{"id":94262,"date":"2020-09-14T19:42:34","date_gmt":"2020-09-14T17:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod"},"modified":"2020-09-14T19:42:34","modified_gmt":"2020-09-14T17:42:34","slug":"kak-poluchit-dostup-k-resursam-kubernetes-pod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod","title":{"rendered":"Ako z\u00edska\u0165 pr\u00edstup k prostriedkom Kubernetes Pod","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Ako z\u00edska\u0165 pr\u00edstup k prostriedkom Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/3d6760d512ef456daad121f7d1ddbcf8.jpg\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" href=\"https:\/\/www.deviantart.com\/tohad\/art\/The-Reward-549720998\"><i>Odmena od Tohad<\/i><\/a><\/noindex><\/p>\n<p>Na za\u010diatku pr\u00e1ce s Kubernetes sa zvy\u010dajne zab\u00fada na nastavenie zdrojov kontajnerov. V tejto f\u00e1ze sta\u010d\u00ed overi\u0165, \u017ee obraz Docker funguje a d\u00e1 sa nasadi\u0165 v klastre Kubernetes.<\/p>\n<p>Nesk\u00f4r sa v\u0161ak vy\u017eaduje nasadenie aplik\u00e1cie do produk\u010dn\u00e9ho klastra spolu s in\u00fdmi aplik\u00e1ciami. Na to je potrebn\u00e9 vy\u010dleni\u0165 zdroje pre kontajner a zabezpe\u010di\u0165, \u017ee s\u00fa dostato\u010dn\u00e9 na spustenie a prev\u00e1dzku aplik\u00e1cie, a \u017ee sa nevyskytn\u00fa probl\u00e9my s in\u00fdmi be\u017eiacimi aplik\u00e1ciami.<\/p>\n<p>T\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Kubernetes aaS od Mail.ru<\/a><\/noindex> prelo\u017eila \u010dl\u00e1nok o zdrojoch kontajnerov (CPU &amp; MEM), po\u017eiadavk\u00e1ch a obmedzeniach zdrojov. Zist\u00edte, ak\u00e9 v\u00fdhody poskytuj\u00fa tieto nastavenia a \u010do sa stane, ak sa nenastavia.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>V\u00fdpo\u010dtov\u00e9 zdroje<\/h2>\n<p>\nM\u00e1me dva typy zdrojov s nasleduj\u00facimi jednotkami:<\/p>\n<ul>\n<li>Centr\u00e1lny procesor (CPU) \u2014 jadr\u00e1;<\/li>\n<li>Pam\u00e4\u0165 (MEM) \u2014 bajty.<\/li>\n<\/ul>\n<p>\nZdroje s\u00fa ur\u010den\u00e9 pre ka\u017ed\u00fd kontajner. V nasleduj\u00facom YAML s\u00fabore Pod uvid\u00edte sekciu zdrojov, ktor\u00e1 obsahuje po\u017eadovan\u00e9 a maxim\u00e1lne zdroje:<\/p>\n<ul>\n<li>Po\u017eadovan\u00e9 zdroje Pod = suma po\u017eadovan\u00fdch zdrojov v\u0161etk\u00fdch kontajnerov;<\/li>\n<li>Maxim\u00e1lne zdroje Pod = suma maxim\u00e1lnych zdrojov v\u0161etk\u00fdch kontajnerov.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Pod\nmetadata:\n  name: backend-pod-name\n  labels:\n    application: backend\nspec:\n  containers:\n    - name: main-container\n      image: my-backend\n      tag: v1\n      ports:\n      - containerPort: 8080\n      resources:\n        requests:\n          cpu: 0.2 # \u017dIADOS\u0164 O CPU: 200m jadier\n          memory: \"1Gi\" # \u017dIADOS\u0164 O PAM\u00c4\u0164: 1Gi\n        limits:\n          cpu: 1 # MAX POU\u017dITIE CPU: 1 jadro\n          memory: \"1Gi\" # MAX POU\u017dITIE PAM\u00c4TE: 1Gi\n    - name: other-container\n      image: other-app\n      tag: v1\n      ports:\n      - containerPort: 8000\n      resources:\n        requests:\n          cpu: \"200m\" # \u017dIADOS\u0164 O CPU: 200m jadier\n          memory: \"0.5Gi\" # \u017dIADOS\u0164 O PAM\u00c4\u0164: 0.5Gi\n        limits:\n          cpu: 1 # MAX POU\u017dITIE CPU: 1 jadro\n          memory: \"1Gi\" # MAX POU\u017dITIE PAM\u00c4TE: 1Gi<\/code><\/pre>\n<p>Pr\u00edklad po\u017eadovan\u00fdch a maxim\u00e1lnych zdrojov<\/p>\n<p>Pole <code>resources.requested<\/code> z \u0161pecifik\u00e1cie Pod \u2014 jeden z prvkov, ktor\u00fd sa pou\u017e\u00edva na vyh\u013ead\u00e1vanie potrebn\u00e9ho uzla. Na\u0148 sa m\u00f4\u017ee napl\u00e1nova\u0165 nasadenie Pod. Ako sa h\u013ead\u00e1 vhodn\u00fd uzol?<\/p>\n<p>Kubernetes sa sklad\u00e1 z nieko\u013ek\u00fdch komponentov, vr\u00e1tane hlavn\u00e9ho uzla alebo master uzla (Kubernetes Control Plane). Na master uzle be\u017e\u00ed nieko\u013eko procesov: kube-apiserver, kube-controller-manager a kube-scheduler. <\/p>\n<p>Proces kube-scheduler zodpoved\u00e1 za preh\u013ead\u00e1vanie novo vytvoren\u00fdch modulov a h\u013eadanie potenci\u00e1lnych pracovn\u00fdch uzlov, ktor\u00e9 sp\u013a\u0148aj\u00fa v\u0161etky po\u017eiadavky modulov, vr\u00e1tane po\u010dtu po\u017eadovan\u00fdch zdrojov. Zoznam uzlov, ktor\u00e9 n\u00e1jde kube-scheduler, sa hodnot\u00ed. Pod sa pl\u00e1nuje na uzle s najvy\u0161\u0161\u00edmi bodmi.<\/p>\n<p><img decoding=\"async\" alt=\"Ako z\u00edska\u0165 pr\u00edstup k prostriedkom Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/b489991a3cbbd5359c99701886d488e5.jpg\" style=\"display:block;margin: 0 auto;\" \/>Kam bude umiestnen\u00fd fialov\u00fd Pod?<\/p>\n<p>Na obr\u00e1zku je vidie\u0165, \u017ee kube-scheduler m\u00e1 napl\u00e1nova\u0165 nov\u00fd fialov\u00fd Pod. Kubernetes klaster obsahuje dva uzly: A a B. Ako si m\u00f4\u017eete v\u0161imn\u00fa\u0165, kube-scheduler nem\u00f4\u017ee napl\u00e1nova\u0165 Pod na uzol A \u2014 dostupn\u00e9 (nepo\u017eiadan\u00e9) zdroje nezodpovedaj\u00fa po\u017eiadavk\u00e1m fialov\u00e9ho Pod. Tak\u017ee po\u017eadovan\u00fdch 1 GB pam\u00e4te pre fialov\u00fd Pod sa nezmest\u00ed na uzol A, preto\u017ee dostupn\u00fd objem pam\u00e4te je 0,5 GB. Ale uzol B m\u00e1 dostatok zdrojov. Nakoniec kube-scheduler rozhodne, \u017ee ur\u010den\u00edm fialov\u00e9ho Pod je uzol B.<\/p>\n<p>Teraz u\u017e vieme, ako po\u017eadovan\u00e9 zdroje ovplyv\u0148uj\u00fa v\u00fdber uzla pre spustenie Pod. Ale ako ovplyv\u0148uj\u00fa predbe\u017en\u00e9 zdroje?<\/p>\n<p>Predbe\u017en\u00e9 zdroje s\u00fa hranicou, ktor\u00fa CPU\/MEM nem\u00f4\u017ee prekro\u010di\u0165. Naviac, CPU je flexibiln\u00e9, tak\u017ee kontajnery, ktor\u00e9 dosiahnu predbe\u017en\u00e9 hodnoty CPU, nesp\u00f4sobia ukon\u010denie Pod. Namiesto toho sa aktivuje obmedzenie CPU. Av\u0161ak, ak sa dosiahne limit na vyu\u017eitie MEM, kontajner bude zastaven\u00fd kv\u00f4li OOM-Killer a reinicializovan\u00fd, ak to povol\u00ed nastavenie RestartPolicy.