{"id":94262,"date":"2020-09-14T19:42:34","date_gmt":"2020-09-14T17:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod"},"modified":"2020-09-14T19:42:34","modified_gmt":"2020-09-14T17:42:34","slug":"kak-poluchit-dostup-k-resursam-kubernetes-pod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod","title":{"rendered":"Jak z\u00edskat p\u0159\u00edstup k prost\u0159edk\u016fm Kubernetes Pod","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Jak z\u00edskat p\u0159\u00edstup k prost\u0159edk\u016fm Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/3d6760d512ef456daad121f7d1ddbcf8.jpg\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" href=\"https:\/\/www.deviantart.com\/tohad\/art\/The-Reward-549720998\"><i>Odm\u011bna od Tohad<\/i><\/a><\/noindex><\/p>\n<p>Na za\u010d\u00e1tku pr\u00e1ce s Kubernetes obvykle zapom\u00ednaj\u00ed na nastaven\u00ed prost\u0159edk\u016f kontejner\u016f. V t\u00e9to f\u00e1zi sta\u010d\u00ed ov\u011b\u0159it, \u017ee obraz Docker funguje a \u017ee ho lze nasadit v klastru Kubernetes.<\/p>\n<p>Pozd\u011bji je pot\u0159eba aplikaci nasadit do produk\u010dn\u00edho klastru spolu s dal\u0161\u00edmi aplikacemi. K tomu je nutn\u00e9 vy\u010dlenit prost\u0159edky pro kontejner a ujistit se, \u017ee jich je dostatek pro spu\u0161t\u011bn\u00ed a fungov\u00e1n\u00ed aplikace, ani\u017e by to zp\u016fsobilo probl\u00e9my v ostatn\u00edch spu\u0161t\u011bn\u00fdch aplikac\u00edch.<\/p>\n<p>T\u00fdm <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Kubernetes aaS od Mail.ru<\/a><\/noindex> p\u0159elo\u017eila jsem \u010dl\u00e1nek o prost\u0159edc\u00edch kontejner\u016f (CPU &amp; MEM), dotazech a limitech prost\u0159edk\u016f. Zjist\u00edte, jak\u00e9 v\u00fdhody tyto nastaven\u00ed poskytuj\u00ed a co se stane, pokud nejsou nastavena.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>V\u00fdpo\u010detn\u00ed prost\u0159edky<\/h2>\n<p>\nM\u00e1me dva typy prost\u0159edk\u016f s n\u00e1sleduj\u00edc\u00edmi jednotkami:<\/p>\n<ul>\n<li>Centr\u00e1ln\u00ed procesor (CPU) \u2014 j\u00e1dra;<\/li>\n<li>Pam\u011b\u0165 (MEM) \u2014 bajty.<\/li>\n<\/ul>\n<p>\nProst\u0159edky jsou specifikov\u00e1ny pro ka\u017ed\u00fd kontejner. V n\u00e1sleduj\u00edc\u00edm YAML souboru Pod uvid\u00edte sekci prost\u0159edk\u016f, kter\u00e1 obsahuje po\u017eadovan\u00e9 a limitovan\u00e9 prost\u0159edky:<\/p>\n<ul>\n<li>Po\u017eadovan\u00e9 prost\u0159edky Podu = sou\u010det po\u017eadovan\u00fdch prost\u0159edk\u016f v\u0161ech kontejner\u016f;<\/li>\n<li>Limitovan\u00e9 prost\u0159edky Podu = sou\u010det limitovan\u00fdch prost\u0159edk\u016f v\u0161ech kontejner\u016f.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Pod\nmetadata:\n  name: backend-pod-name\n  labels:\n    application: backend\nspec:\n  containers:\n    - name: main-container\n      image: my-backend\n      tag: v1\n      ports:\n      - containerPort: 8080\n      resources:\n        requests:\n          cpu: 0.2 # PO\u017dADOVAN\u00c9 CPU: 200m jader\n          memory: \"1Gi\" # PO\u017dADOVAN\u00c1 PAM\u011a\u0164: 1Gi\n        limits:\n          cpu: 1 # MAXIM\u00c1LN\u00cd VYU\u017dIT\u00cd CPU: 1 j\u00e1dro\n          memory: \"1Gi\" # MAXIM\u00c1LN\u00cd VYU\u017dIT\u00cd