Kerbernetes的Pod资源管理进阶

简介: 文章详细介绍了Kubernetes中Pod的资源管理,包括健康检查、资源限制、安全配置、优先级和服务质量类别等方面的进阶知识。

作者:尹正杰

版权声明:原创作品,谢绝转载!否则将追究法律责任。

一.livenessProbe(需要做健康状态检查,即验证存活状态检测,当发现容器运行不正常会立即重启,若重启后容器依旧不正常运行会逐一累计间隔时间进行重启)

1>.定义yaml文件

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/liveness-exec.yaml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    test: liveness-exec
  name: liveness-exec
spec:
  containers:
  - name: liveness-demo
    image: busybox
    args:
    - /bin/sh
    - -c
    - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600
    livenessProbe:
      exec:
        command:
        - test
        - -e
        - /tmp/healthy
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/liveness-exec.yaml

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/liveness-http.yaml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    test: liveness
  name: liveness-http
spec:
  containers:
  - name: liveness-demo
    image: nginx:1.14-alpine
    ports:
    - name: http
      containerPort: 80
    lifecycle:
      postStart:
        exec:
          command:
          - /bin/sh
          - -c
          - 'echo Healty > /usr/share/nginx/html/healthz'
    livenessProbe:
      httpGet:
        path: /healthz
        port: http
        scheme: HTTP
      periodSeconds: 2
      failureThreshold: 2
      initialDelaySeconds: 3
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/liveness-http.yaml

2>.应用yaml文件并查看pods信息

[root@master200.yinzhengjie.org.cn ~]# kubectl apply -f /yinzhengjie/data/k8s/manifests/pod/liveness-exec.yaml 
pod/liveness-exec created
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl apply -f /yinzhengjie/data/k8s/manifests/pod/liveness-http.yaml 
pod/liveness-http created
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl get pods
NAME                       READY   STATUS             RESTARTS   AGE
liveness-exec              0/1     CrashLoopBackOff   7          19m
liveness-http              1/1     Running            0          10m
mynginx-677d85dbd5-t9xfz   1/1     Running            0          4h46m
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]#

3>.验证pod是否发生重启

[root@master200.yinzhengjie.org.cn ~]# kubectl get pods
NAME                       READY   STATUS             RESTARTS   AGE
liveness-exec              0/1     CrashLoopBackOff   7          20m
liveness-http              1/1     Running            0          10m
mynginx-677d85dbd5-t9xfz   1/1     Running            0          4h46m
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods liveness-http
Name:         liveness-http
Namespace:    default
Priority:     0
Node:         node201.yinzhengjie.org.cn/172.200.1.201
Start Time:   Thu, 06 Feb 2020 13:15:43 +0800
Labels:       test=liveness
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"labels":{"test":"liveness"},"name":"liveness-http","na
Status:       Running
IP:           10.244.1.3
IPs:
  IP:  10.244.1.3
Containers:
  liveness-demo:
    Container ID:   docker://f9457bb20479d8e0c121c8c1fbe04146f767ee895522c5cc47a759e939993b07
    Image:          nginx:1.14-alpine
    Image ID:       docker-pullable://nginx@sha256:485b610fefec7ff6c463ced9623314a04ed67e3945b9c08d7e53a47f6d108dc7
    Port:           80/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Thu, 06 Feb 2020 13:15:44 +0800
    Ready:          True
    Restart Count:  0
    Liveness:       http-get http://:http/healthz delay=3s timeout=1s period=2s #success=1 #failure=2
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-4jpjf (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-4jpjf:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-4jpjf
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age   From                                 Message
  ----    ------     ----  ----                                 -------
  Normal  Scheduled  10m   default-scheduler                    Successfully assigned default/liveness-http to node201.yinzhengjie.o
  Normal  Pulled     10m   kubelet, node201.yinzhengjie.org.cn  Container image "nginx:1.14-alpine" already present on machine
  Normal  Created    10m   kubelet, node201.yinzhengjie.org.cn  Created container liveness-demo
  Normal  Started    10m   kubelet, node201.yinzhengjie.org.cn  Started container liveness-demo
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods liveness-http

