[zh] Sync changes to docs/concepts/policy/resource-quotas.md
Also fixed a nit in English version.pull/24894/head
Qiming Teng
parent
06f22a2dc5
commit
4bf6c16cca
|
|
@ -237,7 +237,7 @@ one value. For example:
|
|||
- middle
|
||||
```
|
||||
|
||||
If the `operator` is `Exists` or `DoesNotExist`, the `values field must *NOT* be
|
||||
If the `operator` is `Exists` or `DoesNotExist`, the `values` field must *NOT* be
|
||||
specified.
|
||||
|
||||
### Resource Quota Per PriorityClass
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ Resource quotas are a tool for administrators to address this concern.
|
|||
A resource quota, defined by a `ResourceQuota` object, provides constraints that limit
|
||||
aggregate resource consumption per namespace. It can limit the quantity of objects that can
|
||||
be created in a namespace by type, as well as the total amount of compute resources that may
|
||||
be consumed by resources in that project.
|
||||
be consumed by resources in that namespace.
|
||||
-->
|
||||
资源配额，通过 `ResourceQuota` 对象来定义，对每个命名空间的资源消耗总量提供限制。
|
||||
它可以限制命名空间中某种类型的对象的总数目上限，也可以限制命令空间中的 Pod 可以使用的计算资源的总上限。
|
||||
|
|
@ -43,9 +43,9 @@ Resource quotas work like this:
|
|||
<!--
|
||||
- Different teams work in different namespaces. Currently this is voluntary, but
|
||||
support for making this mandatory via ACLs is planned.
|
||||
- The administrator creates one `ResourceQuota` for each namespace.
|
||||
- The administrator creates one ResourceQuota for each namespace.
|
||||
- Users create resources (pods, services, etc.) in the namespace, and the quota system
|
||||
tracks usage to ensure it does not exceed hard resource limits defined in a `ResourceQuota`.
|
||||
tracks usage to ensure it does not exceed hard resource limits defined in a ResourceQuota.
|
||||
- If creating or updating a resource violates a quota constraint, the request will fail with HTTP
|
||||
status code `403 FORBIDDEN` with a message explaining the constraint that would have been violated.
|
||||
- If quota is enabled in a namespace for compute resources like `cpu` and `memory`, users must specify
|
||||
|
|
@ -55,9 +55,9 @@ Resource quotas work like this:
|
|||
-->
|
||||
- 不同的团队可以在不同的命名空间下工作，目前这是非约束性的，在未来的版本中可能会通过
|
||||
ACL (Access Control List 访问控制列表) 来实现强制性约束。
|
||||
- 集群管理员可以为每个命名空间创建一个或多个资源配额对象。
|
||||
- 集群管理员可以为每个命名空间创建一个或多个 ResourceQuota 对象。
|
||||
- 当用户在命名空间下创建资源（如 Pod、Service 等）时，Kubernetes 的配额系统会
|
||||
跟踪集群的资源使用情况，以确保使用的资源用量不超过资源配额中定义的硬性资源限额。
|
||||
跟踪集群的资源使用情况，以确保使用的资源用量不超过 ResourceQuota 中定义的硬性资源限额。
|
||||
- 如果资源创建或者更新请求违反了配额约束，那么该请求会报错（HTTP 403 FORBIDDEN），
|
||||
并在消息中给出有可能违反的约束。
|
||||
- 如果命名空间下的计算资源 （如 `cpu` 和 `memory`）的配额被启用，则用户必须为
|
||||
|
|
@ -68,10 +68,10 @@ Resource quotas work like this:
|
|||
[演练](/zh/docs/tasks/administer-cluster/manage-resources/quota-memory-cpu-namespace/)示例。
|
||||
|
||||
<!--
|
||||
The name of a `ResourceQuota` object must be a valid
|
||||
The name of a ResourceQuota object must be a valid
|
||||
[DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names).
|
||||
-->
|
||||
ResourceQuota 对象的名称必须时合法的
|
||||
ResourceQuota 对象的名称必须是合法的
|
||||
[DNS 子域名](/zh/docs/concepts/overview/working-with-objects/names#dns-subdomain-names)。
|
||||
|
||||
<!--
|
||||
|
|
@ -103,19 +103,19 @@ Neither contention nor changes to quota will affect already created resources.
|
|||
## Enabling Resource Quota
|
||||
|
||||
Resource Quota support is enabled by default for many Kubernetes distributions. It is
|
||||
enabled when the apiserver `-enable-admission-plugins=` flag has `ResourceQuota` as
|
||||
enabled when the API server `--enable-admission-plugins=` flag has `ResourceQuota` as
|
||||
one of its arguments.
