetes-1.14/). - For historical context, read
[Process ID Limiting for Stability Improvements in Kubernetes 1.14](/blog/2019/04/15/process-id-limiting-for-stability-improvements-in-kubernetes-1.14/).
- Read [Managing Resources for Containers](/docs/concepts/configuration/manage-resources-containers/). - Read [Managing Resources for Containers](/docs/concepts/configuration/manage-resources-containers/).
- Learn how to [Configure Out of Resource Handling](/docs/tasks/administer-cluster/out-of-resource). - Learn how to [Configure Out of Resource Handling](/docs/concepts/scheduling-eviction/node-pressure-eviction/).
content/en/docs/concepts/policy/resource-quotas.md
+17 -11
View File
@@ -58,7 +58,8 @@ Neither contention nor changes to quota will affect already created resources.
## Enabling Resource Quota ## Enabling Resource Quota
Resource Quota support is enabled by default for many Kubernetes distributions. It is Resource Quota support is enabled by default for many Kubernetes distributions. It is
enabled when the {{< glossary_tooltip text="API server" term_id="kube-apiserver" >}} `--enable-admission-plugins=` flag has `ResourceQuota` as enabled when the {{< glossary_tooltip text="API server" term_id="kube-apiserver" >}}
`--enable-admission-plugins=` flag has `ResourceQuota` as
one of its arguments. one of its arguments.
A resource quota is enforced in a particular namespace when there is a A resource quota is enforced in a particular namespace when there is a
@@ -66,7 +67,9 @@ ResourceQuota in that namespace.
## Compute Resource Quota ## Compute Resource Quota
You can limit the total sum of [compute resources](/docs/concepts/configuration/manage-resources-containers/) that can be requested in a given namespace. You can limit the total sum of
[compute resources](/docs/concepts/configuration/manage-resources-containers/)
that can be requested in a given namespace.
The following resource types are supported: The following resource types are supported:
@@ -125,7 +128,9 @@ In release 1.8, quota support for local ephemeral storage is added as an alpha f
| `ephemeral-storage` | Same as `requests.ephemeral-storage`. | | `ephemeral-storage` | Same as `requests.ephemeral-storage`. |
{{< note >}} {{< note >}}
When using a CRI container runtime, container logs will count against the ephemeral storage quota. This can result in the unexpected eviction of pods that have exhausted their storage quotas. Refer to [Logging Architecture](/docs/concepts/cluster-administration/logging/) for details. When using a CRI container runtime, container logs will count against the ephemeral storage quota.
This can result in the unexpected eviction of pods that have exhausted their storage quotas.
Refer to [Logging Architecture](/docs/concepts/cluster-administration/logging/) for details.
{{< /note >}} {{< /note >}}
## Object Count Quota ## Object Count Quota
@@ -192,7 +197,7 @@ Resources specified on the quota outside of the allowed set results in a validat
| `NotTerminating` | Match pods where `.spec.activeDeadlineSeconds is nil` | | `NotTerminating` | Match pods where `.spec.activeDeadlineSeconds is nil` |
| `BestEffort` | Match pods that have best effort quality of service. | | `BestEffort` | Match pods that have best effort quality of service. |
| `NotBestEffort` | Match pods that do not have best effort quality of service. | | `NotBestEffort` | Match pods that do not have best effort quality of service. |
| `PriorityClass` | Match pods that references the specified [priority class](/docs/concepts/configuration/pod-priority-preemption). | | `PriorityClass` | Match pods that references the specified [priority class](/docs/concepts/scheduling-eviction/pod-priority-preemption). |
| `CrossNamespacePodAffinity` | Match pods that have cross-namespace pod [(anti)affinity terms](/docs/concepts/scheduling-eviction/assign-pod-node). | | `CrossNamespacePodAffinity` | Match pods that have cross-namespace pod [(anti)affinity terms](/docs/concepts/scheduling-eviction/assign-pod-node). |
The `BestEffort` scope restricts a quota to tracking the following resource: The `BestEffort` scope restricts a quota to tracking the following resource:
@@ -248,13 +253,14 @@ specified.
{{< feature-state for_k8s_version="v1.17" state="stable" >}} {{< feature-state for_k8s_version="v1.17" state="stable" >}}
Pods can be created at a specific [priority](/docs/concepts/configuration/pod-priority-preemption/#pod-priority). Pods can be created at a specific [priority](/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority).
You can control a pod's consumption of system resources based on a pod's priority, by using the `scopeSelector` You can control a pod's consumption of system resources based on a pod's priority, by using the `scopeSelector`
field in the quota spec. field in the quota spec.
