whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Proof of concept for import script; various FARs

Browse Source
This commit is contained in:
johndmulhausen
2016-02-14 14:08:16 -08:00
parent 42c2226bef
commit e37603f8bd
68 changed files with 527 additions and 6976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
v1.1/docs/admin/limitrange/README.md
+52 -35
View File
@@ -1,9 +1,6 @@
---
title: "Limit Range"
---
Limit Range
========================================
By default, pods run with unbounded CPU and memory limits. This means that any pod in the
system will be able to consume as much CPU and memory on the node that executes the pod.
@@ -31,39 +28,44 @@ apply default resource limits to pods in the absence of an end-user specified va
See [LimitRange design doc](../../design/admission_control_limit_range) for more information. For a detailed description of the Kubernetes resource model, see [Resources](/{{page.version}}/docs/user-guide/compute-resources)
Step 0: Prerequisites
-----------------------------------------
## Step 0: Prerequisites
This example requires a running Kubernetes cluster. See the [Getting Started guides](/{{page.version}}/docs/getting-started-guides/) for how to get started.
Change to the `<kubernetes>` directory if you're not already there.
Step 1: Create a namespace
-----------------------------------------
## Step 1: Create a namespace
This example will work in a custom namespace to demonstrate the concepts involved.
Let's create a new namespace called limit-example:
{% highlight console %}
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/namespace.yaml
namespace "limit-example" created
$ kubectl get namespaces
NAME LABELS STATUS AGE
default <none> Active 5m
default <none> Active 5m
limit-example <none> Active 53s
{% endhighlight %}
{% endhighlight %}
## Step 2: Apply a limit to the namespace
Let's create a simple limit in our namespace.
Let's create a simple limit in our namespace.
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/limits.yaml --namespace=limit-example
{% highlight console %}
limitrange "mylimits" created
{% endhighlight %}
Let's describe the limits that we have imposed in our namespace.
{% endhighlight %}
{% highlight console %}
$ kubectl describe limits mylimits --namespace=limit-example
Name: mylimits
Namespace: limit-example
@@ -72,7 +74,8 @@ Type Resource Min Max Request Limit Limit/Reques
Pod cpu 200m 2 - - -
Pod memory 6Mi 1Gi - - -
Container cpu 100m 2 200m 300m -
Type Resource Min Max Request Limit Limit/Request
Container memory 3Mi 1Gi 100Mi 200Mi -
{% endhighlight %}
In this scenario, we have said the following:
@@ -89,8 +92,8 @@ set by *defaultRequest* in file `limits.yaml` (200m CPU and 100Mi memory).
memory limits must be <= 1Gi; the sum of all containers CPU requests must be >= 200m and the sum of all
containers CPU limits must be <= 2.
result in a validation error when attempting to create the pod. Note that a default value of request is
set by *defaultRequest* in file `limits.yaml` (200m CPU and 100Mi memory).
## Step 3: Enforcing limits at point of creation
The limits enumerated in a namespace are only enforced when a pod is created or updated in
the cluster. If you change the limits to a different value range, it does not affect pods that
were previously created in a namespace.
@@ -101,16 +104,19 @@ of creation explaining why.
Let's first spin up a replication controller that creates a single container pod to demonstrate
how default values are applied to each pod.
If a resource (cpu or memory) is being restricted by a limit, the user will get an error at time
{% highlight console %}
$ kubectl run nginx --image=nginx --replicas=1 --namespace=limit-example
replicationcontroller "nginx" created
$ kubectl get pods --namespace=limit-example
NAME READY STATUS RESTARTS AGE
nginx-aq0mf 1/1 Running 0 35s
{% highlight console %}
$ kubectl get pods nginx-aq0mf --namespace=limit-example -o yaml | grep resources -C 8
{% endhighlight %}
replicationcontroller "nginx" created
{% highlight yaml %}
resourceVersion: "127"
selfLink: /api/v1/namespaces/limit-example/pods/nginx-aq0mf
uid: 51be42a7-7156-11e5-9921-286ed488f785
@@ -127,27 +133,33 @@ spec:
cpu: 200m
memory: 100Mi
terminationMessagePath: /dev/termination-log
name: nginx
volumeMounts:
{% endhighlight %}
Note that our nginx container has picked up the namespace default cpu and memory resource *limits* and *requests*.