|
||||
-->
|
||||
## 启用资源配额
|
||||
|
||||
资源配额的支持在很多 Kubernetes 版本中是默认开启的。当 apiserver `--enable-admission-plugins=`
|
||||
资源配额的支持在很多 Kubernetes 版本中是默认开启的。当 API 服务器的 `--enable-admission-plugins=`
|
||||
参数中包含 `ResourceQuota` 时，资源配额会被启用。
|
||||
|
||||
<!--
|
||||
A resource quota is enforced in a particular namespace when there is a
|
||||
`ResourceQuota` in that namespace.
|
||||
ResourceQuota in that namespace.
|
||||
-->
|
||||
当命名空间中存在一个 `ResourceQuota` 对象时，对于该命名空间而言，资源配额就是开启的。
|
||||
当命名空间中存在一个 ResourceQuota 对象时，对于该命名空间而言，资源配额就是开启的。
|
||||
|
||||
<!--
|
||||
## Compute Resource Quota
|
||||
|
|
@ -140,6 +140,10 @@ The following resource types are supported:
|
|||
| `limits.memory` | Across all pods in a non-terminal state, the sum of memory limits cannot exceed this value. |
|
||||
| `requests.cpu` | Across all pods in a non-terminal state, the sum of CPU requests cannot exceed this value. |
|
||||
| `requests.memory` | Across all pods in a non-terminal state, the sum of memory requests cannot exceed this value. |
|
||||
| `hugepages-<size>` | Across all pods in a non-terminal state, the number of
|
||||
huge page requests of the specified size cannot exceed this value. |
|
||||
| `cpu` | Same as `requests.cpu` |
|
||||
| `memory` | Same as `requests.memory` |
|
||||
-->
|
||||
| 资源名称 | 描述 |
|
||||
| --------------------- | --------------------------------------------- |
|
||||
|
|
@ -147,6 +151,9 @@ The following resource types are supported:
|
|||
| `limits.memory` | 所有非终止状态的 Pod，其内存限额总量不能超过该值。 |
|
||||
| `requests.cpu` | 所有非终止状态的 Pod，其 CPU 需求总量不能超过该值。 |
|
||||
| `requests.memory` | 所有非终止状态的 Pod，其内存需求总量不能超过该值。 |
|
||||
| `hugepages-<size>` | 对于所有非终止状态的 Pod，针对指定尺寸的巨页请求总数不能超过此值。 |
|
||||
| `cpu` | 与 `requests.cpu` 相同。 |
|
||||
| `memory` | 与 `requests.memory` 相同。 |
|
||||
|
||||
<!--
|
||||
### Resource Quota For Extended Resources
|
||||
|
|
@ -198,16 +205,16 @@ In addition, you can limit consumption of storage resources based on associated
|
|||
| Resource Name | Description |
|
||||
| --------------------- | --------------------------------------------------------- |
|
||||
| `requests.storage` | Across all persistent volume claims, the sum of storage requests cannot exceed this value. |
|
||||
| `persistentvolumeclaims` | The total number of [persistent volume claims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
|
||||
| `<storage-class-name>.storageclass.storage.k8s.io/requests.storage` | Across all persistent volume claims associated with the storage-class-name, the sum of storage requests cannot exceed this value. |
|
||||
| `persistentvolumeclaims` | The total number of [PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
|
||||
| `<storage-class-name>.storageclass.storage.k8s.io/requests.storage` | Across all persistent volume claims associated with the `<storage-class-name>`, the sum of storage requests cannot exceed this value. |
|
||||
| `<storage-class-name>.storageclass.storage.k8s.io/persistentvolumeclaims` | Across all persistent volume claims associated with the storage-class-name, the total number of [persistent volume claims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
|
||||
-->
|
||||
| 资源名称 | 描述 |
|
||||
| --------------------- | ----------------------------------------------------------- |
|
||||
| `requests.storage` | 所有 PVC，存储资源的需求总量不能超过该值。 |
|
||||
| `persistentvolumeclaims` | 在该命名空间中所允许的 [PVC](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) 总量。 |
|
||||
| `<storage-class-name>.storageclass.storage.k8s.io/requests.storage` | 在所有与 storage-class-name 相关的持久卷声明中，存储请求的总和不能超过该值。 |
|
||||
| `<storage-class-name>.storageclass.storage.k8s.io/persistentvolumeclaims` | 在与 storage-class-name 相关的所有持久卷声明中，命名空间中可以存在的[持久卷申领](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)总数。 |
|
||||
| `persistentvolumeclaims` | 在该命名空间中所允许的 [PVC](/zh/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) 总量。 |