<\/p>\n<h2>Po\u017eadovan\u00e9 a predbe\u017en\u00e9 zdroje v detalhoch<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Ako z\u00edska\u0165 pr\u00edstup k prostriedkom Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/22e672100940e8895ae42a56a681111f.jpg\" style=\"display:block;margin: 0 auto;\" \/>Prepojenie zdrojov medzi Dockerom a Kubernetes<\/p>\n<p>Najlep\u0161\u00ed sp\u00f4sob, ako vysvetli\u0165, ako funguj\u00fa po\u017eadovan\u00e9 a predbe\u017en\u00e9 zdroje, je predstavi\u0165 prepojenie medzi Kubernetes a Dockerom. Na obr\u00e1zku vy\u0161\u0161ie si m\u00f4\u017eete pozrie\u0165, ako s\u00fa navz\u00e1jom prepojen\u00e9 polia Kubernetes a sp\u00fa\u0161\u0165acie flagy Dockeru.<\/p>\n<h2>Pam\u00e4\u0165: po\u017eiadavka a obmedzenie<\/h2>\n<p><\/p>\n<pre><code class=\"plaintext\">containers:\n...\n resources:\n   requests:\n     memory: \"0.5Gi\"\n   limits:\n     memory: \"1Gi\"\n<\/code><\/pre>\n<p>\nAko bolo spomenut\u00e9 vy\u0161\u0161ie, pam\u00e4\u0165 sa meria v bajtoch. Na z\u00e1klade <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/configuration\/manage-resources-containers\/#meaning-of-memory\">dokument\u00e1cii Kubernetes<\/a><\/noindex>, m\u00f4\u017eeme ur\u010di\u0165 pam\u00e4\u0165 ako \u010d\u00edslo. Zvy\u010dajne je to cel\u00e9 \u010d\u00edslo, napr\u00edklad 2678 \u2014 teda 2678 bajtov. M\u00f4\u017eeme tie\u017e pou\u017ei\u0165 pr\u00edpony <code>G<\/code> a <code>Gi<\/code>, d\u00f4le\u017eit\u00e9 je pam\u00e4ta\u0165, \u017ee nie s\u00fa ekvivalentn\u00e9. Prv\u00fd je desiatkov\u00fd, zatia\u013e \u010do druh\u00fd je dvojkov\u00fd. Ako pr\u00edklad, uveden\u00fd v dokument\u00e1cii k8s: <code>128974848<\/code>, <code>129e6<\/code>, <code>129M<\/code>, <code>123Mi<\/code> \u2014 s\u00fa prakticky ekvivalentn\u00e9.<\/p>\n<p>Parametr Kubernetes <code>limits.memory<\/code> zodpoved\u00e1 flagu <code>--memory<\/code> z Dockeru. V pr\u00edpade <code>request.memory<\/code> nenach\u00e1dzaj\u00fa sa \u017eiadne \u0161\u00edpky pre Docker, preto\u017ee Docker toto pole nepou\u017e\u00edva. M\u00f4\u017eete sa op\u00fdta\u0165, \u010di je to v\u00f4bec potrebn\u00e9? \u00c1no, je. Ako som u\u017e spomenul, pole m\u00e1 v\u00fdznam pre Kubernetes. Na z\u00e1klade inform\u00e1ci\u00ed v \u0148om kube-scheduler rozhoduje, na ktor\u00fd uzol napl\u00e1nova\u0165 Pod.<\/p>\n<p><strong>\u010co sa stane, ak nastav\u00edte pre po\u017eiadavku nedostato\u010dn\u00fa pam\u00e4\u0165?<\/strong><\/p>\n<p>Ak kontajner dosiahne hranice po\u017eadovanej pam\u00e4te, Pod sa umiestni do skupiny Pod, ktor\u00e9 sa zastavuj\u00fa pri nedostatku pam\u00e4te v uzle.<\/p>\n<p><strong>\u010co sa stane, ak nastav\u00edte pr\u00edli\u0161 n\u00edzky limit pam\u00e4te?<\/strong><\/p>\n<p>Ak kontajner prekro\u010d\u00ed limit pam\u00e4te, bude ukon\u010den\u00fd z d\u00f4vodu OOM-Killed. A bude znovu spusten\u00fd, ak je to mo\u017en\u00e9 na z\u00e1klade RestartPolicy, kde je predvolen\u00e9 nastavenie \u2014 <code>V\u017edy<\/code>.<\/p>\n<p><strong>\u010co sa stane, ak neuv\u00e1dzate po\u017eadovan\u00fa pam\u00e4\u0165?<\/strong><\/p>\n<p>Kubernetes vezme limit a nastav\u00ed ho ako predvolen\u00fa hodnotu.<\/p>\n<p><strong>\u010co sa m\u00f4\u017ee sta\u0165, ak neuv\u00e1dzate limit na pam\u00e4\u0165?