Let's create a pod that exceeds our allowed limits by having it have a container that requests 3 cpu cores.
memory: 100Mi
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/invalid-pod.yaml --namespace=limit-example
volumeMounts:
Error from server: error when creating "docs/admin/limitrange/invalid-pod.yaml": Pod "invalid-pod" is forbidden: [Maximum cpu usage per Pod is 2, but limit is 3., Maximum cpu usage per Container is 2, but limit is 3.]
{% endhighlight %}
Let's create a pod that falls within the allowed limit boundaries.
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/valid-pod.yaml --namespace=limit-example
pod "valid-pod" created
{% highlight console %}
$ kubectl get pods valid-pod --namespace=limit-example -o yaml | grep -C 6 resources
{% endhighlight %}
Error from server: error when creating "docs/admin/limitrange/invalid-pod.yaml": Pod "invalid-pod" is forbidden: [Maximum cpu usage per Pod is 2, but limit is 3., Maximum cpu usage per Container is 2, but limit is 3.]
{% highlight yaml %}
uid: 162a12aa-7157-11e5-9921-286ed488f785
spec:
containers:
@@ -160,7 +172,8 @@ spec:
memory: 512Mi
requests:
cpu: "1"
memory: 512Mi
{% endhighlight %}
Note that this pod specifies explicit resource *limits* and *requests* so it did not pick up the namespace
@@ -169,28 +182,32 @@ default values.
Note: The *limits* for CPU resource are not enforced in the default Kubernetes setup on the physical node
that runs the container unless the administrator deploys the kubelet with the folllowing flag:
resources:
```
$ kubelet --help
Usage of kubelet
....
--cpu-cfs-quota[=false]: Enable CPU CFS quota enforcement for containers that specify CPU limits
cpu: "1"
$ kubelet --cpu-cfs-quota=true ...
```
{% endhighlight %}
## Step 4: Cleanup
To remove the resources used by this example, you can just delete the limit-example namespace.
{% highlight console %}
$ kubectl delete namespace limit-example
namespace "limit-example" deleted
$ kubectl get namespaces
NAME LABELS STATUS AGE
default <none> Active 20m
{% endhighlight %}
....
--cpu-cfs-quota[=false]: Enable CPU CFS quota enforcement for containers that specify CPU limits
## Summary
Cluster operators that want to restrict the amount of resources a single container or pod may consume
are able to define allowable ranges per Kubernetes namespace. In the absence of any explicit assignments,
the Kubernetes system is able to apply default resource *limits* and *requests* if desired in order to
v1.1/docs/admin/limitrange/index.md
+52 -35
View File
@@ -1,9 +1,6 @@
---
title: "Limit Range"
---
Limit Range
========================================
By default, pods run with unbounded CPU and memory limits. This means that any pod in the
system will be able to consume as much CPU and memory on the node that executes the pod.
@@ -31,39 +28,44 @@ apply default resource limits to pods in the absence of an end-user specified va
See [LimitRange design doc](../../design/admission_control_limit_range) for more information. For a detailed description of the Kubernetes resource model, see [Resources](/{{page.version}}/docs/user-guide/compute-resources)
Step 0: Prerequisites
-----------------------------------------
## Step 0: Prerequisites
This example requires a running Kubernetes cluster. See the [Getting Started guides](/{{page.version}}/docs/getting-started-guides/) for how to get started.
Change to the `<kubernetes>` directory if you're not already there.
Step 1: Create a namespace
-----------------------------------------
## Step 1: Create a namespace
This example will work in a custom namespace to demonstrate the concepts involved.
Let's create a new namespace called limit-example:
{% highlight console %}
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/namespace.yaml
namespace "limit-example" created
$ kubectl get namespaces
NAME LABELS STATUS AGE
default <none> Active 5m
default <none> Active 5m
limit-example <none> Active 53s
{% endhighlight %}
{% endhighlight %}
## Step 2: Apply a limit to the namespace
Let's create a simple limit in our namespace.