|
||||
| `<storage-class-name>.storageclass.storage.k8s.io/requests.storage` | 在所有与 `<storage-class-name>` 相关的持久卷申领中，存储请求的总和不能超过该值。 |
|
||||
| `<storage-class-name>.storageclass.storage.k8s.io/persistentvolumeclaims` | 在与 storage-class-name 相关的所有持久卷申领中，命名空间中可以存在的[持久卷申领](/zh/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)总数。 |
|
||||
|
||||
<!--
|
||||
For example, if an operator wants to quota storage with `gold` storage class separate from `bronze` storage class, the operator can
|
||||
|
|
@ -228,22 +235,29 @@ In release 1.8, quota support for local ephemeral storage is added as an alpha f
|
|||
| ------------------------------- |----------------------------------------------------------- |
|
||||
| `requests.ephemeral-storage` | Across all pods in the namespace, the sum of local ephemeral storage requests cannot exceed this value. |
|
||||
| `limits.ephemeral-storage` | Across all pods in the namespace, the sum of local ephemeral storage limits cannot exceed this value. |
|
||||
| `ephemeral-storage` | Same as `requests.ephemeral-storage`. |
|
||||
-->
|
||||
| 资源名称 | 描述 |
|
||||
| ------------------------------- |----------------------------------------------------------- |
|
||||
| `requests.ephemeral-storage` | 在命名空间的所有 Pod 中，本地临时存储请求的总和不能超过此值。 |
|
||||
| `limits.ephemeral-storage` | 在命名空间的所有 Pod 中，本地临时存储限制值的总和不能超过此值。 |
|
||||
| `ephemeral-storage` | 与 `requests.ephemeral-storage` 相同。 |
|
||||
|
||||
<!--
|
||||
## Object Count Quota
|
||||
|
||||
The 1.9 release added support to quota all standard namespaced resource types using the following syntax:
|
||||
You can set quota for the total number of certain resources of all standard,
|
||||
namespaced resource types using the following syntax:
|
||||
|
||||
* `count/<resource>.<group>` for resources from non-core groups
|
||||
* `count/<resource>` for resources from the core group
|
||||
-->
|
||||
## 对象数量配额
|
||||
|
||||
Kubernetes 1.9 版本增加了使用以下语法对所有标准的、命名空间域的资源类型进行配额设置的支持。
|
||||
你可以使用以下语法对所有标准的、命名空间域的资源类型进行配额设置：
|
||||
|
||||
* `count/<resource>.<group>`
|
||||
* `count/<resource>.<group>`：用于非核心（core）组的资源
|
||||
* `count/<resource>`：用于核心组的资源
|
||||
|
||||
<!--
|
||||
Here is an example set of resources users may want to put under object count quota:
|
||||
|
|
@ -260,33 +274,34 @@ Here is an example set of resources users may want to put under object count quo
|
|||
* `count/statefulsets.apps`
|
||||
* `count/jobs.batch`
|
||||
* `count/cronjobs.batch`
|
||||
* `count/deployments.extensions`
|
||||
|
||||
<!--
|
||||
The 1.15 release added support for custom resources using the same syntax.
|
||||
The same syntax can be used for custom resources.
|
||||
For example, to create a quota on a `widgets` custom resource in the `example.com` API group, use `count/widgets.example.com`.
|
||||
-->
|
||||
Kubernetes 1.15 版本增加了对使用相同语法来约束自定义资源的支持。
|
||||
相同语法也可用于自定义资源。
|
||||
例如，要对 `example.com` API 组中的自定义资源 `widgets` 设置配额，请使用 `count/widgets.example.com`。
|
||||
|
||||
<!--
|
||||
When using `count/*` resource quota, an object is charged against the quota if it exists in server storage.
|
||||
These types of quotas are useful to protect against exhaustion of storage resources. For example, you may
|
||||
want to quota the number of secrets in a server given their large size. Too many secrets in a cluster can
|
||||
actually prevent servers and controllers from starting! You may choose to quota jobs to protect against
|
||||
a poorly configured cronjob creating too many jobs in a namespace causing a denial of service.
|
||||
want to limit the number of Secrets in a server given their large size. Too many Secrets in a cluster can
|
||||
actually prevent servers and controllers from starting. You can set a quota for Jobs to protect against
|
||||
a poorly configured CronJob. CronJobs that create too many Jobs in a namespace can lead to a denial of service.
