whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update ResourceQuota documentation for current code

Browse Source
This commit is contained in:
derekwaynecarr
2016-06-06 14:57:50 -04:00
parent 07cb8b573c
commit f982e21d5b
1 changed files with 122 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/resourcequota/index.md
+122 -63
View File
@@ -4,29 +4,26 @@
When several users or teams share a cluster with a fixed number of nodes, When several users or teams share a cluster with a fixed number of nodes,
there is a concern that one team could use more than its fair share of resources. there is a concern that one team could use more than its fair share of resources.
Resource quotas are a tool for administrators to address this concern. Resource quotas Resource quotas are a tool for administrators to address this concern.
work like this:
A resource quota, defined by a `ResourceQuota` object, provides constraints that limit
aggregate resource consumption per namespace. It can limit the quantity of objects that can
be created in a namespace by type, as well as the total amount of compute resources that may
be consumed by resources in that project.
Resource quotas work like this:
- Different teams work in different namespaces. Currently this is voluntary, but - Different teams work in different namespaces. Currently this is voluntary, but
support for making this mandatory via ACLs is planned. support for making this mandatory via ACLs is planned.
- The administrator creates a Resource Quota for each namespace. - The administrator creates one or more Resource Quota objects for each namespace.
- Users put compute resource requests on their pods. The sum of all resource requests across - Users create resources (pods, services, etc.) in the namespace, and the quota system
all pods in the same namespace must not exceed any hard resource limit in any Resource Quota tracks usage to ensure it does not exceed hard resource limits defined in a Resource Quota.
document for the namespace. Note that we used to verify Resource Quota by taking the sum of - If creating or updating a resource violates a quota constraint, the request will fail with HTTP
resource limits of the pods, but this was altered to use resource requests. Backwards compatibility status code `403 FORBIDDEN` with a message explaining the constraint that would have been violated.
for those pods previously created is preserved because pods that only specify a resource limit have - If quota is enabled in a namespace for compute resources like `cpu` and `memory`, users must specify
their resource requests defaulted to match their defined limits. The user is only charged for the requests or limits for those values; otherwise, the quota system may reject pod creation. Hint: Use
resources they request in the Resource Quota versus their limits because the request is the minimum the LimitRange admission controller to force defaults for pods that make no compute resource requirements.
amount of resource guaranteed by the cluster during scheduling. For more information on over commit, See the [walkthrough](/docs/admin/resourcequota/walkthrough.md) for an example to avoid this problem.
see [compute-resources](/docs/user-guide/compute-resources).
- If creating a pod would cause the namespace to exceed any of the limits specified in the
the Resource Quota for that namespace, then the request will fail with HTTP status
code `403 FORBIDDEN`.
- If quota is enabled in a namespace and the user does not specify *requests* on the pod for each
of the resources for which quota is enabled, then the POST of the pod will fail with HTTP
status code `403 FORBIDDEN`. Hint: Use the LimitRange admission controller to force default
values of *limits* (then resource *requests* would be equal to *limits* by default, see
[admission controller](/docs/admin/admission-controllers)) before the quota is checked to avoid this problem.
Examples of policies that could be created using namespaces and quotas are: Examples of policies that could be created using namespaces and quotas are:
@@ -38,7 +35,7 @@ Examples of policies that could be created using namespaces and quotas are:
In the case where the total capacity of the cluster is less than the sum of the quotas of the namespaces, In the case where the total capacity of the cluster is less than the sum of the quotas of the namespaces,
there may be contention for resources. This is handled on a first-come-first-served basis. there may be contention for resources. This is handled on a first-come-first-served basis.
Neither contention nor changes to quota will affect already-running pods. Neither contention nor changes to quota will affect already created resources.
## Enabling Resource Quota ## Enabling Resource Quota
@@ -57,11 +54,12 @@ in a namespace can be limited. The following compute resource types are support
| ResourceName | Description | | ResourceName | Description |
| ------------ | ----------- | | ------------ | ----------- |
| cpu | Total cpu requests of containers | | cpu | Across all pods in a non-terminal state, the sum of CPU requests cannot exceed this value. |
| memory | Total memory requests of containers | limits.cpu | Across all pods in a non-terminal state, the sum of CPU limits cannot exceed this value. |
| limits.memory | Across all pods in a non-terminal state, the sum of memory limits cannot exceed this value. |
For example, `cpu` quota sums up the `resources.requests.cpu` fields of every | memory | Across all pods in a non-terminal state, the sum of memory requests cannot exceed this value. |
container of every pod in the namespace, and enforces a maximum on that sum. | requests.cpu | Across all pods in a non-terminal state, the sum of CPU requests cannot exceed this value. |
| requests.memory | Across all pods in a non-terminal state, the sum of memory requests cannot exceed this value. |
## Object Count Quota ## Object Count Quota
@@ -70,12 +68,13 @@ are supported:
| ResourceName | Description | | ResourceName | Description |
| ------------ | ----------- | | ------------ | ----------- |
| pods | Total number of pods | | configmaps | The total number of config maps that can exist in the namespace. |
| services | Total number of services | | persistentvolumeclaims | The total number of [persistent volume claims](/docs/user-guide/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
| replicationcontrollers | Total number of replication controllers | | pods | The total number of pods in a non-terminal state that can exist in the namespace. A pod is in a terminal state if `status.phase in (Failed, Succeeded)` is true. |
| resourcequotas | Total number of [resource quotas](/docs/admin/admission-controllers/#resourcequota) | | replicationcontrollers | The total number of replication controllers that can exist in the namespace. |
| secrets | Total number of secrets | | resourcequotas | The total number of [resource quotas](/docs/admin/admission-controllers/#resourcequota) that can exist in the namespace. |
| persistentvolumeclaims | Total number of [persistent volume claims](/docs/user-guide/persistent-volumes/#persistentvolumeclaims) | | services | The total number of services that can exist in the namespace. |
| secrets | The total number of secrets that can exist in the namespace. |
For example, `pods` quota counts and enforces a maximum on the number of `pods` For example, `pods` quota counts and enforces a maximum on the number of `pods`
created in a single namespace. created in a single namespace.