<\/strong><\/p>\n<p>Kontajner nem\u00e1 obmedzenia, m\u00f4\u017ee pou\u017e\u00edva\u0165 to\u013eko pam\u00e4te, ko\u013eko chce. Ak v\u0161ak za\u010dne vyu\u017e\u00edva\u0165 cel\u00fa dostupn\u00fa pam\u00e4\u0165 nody, bude zlikvidovan\u00fd OOM. Potom bude kontajner znova spusten\u00fd, ak je to mo\u017en\u00e9 na z\u00e1klade RestartPolicy.<\/p>\n<p><strong>\u010co sa stane, ak neuv\u00e1dzate limity pam\u00e4te?<\/strong><\/p>\n<p>Toto je najhor\u0161\u00ed scen\u00e1r: pl\u00e1nova\u010d nevie, ko\u013eko zdrojov kontajner potrebuje, a to m\u00f4\u017ee sp\u00f4sobi\u0165 v\u00e1\u017ene probl\u00e9my na node. V tomto pr\u00edpade by bolo dobr\u00e9 ma\u0165 predvolen\u00e9 obmedzenia v namespacu (nastaven\u00e9 LimitRange). Neexistuj\u00fa \u017eiadne predvolen\u00e9 obmedzenia \u2014 pod nem\u00e1 obmedzenia, m\u00f4\u017ee pou\u017e\u00edva\u0165 to\u013eko pam\u00e4te, ko\u013eko chce.<\/p>\n<p>Ak je po\u017eadovan\u00e1 pam\u00e4\u0165 v\u00e4\u010d\u0161ia, ne\u017e m\u00f4\u017ee node pon\u00faknu\u0165 \u2014 pod nebude napl\u00e1novan\u00fd. Je d\u00f4le\u017eit\u00e9 si zapam\u00e4ta\u0165, \u017ee <code>Requests.memory<\/code> \u2014 nie je minim\u00e1lna hodnota. Toto je popis objemu pam\u00e4te, ktor\u00fd je dostato\u010dn\u00fd na nepretr\u017eit\u00fa prev\u00e1dzku kontajnera. <\/p>\n<p>Zvy\u010dajne sa odpor\u00fa\u010da nastavi\u0165 rovnak\u00fa hodnotu pre <code>request.memory<\/code> a <code>limit.memory<\/code>. V\u010faka tomu Kubernetes nenapl\u00e1nuje pod na uzle, ktor\u00fd m\u00e1 dostatok pam\u00e4te na spustenie podu, ale nie dostatok na jeho prev\u00e1dzku. Pam\u00e4tajte: pri pl\u00e1novan\u00ed podu Kubernetes zoh\u013ead\u0148uje iba <code>requests.memory<\/code>, a <code>limits.memory<\/code> ner\u00e1ta.<\/p>\n<h2>CPU: po\u017eiadavka a limit<\/h2>\n<p><\/p>\n<pre><code class=\"plaintext\">containers:\n...\n resources:\n   requests:\n     cpu: 1\n   limits:\n     cpu: \"1200m\"\n<\/code><\/pre>\n<p>\nS CPU je to trochu zlo\u017eitej\u0161ie. Ak sa vr\u00e1tite k obr\u00e1zku t\u00fdkaj\u00facemu sa s\u00favislosti medzi Kubernetes a Dockerom, m\u00f4\u017eete si v\u0161imn\u00fa\u0165, \u017ee <code>request.cpu<\/code> zodpoved\u00e1 <code>--cpu-shares<\/code>, zatia\u013e \u010do <code>limit.cpu<\/code> zodpoved\u00e1 flagu <code>cpus<\/code> v Dockeri.<\/p>\n<p>CPU, ktor\u00fd Kubernetes po\u017eaduje, sa n\u00e1sob\u00ed 1024 \u2014 proporciou cyklov CPU. Ak chcete po\u017eiada\u0165 o 1 cel\u00e9 jadro, mus\u00edte prida\u0165 <code>cpu: 1<\/code>, ako je uveden\u00e9 vy\u0161\u0161ie. <\/p>\n<p>\u017diados\u0165 o pln\u00e9 jadro (proporcia = 1024) neznamen\u00e1, \u017ee v\u00e1\u0161 kontajner ho dostane. Ak m\u00e1 v\u00e1\u0161 hostite\u013esk\u00fd po\u010d\u00edta\u010d len jedno jadro a pou\u017e\u00edvate viac ako jeden kontajner, v\u0161etky kontajnery musia zdie\u013ea\u0165 dostupn\u00fd CPU medzi sebou. Ako sa to deje? Pozrime sa na obr\u00e1zok.<\/p>\n<p><img decoding=\"async\" alt=\"Ako z\u00edska\u0165 pr\u00edstup k prostriedkom Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/7f4b20642708ef3a7e773d7900161267.