|
||||
-->
|
||||
当使用 `count/*` 资源配额时，如果对象存在于服务器存储中，则会根据配额管理资源。
|
||||
这些类型的配额有助于防止存储资源耗尽。例如，用户可能想根据服务器的存储能力来对服务器中 Secret 的数量进行配额限制。集群中存在过多的 Secret 实际上会导致服务器和控制器无法启动！用户可以选择对 Job 进行配额管理，以防止配置不当的 CronJob 在某命名空间中创建太多作业而导致集群拒绝服务。
|
||||
|
||||
这些类型的配额有助于防止存储资源耗尽。例如，用户可能想根据服务器的存储能力来对服务器中
|
||||
Secret 的数量进行配额限制。
|
||||
集群中存在过多的 Secret 实际上会导致服务器和控制器无法启动。
|
||||
用户可以选择对 Job 进行配额管理，以防止配置不当的 CronJob 在某命名空间中创建太多 Job 而导致集群拒绝服务。
|
||||
|
||||
<!--
|
||||
Prior to the 1.9 release, it was possible to do generic object count quota on a limited set of resources.
|
||||
It is possible to do generic object count quota on a limited set of resources.
|
||||
In addition, it is possible to further constrain quota for particular resources by their type.
|
||||
|
||||
The following types are supported:
|
||||
-->
|
||||
在 Kubernetes 1.9 版本之前，可以在有限的一组资源上实施一般性的对象数量配额。
|
||||
对有限的一组资源上实施一般性的对象数量配额也是可能的。
|
||||
此外，还可以进一步按资源的类型设置其配额。
|
||||
|
||||
支持以下类型：
|
||||
|
|
@ -294,26 +309,26 @@ The following types are supported:
|
|||
<!--
|
||||
| Resource Name | Description |
|
||||
| ----------------------------|--------------------------------------------- |
|
||||
| `configmaps` | The total number of config maps that can exist in the namespace. |
|
||||
| `persistentvolumeclaims` | The total number of [persistent volume claims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
|
||||
| `pods` | The total number of pods in a non-terminal state that can exist in the namespace. A pod is in a terminal state if `.status.phase in (Failed, Succeeded)` is true. |
|
||||
| `replicationcontrollers` | The total number of replication controllers that can exist in the namespace. |
|
||||
| `resourcequotas` | The total number of [resource quotas](/docs/reference/access-authn-authz/admission-controllers/#resourcequota) that can exist in the namespace. |
|
||||
| `services` | The total number of services that can exist in the namespace. |
|
||||
| `services.loadbalancers` | The total number of services of type load balancer that can exist in the namespace. |
|
||||
| `services.nodeports` | The total number of services of type node port that can exist in the namespace. |
|
||||
| `secrets` | The total number of secrets that can exist in the namespace. |
|
||||
| `configmaps` | The total number of ConfigMaps that can exist in the namespace. |
|
||||
| `persistentvolumeclaims` | The total number of [PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
|
||||
| `pods` | The total number of Pods in a non-terminal state that can exist in the namespace. A pod is in a terminal state if `.status.phase in (Failed, Succeeded)` is true. |
|
||||
| `replicationcontrollers` | The total number of ReplicationControllers that can exist in the namespace. |
|
||||
| `resourcequotas` | The total number of ResourceQuotas that can exist in the namespace. |
|
||||
| `services` | The total number of Services that can exist in the namespace. |
|
||||
| `services.loadbalancers` | The total number of Services of type `LoadBalancer` that can exist in the namespace. |
|
||||
| `services.nodeports` | The total number of Services of type `NodePort` that can exist in the namespace. |
|
||||
| `secrets` | The total number of Secrets that can exist in the namespace. |
|
||||
-->
|
||||
| 资源名称 | 描述 |
|
||||
| ------------------------------- | ------------------------------------------------- |
|
||||
| `configmaps` | 在该命名空间中允许存在的 ConfigMap 总数上限。 |
|
||||
| `persistentvolumeclaims` | 在该命名空间中允许存在的 [PVC](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) 的总数上限。 |
|
||||
| `pods` | 在该命名空间中允许存在的非终止状态的 pod 总数上限。Pod 终止状态等价于 Pod 的 `.status.phase in (Failed, Succeeded)` = true |
|
||||
| `replicationcontrollers` | 在该命名空间中允许存在的 RC 总数上限。 |
|
||||
| `resourcequotas` | 在该命名空间中允许存在的资源配额总数上限。 |
|
||||
| `persistentvolumeclaims` | 在该命名空间中允许存在的 [PVC](/zh/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) 的总数上限。 |
|
||||
| `pods` | 在该命名空间中允许存在的非终止状态的 Pod 总数上限。Pod 终止状态等价于 Pod 的 `.status.phase in (Failed, Succeeded)` 为真。 |
|
||||
| `replicationcontrollers` | 在该命名空间中允许存在的 ReplicationController 总数上限。 |
|
||||
| `resourcequotas` | 在该命名空间中允许存在的 ResourceQuota 总数上限。 |
|
||||
| `services` | 在该命名空间中允许存在的 Service 总数上限。 |
|
||||
| `services.loadbalancers` | 在该命名空间中允许存在的 LoadBalancer 类型的服务总数上限。 |
|
||||
| `services.nodeports` | 在该命名空间中允许存在的 NodePort 类型的服务总数上限。 |
|
||||
| `services.loadbalancers` | 在该命名空间中允许存在的 LoadBalancer 类型的 Service 总数上限。 |
|
||||
| `services.nodeports` | 在该命名空间中允许存在的 NodePort 类型的 Service 总数上限。 |
|
||||
| `secrets` | 在该命名空间中允许存在的 Secret 总数上限。 |
|
||||
|
||||
<!--
|
||||
|
|
@ -328,12 +343,12 @@ exhausts the cluster's supply of Pod IPs.