PAM\u011aTI: 1Gi\n    - name: other-container\n      image: other-app\n      tag: v1\n      ports:\n      - containerPort: 8000\n      resources:\n        requests:\n          cpu: \"200m\" # PO\u017dADOVAN\u00c9 CPU: 200m jader\n          memory: \"0.5Gi\" # PO\u017dADOVAN\u00c1 PAM\u011a\u0164: 0.5Gi\n        limits:\n          cpu: 1 # MAXIM\u00c1LN\u00cd VYU\u017dIT\u00cd CPU: 1 j\u00e1dro\n          memory: \"1Gi\" # MAXIM\u00c1LN\u00cd VYU\u017dIT\u00cd PAM\u011aTI: 1Gi<\/code><\/pre>\n<p>P\u0159\u00edklad po\u017eadovan\u00fdch a limitovan\u00fdch prost\u0159edk\u016f<\/p>\n<p>Pole <code>resources.requested<\/code> ze specifikace Pod \u2014 jeden z prvk\u016f, kter\u00fd se pou\u017e\u00edv\u00e1 k vyhled\u00e1n\u00ed po\u017eadovan\u00e9ho uzlu. Na n\u011bj lze ji\u017e napl\u00e1novat nasazen\u00ed Pod. Jak se v\u0161ak hled\u00e1 vhodn\u00fd uzel?<\/p>\n<p>Kubernetes se skl\u00e1d\u00e1 z n\u011bkolika komponent\u016f a zahrnuje hlavn\u00ed uzel nebo master uzel (Kubernetes Control Plane). Na master uzlu b\u011b\u017e\u00ed n\u011bkolik proces\u016f: kube-apiserver, kube-controller-manager a kube-scheduler. <\/p>\n<p>Proces kube-scheduler je zodpov\u011bdn\u00fd za prohl\u00ed\u017een\u00ed nov\u011b vytvo\u0159en\u00fdch modul\u016f a hled\u00e1n\u00ed mo\u017en\u00fdch pracovn\u00edch uzl\u016f, kter\u00e9 spl\u0148uj\u00ed v\u0161echny po\u017eadavky modul\u016f, v\u010detn\u011b po\u017eadovan\u00e9ho mno\u017estv\u00ed prost\u0159edk\u016f. Seznam uzl\u016f, kter\u00fd kube-scheduler najde, je se\u0159azen. Pod je pl\u00e1nov\u00e1n na uzlu s nejvy\u0161\u0161\u00edmi sk\u00f3re.<\/p>\n<p><img decoding=\"async\" alt=\"Jak z\u00edskat p\u0159\u00edstup k prost\u0159edk\u016fm Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/b489991a3cbbd5359c99701886d488e5.jpg\" style=\"display:block;margin: 0 auto;\" \/>Kam bude um\u00edst\u011bn fialov\u00fd Pod?<\/p>\n<p>Na obr\u00e1zku je vid\u011bt, \u017ee kube-scheduler mus\u00ed napl\u00e1novat nov\u00fd fialov\u00fd Pod. Kluster Kubernetes obsahuje dva uzly: A a B. Jak si m\u016f\u017eete v\u0161imnout, kube-scheduler nem\u016f\u017ee napl\u00e1novat Pod na uzel A \u2014 dostupn\u00e9 (nepo\u017eadovan\u00e9) zdroje neodpov\u00eddaj\u00ed po\u017eadavk\u016fm fialov\u00e9ho Podu. Tak\u017ee, po\u017eadovan\u00fdch 1 GB pam\u011bti pro fialov\u00fd Pod se na uzlu A nevejde, proto\u017ee dostupn\u00e1 pam\u011b\u0165 je 0,5 GB. Na uzlu B v\u0161ak jsou dostate\u010dn\u00e9 zdroje. Nakonec kube-scheduler rozhoduje, \u017ee c\u00edlov\u00fdm m\u00edstem fialov\u00e9ho Podu je uzel B.<\/p>\n<p>Nyn\u00ed v\u00edme, jak po\u017eadovan\u00e9 zdroje ovliv\u0148uj\u00ed v\u00fdb\u011br uzlu pro spu\u0161t\u011bn\u00ed Podu. Ale jak ovliv\u0148uj\u00ed limity zdroj\u016f?<\/p>\n<p>Limity zdroj\u016f jsou hranice, kter\u00e9 CPU\/MEM nemohou p\u0159ekro\u010dit. Nicm\u00e9n\u011b zdroj CPU je flexibiln\u00ed, tak\u017ee kontejnery, kter\u00e9 dos\u00e1hnou limitn\u00edch hodnot CPU, nezp\u016fsob\u00ed ukon\u010den\u00ed Podu. M\u00edsto toho dojde k throttlingu CPU. Pokud v\u0161ak dojde k dosa\u017een\u00ed limitu vyu\u017eit\u00ed MEM, kontejner bude zastaven z d\u016fvodu OOM-Killer a pokud je to povoleno nastaven\u00edm RestartPolicy, bude restartov\u00e1n.