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u017diados\u0165 CPU \u2014 syst\u00e9m s jedn\u00fdm jadrom<\/p>\n<p>Predstavte si, \u017ee m\u00e1te hostite\u013esk\u00fd syst\u00e9m s jedn\u00fdm jadrom, na ktorom s\u00fa spusten\u00e9 kontajnery. Mama (Kubernetes) upiekla kol\u00e1\u010d (CPU) a chce ho rozdeli\u0165 medzi deti (kontajnery). Tri deti chc\u00fa cel\u00fd kol\u00e1\u010d (proporcia = 1024), \u010fal\u0161ie die\u0165a chce polovicu kol\u00e1\u010da (512). Mama chce by\u0165 spravodliv\u00e1 a vykon\u00e1va jednoduch\u00fd v\u00fdpo\u010det.<\/p>\n<pre><code class=\"plaintext\"># \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0438\u0440\u043e\u0433\u043e\u0432 \u0445\u043e\u0442\u044f\u0442 \u0434\u0435\u0442\u0438?\n# 3 \u0440\u0435\u0431\u0435\u043d\u043a\u0430 \u0445\u043e\u0442\u044f\u0442 \u043f\u043e \u0446\u0435\u043b\u043e\u043c\u0443 \u043f\u0438\u0440\u043e\u0433\u0443 \u0438 \u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u0445\u043e\u0447\u0435\u0442 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443 \u043f\u0438\u0440\u043e\u0433\u0430\ncakesNumberKidsWant = (3 * 1) + (1 * 0.5) = 3.5\n# \u0412\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0442\u0430\u043a:\n3 (\u0440\u0435\u0431\u0435\u043d\u043a\u0430\/\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430) * 1 (\u0446\u0435\u043b\u044b\u0439 \u043f\u0438\u0440\u043e\u0433\/\u043f\u043e\u043b\u043d\u043e\u0435 \u044f\u0434\u0440\u043e) + 1 (\u0440\u0435\u0431\u0435\u043d\u043e\u043a\/\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440) * 0.5 (\u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u043f\u0438\u0440\u043e\u0433\u0430\/\u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u044f\u0434\u0440\u0430)\n# \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0438\u0440\u043e\u0433\u043e\u0432 \u0438\u0441\u043f\u0435\u0447\u0435\u043d\u043e?\navailableCakesNumber = 1\n# \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0438\u0440\u043e\u0433\u0430 (\u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e) \u0434\u0435\u0442\u0438 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c?\nnewMaxRequest = 1 \/ 3.5 =~ 28%<\/code><\/pre>\n<p>\nNa z\u00e1klade v\u00fdpo\u010dtu tri deti dostan\u00fa po 28% jadra, nie po celom jadre. \u0160tvrt\u00e9mu die\u0165a\u0165u pripadne 14% z cel\u00e9ho jadra, nie polovica. Ale v\u0161etko bude in\u00e9, ak m\u00e1te viacjadrov\u00fd syst\u00e9m.<\/p>\n<p><img decoding=\"async\" alt=\"Ako z\u00edska\u0165 pr\u00edstup k prostriedkom Kubernetes Pod\" src=\"\/wp-content\/uploads\/2020\/09\/7bf71d97add9adcf7cf0260941526590.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u017diados\u0165 CPU \u2014 viacjadrov\u00fd (4) syst\u00e9m<\/p>\n<p>Na obr\u00e1zku vy\u0161\u0161ie je vidie\u0165, \u017ee tri deti chc\u00fa cel\u00fd kol\u00e1\u010d a jedno chce polovicu. Ke\u010f\u017ee mama upiekla \u0161tyri kol\u00e1\u010de, ka\u017ed\u00e9 z jej det\u00ed dostane to\u013eko, ko\u013eko chce. V vi\u0161ejadrovom syst\u00e9me s\u00fa procesorov\u00e9 zdroje rozdelen\u00e9 medzi v\u0161etky dostupn\u00e9 jadr\u00e1 procesora. Ak je kontajner obmedzen\u00fd na menej ako jedno cel\u00e9 jadro CPU, st\u00e1le ho m\u00f4\u017ee vyu\u017e\u00edva\u0165 na 100%. <\/p>\n<p>Vy\u0161\u0161ie