A quota is matched and consumed only if `scopeSelector` in the quota spec selects the pod. A quota is matched and consumed only if `scopeSelector` in the quota spec selects the pod.
When quota is scoped for priority class using `scopeSelector` field, quota object is restricted to track only following resources: When quota is scoped for priority class using `scopeSelector` field, quota object
is restricted to track only following resources:
* `pods` * `pods`
* `cpu` * `cpu`
@@ -554,7 +560,7 @@ kubectl create -f ./object-counts.yaml --namespace=myspace
kubectl get quota --namespace=myspace kubectl get quota --namespace=myspace
``` ```
``` ```none
NAME AGE NAME AGE
compute-resources 30s compute-resources 30s
object-counts 32s object-counts 32s
@@ -564,7 +570,7 @@ object-counts 32s
kubectl describe quota compute-resources --namespace=myspace kubectl describe quota compute-resources --namespace=myspace
``` ```
``` ```none
Name: compute-resources Name: compute-resources
Namespace: myspace Namespace: myspace
Resource Used Hard Resource Used Hard
@@ -580,7 +586,7 @@ requests.nvidia.com/gpu 0 4
kubectl describe quota object-counts --namespace=myspace kubectl describe quota object-counts --namespace=myspace
``` ```
``` ```none
Name: object-counts Name: object-counts
Namespace: myspace Namespace: myspace
Resource Used Hard Resource Used Hard
@@ -677,10 +683,10 @@ Then, create a resource quota object in the `kube-system` namespace:
{{< codenew file="policy/priority-class-resourcequota.yaml" >}} {{< codenew file="policy/priority-class-resourcequota.yaml" >}}
```shell ```shell
$ kubectl apply -f https://k8s.io/examples/policy/priority-class-resourcequota.yaml -n kube-system kubectl apply -f https://k8s.io/examples/policy/priority-class-resourcequota.yaml -n kube-system
``` ```
``` ```none
resourcequota/pods-cluster-services created resourcequota/pods-cluster-services created
``` ```
content/en/docs/concepts/scheduling-eviction/node-pressure-eviction.md
+1 -1
View File
@@ -214,7 +214,7 @@ signal below the threshold, the kubelet begins to evict end-user pods.
The kubelet uses the following parameters to determine pod eviction order: The kubelet uses the following parameters to determine pod eviction order:
1. Whether the pod's resource usage exceeds requests 1. Whether the pod's resource usage exceeds requests
1. [Pod Priority](/docs/concepts/configuration/pod-priority-preemption/) 1. [Pod Priority](/docs/concepts/scheduling-eviction/pod-priority-preemption/)
1. The pod's resource usage relative to requests 1. The pod's resource usage relative to requests
As a result, kubelet ranks and evicts pods in the following order: As a result, kubelet ranks and evicts pods in the following order:
content/en/docs/concepts/scheduling-eviction/taint-and-toleration.md
+2 -2
View File
@@ -285,7 +285,7 @@ arbitrary tolerations to DaemonSets.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
* Read about [out of resource handling](/docs/tasks/administer-cluster/out-of-resource/) and how you can configure it * Read about [out of resource handling](/docs/concepts/scheduling-eviction/out-of-resource/) and how you can configure it
* Read about [pod priority](/docs/concepts/configuration/pod-priority-preemption/) * Read about [pod priority](/docs/concepts/scheduling-eviction/pod-priority-preemption/)
content/en/docs/concepts/services-networking/endpoint-slices.md
-1
View File
@@ -249,5 +249,4 @@ implementation in `kube-proxy`.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
* Learn about [Enabling EndpointSlices](/docs/tasks/administer-cluster/enabling-endpointslices)
* Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/) * Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/)
content/en/docs/concepts/services-networking/service.md
+1 -1
View File
@@ -215,7 +215,7 @@ each Service port. The value of this field is mirrored by the corresponding
Endpoints and EndpointSlice objects. Endpoints and EndpointSlice objects.
This field follows standard Kubernetes label syntax. Values should either be This field follows standard Kubernetes label syntax. Values should either be
[IANA standard service names](http://www.iana.org/assignments/service-names) or [IANA standard service names](https://www.iana.org/assignments/service-names) or
domain prefixed names such as `mycompany.com/my-custom-protocol`. domain prefixed names such as `mycompany.com/my-custom-protocol`.