<\/p>\n<h2>Po\u017eadovan\u00e9 a limitn\u00ed zdroje v detailech<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Jak z\u00edskat p\u0159\u00edstup k prost\u0159edk\u016fm Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/22e672100940e8895ae42a56a681111f.jpg\" style=\"display:block;margin: 0 auto;\" \/>Souvislost zdroj\u016f mezi Dockerem a Kubernetes<\/p>\n<p>Nejlep\u0161\u00edm zp\u016fsobem, jak vysv\u011btlit, jak po\u017eadovan\u00e9 a limitn\u00ed zdroje funguj\u00ed, je p\u0159edstavit si souvislost mezi Kubernetes a Doctorem. Na obr\u00e1zku v\u00fd\u0161e m\u016f\u017eete vid\u011bt, jak jsou propojen\u00e1 pole Kubernetes a spou\u0161t\u011bc\u00ed p\u0159\u00edznaky Dockeru.<\/p>\n<h2>Pam\u011b\u0165: po\u017eadavek a limit<\/h2>\n<p><\/p>\n<pre><code class=\"plaintext\">containers:\n...\n resources:\n   requests:\n     memory: \"0.5Gi\"\n   limits:\n     memory: \"1Gi\"\n<\/code><\/pre>\n<p>\nJak bylo zm\u00edn\u011bno v\u00fd\u0161e, pam\u011b\u0165 se m\u011b\u0159\u00ed v bytech. Na z\u00e1klad\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/configuration\/manage-resources-containers\/#meaning-of-memory\">dokumentace Kubernetes<\/a><\/noindex>, m\u016f\u017eeme vyu\u017e\u00edt pam\u011b\u0165 jako \u010d\u00edslo. Obvykle je to cel\u00e9 \u010d\u00edslo, nap\u0159\u00edklad 2678 \u2014 tedy 2678 byt\u016f. Lze tak\u00e9 pou\u017e\u00edt suffixy <code>G<\/code> a <code>Gi<\/code>, hlavn\u00ed je si pamatovat, \u017ee nejsou ekvivalentn\u00ed. Prvn\u00ed je des\u00edtkov\u00fd, druh\u00fd je bin\u00e1rn\u00ed. Jako p\u0159\u00edklad, uveden\u00fd v dokumentaci k8s: <code>128974848<\/code>, <code>129e6<\/code>, <code>129M<\/code>, <code>123Mi<\/code> \u2014 jsou prakticky ekvivalentn\u00ed.<\/p>\n<p>Parametr Kubernetes <code>limits.memory<\/code> odpov\u00edd\u00e1 p\u0159\u00edznaku <code>--memory<\/code> v Dockeru. V p\u0159\u00edpad\u011b <code>request.memory<\/code> neexistuje \u017e\u00e1dn\u00fd ekvivalent v Dockeru, proto\u017ee Docker toto pole nepou\u017e\u00edv\u00e1. M\u016f\u017eete se pt\u00e1t, jestli je to v\u016fbec pot\u0159eba? Ano, pot\u0159ebn\u00e9 je. Jak jsem ji\u017e \u0159ekl, pole m\u00e1 v\u00fdznam pro Kubernetes. Na z\u00e1klad\u011b informac\u00ed z n\u011bj kube-scheduler rozhoduje, na kter\u00fd uzel napl\u00e1novat Pod.<\/p>\n<p><strong>Co se stane, kdy\u017e nastav\u00edte nedostate\u010dnou pam\u011b\u0165 pro po\u017eadavek?<\/strong><\/p>\n<p>Pokud kontejner dos\u00e1hne limitu po\u017eadovan\u00e9 pam\u011bti, Pod je um\u00edst\u011bn do skupiny Pod\u016f, kter\u00e9 se zastav\u00ed p\u0159i nedostatku pam\u011bti na uzlu.<\/p>\n<p><strong>Co se stane, pokud nastav\u00edte p\u0159\u00edli\u0161 n\u00edzk\u00fd limit pam\u011bti?<\/strong><\/p>\n<p>Pokud kontejner p\u0159ekro\u010d\u00ed limit pam\u011bti, bude ukon\u010den z d\u016fvodu OOM-Killed. A bude restartov\u00e1n, pokud to bude mo\u017en\u00e9 na z\u00e1klad\u011b RestartPolicy, kde v\u00fdchoz\u00ed hodnota je <code>V\u017edy<\/code>.<\/p>\n<p><strong>Co se stane, pokud nezad\u00e1te po\u017eadovanou pam\u011b\u0165?<\/strong><\/p>\n<p>Kubernetes vezme limit a nastav\u00ed ho jako v\u00fdchoz\u00ed hodnotu.