uveden\u00e9 v\u00fdpo\u010dty s\u00fa zjednodu\u0161en\u00e9 na pochopenie toho, ako sa CPU rozde\u013euje medzi kontajnery. Samozrejme, okrem samotn\u00fdch kontajnerov existuj\u00fa aj in\u00e9 procesy, ktor\u00e9 tie\u017e vyu\u017e\u00edvaj\u00fa zdroje CPU. Ke\u010f procesy v jednom kontajneri nepracuj\u00fa, in\u00e9 m\u00f4\u017eu vyu\u017e\u00edva\u0165 jeho zdroje. <code>CPU: \"200m\"<\/code> zodpoved\u00e1 <code>CPU: 0,2<\/code>, \u010do znamen\u00e1 pribli\u017ene 20% jedn\u00e9ho jadra.<\/p>\n<p>Teraz sa po\u010fme porozpr\u00e1va\u0165 o <code>limit.cpu<\/code>. CPU, ktor\u00fd obmedzuje Kubernetes, sa vyn\u00e1sob\u00ed 100. V\u00fdsledok je mno\u017estvo \u010dasu, po\u010das ktor\u00e9ho m\u00f4\u017ee kontajner pou\u017e\u00edva\u0165 ka\u017ed\u00fdch 100 \u00b5s (<code>cpu-period<\/code>). <\/p>\n<p><code>limit.cpu<\/code> s\u00favis\u00ed s vlajkou Docker <code>--cpus<\/code>. Toto je nov\u00e1 kombin\u00e1cia star\u00fdch <code>--cpu-period<\/code> a <code>--cpu-quota<\/code>. Nastaven\u00edm tohto parametra ur\u010dujeme, ko\u013eko dostupn\u00fdch zdrojov CPU m\u00f4\u017ee kontajner maxim\u00e1lne vyu\u017ei\u0165, k\u00fdm neza\u010dne obmedzovanie:<\/p>\n<ul>\n<li><strong>cpus<\/strong> \u2014 kombin\u00e1cia <code>cpu-period<\/code> a <code>cpu-quota. cpus = 1.5<\/code> je ekvivalentn\u00e1 nastaveniu <code>cpu-period = 100000<\/code> a <code>cpu-quota = 150000<\/code>;<\/li>\n<li><strong>cpu-period<\/strong> \u2014 obdobie <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Completely_Fair_Scheduler\">pl\u00e1nova\u010da CPU CFS<\/a><\/noindex>, predvolen\u00e9 nastavenie je 100 mikrosek\u00fand;<\/li>\n<li><strong>cpu-quota<\/strong> \u2014 po\u010det mikrosek\u00fand v r\u00e1mci <code>cpu-period<\/code>, ktor\u00fdm je kontajner obmedzen\u00fd.<\/li>\n<\/ul>\n<p>\n<strong>\u010co sa stane, ak nastav\u00edte nedostato\u010dn\u00fd po\u017eiadavok na CPU?<\/strong><\/p>\n<p>Ak kontajner potrebuje viac, ako je nastaven\u00e9, ukradne CPU ostatn\u00fdm procesom.<\/p>\n<p><strong>\u010co sa stane, ak nastav\u00edte nedostato\u010dn\u00fd limit CPU?<\/strong><\/p>\n<p>Preto\u017ee je zdroj CPU regulovan\u00fd, za\u010dne obmedzovanie.<\/p>\n<p><strong>\u010co sa stane, ak neur\u010d\u00edte \u017eiados\u0165 CPU?<\/strong><\/p>\n<p>Rovnako ako pri pam\u00e4ti, hodnota po\u017eiadavky je rovn\u00e1 limitu.<\/p>\n<p><strong>\u010co sa stane, ak neuviedete limit CPU?<\/strong><\/p>\n<p>Kontajner bude pou\u017e\u00edva\u0165 to\u013eko CPU, ko\u013eko potrebuje. Ak je v n\u00e1zvovom priestore definovan\u00e1 predvolen\u00e1 politika CPU (LimitRange), tento limit sa pou\u017eije aj pre kontajner.<\/p>\n<p><strong>\u010co sa stane, ak neuviediete po\u017eiadavku ani limit CPU?<\/strong><\/p>\n<p>Rovnako ako pri pam\u00e4ti, toto je najhor\u0161\u00ed scen\u00e1r. Pl\u00e1nova\u010d nevie, ko\u013eko zdrojov v\u00e1\u0161 kontajner potrebuje, a to m\u00f4\u017ee sp\u00f4sobi\u0165 v\u00e1\u017ene probl\u00e9my na uzle. Aby ste tomu predi\u0161li, je potrebn\u00e9 nastavi\u0165 predvolen\u00e9 obmedzenia pre n\u00e1zvov\u00e9 priestory (LimitRange).