[root@master200.yinzhengjie.org.cn ~]# kubectl get pods
NAME                       READY   STATUS    RESTARTS   AGE
liveness-exec              1/1     Running   8          21m
liveness-http              1/1     Running   0          11m
mynginx-677d85dbd5-t9xfz   1/1     Running   0          4h47m
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods liveness-exec
Name:         liveness-exec
Namespace:    default
Priority:     0
Node:         node202.yinzhengjie.org.cn/172.200.1.202
Start Time:   Thu, 06 Feb 2020 13:05:53 +0800
Labels:       test=liveness-exec
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"labels":{"test":"liveness-exec"},"name":"liveness-exec
","namespace":"default...Status:       Running
IP:           10.244.2.2
IPs:
  IP:  10.244.2.2
Containers:
  liveness-demo:
    Container ID:  docker://0e718e53f333af21d266b3ff0c1f69c76712675ec772da0f5b57eeb2cc9a0512
    Image:         busybox
    Image ID:      docker-pullable://busybox@sha256:6915be4043561d64e0ab0f8f098dc2ac48e077fe23f488ac24b665166898115a
    Port:          <none>
    Host Port:     <none>
    Args:
      /bin/sh
      -c
      touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600
    State:          Running
      Started:      Thu, 06 Feb 2020 13:26:44 +0800
    Last State:     Terminated
      Reason:       Error
      Exit Code:    137
      Started:      Thu, 06 Feb 2020 13:20:10 +0800
      Finished:     Thu, 06 Feb 2020 13:21:30 +0800
    Ready:          True
    Restart Count:  8
    Liveness:       exec [test -e /tmp/healthy] delay=0s timeout=1s period=10s #success=1 #failure=3
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-4jpjf (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-4jpjf:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-4jpjf
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason     Age                  From                                 Message
  ----     ------     ----                 ----                                 -------
  Normal   Scheduled  21m                  default-scheduler                    Successfully assigned default/liveness-exec to node2
02.yinzhengjie.org.cn  Normal   Created    18m (x3 over 21m)    kubelet, node202.yinzhengjie.org.cn  Created container liveness-demo
  Normal   Started    18m (x3 over 21m)    kubelet, node202.yinzhengjie.org.cn  Started container liveness-demo
  Normal   Pulling    16m (x4 over 21m)    kubelet, node202.yinzhengjie.org.cn  Pulling image "busybox"
  Normal   Pulled     16m (x4 over 21m)    kubelet, node202.yinzhengjie.org.cn  Successfully pulled image "busybox"
  Warning  Unhealthy  11m (x19 over 20m)   kubelet, node202.yinzhengjie.org.cn  Liveness probe failed:
  Normal   Killing    6m28s (x8 over 20m)  kubelet, node202.yinzhengjie.org.cn  Container liveness-demo failed liveness probe, will 
be restarted  Warning  BackOff    84s (x38 over 10m)   kubelet, node202.yinzhengjie.org.cn  Back-off restarting failed container
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods liveness-exec

二.readinessProbe(就绪状态检测,即验证服务是否正常运行,如果就绪的话就作为service的后端,如果一直处于未就绪状态就会讲该容器从service的后端移除掉;需要注意的是该步骤也没有权限重启容器,这就是它和健康检查的重要区别)

1>.定义yaml文件

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/readiness-exec.yaml 
apiVersion: v1
kind: Pod
metadata:
  labels:
    test: readiness-exec
  name: readiness-exec
spec:
  containers:
  - name: readiness-demo
    image: busybox
    args: ["/bin/sh", "-c", "while true; do rm -f /tmp/ready; sleep 30; touch /tmp/ready; sleep 300; done"] 
    readinessProbe:
      exec:
        command: ["test", "-e", "/tmp/ready"]
      initialDelaySeconds: 5
      periodSeconds: 5
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/readiness-exec.yaml

2>.应用yaml文件并查看pods信息

[root@master200.yinzhengjie.org.cn ~]# kubectl apply -f /yinzhengjie/data/k8s/manifests/pod/readiness-exec.yaml 
pod/readiness-exec created
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl get pods        #虽然状态是"Running",但并没有READY
NAME                       READY   STATUS             RESTARTS   AGE
liveness-exec              0/1     CrashLoopBackOff   11         37m
liveness-http              1/1     Running            0          27m
mynginx-677d85dbd5-t9xfz   1/1     Running            0          5h3m
readiness-exec             0/1     Running            0          7s
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl get pods        #由于我们设置了延迟检测,因此需要等一会pod的容器才会被认为是正常运行的
NAME                       READY   STATUS    RESTARTS   AGE
liveness-exec              1/1     Running   12         37m
liveness-http              1/1     Running   0          27m
mynginx-677d85dbd5-t9xfz   1/1     Running   0          5h4m
readiness-exec             1/1     Running   0          45s
[root@master200.yinzhengjie.org.cn ~]#