Let's create a simple limit in our namespace.
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/limits.yaml --namespace=limit-example
{% highlight console %}
limitrange "mylimits" created
{% endhighlight %}
Let's describe the limits that we have imposed in our namespace.
{% endhighlight %}
{% highlight console %}
$ kubectl describe limits mylimits --namespace=limit-example
Name: mylimits
Namespace: limit-example
@@ -72,7 +74,8 @@ Type Resource Min Max Request Limit Limit/Reques
Pod cpu 200m 2 - - -
Pod memory 6Mi 1Gi - - -
Container cpu 100m 2 200m 300m -
Type Resource Min Max Request Limit Limit/Request
Container memory 3Mi 1Gi 100Mi 200Mi -
{% endhighlight %}
In this scenario, we have said the following:
@@ -89,8 +92,8 @@ set by *defaultRequest* in file `limits.yaml` (200m CPU and 100Mi memory).
memory limits must be <= 1Gi; the sum of all containers CPU requests must be >= 200m and the sum of all
containers CPU limits must be <= 2.
result in a validation error when attempting to create the pod. Note that a default value of request is
set by *defaultRequest* in file `limits.yaml` (200m CPU and 100Mi memory).
## Step 3: Enforcing limits at point of creation
The limits enumerated in a namespace are only enforced when a pod is created or updated in
the cluster. If you change the limits to a different value range, it does not affect pods that
were previously created in a namespace.
@@ -101,16 +104,19 @@ of creation explaining why.
Let's first spin up a replication controller that creates a single container pod to demonstrate
how default values are applied to each pod.
If a resource (cpu or memory) is being restricted by a limit, the user will get an error at time
{% highlight console %}
$ kubectl run nginx --image=nginx --replicas=1 --namespace=limit-example
replicationcontroller "nginx" created
$ kubectl get pods --namespace=limit-example
NAME READY STATUS RESTARTS AGE
nginx-aq0mf 1/1 Running 0 35s
{% highlight console %}
$ kubectl get pods nginx-aq0mf --namespace=limit-example -o yaml | grep resources -C 8
{% endhighlight %}
replicationcontroller "nginx" created
{% highlight yaml %}
resourceVersion: "127"
selfLink: /api/v1/namespaces/limit-example/pods/nginx-aq0mf
uid: 51be42a7-7156-11e5-9921-286ed488f785
@@ -127,27 +133,33 @@ spec:
cpu: 200m
memory: 100Mi
terminationMessagePath: /dev/termination-log
name: nginx
volumeMounts:
{% endhighlight %}
Note that our nginx container has picked up the namespace default cpu and memory resource *limits* and *requests*.
Let's create a pod that exceeds our allowed limits by having it have a container that requests 3 cpu cores.
memory: 100Mi
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/invalid-pod.yaml --namespace=limit-example
volumeMounts:
Error from server: error when creating "docs/admin/limitrange/invalid-pod.yaml": Pod "invalid-pod" is forbidden: [Maximum cpu usage per Pod is 2, but limit is 3., Maximum cpu usage per Container is 2, but limit is 3.]
{% endhighlight %}
Let's create a pod that falls within the allowed limit boundaries.
{% highlight console %}
$ kubectl create -f docs/admin/limitrange/valid-pod.yaml --namespace=limit-example
pod "valid-pod" created
{% highlight console %}
$ kubectl get pods valid-pod --namespace=limit-example -o yaml | grep -C 6 resources
{% endhighlight %}
Error from server: error when creating "docs/admin/limitrange/invalid-pod.yaml": Pod "invalid-pod" is forbidden: [Maximum cpu usage per Pod is 2, but limit is 3., Maximum cpu usage per Container is 2, but limit is 3.]
{% highlight yaml %}
uid: 162a12aa-7157-11e5-9921-286ed488f785
spec:
containers:
@@ -160,7 +172,8 @@ spec:
memory: 512Mi
requests:
cpu: "1"
memory: 512Mi
{% endhighlight %}
Note that this pod specifies explicit resource *limits* and *requests* so it did not pick up the namespace
@@ -169,28 +182,32 @@ default values.