@@ -84,45 +83,105 @@ You might want to set a pods quota on a namespace
to avoid the case where a user creates many small pods and exhausts the cluster's to avoid the case where a user creates many small pods and exhausts the cluster's
supply of Pod IPs. supply of Pod IPs.
## Quota Scopes
Each quota can have an associated set of scopes. A quota will only measure usage for a resource if it matches
the intersection of enumerated scopes.
When a scope is added to the quota, it limits the number of resources it supports to those that pertain to the scope.
Resources specified on the quota outside of the allowed set results in a validation error.
| Scope | Description |
| ----- | ----------- |
| Terminating | Match pods where `spec.activeDeadlineSeconds >= 0` |
| NotTerminating | Match pods where `spec.activeDeadlineSeconds is nil` |
| BestEffort | Match pods that have best effort quality of service. |
| NotBestEffort | Match pods that do not have best effort quality of service. |
The `BestEffort` scope restricts a quota to tracking the following resources:
* pods
The `Terminating`, `NotTerminating`, and `NotBestEffort` scopes restrict a quota to tracking the following resources:
* cpu
* limits.cpu
* limits.memory
* memory
* pods
* requests.cpu
* requests.memory
## Requests vs Limits
When allocating compute resources, each container may specify a request and a limit value for either CPU or memory.
The quota can be configured to quota either value.
If the quota has a value specified for `requests.cpu` or `requests.memory`, then it requires that every incoming
container makes an explicit request for those resources. If the quota has a value specified for `limits.cpu` or `limits.memory`,
then it requires that every incoming container specifies an explict limit for those resources.
## Viewing and Setting Quotas ## Viewing and Setting Quotas
Kubectl supports creating, updating, and viewing quotas: Kubectl supports creating, updating, and viewing quotas:
```shell ```shell
$ kubectl namespace myspace $ kubectl create namespace myspace
$ cat <<EOF > quota.json
{ $ cat <<EOF > compute-resources.yaml
"apiVersion": "v1", apiVersion: v1
"kind": "ResourceQuota", kind: ResourceQuota
"metadata": { metadata:
"name": "quota" name: compute-resources
}, spec:
"spec": { hard:
"hard": { pods: "4"
"memory": "1Gi", requests.cpu: "1"
"cpu": "20", requests.memory: 1Gi
"pods": "10", limits.cpu: "2"
"services": "5", limits.memory: 2Gi
"replicationcontrollers":"20",
"resourcequotas":"1"
}
}
}
EOF EOF
$ kubectl create -f ./quota.json $ kubectl create -f ./compute-resources.yaml --namespace=myspace
$ kubectl get quota
NAME $ cat <<EOF > object-counts.yaml
quota apiVersion: v1
$ kubectl describe quota quota kind: ResourceQuota
Name: quota metadata:
name: object-counts
spec:
hard:
configmaps: "10"
persistentvolumeclaims: "4"
replicationcontrollers: "20"
secrets: "10"
services: "10"
EOF
$ kubectl create -f ./object-counts.yaml --namespace=myspace
$ kubectl get quota --namespace=myspace
NAME AGE
compute-resources 30s
object-counts 32s
$ kubectl describe quota compute-resources --namespace=myspace
Name: compute-resources
Namespace: myspace
Resource Used Hard
-------- ---- ----
limits.cpu 0 2
limits.memory 0 2Gi
pods 0 4
requests.cpu 0 1
requests.memory 0 1Gi
$ kubectl describe quota object-counts --namespace=myspace
Name: object-counts
Namespace: myspace
Resource Used Hard Resource Used Hard
-------- ---- ---- -------- ---- ----
cpu 0m 20 configmaps 0 10
memory 0 1Gi persistentvolumeclaims 0 4
pods 5 10 replicationcontrollers 0 20
replicationcontrollers 5 20 secrets 1 10
resourcequotas 1 1 services 0 10
services 3 5
``` ```
## Quota and Cluster Capacity ## Quota and Cluster Capacity