|
|||
<!--
|
||||
## Quota Scopes
|
||||
|
||||
Each quota can have an associated set of scopes. A quota will only measure usage for a resource if it matches
|
||||
Each quota can have an associated set of `scopes`. A quota will only measure usage for a resource if it matches
|
||||
the intersection of enumerated scopes.
|
||||
-->
|
||||
## 配额作用域 {#quota-scopes}
|
||||
|
||||
每个配额都有一组相关的作用域（scope），配额只会对作用域内的资源生效。
|
||||
每个配额都有一组相关的 `scope`（作用域），配额只会对作用域内的资源生效。
|
||||
配额机制仅统计所列举的作用域的交集中的资源用量。
|
||||
|
||||
<!--
|
||||
|
|
@ -350,6 +365,7 @@ Resources specified on the quota outside of the allowed set results in a validat
|
|||
| `NotTerminating` | Match pods where `.spec.activeDeadlineSeconds is nil` |
|
||||
| `BestEffort` | Match pods that have best effort quality of service. |
|
||||
| `NotBestEffort` | Match pods that do not have best effort quality of service. |
|
||||
| `PriorityClass` | Match pods that references the specified [priority class](/docs/concepts/configuration/pod-priority-preemption). |
|
||||
-->
|
||||
| 作用域 | 描述 |
|
||||
| ----- | ----------- |
|
||||
|
|
@ -357,30 +373,88 @@ Resources specified on the quota outside of the allowed set results in a validat
|
|||
| `NotTerminating` | 匹配所有 `spec.activeDeadlineSeconds` 是 nil 的 Pod。 |
|
||||
| `BestEffort` | 匹配所有 Qos 是 BestEffort 的 Pod。 |
|
||||
| `NotBestEffort` | 匹配所有 Qos 不是 BestEffort 的 Pod。 |
|
||||
| `PriorityClass` | 匹配所有引用了所指定的[优先级类](/zh/docs/concepts/configuration/pod-priority-preemption)的 Pods。 |
|
||||
|
||||
<!--
|
||||
The `BestEffort` scope restricts a quota to tracking the following resource: `pods`
|
||||
The `BestEffort` scope restricts a quota to tracking the following resource:
|
||||
|
||||
The `Terminating`, `NotTerminating`, and `NotBestEffort` scopes restrict a quota to tracking the following resources:
|
||||
-->
|
||||
`BestEffort` 作用域限制配额跟踪以下资源：`pods`
|
||||
|
||||
`Terminating`、`NotTerminating` 和 `NotBestEffort` 这三种作用域限制配额跟踪以下资源：
|
||||
|
||||
* `cpu`
|
||||
* `limits.cpu`
|
||||
* `limits.memory`
|
||||
* `memory`
|
||||
* `pods`
|
||||
|
||||
The `Terminating`, `NotTerminating`, `NotBestEffort` and `PriorityClass`
|
||||
scopes restrict a quota to tracking the following resources:
|
||||
-->
|
||||
`BestEffort` 作用域限制配额跟踪以下资源：
|
||||
|
||||
* `pods`
|
||||
|
||||
`Terminating`、`NotTerminating`、`NotBestEffort` 和 `PriorityClass` 这些作用域限制配额跟踪以下资源：
|
||||
|
||||
* `pods`
|
||||
* `cpu`
|
||||
* `memory`
|
||||
* `requests.cpu`
|
||||
* `requests.memory`
|
||||
* `limits.cpu`
|
||||
* `limits.memory`
|
||||
|
||||
<!--
|
||||
Note that you cannot specify both the `Terminating` and the `NotTerminating`
|
||||
scopes in the same quota, and you cannot specify both the `BestEffort` and
|
||||
`NotBestEffort` scopes in the same quota either.