## Virtual IPs and service proxies ## Virtual IPs and service proxies
content/en/docs/concepts/workloads/controllers/daemonset.md
+28 -17
View File
@@ -32,7 +32,8 @@ different flags and/or different memory and cpu requests for different hardware
### Create a DaemonSet ### Create a DaemonSet
You can describe a DaemonSet in a YAML file. For example, the `daemonset.yaml` file below describes a DaemonSet that runs the fluentd-elasticsearch Docker image: You can describe a DaemonSet in a YAML file. For example, the `daemonset.yaml` file below
describes a DaemonSet that runs the fluentd-elasticsearch Docker image:
{{< codenew file="controllers/daemonset.yaml" >}} {{< codenew file="controllers/daemonset.yaml" >}}
@@ -46,19 +47,23 @@ kubectl apply -f https://k8s.io/examples/controllers/daemonset.yaml
As with all other Kubernetes config, a DaemonSet needs `apiVersion`, `kind`, and `metadata` fields. For As with all other Kubernetes config, a DaemonSet needs `apiVersion`, `kind`, and `metadata` fields. For
general information about working with config files, see general information about working with config files, see
[running stateless applications](/docs/tasks/run-application/run-stateless-application-deployment/), [running stateless applications](/docs/tasks/run-application/run-stateless-application-deployment/)
[configuring containers](/docs/tasks/), and [object management using kubectl](/docs/concepts/overview/working-with-objects/object-management/) documents. and [object management using kubectl](/docs/concepts/overview/working-with-objects/object-management/).
The name of a DaemonSet object must be a valid The name of a DaemonSet object must be a valid
[DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names).
A DaemonSet also needs a [`.spec`](https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status) section. A DaemonSet also needs a
[`.spec`](https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status)
section.
### Pod Template ### Pod Template
The `.spec.template` is one of the required fields in `.spec`. The `.spec.template` is one of the required fields in `.spec`.
The `.spec.template` is a [pod template](/docs/concepts/workloads/pods/#pod-templates). It has exactly the same schema as a {{< glossary_tooltip text="Pod" term_id="pod" >}}, except it is nested and does not have an `apiVersion` or `kind`. The `.spec.template` is a [pod template](/docs/concepts/workloads/pods/#pod-templates).
It has exactly the same schema as a {{< glossary_tooltip text="Pod" term_id="pod" >}},
except it is nested and does not have an `apiVersion` or `kind`.
In addition to required fields for a Pod, a Pod template in a DaemonSet has to specify appropriate In addition to required fields for a Pod, a Pod template in a DaemonSet has to specify appropriate
labels (see [pod selector](#pod-selector)). labels (see [pod selector](#pod-selector)).
@@ -79,20 +84,23 @@ unintentional orphaning of Pods, and it was found to be confusing to users.
The `.spec.selector` is an object consisting of two fields: The `.spec.selector` is an object consisting of two fields:
* `matchLabels` - works the same as the `.spec.selector` of a [ReplicationController](/docs/concepts/workloads/controllers/replicationcontroller/). * `matchLabels` - works the same as the `.spec.selector` of a
[ReplicationController](/docs/concepts/workloads/controllers/replicationcontroller/).
* `matchExpressions` - allows to build more sophisticated selectors by specifying key, * `matchExpressions` - allows to build more sophisticated selectors by specifying key,
list of values and an operator that relates the key and values. list of values and an operator that relates the key and values.
When the two are specified the result is ANDed. When the two are specified the result is ANDed.
If the `.spec.selector` is specified, it must match the `.spec.template.metadata.labels`. Config with these not matching will be rejected by the API. If the `.spec.selector` is specified, it must match the `.spec.template.metadata.labels`.
Config with these not matching will be rejected by the API.
### Running Pods on select Nodes ### Running Pods on select Nodes
If you specify a `.spec.template.spec.nodeSelector`, then the DaemonSet controller will If you specify a `.spec.template.spec.nodeSelector`, then the DaemonSet controller will
create Pods on nodes which match that [node create Pods on nodes which match that [node selector](/docs/concepts/scheduling-eviction/assign-pod-node/).
selector](/docs/concepts/scheduling-eviction/assign-pod-node/). Likewise if you specify a `.spec.template.spec.affinity`, Likewise if you specify a `.spec.template.spec.affinity`,
then DaemonSet controller will create Pods on nodes which match that [node affinity](/docs/concepts/scheduling-eviction/assign-pod-node/). then DaemonSet controller will create Pods on nodes which match that
[node affinity](/docs/concepts/scheduling-eviction/assign-pod-node/).
If you do not specify either, then the DaemonSet controller will create Pods on all nodes. If you do not specify either, then the DaemonSet controller will create Pods on all nodes.
## How Daemon Pods are scheduled ## How Daemon Pods are scheduled
@@ -106,10 +114,10 @@ node that a Pod runs on is selected by the Kubernetes scheduler. However,
DaemonSet pods are created and scheduled by the DaemonSet controller instead. DaemonSet pods are created and scheduled by the DaemonSet controller instead.