3>.验证pod是否发生重启

[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl exec readiness-exec -- touch /tmp/ready
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl get pods
NAME                       READY   STATUS             RESTARTS   AGE
liveness-exec              0/1     CrashLoopBackOff   13         45m
liveness-http              1/1     Running            0          35m
mynginx-677d85dbd5-t9xfz   1/1     Running            0          5h11m
readiness-exec             1/1     Running            0          8m28s
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods readiness-exec 
Name:         readiness-exec
Namespace:    default
Priority:     0
Node:         node202.yinzhengjie.org.cn/172.200.1.202
Start Time:   Thu, 06 Feb 2020 13:42:51 +0800
Labels:       test=readiness-exec
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"labels":{"test":"readiness-exec"},"name":"readiness-exec","namespace":"defau...
Status:       Running
IP:           10.244.2.3
IPs:
  IP:  10.244.2.3
Containers:
  readiness-demo:
    Container ID:  docker://a603c504e38d91d420c9aaa8d062d2b595323b0f91ab789bedafc26035e95eb6
    Image:         busybox
    Image ID:      docker-pullable://busybox@sha256:6915be4043561d64e0ab0f8f098dc2ac48e077fe23f488ac24b665166898115a
    Port:          <none>
    Host Port:     <none>
    Args:
      /bin/sh
      -c
      while true; do rm -f /tmp/ready; sleep 30; touch /tmp/ready; sleep 300; done
    State:          Running
      Started:      Thu, 06 Feb 2020 13:42:57 +0800
    Ready:          True
    Restart Count:  0
    Readiness:      exec [test -e /tmp/ready] delay=5s timeout=1s period=5s #success=1 #failure=3
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-4jpjf (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-4jpjf:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-4jpjf
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason     Age                   From                                 Message
  ----     ------     ----                  ----                                 -------
  Normal   Scheduled  10m                   default-scheduler                    Successfully assigned default/readiness-exec to node202.yinzhengjie.org.cn
  Normal   Pulling    10m                   kubelet, node202.yinzhengjie.org.cn  Pulling image "busybox"
  Normal   Pulled     10m                   kubelet, node202.yinzhengjie.org.cn  Successfully pulled image "busybox"
  Normal   Created    10m                   kubelet, node202.yinzhengjie.org.cn  Created container readiness-demo
  Normal   Started    10m                   kubelet, node202.yinzhengjie.org.cn  Started container readiness-demo
  Warning  Unhealthy  5m22s (x39 over 10m)  kubelet, node202.yinzhengjie.org.cn  Readiness probe failed:
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl exec readiness-exec -- touch /tmp/ready