|
||||
|
||||
The `scopeSelector` supports the following values in the `operator` field:
|
||||
-->
|
||||
需要注意的是，你不可以在同一个配额对象中同时设置 `Terminating` 和 `NotTerminating`
|
||||
作用域，你也不可以在同一个配额中同时设置 `BestEffort` 和 `NotBestEffort`
|
||||
作用域。
|
||||
|
||||
`scopeSelector` 支持在 `operator` 字段中使用以下值：
|
||||
|
||||
* `In`
|
||||
* `NotIn`
|
||||
* `Exists`
|
||||
* `DoesNotExist`
|
||||
|
||||
<!--
|
||||
When using one of the following values as the `scopeName` when defining the
|
||||
`scopeSelector`, the `operator` must be `Exists`.
|
||||
-->
|
||||
定义 `scopeSelector` 时，如果使用以下值之一作为 `scopeName` 的值，则对应的
|
||||
`operator` 只能是 `Exists`。
|
||||
|
||||
* `Terminating`
|
||||
* `NotTerminating`
|
||||
* `BestEffort`
|
||||
* `NotBestEffort`
|
||||
|
||||
<!--
|
||||
If the `operator` is `In` or `NotIn`, the `values` field must have at least
|
||||
one value. For example:
|
||||
-->
|
||||
如果 `operator` 是 `In` 或 `NotIn` 之一，则 `values` 字段必须至少包含一个值。
|
||||
例如：
|
||||
|
||||
```yaml
|
||||
scopeSelector:
|
||||
matchExpressions:
|
||||
- scopeName: PriorityClass
|
||||
operator: In
|
||||
values:
|
||||
- middle
|
||||
```
|
||||
|
||||
<!--
|
||||
If the `operator` is `Exists` or `DoesNotExist`, the `values field must *NOT* be
|
||||
specified.
|
||||
-->
|
||||
如果 `operator` 为 `Exists` 或 `DoesNotExist`，则*不*可以设置 `values` 字段。
|
||||
|
||||
<!--
|
||||
### Resource Quota Per PriorityClass
|
||||
-->
|
||||
### 基于优先级类（PriorityClass）来设置资源配额
|
||||
|
||||
{{< feature-state for_k8s_version="1.12" state="beta" >}}
|
||||
{{< feature-state for_k8s_version="v1.17" state="stable" >}}
|
||||
|
||||
<!--
|
||||
Pods can be created at a specific [priority](/docs/concepts/configuration/pod-priority-preemption/#pod-priority).
|
||||
|
|
@ -392,12 +466,30 @@ Pod 可以创建为特定的[优先级](/docs/concepts/configuration/pod-priorit
|
|||
|
||||
<!--
|
||||
A quota is matched and consumed only if `scopeSelector` in the quota spec selects the pod.
|
||||
|
||||
This example creates a quota object and matches it with pods at specific priorities. The example
|
||||
works as follows:
|
||||
-->
|
||||
仅当配额规范中的 `scopeSelector` 字段选择到某 Pod 时，配额机制才会匹配和计量 Pod 的资源消耗。
|
||||
|
||||
<!--
|
||||
When quota is scoped for priority class using `scopeSelector` field, quota object is restricted to track only following resources:
|
||||
-->
|
||||
如果配额对象通过 `scopeSelector` 字段设置其作用域为优先级类，则配额对象只能
|
||||
跟踪以下资源：
|
||||
|
||||
* `pods`
|
||||
* `cpu`
|
||||
* `memory`
|
||||
* `ephemeral-storage`
|
||||
* `limits.cpu`
|
||||
* `limits.memory`
|
||||
* `limits.ephemeral-storage`
|
||||
* `requests.cpu`
|
||||
* `requests.memory`
|
||||
* `requests.ephemeral-storage`
|
||||
|
||||
<!--
|
||||
This example creates a quota object and matches it with pods at specific priorities. The example
|
||||
works as follows:
|
||||
-->
|
||||
本示例创建一个配额对象，并将其与具有特定优先级的 Pod 进行匹配。
|
||||
该示例的工作方式如下：
|
||||
|
||||
|
|
@ -586,16 +678,6 @@ memory 0 20Gi
|
|||
pods 0 10
|
||||
```
|
||||
|
||||
<!--
|
||||
`scopeSelector` supports the following values in the `operator` field:
|
||||
-->
|
||||
`scopeSelector` 在 `operator` 字段中支持以下值：
|
||||
|
||||
* `In`
|
||||
* `NotIn`
|
||||
* `Exist`
|
||||
* `DoesNotExist`
|
||||
|
||||
<!--
|
||||
## Requests vs Limits
|
||||
|
||||
|
|
@ -725,11 +807,11 @@ kubectl create namespace myspace
|
|||
```
|
||||
|
||||
```shell
|
||||