Note: The *limits* for CPU resource are not enforced in the default Kubernetes setup on the physical node
that runs the container unless the administrator deploys the kubelet with the folllowing flag:
resources:
```
$ kubelet --help
Usage of kubelet
....
--cpu-cfs-quota[=false]: Enable CPU CFS quota enforcement for containers that specify CPU limits
cpu: "1"
$ kubelet --cpu-cfs-quota=true ...
```
{% endhighlight %}
## Step 4: Cleanup
To remove the resources used by this example, you can just delete the limit-example namespace.
{% highlight console %}
$ kubectl delete namespace limit-example
namespace "limit-example" deleted
$ kubectl get namespaces
NAME LABELS STATUS AGE
default <none> Active 20m
{% endhighlight %}
....
--cpu-cfs-quota[=false]: Enable CPU CFS quota enforcement for containers that specify CPU limits
## Summary
Cluster operators that want to restrict the amount of resources a single container or pod may consume
are able to define allowable ranges per Kubernetes namespace. In the absence of any explicit assignments,
the Kubernetes system is able to apply default resource *limits* and *requests* if desired in order to
v1.1/docs/admin/resourcequota/README.md
+44 -29
View File
@@ -1,32 +1,31 @@
---
title: "Resource Quota"
---
Resource Quota
========================================
This example demonstrates how [resource quota](../../admin/admission-controllers.html#resourcequota) and
[limitsranger](../../admin/admission-controllers.html#limitranger) can be applied to a Kubernetes namespace.
See [ResourceQuota design doc](../../design/admission_control_resource_quota) for more information.
This example assumes you have a functional Kubernetes setup.
Step 1: Create a namespace
-----------------------------------------
## Step 1: Create a namespace
This example will work in a custom namespace to demonstrate the concepts involved.
Let's create a new namespace called quota-example:
{% highlight console %}
{% highlight console %}
$ kubectl create -f docs/admin/resourcequota/namespace.yaml
namespace "quota-example" created
$ kubectl get namespaces
NAME LABELS STATUS AGE
default <none> Active 2m
default <none> Active 2m
quota-example <none> Active 39s
{% endhighlight %}
{% endhighlight %}
## Step 2: Apply a quota to the namespace
By default, a pod will run with unbounded CPU and memory requests/limits. This means that any pod in the
system will be able to consume as much CPU and memory on the node that executes the pod.
@@ -38,9 +37,11 @@ checks the total resource *requests*, not resource *limits* of all containers/po
Let's create a simple quota in our namespace:
Let's create a simple quota in our namespace:
{% highlight console %}
$ kubectl create -f docs/admin/resourcequota/quota.yaml --namespace=quota-example
{% highlight console %}
resourcequota "quota" created
{% endhighlight %}
Once your quota is applied to a namespace, the system will restrict any creation of content
@@ -49,7 +50,8 @@ in the namespace until the quota usage has been calculated. This should happen
You can describe your current quota usage to see what resources are being consumed in your
namespace.
{% highlight console %}
$ kubectl describe quota quota --namespace=quota-example
Name: quota
Namespace: quota-example
@@ -62,11 +64,12 @@ pods 0 10
replicationcontrollers 0 20
resourcequotas 1 1
secrets 1 10
persistentvolumeclaims 0 10
services 0 5
{% endhighlight %}
resourcequotas 1 1
secrets 1 10
## Step 3: Applying default resource requests and limits
Pod authors rarely specify resource requests and limits for their pods.
Since we applied a quota to our project, let's see what happens when an end-user creates a pod that has unbounded
@@ -74,21 +77,26 @@ cpu and memory by creating an nginx container.
To demonstrate, lets create a replication controller that runs nginx:
{% highlight console %}
$ kubectl run nginx --image=nginx --replicas=1 --namespace=quota-example
cpu and memory by creating an nginx container.
replicationcontroller "nginx" created
{% endhighlight %}
Now let's look at the pods that were created.
{% highlight console %}
$ kubectl get pods --namespace=quota-example
replicationcontroller "nginx" created
NAME READY STATUS RESTARTS AGE
{% endhighlight %}
What happened? I have no pods! Let's describe the replication controller to get a view of what is happening.