<\/p>\n<p><strong>Co se m\u016f\u017ee st\u00e1t, pokud nezad\u00e1te limit pam\u011bti?<\/strong><\/p>\n<p>Kontejner nem\u00e1 \u017e\u00e1dn\u00e1 omezen\u00ed, m\u016f\u017ee pou\u017e\u00edvat tolik pam\u011bti, kolik chce. Pokud za\u010dne pou\u017e\u00edvat ve\u0161kerou dostupnou pam\u011b\u0165 uzlu, bude ukon\u010den OOM. Pot\u00e9 bude kontejner restartov\u00e1n, pokud to bude mo\u017en\u00e9 na z\u00e1klad\u011b RestartPolicy.<\/p>\n<p><strong>Co se stane, pokud nezad\u00e1te limity pam\u011bti?<\/strong><\/p>\n<p>To je nejhor\u0161\u00ed sc\u00e9n\u00e1\u0159: pl\u00e1nova\u010d nev\u00ed, kolik zdroj\u016f kontejner pot\u0159ebuje, a to m\u016f\u017ee zp\u016fsobit v\u00e1\u017en\u00e9 probl\u00e9my na uzlu. V tomto p\u0159\u00edpad\u011b by bylo dobr\u00e9 m\u00edt v\u00fdchoz\u00ed omezen\u00ed v prostoru jmen (nastaven\u00e9 LimitRange). \u017d\u00e1dn\u00e1 v\u00fdchoz\u00ed omezen\u00ed nejsou - Pod nem\u00e1 \u017e\u00e1dn\u00e1 omezen\u00ed, m\u016f\u017ee pou\u017e\u00edvat tolik pam\u011bti, kolik chce.<\/p>\n<p>Pokud je po\u017eadovan\u00e1 pam\u011b\u0165 v\u011bt\u0161\u00ed, ne\u017e m\u016f\u017ee uzel nab\u00eddnout - Pod nebude napl\u00e1nov\u00e1n. Je d\u016fle\u017eit\u00e9 si pamatovat, \u017ee <code>Requests.memory<\/code> nen\u00ed minim\u00e1ln\u00ed hodnota. Je to popis objemu pam\u011bti, kter\u00fd je dostate\u010dn\u00fd pro neust\u00e1l\u00fd provoz kontejneru. <\/p>\n<p>Obvykle se doporu\u010duje nastavit stejnou hodnotu pro <code>request.memory<\/code> a <code>limit.memory<\/code>. D\u00edky tomu Kubernetes nenapl\u00e1nuje Pod na uzlu, kter\u00fd m\u00e1 dostatek pam\u011bti pro spu\u0161t\u011bn\u00ed Pod, ale nedostatek pro provoz. M\u011bjte na pam\u011bti: p\u0159i pl\u00e1nov\u00e1n\u00ed Pod Kubernetes zohled\u0148uje pouze <code>requests.memory<\/code>, a <code>limits.memory<\/code> a to nezohled\u0148uje.<\/p>\n<h2>CPU: po\u017eadavek a limit<\/h2>\n<p><\/p>\n<pre><code class=\"plaintext\">containers:\n...\n resources:\n   requests:\n     cpu: 1\n   limits:\n     cpu: \"1200m\"\n<\/code><\/pre>\n<p>\nS CPU je to o n\u011bco slo\u017eit\u011bj\u0161\u00ed. Kdy\u017e se vr\u00e1t\u00edme k obr\u00e1zku vz\u00e1jemn\u00e9ho vztahu mezi Kubernetes a Docker, m\u016f\u017eeme si v\u0161imnout, \u017ee <code>request.cpu<\/code> odpov\u00edd\u00e1 <code>--cpu-shares<\/code>, zat\u00edmco <code>limit.cpu<\/code> odpov\u00edd\u00e1 p\u0159\u00edznaku <code>cpus<\/code> v Dockeru.<\/p>\n<p>CPU, kter\u00fd Kubernetes \u017e\u00e1d\u00e1, se n\u00e1sob\u00ed 1024 - pom\u011br cykl\u016f CPU. Pokud chcete po\u017e\u00e1dat o jedno pln\u00e9 j\u00e1dro, mus\u00edte p\u0159idat <code>cpu: 1<\/code>, jak je uvedeno v\u00fd\u0161e. <\/p>\n<p>\u017d\u00e1dost o pln\u00e9 j\u00e1dro (pom\u011br = 1024) neznamen\u00e1, \u017ee v\u00e1\u0161 kontejner toto j\u00e1dro dostane. Pokud m\u00e1 v\u00e1\u0161 hostitelsk\u00fd po\u010d\u00edta\u010d pouze jedno j\u00e1dro a pou\u017e\u00edv\u00e1te v\u00edce ne\u017e jeden kontejner, v\u0161echny kontejnery si mus\u00ed dostupn\u00fd CPU sd\u00edlet. Jak to funguje? Poj\u010fme se pod\u00edvat na obr\u00e1zek.