[root@master200.yinzhengjie.org.cn ~]# kubectl get pods
NAME                       READY   STATUS    RESTARTS   AGE
liveness-exec              1/1     Running   14         47m
liveness-http              1/1     Running   0          37m
mynginx-677d85dbd5-t9xfz   1/1     Running   0          5h13m
readiness-exec             1/1     Running   0          10m
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl exec readiness-exec -- rm -f /tmp/ready
[root@master200.yinzhengjie.org.cn ~]# 
root@master200.yinzhengjie.org.cn ~]# kubectl get pods
NAME                       READY   STATUS    RESTARTS   AGE
liveness-exec              1/1     Running   15         48m
liveness-http              1/1     Running   0          38m
mynginx-677d85dbd5-t9xfz   1/1     Running   0          5h14m
readiness-exec             0/1     Running   0          11m
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl get pods
NAME                       READY   STATUS             RESTARTS   AGE
liveness-exec              0/1     CrashLoopBackOff   15         49m
liveness-http              1/1     Running            0          39m
mynginx-677d85dbd5-t9xfz   1/1     Running            0          5h15m
readiness-exec             0/1     Running            0          12m
[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods readiness-exec 
Name:         readiness-exec
Namespace:    default
Priority:     0
Node:         node202.yinzhengjie.org.cn/172.200.1.202
Start Time:   Thu, 06 Feb 2020 13:42:51 +0800
Labels:       test=readiness-exec
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"labels":{"test":"readiness-exec"},"name":"readiness-exec","namespace":"defau...
Status:       Running
IP:           10.244.2.3
IPs:
  IP:  10.244.2.3
Containers:
  readiness-demo:
    Container ID:  docker://a603c504e38d91d420c9aaa8d062d2b595323b0f91ab789bedafc26035e95eb6
    Image:         busybox
    Image ID:      docker-pullable://busybox@sha256:6915be4043561d64e0ab0f8f098dc2ac48e077fe23f488ac24b665166898115a
    Port:          <none>
    Host Port:     <none>
    Args:
      /bin/sh
      -c
      while true; do rm -f /tmp/ready; sleep 30; touch /tmp/ready; sleep 300; done
    State:          Running
      Started:      Thu, 06 Feb 2020 13:42:57 +0800
    Ready:          False
    Restart Count:  0
    Readiness:      exec [test -e /tmp/ready] delay=5s timeout=1s period=5s #success=1 #failure=3
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-4jpjf (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             False 
  ContainersReady   False 
  PodScheduled      True 
Volumes:
  default-token-4jpjf:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-4jpjf
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason     Age                 From                                 Message
  ----     ------     ----                ----                                 -------
  Normal   Scheduled  12m                 default-scheduler                    Successfully assigned default/readiness-exec to node202.yinzhengjie.org.cn
  Normal   Pulling    12m                 kubelet, node202.yinzhengjie.org.cn  Pulling image "busybox"
  Normal   Pulled     12m                 kubelet, node202.yinzhengjie.org.cn  Successfully pulled image "busybox"
  Normal   Created    12m                 kubelet, node202.yinzhengjie.org.cn  Created container readiness-demo
  Normal   Started    12m                 kubelet, node202.yinzhengjie.org.cn  Started container readiness-demo
  Warning  Unhealthy  93s (x66 over 11m)  kubelet, node202.yinzhengjie.org.cn  Readiness probe failed:
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl exec readiness-exec -- rm -f /tmp/ready

三.pod对象的相位(phase)

  Pod对象总是应该处于其生命进程周期中以下几个相位(phase)之一:  

  Pending:  
    API Server创建了Pod资源对象并已存入etcd中,但它尚未被调度完成(一般是资源需求紧缺导致,比如内存不足),或仍处于从仓库中下载镜像的过程中。  

  Running:  
    Pod已经被调度至某节点,并且所有容器都已经被kubelet创建完成。  

  Succeeded:  
    Pod中的所有容器都已经成功终止并且不会被重启。  

  Failed:  
    所有容器都已经终止,但至少有一个容器终止失败,即容器返回了非0值的退出状态码或已经被系统终止。  

  Unknown:  
    API Server无法正常获取到Pod对象的状态信息,通常是由于其无法在所在工作节点的kubelet通信所致。

四.Pod对象的创建过程

  (1)用户提交创建Pod请求给K8S API Server;  

  (2)API Server将用户的请求中未提交的参数使用默认参数补齐(即准入控制)后写入etcd中;  

  (3)Scheduler通过监测(watch)事件发现需要创建新的pod,于是根据自己的默认算法选出将一个最佳的K8S node,并将该节点回馈给API Server;  

  (4)API Server更新etcd中的数据(即"nameNode"字段),与此同时会通知相应的K8S node主机的kubelet进程;  

  (5)kubelet进程接收到API Server的消息后,向API Server发送请求获取需要创建的pod的元数据信息属性,通过这些属性调用本地的Docker引擎去创建相应的容器,Docker引擎创建完毕后由kubelet返回给API Server状态;  

  (6)API Server接收到Kubelet的数据后,将pod信息再一次更新到etcd中(比如更新容器的相位(phase)的状态由Pending变为Running);

五.容器的重启策略

  Pod对象因容器程序崩溃或容器申请超出限制的资源等原因都可能导致其被终止,此时是否应该重建它取决于其重启策略(restartPolicy)属性的定义。  

  Always:  
    但凡Pod对象终止就将其重启,此为默认设定。  

  OnFailure:  
    仅在Pod对象出现错误时方才将其重启。  

  Nerver:  
    从不重启。

六.Pod的终止过程

  (1)用户提交删除Pod请求给K8S API Server(在用户提交删除请求后,该Pod会被标记为"terminating");