<\/p>\n<p>Pam\u00e4tajte: ak po\u017eiadate o viac CPU, ako m\u00f4\u017eu poskytn\u00fa\u0165 uzly, Pod nebude napl\u00e1novan\u00fd. <code>Requests.cpu<\/code> \u2014 nie minim\u00e1lna hodnota, ale hodnota dostato\u010dn\u00e1 na spustenie Podu a jeho bezprobl\u00e9mov\u00e9 fungovanie. Ak aplik\u00e1cia nevykon\u00e1va zlo\u017eit\u00fd v\u00fdpo\u010dtov\u00fd proces, najlep\u0161ou vo\u013ebou je nastavi\u0165 <code>request.cpu &lt;= 1<\/code> a spusti\u0165 to\u013eko replik, ko\u013eko je potrebn\u00e9.<\/p>\n<h2>Ide\u00e1lne mno\u017estvo po\u017eadovan\u00fdch zdrojov alebo limitu zdrojov<\/h2>\n<p>\nDozvedeli sme sa o obmedzen\u00ed v\u00fdpo\u010dtov\u00fdch zdrojov. Teraz je \u010das odpoveda\u0165 na ot\u00e1zku: \u201eKo\u013eko zdrojov potrebuje m\u00f4j Pod na to, aby aplik\u00e1cia fungovala bez probl\u00e9mov? Ak\u00e9 mno\u017estvo je ide\u00e1lne?\u201c. <\/p>\n<p>\u017dia\u013e, na tieto ot\u00e1zky nie je jednozna\u010dn\u00e1 odpove\u010f. Ak neviete, ako va\u0161a aplik\u00e1cia funguje, ko\u013eko CPU alebo pam\u00e4te potrebuje, najlep\u0161ou vo\u013ebou je poskytn\u00fa\u0165 aplik\u00e1cii ve\u013ea pam\u00e4te a CPU, a potom spusti\u0165 v\u00fdkonnostn\u00e9 testy.<\/p>\n<p>Okrem v\u00fdkonnostn\u00fdch testov, po dobu jedn\u00e9ho t\u00fd\u017ed\u0148a sledujte spr\u00e1vanie aplik\u00e1cie v monitoringu. Ak z grafov vypl\u00fdva, \u017ee va\u0161a aplik\u00e1cia spotreb\u00fava menej zdrojov, ako ste po\u017eadovali, m\u00f4\u017eete zn\u00ed\u017ei\u0165 mno\u017estvo po\u017eadovan\u00e9ho CPU alebo pam\u00e4te.<\/p>\n<p>Ako pr\u00edklad sa pozrite na tento <noindex><a rel=\"nofollow\" href=\"https:\/\/grafana.com\/grafana\/dashboards\/7187\">dashboard Grafana<\/a><\/noindex>. Zobrazuje rozdiel medzi po\u017eadovan\u00fdmi zdrojmi alebo limitom zdrojov a aktu\u00e1lnym vyu\u017eit\u00edm zdrojov.<\/p>\n<h2>Z\u00e1ver<\/h2>\n<p>\nPo\u017eiadavky a obmedzenia zdrojov pom\u00e1haj\u00fa udr\u017eiava\u0165 funk\u010dnos\u0165 klastrov Kubernetes. Spr\u00e1vna konfigur\u00e1cia limitov minimalizuje n\u00e1klady a neust\u00e1le udr\u017euje aplik\u00e1cie v chode.<\/p>\n<p>Stru\u010dne povedan\u00e9, mali by ste ma\u0165 na pam\u00e4ti nieko\u013eko aspektov:<\/p>\n<ol>\n<li>Po\u017eadovan\u00e9 prostriedky s\u00fa konfigur\u00e1cia, ktor\u00e1 sa zoh\u013ead\u0148uje po\u010das sp\u00fa\u0161\u0165ania (ke\u010f Kubernetes pl\u00e1nuje umiestnenie aplik\u00e1cie). Naopak, obmedzenie prostriedkov je d\u00f4le\u017eit\u00e9 po\u010das prev\u00e1dzky \u2014 ke\u010f u\u017e je aplik\u00e1cia spusten\u00e1 na uzle.<\/li>\n<li>V porovnan\u00ed s pam\u00e4\u0165ou je CPU regulovate\u013en\u00fd prostriedok. V pr\u00edpade nedostatku CPU v\u00e1\u0161 Pod nebude ukon\u010den\u00fd, ale zapne sa mechanizmus spomalenia.<\/li>\n<li>Po\u017eadovan\u00e9 prostriedky a limit prostriedkov nie s\u00fa minim\u00e1lne a maxim\u00e1lne hodnoty! Ur\u010den\u00edm po\u017eadovan\u00fdch prostriedkov zaru\u010dujete, \u017ee aplik\u00e1cia bude fungova\u0165 bez probl\u00e9mov.<\/li>\n<li>Dobrou praxou je nastavi\u0165 po\u017eiadavku na pam\u00e4\u0165, ktor\u00e1 sa rovn\u00e1 limitu pam\u00e4ti.