<\/p>\n<p><img decoding=\"async\" alt=\"Jak z\u00edskat p\u0159\u00edstup k prost\u0159edk\u016fm Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/7f4b20642708ef3a7e773d7900161267.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u017d\u00e1dost o CPU \u2014 syst\u00e9m s jedn\u00edm j\u00e1drem<\/p>\n<p>P\u0159edstavme si, \u017ee m\u00e1te hostitelsk\u00fd syst\u00e9m s jedn\u00edm j\u00e1drem, na kter\u00e9m b\u011b\u017e\u00ed kontejnery. Maminka (Kubernetes) upekla kol\u00e1\u010d (CPU) a chce ho rozd\u011blit mezi d\u011bti (kontejnery). T\u0159i d\u011bti cht\u011bj\u00ed cel\u00fd kol\u00e1\u010d (pom\u011br = 1024), jedno d\u00edt\u011b chce polovinu kol\u00e1\u010de (512). Maminka chce b\u00fdt spravedliv\u00e1 a provede jednoduch\u00fd v\u00fdpo\u010det.<\/p>\n<pre><code class=\"plaintext\"># \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0438\u0440\u043e\u0433\u043e\u0432 \u0445\u043e\u0442\u044f\u0442 \u0434\u0435\u0442\u0438?\n# 3 \u0440\u0435\u0431\u0435\u043d\u043a\u0430 \u0445\u043e\u0442\u044f\u0442 \u043f\u043e \u0446\u0435\u043b\u043e\u043c\u0443 \u043f\u0438\u0440\u043e\u0433\u0443 \u0438 \u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u0445\u043e\u0447\u0435\u0442 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443 \u043f\u0438\u0440\u043e\u0433\u0430\ncakesNumberKidsWant = (3 * 1) + (1 * 0.5) = 3.5\n# \u0412\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0442\u0430\u043a:\n3 (\u0440\u0435\u0431\u0435\u043d\u043a\u0430\/\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430) * 1 (\u0446\u0435\u043b\u044b\u0439 \u043f\u0438\u0440\u043e\u0433\/\u043f\u043e\u043b\u043d\u043e\u0435 \u044f\u0434\u0440\u043e) + 1 (\u0440\u0435\u0431\u0435\u043d\u043e\u043a\/\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440) * 0.5 (\u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u043f\u0438\u0440\u043e\u0433\u0430\/\u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u044f\u0434\u0440\u0430)\n# \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0438\u0440\u043e\u0433\u043e\u0432 \u0438\u0441\u043f\u0435\u0447\u0435\u043d\u043e?\navailableCakesNumber = 1\n# \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0438\u0440\u043e\u0433\u0430 (\u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e) \u0434\u0435\u0442\u0438 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c?\nnewMaxRequest = 1 \/ 3.5 =~ 28%<\/code><\/pre>\n<p>\nNa z\u00e1klad\u011b v\u00fdpo\u010dtu obdr\u017e\u00ed t\u0159i d\u011bti p\u0159ibli\u017en\u011b 28 % j\u00e1dra, a ne cel\u00e9 j\u00e1dro. \u010ctvrt\u00e9 d\u00edt\u011b dostane 14 % z pln\u00e9ho j\u00e1dra, a ne polovinu. Ale v\u0161e bude jinak, pokud m\u00e1te v\u00edcej\u00e1drov\u00fd syst\u00e9m.<\/p>\n<p><img decoding=\"async\" alt=\"Jak z\u00edskat p\u0159\u00edstup k prost\u0159edk\u016fm Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/7bf71d97add9adcf7cf0260941526590.