  (2)API Server将用户的请求中未提交的参数使用默认参数补齐(即准入控制)后写入etcd中,并设置宽限策略(set grace period,比如30s时间,这也是为什么我们删除Pod时会等待一段时间),即并不会立即删除Pod;  

  (3)所有的K8S node主机kubelet进程通过API Server的监测(watch)事件得知需要终止的Pod,于是会向本地的Docker引擎发送终止信号,于是Docker引擎开始运行"pre Stop hook"相关指令;  

  (4)API Server将pod标记为终止终端(terminating)状态并告知端点控制器(Endpoint controller),端点控制器开始移除相应的service;  

  (5)如果kubulet在超出了指定宽限策略(我们假设宽限策略是30s,而我们使用了31s)还没有移除Pod的所有service那么就会发送SIGKILL(比如发送"kill -9")信号,此时Pod会被立即删除;  

  (6)移除成功后,此时API Server将etcd中的数据移除。

七.POD安全配置接口(需要的小伙伴可根据官方文档自行调研)

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.securityContext
KIND:     Pod
VERSION:  v1

RESOURCE: securityContext <Object>

DESCRIPTION:
     SecurityContext holds pod-level security attributes and common container
     settings. Optional: Defaults to empty. See type description for default
     values of each field.

     PodSecurityContext holds pod-level security attributes and common container
     settings. Some fields are also present in container.securityContext. Field
     values of container.securityContext take precedence over field values of
     PodSecurityContext.

FIELDS:
   fsGroup    <integer>
     A special supplemental group that applies to all containers in a pod. Some
     volume types allow the Kubelet to change the ownership of that volume to be
     owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit
     is set (new files created in the volume will be owned by FSGroup) 3. The
     permission bits are OR'd with rw-rw---- If unset, the Kubelet will not
     modify the ownership and permissions of any volume.

   runAsGroup    <integer>
     The GID to run the entrypoint of the container process. Uses runtime
     default if unset. May also be set in SecurityContext. If set in both
     SecurityContext and PodSecurityContext, the value specified in
     SecurityContext takes precedence for that container.

   runAsNonRoot    <boolean>
     Indicates that the container must run as a non-root user. If true, the
     Kubelet will validate the image at runtime to ensure that it does not run
     as UID 0 (root) and fail to start the container if it does. If unset or
     false, no such validation will be performed. May also be set in
     SecurityContext. If set in both SecurityContext and PodSecurityContext, the
     value specified in SecurityContext takes precedence.

   runAsUser    <integer>
     The UID to run the entrypoint of the container process. Defaults to user
     specified in image metadata if unspecified. May also be set in
     SecurityContext. If set in both SecurityContext and PodSecurityContext, the
     value specified in SecurityContext takes precedence for that container.

   seLinuxOptions    <Object>
     The SELinux context to be applied to all containers. If unspecified, the
     container runtime will allocate a random SELinux context for each
     container. May also be set in SecurityContext. If set in both
     SecurityContext and PodSecurityContext, the value specified in
     SecurityContext takes precedence for that container.

   supplementalGroups    <[]integer>
     A list of groups applied to the first process run in each container, in
     addition to the container's primary GID. If unspecified, no groups will be
     added to any container.

   sysctls    <[]Object>
     Sysctls hold a list of namespaced sysctls used for the pod. Pods with
     unsupported sysctls (by the container runtime) might fail to launch.

   windowsOptions    <Object>
     The Windows specific settings applied to all containers. If unspecified,
     the options within a container's SecurityContext will be used. If set in
     both SecurityContext and PodSecurityContext, the value specified in
     SecurityContext takes precedence.

[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.securityContext

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.containers.securityContext
KIND:     Pod
VERSION:  v1

RESOURCE: securityContext <Object>

DESCRIPTION:
     Security options the pod should run with. More info:
     https://kubernetes.io/docs/concepts/policy/security-context/ More info:
     https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
     SecurityContext holds security configuration that will be applied to a
     container. Some fields are present in both SecurityContext and
     PodSecurityContext. When both are set, the values in SecurityContext take
     precedence.