That introduces the following issues: That introduces the following issues:
* Inconsistent Pod behavior: Normal Pods waiting to be scheduled are created * Inconsistent Pod behavior: Normal Pods waiting to be scheduled are created
and in `Pending` state, but DaemonSet pods are not created in `Pending` and in `Pending` state, but DaemonSet pods are not created in `Pending`
state. This is confusing to the user. state. This is confusing to the user.
* [Pod preemption](/docs/concepts/configuration/pod-priority-preemption/) * [Pod preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/)
is handled by default scheduler. When preemption is enabled, the DaemonSet controller is handled by default scheduler. When preemption is enabled, the DaemonSet controller
will make scheduling decisions without considering pod priority and preemption. will make scheduling decisions without considering pod priority and preemption.
@@ -117,7 +125,8 @@ That introduces the following issues:
scheduler instead of the DaemonSet controller, by adding the `NodeAffinity` term scheduler instead of the DaemonSet controller, by adding the `NodeAffinity` term
to the DaemonSet pods, instead of the `.spec.nodeName` term. The default to the DaemonSet pods, instead of the `.spec.nodeName` term. The default
scheduler is then used to bind the pod to the target host. If node affinity of scheduler is then used to bind the pod to the target host. If node affinity of
the DaemonSet pod already exists, it is replaced (the original node affinity was taken into account before selecting the target host). The DaemonSet controller only the DaemonSet pod already exists, it is replaced (the original node affinity was
taken into account before selecting the target host). The DaemonSet controller only
performs these operations when creating or modifying DaemonSet pods, and no performs these operations when creating or modifying DaemonSet pods, and no
changes are made to the `spec.template` of the DaemonSet. changes are made to the `spec.template` of the DaemonSet.
@@ -158,10 +167,12 @@ Some possible patterns for communicating with Pods in a DaemonSet are:
- **Push**: Pods in the DaemonSet are configured to send updates to another service, such - **Push**: Pods in the DaemonSet are configured to send updates to another service, such
as a stats database. They do not have clients. as a stats database. They do not have clients.
- **NodeIP and Known Port**: Pods in the DaemonSet can use a `hostPort`, so that the pods are reachable via the node IPs. Clients know the list of node IPs somehow, and know the port by convention. - **NodeIP and Known Port**: Pods in the DaemonSet can use a `hostPort`, so that the pods
- **DNS**: Create a [headless service](/docs/concepts/services-networking/service/#headless-services) with the same pod selector, are reachable via the node IPs.
and then discover DaemonSets using the `endpoints` resource or retrieve multiple A records from Clients know the list of node IPs somehow, and know the port by convention.
DNS. - **DNS**: Create a [headless service](/docs/concepts/services-networking/service/#headless-services)
with the same pod selector, and then discover DaemonSets using the `endpoints`
resource or retrieve multiple A records from DNS.
- **Service**: Create a service with the same Pod selector, and use the service to reach a - **Service**: Create a service with the same Pod selector, and use the service to reach a
daemon on a random node. (No way to reach specific node.) daemon on a random node. (No way to reach specific node.)
content/en/docs/concepts/workloads/pods/disruptions.md
+1 -1
View File
@@ -86,7 +86,7 @@ rolling out node software updates can cause voluntary disruptions. Also, some im
of cluster (node) autoscaling may cause voluntary disruptions to defragment and compact nodes. of cluster (node) autoscaling may cause voluntary disruptions to defragment and compact nodes.
Your cluster administrator or hosting provider should have documented what level of voluntary Your cluster administrator or hosting provider should have documented what level of voluntary
disruptions, if any, to expect. Certain configuration options, such as disruptions, if any, to expect. Certain configuration options, such as
[using PriorityClasses](/docs/concepts/configuration/pod-priority-preemption/) [using PriorityClasses](/docs/concepts/scheduling-eviction/pod-priority-preemption/)
in your pod spec can also cause voluntary (and involuntary) disruptions. in your pod spec can also cause voluntary (and involuntary) disruptions.
content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md
+1 -1
View File
@@ -16,7 +16,7 @@ You can use _topology spread constraints_ to control how {{< glossary_tooltip te
In versions of Kubernetes before v1.18, you must enable the `EvenPodsSpread` In versions of Kubernetes before v1.18, you must enable the `EvenPodsSpread`
[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) on [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) on
the [API server](/docs/concepts/overview/components/#kube-apiserver) and the the [API server](/docs/concepts/overview/components/#kube-apiserver) and the
[scheduler](/docs/reference/generated/kube-scheduler/) in order to use Pod [scheduler](/docs/reference/command-line-tools-reference/kube-scheduler/) in order to use Pod
topology spread constraints. topology spread constraints.
{{< /note >}} {{< /note >}}