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u017d\u00e1dost o CPU \u2014 v\u00edcej\u00e1drov\u00fd (4) syst\u00e9m<\/p>\n<p>Na obr\u00e1zku v\u00fd\u0161e je vid\u011bt, \u017ee t\u0159i d\u011bti cht\u011bj\u00ed cel\u00fd kol\u00e1\u010d a jedno chce polovinu. Proto\u017ee maminka upekla \u010dty\u0159i kol\u00e1\u010de, ka\u017ed\u00e9 d\u00edt\u011b dostane tolik, kolik chce. V v\u00edcej\u00e1drov\u00e9m syst\u00e9mu jsou procesorov\u00e9 zdroje rozd\u011bleny mezi v\u0161echna dostupn\u00e1 j\u00e1dra procesoru. Pokud je kontejner omezen na m\u00e9n\u011b ne\u017e jedno pln\u00e9 j\u00e1dro CPU, m\u016f\u017ee ho p\u0159esto vyu\u017e\u00edt na 100 %. <\/p>\n<p>V\u00fd\u0161e uveden\u00e9 v\u00fdpo\u010dty byly zjednodu\u0161eny pro pochopen\u00ed, jak se CPU d\u011bl\u00ed mezi kontejnery. Samoz\u0159ejm\u011b, \u017ee krom\u011b samotn\u00fdch kontejner\u016f existuj\u00ed i dal\u0161\u00ed procesy, kter\u00e9 tak\u00e9 vyu\u017e\u00edvaj\u00ed CPU. Kdy\u017e procesy v jednom kontejneru nepracuj\u00ed, mohou ostatn\u00ed procesy vyu\u017e\u00edt jeho zdroje. <code>CPU: \"200m\"<\/code> odpov\u00edd\u00e1 <code>CPU: 0,2<\/code>, co\u017e odpov\u00edd\u00e1 p\u0159ibli\u017en\u011b 20 % jednoho j\u00e1dra.<\/p>\n<p>Nyn\u00ed si promluvme o <code>limit.cpu<\/code>. CPU, kter\u00fd omezuje Kubernetes, se n\u00e1sob\u00ed 100. V\u00fdsledek je mno\u017estv\u00ed \u010dasu, kter\u00e9 m\u016f\u017ee kontejner vyu\u017e\u00edt ka\u017ed\u00fdch 100 \u03bcs (<code>cpu-period<\/code>). <\/p>\n<p><code>limit.cpu<\/code> odpov\u00edd\u00e1 flagu Docker <code>--cpus<\/code>. To je nov\u00e1 kombinace star\u00fdch <code>--cpu-period<\/code> a <code>--cpu-quota<\/code>. Nastaven\u00edm toho uv\u00e1d\u00edme, kolik dostupn\u00fdch zdroj\u016f CPU m\u016f\u017ee kontejner maxim\u00e1ln\u011b vyu\u017e\u00edt, ne\u017e dojde k omezen\u00ed:<\/p>\n<ul>\n<li><strong>cpus<\/strong> \u2014 kombinace <code>cpu-period<\/code> a <code>cpu-quota. cpus = 1.5<\/code> odpov\u00edd\u00e1 nastaven\u00ed <code>cpu-period = 100000<\/code> a <code>cpu-quota = 150000<\/code>;<\/li>\n<li><strong>cpu-period<\/strong> \u2014 obdob\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Completely_Fair_Scheduler\">pl\u00e1nova\u010de CPU CFS<\/a><\/noindex>, ve v\u00fdchoz\u00edm nastaven\u00ed 100 mikrosekund;<\/li>\n<li><strong>cpu-quota<\/strong> \u2014 mno\u017estv\u00ed mikrosekund uvnit\u0159 <code>cpu-period<\/code>, kter\u00fdm je kontejner omezen.<\/li>\n<\/ul>\n<p>\n<strong>Co se stane, pokud nastav\u00edte nedostate\u010dn\u00fd po\u017eadavek na CPU?<\/strong><\/p>\n<p>Pokud kontejner pot\u0159ebuje v\u00edce, ne\u017e je nastaveno, ukradne CPU od ostatn\u00edch proces\u016f.<\/p>\n<p><strong>Co se stane, pokud nastav\u00edte nedostate\u010dn\u00fd limit CPU?<\/strong><\/p>\n<p>Jeliko\u017e je zdroj CPU regulovan\u00fd, dojde k throttlingu.<\/p>\n<p><strong>Co se stane, pokud neuvedete po\u017eadavek na CPU?<\/strong><\/p>\n<p>Stejn\u011b jako u pam\u011bti, po\u017eadavek se rovn\u00e1 limitu.<\/p>\n<p><strong>Co se stane, pokud neuvedete limit CPU?<\/strong><\/p>\n<p>Kontejner pou\u017eije tolik CPU, kolik pot\u0159ebuje. Pokud je v prostoru jmen ur\u010dena v\u00fdchoz\u00ed politika CPU (LimitRange), pak tento limit se pou\u017e\u00edv\u00e1 i pro kontejner.<\/p>\n<p><strong>Co se stane, pokud neuvedete ani po\u017eadavek, ani limit CPU?<\/strong><\/p>\n<p>Stejn\u011b jako u pam\u011bti, to je nejhor\u0161\u00ed sc\u00e9n\u00e1\u0159. Pl\u00e1nova\u010d nev\u00ed, kolik zdroj\u016f v\u00e1\u0161 kontejner pot\u0159ebuje, a to m\u016f\u017ee zp\u016fsobit v\u00e1\u017en\u00e9 probl\u00e9my na uzlu. Abychom tomu p\u0159ede\u0161li, mus\u00edte nastavit v\u00fdchoz\u00ed omezen\u00ed pro prostory jmen (LimitRange).