FIELDS:
   allowPrivilegeEscalation    <boolean>
     AllowPrivilegeEscalation controls whether a process can gain more
     privileges than its parent process. This bool directly controls if the
     no_new_privs flag will be set on the container process.
     AllowPrivilegeEscalation is true always when the container is: 1) run as
     Privileged 2) has CAP_SYS_ADMIN

   capabilities    <Object>
     The capabilities to add/drop when running containers. Defaults to the
     default set of capabilities granted by the container runtime.

   privileged    <boolean>
     Run container in privileged mode. Processes in privileged containers are
     essentially equivalent to root on the host. Defaults to false.

   procMount    <string>
     procMount denotes the type of proc mount to use for the containers. The
     default is DefaultProcMount which uses the container runtime defaults for
     readonly paths and masked paths. This requires the ProcMountType feature
     flag to be enabled.

   readOnlyRootFilesystem    <boolean>
     Whether this container has a read-only root filesystem. Default is false.

   runAsGroup    <integer>
     The GID to run the entrypoint of the container process. Uses runtime
     default if unset. May also be set in PodSecurityContext. If set in both
     SecurityContext and PodSecurityContext, the value specified in
     SecurityContext takes precedence.

   runAsNonRoot    <boolean>
     Indicates that the container must run as a non-root user. If true, the
     Kubelet will validate the image at runtime to ensure that it does not run
     as UID 0 (root) and fail to start the container if it does. If unset or
     false, no such validation will be performed. May also be set in
     PodSecurityContext. If set in both SecurityContext and PodSecurityContext,
     the value specified in SecurityContext takes precedence.

   runAsUser    <integer>
     The UID to run the entrypoint of the container process. Defaults to user
     specified in image metadata if unspecified. May also be set in
     PodSecurityContext. If set in both SecurityContext and PodSecurityContext,
     the value specified in SecurityContext takes precedence.

   seLinuxOptions    <Object>
     The SELinux context to be applied to the container. If unspecified, the
     container runtime will allocate a random SELinux context for each
     container. May also be set in PodSecurityContext. If set in both
     SecurityContext and PodSecurityContext, the value specified in
     SecurityContext takes precedence.

   windowsOptions    <Object>
     The Windows specific settings applied to all containers. If unspecified,
     the options from the PodSecurityContext will be used. If set in both
     SecurityContext and PodSecurityContext, the value specified in
     SecurityContext takes precedence.

[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.containers.securityContext

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.containers.securityContext.capabilities
KIND:     Pod
VERSION:  v1

RESOURCE: capabilities <Object>

DESCRIPTION:
     The capabilities to add/drop when running containers. Defaults to the
     default set of capabilities granted by the container runtime.

     Adds and removes POSIX capabilities from running containers.

FIELDS:
   add    <[]string>
     Added capabilities

   drop    <[]string>
     Removed capabilities

[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.containers.securityContext.capabilities

八.资源需求及资源限制(容器的计算资源配额)

  CPU属于可压缩性资源,即资源额度可按需收缩,而内存(当前)则是不可压缩性资源,对其执行收缩操作可能会导致某种程度的问题。

  CPU资源的计算方式:
    一个核心相当于1000个微核心,即1=1000m,0.5=500m。
  
  内存资源的计算方式:
    默认单位为字节,也可以使用E,P,T,G,M和K后缀单位,或Ei,Pi,Ti,Gi,Mi,Ki形式的单位后缀。

  温馨提示:
    下面有两个我从互联网上找到两个pod的yaml文件,感兴趣的小伙伴可以测试一下,测试方式如下:
      [root@master200.yinzhengjie.org.cn ~]# kubectl apply -f /yinzhengjie/data/k8s/manifests/pod/memleak-pod.yaml
      [root@master200.yinzhengjie.org.cn ~]# kubectl describe pods memleak-pod

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.containers.resources
KIND:     Pod
VERSION:  v1

RESOURCE: resources <Object>

DESCRIPTION:
     Compute Resources required by this container. Cannot be updated. More info:
     https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
     ResourceRequirements describes the compute resource requirements.

FIELDS:
   limits    <map[string]string>
     Limits describes the maximum amount of compute resources allowed. More
     info:
     https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
   requests    <map[string]string>
     Requests describes the minimum amount of compute resources required. If
     Requests is omitted for a container, it defaults to Limits if that is
     explicitly specified, otherwise to an implementation-defined value. More
     info:
     https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.containers.resources

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/memleak-pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: memleak-pod
spec:
  containers:
  - name: simmemleak
    image: saadali/simmemleak
    resources:
      requests:
        memory: "64Mi"
        cpu: "1"
      limits:
        memory: "64Mi"
        cpu: "1"
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/memleak-pod.yaml

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/stress-pod.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: stress-pod
spec:
  containers:
  - name: stress
    image: ikubernetes/stress-ng
    command: ["/usr/bin/stress-ng", "-c 1", "-m 1", "--metrics-brief"]
    resources:
      requests:
        memory: "128Mi"
        cpu: "200m"
      limits:
        memory: "512Mi"
        cpu: "400m"
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# cat /yinzhengjie/data/k8s/manifests/pod/stress-pod.yaml

九.Pod服务质量类别

  根据Pod对象的requests和limits属性,kubernetes把Pod对象归类到BestEffort,Burstable和Guaranteed三个服务质量类别(Quality of Service,简称QoS)。  

  Guaranteed:  
    每个容器都为CPU资源设置了具有相同值得requests和limits属性,以及每个容器都为内存资源设置了具体相同值的requests和limits属性的pod资源会自动归属此类别,它们具有中等优先级。  

  Burstable:  
    至少有一个容器设置了CPU和内存资源的requests属性,但不满足Guaranteed类别要求的pod资源自动归属此类别,它们具有中等优先级。  

  BestEffort:  
    未为任何一个容器设置requests或limits属性的pod资源自动归属此类别,它们的优先级为最低级别。

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.priorityClassName
KIND:     Pod
VERSION:  v1

FIELD:    priorityClassName <string>

DESCRIPTION:
     If specified, indicates the pod's priority. "system-node-critical" and
     "system-cluster-critical" are two special keywords which indicate the
     highest priorities with the former being the highest priority. Any other
     name must be defined by creating a PriorityClass object with that name. If
     not specified, the pod priority will be default or zero if there is no
     default.
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl explain pods.spec.priorityClassName

[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods memleak-pod
Name:         memleak-pod
Namespace:    default
Priority:     0
Node:         node201.yinzhengjie.org.cn/172.200.1.201
Start Time:   Thu, 06 Feb 2020 15:30:42 +0800
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"memleak-pod","namespace":"default"},"spec":{"containers":[{"image":"s...
Status:       Running
IP:           10.244.1.12
IPs:
  IP:  10.244.1.12
Containers:
  simmemleak:
    Container ID:   docker://58d3a4bb976bf247510d05ae66fdaa4096a3d96cd67a19eb8041cf41f20285ad
    Image:          saadali/simmemleak
    Image ID:       docker-pullable://saadali/simmemleak@sha256:5cf58299a7698b0c9779acfed15c8e488314fcb80944550eab5992cdf3193054
    Port:           <none>
    Host Port:      <none>
    State:          Waiting
      Reason:       CrashLoopBackOff
    Last State:     Terminated
      Reason:       OOMKilled
      Exit Code:    137
      Started:      Thu, 06 Feb 2020 15:42:13 +0800
      Finished:     Thu, 06 Feb 2020 15:42:13 +0800
    Ready:          False
    Restart Count:  7
    Limits:
      cpu:     1
      memory:  64Mi
    Requests:
      cpu:        1
      memory:     64Mi
    Environment:  <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-4jpjf (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             False 
  ContainersReady   False 
  PodScheduled      True 
Volumes:
  default-token-4jpjf:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-4jpjf
    Optional:    false
QoS Class:       Guaranteed
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason          Age                  From                                 Message
  ----     ------          ----                 ----                                 -------
  Normal   Scheduled       11m                  default-scheduler                    Successfully assigned default/memleak-pod to node201.yinzhengjie.org.cn
  Normal   Started         11m (x3 over 11m)    kubelet, node201.yinzhengjie.org.cn  Started container simmemleak
  Normal   SandboxChanged  11m (x3 over 11m)    kubelet, node201.yinzhengjie.org.cn  Pod sandbox changed, it will be killed and re-created.
  Normal   Pulling         10m (x4 over 11m)    kubelet, node201.yinzhengjie.org.cn  Pulling image "saadali/simmemleak"
  Normal   Pulled          10m (x4 over 11m)    kubelet, node201.yinzhengjie.org.cn  Successfully pulled image "saadali/simmemleak"
  Normal   Created         10m (x4 over 11m)    kubelet, node201.yinzhengjie.org.cn  Created container simmemleak
  Warning  BackOff         107s (x56 over 11m)  kubelet, node201.yinzhengjie.org.cn  Back-off restarting failed container
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# 
[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods memleak-pod | grep QoS
QoS Class:       Guaranteed
[root@master200.yinzhengjie.org.cn ~]#

[root@master200.yinzhengjie.org.cn ~]# kubectl describe pods memleak-pod | grep QoS

目录
相关文章
|
2月前
|
Kubernetes 应用服务中间件 开发工具
Kerbernetes的Ingress资源管理
关于如何在Kubernetes集群中部署和管理Ingress资源,包括使用Ingress-nginx、配置SSL/TLS以及通过Ingress反向代理Tomcat的实战案例。
37 3
Kerbernetes的Ingress资源管理
|
2月前
|
Kubernetes 负载均衡 开发工具
Kerbernetes的Service资源管理
本文介绍了Kubernetes中Service资源的管理和使用,包括Service的基本概念、代理模型、资源类型、以及如何通过Service实现服务发现和负载均衡。
41 2
Kerbernetes的Service资源管理
|
2月前
|
Kubernetes 开发工具 Perl
Kerbernetes的Pod资源管理
文章详细介绍了Kubernetes中Pod资源的管理,包括Pod的基本概念、标签(Label)和标签选择器(Label Selector)的使用方法,以及如何通过kubectl命令行工具对Pod资源进行操作和管理。
42 0
|
3月前
|
机器学习/深度学习 数据采集 算法框架/工具
使用Python实现深度学习模型:智能人力资源管理与招聘
【8月更文挑战第12天】 使用Python实现深度学习模型:智能人力资源管理与招聘
112 2
|
4月前
|
数据采集 监控 数据安全/隐私保护
ERP系统中的人力资源管理与员工绩效评估解析
【7月更文挑战第25天】 ERP系统中的人力资源管理与员工绩效评估解析
325 1
|
4月前
|
机器学习/深度学习 Oracle 安全
人力资源管理革新:6款系统一站式解决HR事务
**Zoho People、BambooHR、Workday、ADP Workforce Now和Oracle HCM Cloud是知名的人力资源管理系统。Zoho People提供模块化设计、移动应用和自动化工作流;BambooHR以用户友好界面和员工档案管理见长;Workday侧重全球化云解决方案和智能决策工具;ADP Workforce Now集成HR与薪资管理,强调合规性;Oracle HCM Cloud则以高度定制和分析工具闻名。这些系统各有特点,适用于不同规模和需求的企业。**
84 11
|
4月前
|
JavaScript Java 测试技术
基于springboot+vue.js+uniapp的人力资源管理系统附带文章源码部署视频讲解等
基于springboot+vue.js+uniapp的人力资源管理系统附带文章源码部署视频讲解等
50 2
|
5月前
|
机器学习/深度学习 人工智能 搜索推荐
人力资源管理(HRM)系统的未来:技术引领的变革浪潮
【6月更文挑战第24天】随着AI、大数据、云计算和移动技术的融合,HRM正转型为提升效率和员工体验的关键工具。AI助力智能决策,大数据驱动精准管理,云计算与移动技术实现无缝访问和远程操作。员工体验被置于设计核心,系统更人性化、个性化。未来趋势强调全面整合与协同工作,赋能企业高效运营。
|
5月前
|
JavaScript Java 测试技术
基于SpringBoot+Vue的人力资源管理系统的详细设计和实现(源码+lw+部署文档+讲解等)
基于SpringBoot+Vue的人力资源管理系统的详细设计和实现(源码+lw+部署文档+讲解等)
85 8
|
5月前
|
JavaScript Java 测试技术
基于ssm+vue.js+uniapp小程序的中小企业人力资源管理系统附带文章和源代码部署视频讲解等
基于ssm+vue.js+uniapp小程序的中小企业人力资源管理系统附带文章和源代码部署视频讲解等
47 1

热门文章

最新文章

下一篇
无影云桌面