kubectl create quota test --hard=count/deployments.extensions=2,count/replicasets.extensions=4,count/pods=3,count/secrets=4 --namespace=myspace
|
||||
kubectl create quota test --hard=count/deployments.apps=2,count/replicasets.apps=4,count/pods=3,count/secrets=4 --namespace=myspace
|
||||
```
|
||||
|
||||
```shell
|
||||
kubectl create deployment nginx --image=nginx --namespace=myspace
|
||||
kubectl create deployment nginx --image=nginx --namespace=myspace --replicas=2
|
||||
```
|
||||
|
||||
```shell
|
||||
|
|
@ -741,37 +823,37 @@ Name: test
|
|||
Namespace: myspace
|
||||
Resource Used Hard
|
||||
-------- ---- ----
|
||||
count/deployments.extensions 1 2
|
||||
count/deployments.apps 1 2
|
||||
count/pods 2 3
|
||||
count/replicasets.extensions 1 4
|
||||
count/replicasets.apps 1 4
|
||||
count/secrets 1 4
|
||||
```
|
||||
|
||||
<!--
|
||||
## Quota and Cluster Capacity
|
||||
|
||||
`ResourceQuotas` are independent of the cluster capacity. They are
|
||||
ResourceQuotas are independent of the cluster capacity. They are
|
||||
expressed in absolute units. So, if you add nodes to your cluster, this does *not*
|
||||
automatically give each namespace the ability to consume more resources.
|
||||
-->
|
||||
## 配额和集群容量 {#quota-and-cluster-capacity}
|
||||
|
||||
资源配额与集群资源总量是完全独立的。它们通过绝对的单位来配置。
|
||||
ResourceQuota 与集群资源总量是完全独立的。它们通过绝对的单位来配置。
|
||||
所以，为集群添加节点时，资源配额*不会*自动赋予每个命名空间消耗更多资源的能力。
|
||||
|
||||
<!--
|
||||
Sometimes more complex policies may be desired, such as:
|
||||
|
||||
- Proportionally divide total cluster resources among several teams.
|
||||
- Allow each tenant to grow resource usage as needed, but have a generous
|
||||
limit to prevent accidental resource exhaustion.
|
||||
- Detect demand from one namespace, add nodes, and increase quota.
|
||||
- Proportionally divide total cluster resources among several teams.
|
||||
- Allow each tenant to grow resource usage as needed, but have a generous
|
||||
limit to prevent accidental resource exhaustion.
|
||||
- Detect demand from one namespace, add nodes, and increase quota.
|
||||
-->
|
||||
有时可能需要资源配额支持更复杂的策略，比如：
|
||||
|
||||
- 在几个团队中按比例划分总的集群资源。
|
||||
- 允许每个租户根据需要增加资源使用量，但要有足够的限制以防止资源意外耗尽。
|
||||
- 探测某个命名空间的需求，添加物理节点并扩大资源配额值。
|
||||
- 在几个团队中按比例划分总的集群资源。
|
||||
- 允许每个租户根据需要增加资源使用量，但要有足够的限制以防止资源意外耗尽。
|
||||
- 探测某个命名空间的需求，添加物理节点并扩大资源配额值。
|
||||
|
||||
<!--
|
||||
Such policies could be implemented using `ResourceQuotas` as building blocks, by
|
||||
|
|
@ -790,7 +872,8 @@ restrictions around nodes: pods from several namespaces may run on the same node
|
|||
<!--
|
||||
## Limit Priority Class consumption by default
|
||||
|
||||
It may be desired that pods at a particular priority, eg. "cluster-services", should be allowed in a namespace, if and only if, a matching quota object exists.
|
||||
It may be desired that pods at a particular priority, eg. "cluster-services",
|
||||
should be allowed in a namespace, if and only if, a matching quota object exists.
|
||||
-->
|
||||
## 默认情况下限制特定优先级的资源消耗
|
||||
|
||||
|
|
@ -798,18 +881,19 @@ It may be desired that pods at a particular priority, eg. "cluster-services", sh
|
|||
（例如 "cluster-services"）的 Pod。
|
||||
|
||||
<!--
|
||||
With this mechanism, operators will be able to restrict usage of certain high priority classes to a limited number of namespaces and not every namespace will be able to consume these priority classes by default.