<\/p>\n<p>Pamatujte: pokud po\u017e\u00e1d\u00e1te o v\u00edce CPU, ne\u017e mohou poskytnout uzly, Pod nebude napl\u00e1nov\u00e1n. <code>Requests.cpu<\/code> \u2014 nen\u00ed to minim\u00e1ln\u00ed hodnota, ale hodnota dostate\u010dn\u00e1 pro spu\u0161t\u011bn\u00ed Podu a provoz bez selh\u00e1n\u00ed. Pokud aplikace neprov\u00e1d\u00ed slo\u017eit\u00e9 v\u00fdpo\u010dty, nejlep\u0161\u00ed volba je nastavit <code>request.cpu &lt;= 1<\/code> a spustit tolik replik, kolik je pot\u0159eba.<\/p>\n<h2>Ide\u00e1ln\u00ed mno\u017estv\u00ed po\u017eadovan\u00fdch nebo limitovan\u00fdch zdroj\u016f<\/h2>\n<p>\nZjistili jsme o omezen\u00ed v\u00fdpo\u010detn\u00edch zdroj\u016f. Te\u010f je \u010das odpov\u011bd\u011bt na ot\u00e1zku: \u201eKolik zdroj\u016f pot\u0159ebuje m\u016fj Pod pro bezprobl\u00e9mov\u00fd provoz aplikace? Jak\u00e9 mno\u017estv\u00ed je ide\u00e1ln\u00ed?\u201c. <\/p>\n<p>Bohu\u017eel na tyto ot\u00e1zky neexistuj\u00ed jednozna\u010dn\u00e9 odpov\u011bdi. Pokud nev\u00edte, jak funguje va\u0161e aplikace, kolik CPU nebo pam\u011bti pot\u0159ebuje, nejlep\u0161\u00ed volba je d\u00e1t aplikaci hodn\u011b pam\u011bti a CPU a pot\u00e9 spustit testy v\u00fdkonnosti.<\/p>\n<p>Krom\u011b test\u016f v\u00fdkonu sledujte chov\u00e1n\u00ed aplikace b\u011bhem t\u00fddne prost\u0159ednictv\u00edm monitorov\u00e1n\u00ed. Pokud z graf\u016f vypl\u00fdv\u00e1, \u017ee va\u0161e aplikace spot\u0159ebov\u00e1v\u00e1 m\u00e9n\u011b zdroj\u016f, ne\u017e jste po\u017eadovali, m\u016f\u017eete sn\u00ed\u017eit mno\u017estv\u00ed po\u017eadovan\u00e9ho CPU nebo pam\u011bti.<\/p>\n<p>Jako p\u0159\u00edklad se pod\u00edvejte na tento <noindex><a rel=\"nofollow\" href=\"https:\/\/grafana.com\/grafana\/dashboards\/7187\">dashboard Grafana<\/a><\/noindex>. Zobrazuje rozd\u00edl mezi po\u017eadovan\u00fdmi nebo limitovan\u00fdmi zdroji a aktu\u00e1ln\u00edm vyu\u017eit\u00edm zdroj\u016f.<\/p>\n<h2>Z\u00e1v\u011br<\/h2>\n<p>\n\u017d\u00e1dosti a omezen\u00ed zdroj\u016f pom\u00e1haj\u00ed udr\u017eovat funk\u010dnost Kubernetes clusteru. Spr\u00e1vn\u00e1 konfigurace limit\u016f minimalizuje n\u00e1klady a neust\u00e1le udr\u017euje aplikace v chodu.<\/p>\n<p>Pokud to shrneme, je dobr\u00e9 m\u00edt na pam\u011bti n\u011bkolik aspekt\u016f:<\/p>\n<ol>\n<li>\u017d\u00e1dan\u00e9 zdroje jsou konfigurace, kter\u00e1 se zohled\u0148uje b\u011bhem spu\u0161t\u011bn\u00ed (kdy Kubernetes pl\u00e1nuje um\u00edst\u011bn\u00ed aplikace). Naopak omezen\u00ed zdroj\u016f je d\u016fle\u017eit\u00e9 b\u011bhem provozu \u2014 kdy\u017e je aplikace ji\u017e spu\u0161t\u011bna na uzlu.<\/li>\n<li>Na rozd\u00edl od pam\u011bti je CPU regulovan\u00fd zdroj. V p\u0159\u00edpad\u011b nedostatku CPU v\u00e1\u0161 Pod nebude ukon\u010den, ale aktivuje se mechanismus throttlingu.<\/li>\n<li>\u017d\u00e1dan\u00e9 zdroje a limit zdroj\u016f nejsou minim\u00e1ln\u00ed a maxim\u00e1ln\u00ed hodnoty! Stanoven\u00edm \u017e\u00e1dan\u00fdch zdroj\u016f zaru\u010dujete, \u017ee aplikace bude fungovat bez probl\u00e9m\u016f.