{% highlight console %}
kubectl describe rc nginx --namespace=quota-example
Name: nginx
Namespace: quota-example
@@ -100,7 +108,8 @@ Pods Status: 0 Running / 0 Waiting / 0 Succeeded / 0 Failed
No volumes.
Events:
FirstSeen LastSeen Count From SubobjectPath Reason Message
kubectl describe rc nginx --namespace=quota-example
42s 11s 3 {replication-controller } FailedCreate Error creating: Pod "nginx-" is forbidden: Must make a non-zero request for memory since it is tracked by quota.
{% endhighlight %}
The Kubernetes API server is rejecting the replication controllers requests to create a pod because our pods
@@ -108,7 +117,8 @@ do not specify any memory usage *request*.
So let's set some default values for the amount of cpu and memory a pod can consume:
No volumes.
{% highlight console %}
$ kubectl create -f docs/admin/resourcequota/limits.yaml --namespace=quota-example
limitrange "limits" created
$ kubectl describe limits limits --namespace=quota-example
@@ -117,7 +127,8 @@ Namespace: quota-example
Type Resource Min Max Request Limit Limit/Request
---- -------- --- --- ------- ----- -------------
Container memory - - 256Mi 512Mi -
Container cpu - - 100m 200m -
{% endhighlight %}
Now any time a pod is created in this namespace, if it has not specified any resource request/limit, the default
@@ -126,15 +137,18 @@ amount of cpu and memory per container will be applied, and the request will be
Now that we have applied default resource *request* for our namespace, our replication controller should be able to
create its pods.
Namespace: quota-example
{% highlight console %}
$ kubectl get pods --namespace=quota-example
NAME READY STATUS RESTARTS AGE
Container memory - - 256Mi 512Mi -
nginx-fca65 1/1 Running 0 1m
{% endhighlight %}
And if we print out our quota usage in the namespace:
Now any time a pod is created in this namespace, if it has not specified any resource request/limit, the default
{% highlight console %}
$ kubectl describe quota quota --namespace=quota-example
Name: quota
Namespace: quota-example
@@ -147,14 +161,15 @@ pods 1 10
replicationcontrollers 1 20
resourcequotas 1 1
secrets 1 10
services 0 5
{% endhighlight %}
You can now see the pod that was created is consuming explicit amounts of resources (specified by resource *request*),
and the usage is being tracked by the Kubernetes system properly.
Name: quota
Namespace: quota-example
## Summary
Actions that consume node resources for cpu and memory can be subject to hard quota limits defined
by the namespace quota. The resource consumption is measured by resource *request* in pod specification.
v1.1/docs/admin/resourcequota/index.md
+44 -29
View File
@@ -1,32 +1,31 @@
---
title: "Resource Quota"
---
Resource Quota
========================================
This example demonstrates how [resource quota](../../admin/admission-controllers.html#resourcequota) and
[limitsranger](../../admin/admission-controllers.html#limitranger) can be applied to a Kubernetes namespace.
See [ResourceQuota design doc](../../design/admission_control_resource_quota) for more information.
This example assumes you have a functional Kubernetes setup.
Step 1: Create a namespace
-----------------------------------------
## Step 1: Create a namespace
This example will work in a custom namespace to demonstrate the concepts involved.
Let's create a new namespace called quota-example:
{% highlight console %}
{% highlight console %}
$ kubectl create -f docs/admin/resourcequota/namespace.yaml
namespace "quota-example" created
$ kubectl get namespaces
NAME LABELS STATUS AGE
default <none> Active 2m
default <none> Active 2m
quota-example <none> Active 39s
{% endhighlight %}
{% endhighlight %}
## Step 2: Apply a quota to the namespace
By default, a pod will run with unbounded CPU and memory requests/limits. This means that any pod in the
system will be able to consume as much CPU and memory on the node that executes the pod.