<\/li>\n<li>Je dobr\u00e9 nastavi\u0165 po\u017eiadavku <code>CPU &lt;=1<\/code>, ak aplik\u00e1cia nevykon\u00e1va zlo\u017eit\u00fd v\u00fdpo\u010dtov\u00fd proces.<\/li>\n<li>Ak po\u017eiadate o viac prostriedkov, ako s\u00fa k dispoz\u00edcii na uzle, Pod nikdy nebude napl\u00e1novan\u00fd na tento uzol.<\/li>\n<li>Na ur\u010denie spr\u00e1vneho mno\u017estva po\u017eadovan\u00fdch prostriedkov\/limitov prostriedkov pou\u017eite z\u00e1\u0165a\u017eov\u00e9 testovanie a monitoring.<\/li>\n<\/ol>\n<p>\nD\u00fafam, \u017ee tento \u010dl\u00e1nok v\u00e1m pom\u00f4\u017ee pochopi\u0165 z\u00e1kladn\u00fd koncept obmedzenia prostriedkov. A budete m\u00f4c\u0165 uplatni\u0165 tieto poznatky vo svojej pr\u00e1ci.<\/p>\n<p>Ve\u013ea \u0161\u0165astia!<\/p>\n<p><strong>\u010co \u010fal\u0161ie \u010d\u00edta\u0165:<\/strong><\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500504\/\">Sledovate\u013enos\u0165 SRE: priestory mien a \u0161trukt\u00fara metr\u00edk<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/poleznye-instrumenty-dlya-kubernetes\">90+ u\u017eito\u010dn\u00fdch n\u00e1strojov pre Kubernetes: nasadenie, spr\u00e1va, monitoring, bezpe\u010dnos\u0165 a nielen to<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tele.click\/k8s_mail\">N\u00e1\u0161 kan\u00e1l Okolo Kubernetes na Telegrame<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/516014\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>The Reward by Tohad \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441 Kubernetes \u043e\u0431\u044b\u0447\u043d\u043e \u0437\u0430\u0431\u044b\u0432\u0430\u044e\u0442 \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0437 Docker \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 Kubernetes. \u041d\u043e \u043f\u043e\u0437\u0434\u043d\u0435\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0443\u0436\u043d\u043e \u0432\u044b\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0438\u0445 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94263,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94262","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c Kubernetes Pod | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-14T17:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-14T17:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ako z\u00edska\u0165 pr\u00edstup k prostriedkom Kubernetes Pod | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c Kubernetes Pod | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-poluchit-dostup-k-resursam-kubernetes-pod","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-14T17:42:34+00:00","article:modified_time":"2020-09-14T17:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:30:27","updated":"2022-10-02 18:20:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=94262"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94262\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/94263"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=94262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=94262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=94262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}