<\/li>\n<li>Dobr\u00fdm postupem je nastavit \u017e\u00e1dost o pam\u011b\u0165 rovnou limitu pam\u011bti.<\/li>\n<li>Je tak\u00e9 dobr\u00e9 nastavit \u017e\u00e1dost o <code>CPU &lt;=1<\/code>, pokud aplikace neprov\u00e1d\u00ed slo\u017eit\u00e9 v\u00fdpo\u010dty.<\/li>\n<li>Pokud po\u017e\u00e1d\u00e1te o v\u00edce zdroj\u016f, ne\u017e jak\u00e9 jsou na uzlu, Pod nikdy nebude napl\u00e1nov\u00e1n na tento uzel.<\/li>\n<li>Chcete-li ur\u010dit spr\u00e1vn\u00e9 mno\u017estv\u00ed \u017e\u00e1dost\u00ed o zdroje \/ limit\u016f zdroj\u016f, pou\u017eijte z\u00e1t\u011b\u017eov\u00e9 testov\u00e1n\u00ed a monitoring.<\/li>\n<\/ol>\n<p>\nDouf\u00e1m, \u017ee tento \u010dl\u00e1nek v\u00e1m pom\u016f\u017ee pochopit z\u00e1kladn\u00ed koncept omezen\u00ed zdroj\u016f. A budete moci tyto znalosti vyu\u017e\u00edt ve sv\u00e9 pr\u00e1ci.<\/p>\n<p>Hodn\u011b \u0161t\u011bst\u00ed!<\/p>\n<p><strong>Co dal\u0161\u00edho si p\u0159e\u010d\u00edst:<\/strong><\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500504\/\">Sledovatelnost SRE: prostory n\u00e1zv\u016f a struktura metrik<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/poleznye-instrumenty-dlya-kubernetes\">90+ u\u017eite\u010dn\u00fdch n\u00e1stroj\u016f pro Kubernetes: nasazen\u00ed, spr\u00e1va, monitoring, bezpe\u010dnost a dal\u0161\u00ed<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tele.click\/k8s_mail\">N\u00e1\u0161 kan\u00e1l Kolem Kubernetes na Telegramu<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/516014\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>The Reward by Tohad \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441 Kubernetes \u043e\u0431\u044b\u0447\u043d\u043e \u0437\u0430\u0431\u044b\u0432\u0430\u044e\u0442 \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0437 Docker \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 Kubernetes. \u041d\u043e \u043f\u043e\u0437\u0434\u043d\u0435\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0443\u0436\u043d\u043e \u0432\u044b\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0438\u0445 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94263,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94262","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c Kubernetes Pod | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-14T17:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-14T17:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83c\udfc6 Jak z\u00edskat p\u0159\u00edstup k zdroj\u016fm Kubernetes Pod | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c Kubernetes Pod | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-14T17:42:34+00:00","article:modified_time":"2020-09-14T17:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:30:27","updated":"2022-10-02 18:20:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/94262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=94262"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/94262\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/94263"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=94262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=94262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=94262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}