@@ -38,9 +37,11 @@ checks the total resource *requests*, not resource *limits* of all containers/po
Let's create a simple quota in our namespace:
Let's create a simple quota in our namespace:
{% highlight console %}
$ kubectl create -f docs/admin/resourcequota/quota.yaml --namespace=quota-example
{% highlight console %}
resourcequota "quota" created
{% endhighlight %}
Once your quota is applied to a namespace, the system will restrict any creation of content
@@ -49,7 +50,8 @@ in the namespace until the quota usage has been calculated. This should happen
You can describe your current quota usage to see what resources are being consumed in your
namespace.
{% highlight console %}
$ kubectl describe quota quota --namespace=quota-example
Name: quota
Namespace: quota-example
@@ -62,11 +64,12 @@ pods 0 10
replicationcontrollers 0 20
resourcequotas 1 1
secrets 1 10
persistentvolumeclaims 0 10
services 0 5
{% endhighlight %}
resourcequotas 1 1
secrets 1 10
## Step 3: Applying default resource requests and limits
Pod authors rarely specify resource requests and limits for their pods.
Since we applied a quota to our project, let's see what happens when an end-user creates a pod that has unbounded
@@ -74,21 +77,26 @@ cpu and memory by creating an nginx container.
To demonstrate, lets create a replication controller that runs nginx:
{% highlight console %}
$ kubectl run nginx --image=nginx --replicas=1 --namespace=quota-example
cpu and memory by creating an nginx container.
replicationcontroller "nginx" created
{% endhighlight %}
Now let's look at the pods that were created.
{% highlight console %}
$ kubectl get pods --namespace=quota-example
replicationcontroller "nginx" created
NAME READY STATUS RESTARTS AGE
{% endhighlight %}
What happened? I have no pods! Let's describe the replication controller to get a view of what is happening.
{% highlight console %}
kubectl describe rc nginx --namespace=quota-example
Name: nginx
Namespace: quota-example
@@ -100,7 +108,8 @@ Pods Status: 0 Running / 0 Waiting / 0 Succeeded / 0 Failed
No volumes.
Events:
FirstSeen LastSeen Count From SubobjectPath Reason Message
kubectl describe rc nginx --namespace=quota-example
42s 11s 3 {replication-controller } FailedCreate Error creating: Pod "nginx-" is forbidden: Must make a non-zero request for memory since it is tracked by quota.
{% endhighlight %}
The Kubernetes API server is rejecting the replication controllers requests to create a pod because our pods
@@ -108,7 +117,8 @@ do not specify any memory usage *request*.
So let's set some default values for the amount of cpu and memory a pod can consume:
No volumes.
{% highlight console %}
$ kubectl create -f docs/admin/resourcequota/limits.yaml --namespace=quota-example
limitrange "limits" created
$ kubectl describe limits limits --namespace=quota-example
@@ -117,7 +127,8 @@ Namespace: quota-example
Type Resource Min Max Request Limit Limit/Request
---- -------- --- --- ------- ----- -------------
Container memory - - 256Mi 512Mi -
Container cpu - - 100m 200m -
{% endhighlight %}
Now any time a pod is created in this namespace, if it has not specified any resource request/limit, the default
@@ -126,15 +137,18 @@ amount of cpu and memory per container will be applied, and the request will be
Now that we have applied default resource *request* for our namespace, our replication controller should be able to
create its pods.
Namespace: quota-example
{% highlight console %}
$ kubectl get pods --namespace=quota-example
NAME READY STATUS RESTARTS AGE
Container memory - - 256Mi 512Mi -
nginx-fca65 1/1 Running 0 1m
{% endhighlight %}
And if we print out our quota usage in the namespace:
Now any time a pod is created in this namespace, if it has not specified any resource request/limit, the default
{% highlight console %}
$ kubectl describe quota quota --namespace=quota-example
Name: quota
Namespace: quota-example
@@ -147,14 +161,15 @@ pods 1 10
replicationcontrollers 1 20
resourcequotas 1 1
secrets 1 10
services 0 5
{% endhighlight %}
You can now see the pod that was created is consuming explicit amounts of resources (specified by resource *request*),
and the usage is being tracked by the Kubernetes system properly.
Name: quota
Namespace: quota-example
## Summary
Actions that consume node resources for cpu and memory can be subject to hard quota limits defined
by the namespace quota. The resource consumption is measured by resource *request* in pod specification.