|
||||
With this mechanism, operators will be able to restrict usage of certain high
|
||||
priority classes to a limited number of namespaces and not every namespace
|
||||
will be able to consume these priority classes by default.
|
||||
-->
|
||||
通过这种机制，操作人员能够将限制某些高优先级类仅出现在有限数量的命名空间中，
|
||||
而并非每个命名空间默认情况下都能够使用这些优先级类。
|
||||
|
||||
<!--
|
||||
To enforce this, kube-apiserver flag `-admission-control-config-file` should be used to pass path to the following configuration file:
|
||||
To enforce this, kube-apiserver flag `-admission-control-config-file` should be
|
||||
used to pass path to the following configuration file:
|
||||
-->
|
||||
要实现此目的，应使用 kube-apiserver 标志 `--admission-control-config-file` 传递如下配置文件的路径：
|
||||
|
||||
{{< tabs name="example1" >}}
|
||||
{{% tab name="apiserver.config.k8s.io/v1" %}}
|
||||
```yaml
|
||||
apiVersion: apiserver.config.k8s.io/v1
|
||||
kind: AdmissionConfiguration
|
||||
|
|
@ -825,27 +909,6 @@ plugins:
|
|||
operator: In
|
||||
values: ["cluster-services"]
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="apiserver.k8s.io/v1alpha1" %}}
|
||||
```yaml
|
||||
# 在 Kubernetes 1.17 中已不推荐使用，请使用 apiserver.config.k8s.io/v1
|
||||
apiVersion: apiserver.k8s.io/v1alpha1
|
||||
kind: AdmissionConfiguration
|
||||
plugins:
|
||||
- name: "ResourceQuota"
|
||||
configuration:
|
||||
# 在 Kubernetes 1.17 中已不推荐使用，请使用 apiserver.config.k8s.io/v1, ResourceQuotaConfiguration
|
||||
apiVersion: resourcequota.admission.k8s.io/v1beta1
|
||||
kind: Configuration
|
||||
limitedResources:
|
||||
- resource: pods
|
||||
matchScopes:
|
||||
- scopeName: PriorityClass
|
||||
operator: In
|
||||
values: ["cluster-services"]
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{< /tabs >}}
|
||||
|
||||
<!--
|
||||
Now, "cluster-services" pods will be allowed in only those namespaces where a quota object with a matching `scopeSelector` is present.
|
||||
|
|
@ -864,25 +927,17 @@ For example:
|
|||
values: ["cluster-services"]
|
||||
```
|
||||
|
||||
<!--
|
||||
See [LimitedResources](https://github.com/kubernetes/kubernetes/pull/36765) and [Quota support for priority class design doc](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/scheduling/pod-priority-resourcequota.md) for more information.
|
||||
-->
|
||||
有关更多信息，请参见 [LimitedResources](https://github.com/kubernetes/kubernetes/pull/36765) 和
|
||||
[优先级类配额支持的设计文档](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/scheduling/pod-priority-resourcequota.md)。
|
||||
|
||||
<!--
|
||||
## Example
|
||||
|
||||
See a [detailed example for how to use resource quota](/docs/tasks/administer-cluster/quota-api-object/).
|
||||
-->
|
||||
## 示例
|
||||
|
||||
查看[如何使用资源配额的详细示例](/zh/docs/tasks/administer-cluster/quota-api-object/)。
|
||||
|
||||
## {{% heading "whatsnext" %}}
|
||||
|
||||
<!--
|
||||
- See [ResourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_resource_quota.md) for more information.
|
||||
- See a [detailed example for how to use resource quota](/docs/tasks/administer-cluster/quota-api-object/).
|
||||
- Read [Quota support for priority class design doc](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/scheduling/pod-priority-resourcequota.md).
|
||||
- See [LimitedResources](https://github.com/kubernetes/kubernetes/pull/36765)
|
||||
-->
|
||||
- 查看[资源配额设计文档](https://git.k8s.io/community/contributors/design-proposals/resource-management/admission_control_resource_quota.md)
|
||||
- 查看[如何使用资源配额的详细示例](/zh/docs/tasks/administer-cluster/quota-api-object/)。
|
||||
- 阅读[优先级类配额支持的设计文档](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/scheduling/pod-priority-resourcequota.md)。
|
||||
了解更多信息。
|
||||
- 参阅[LimitedResources](https://github.com/kubernetes/kubernetes/pull/36765)
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue