京公网安备11010502063487号没写 resources 的 Pod 是怎么得到 requests 和 limits 的?默认值太离谱会怎样?越界的请求怎么被拒绝?这篇建一个 LimitRange,把默认值、部分指定、越界拒绝、PVC 范围以及“改了之后只影响新 Pod”这几件事逐个跑出来,还撞上了一个默认值与比例冲突的坑。
默认 limit cpu 500m、默认 request cpu 100m(比例 5,而 maxLimitRequestRatio 是 4):创建 Pod plain 退出码 1;Error from server (Forbidden): error when creating "STDIN": pods "plain" is forbidden: cpu max limit to request ratio per Container is 4, but provided ratio is 5.000000
把默认 limit 改成 cpu 400m(比例 4)之后:
Pod plain(没写 resources):requests={'cpu': '100m', 'memory': '128Mi'} limits={'cpu': '400m', 'memory': '256Mi'} qos=Burstable
注解:{'kubernetes.io/limit-ranger': 'LimitRanger plugin set: cpu, memory request for container c; cpu, memory limit for container c'}LimitRange 声明:容器默认 limit cpu 500m / memory 256Mi,默认 request cpu 100m / memory 128Mi,maxLimitRequestRatio cpu 为 4。结果什么都没写的 Pod 被拒了:cpu max limit to request ratio per Container is 4, but provided ratio is 5.000000——补默认值发生在变更准入,补完的结果还要过校验。把默认 limit 改成 400m(比例 4)之后,Pod 被补成 requests {cpu: 100m, memory: 128Mi}、limits {cpu: 400m, memory: 256Mi},QoS 是 Burstable,注解 kubernetes.io/limit-ranger 记着补了哪几项。
only-limit-cpu 写了 {limits: {cpu: 200m}} → requests={'cpu': '200m', 'memory': '128Mi'} limits={'cpu': '200m', 'memory': '256Mi'} qos=Burstable
only-req-mem 写了 {requests: {memory: 100Mi}} → requests={'cpu': '100m', 'memory': '100Mi'} limits={'cpu': '400m', 'memory': '256Mi'} qos=Burstable
full 写了 {requests: {cpu: 100m, memory: 100Mi}, limits: {cpu: 300m, memory: 200Mi}} → requests={'cpu': '100m', 'memory': '100Mi'} limits={'cpu': '300m', 'memory': '200Mi'} qos=Burstable只写 limits.cpu: 200m,requests.cpu 也变成 200m(request 缺省取 limit 的值,不再用 defaultRequest),memory 的 request 补 128Mi、limit 补 256Mi;只写 requests.memory: 100Mi,cpu 的 request 补 100m、limit 补 400m,memory limit 补 256Mi;四项都写全则一个都不改。逐容器、逐资源地补缺。
cpu 请求 2 核(max 是 1):退出码 1;Error from server (Forbidden): error when creating "STDIN": pods "too-big" is forbidden: maximum cpu usage per Container is 1, but limit is 2 memory 请求 10Mi(min 是 64Mi):退出码 1;Error from server (Forbidden): error when creating "STDIN": pods "too-small" is forbidden: minimum memory usage per Container is 64Mi, but request is 10Mi cpu limit/request = 9(最大 4):退出码 1;Error from server (Forbidden): error when creating "STDIN": pods "big-ratio" is forbidden: cpu max limit to request ratio per Container is 4, but provided ratio is 9.000000 memory limit 1Gi(max 是 512Mi):退出码 1;Error from server (Forbidden): error when creating "STDIN": pods "mem-over" is forbidden: maximum memory usage per Container is 512Mi, but limit is 1Gi
准入时逐条校验:cpu 2 核超过 max 1(maximum cpu usage per Container is 1, but limit is 2);memory request 10Mi 低于 min 64Mi;cpu limit 900m / request 100m 的比例 9 超过 4;memory limit 1Gi 超过 512Mi。报错都写明了限制值和提交的值。
PVC pvc-ok(storage 500Mi):退出码 0;persistentvolumeclaim/pvc-ok created
PVC pvc-big(storage 5Gi):退出码 1;Error from server (Forbidden): error when creating "STDIN": persistentvolumeclaims "pvc-big" is forbidden: maximum storage usage per PersistentVolumeClaim is 1Gi, but request is 5Gi
PVC pvc-small(storage 1Mi):退出码 1;Error from server (Forbidden): error when creating "STDIN": persistentvolumeclaims "pvc-small" is forbidden: minimum storage usage per PersistentVolumeClaim is 10Mi, but request is 1Mi
把 LimitRange 的默认 limit 改成 cpu 800m / memory 400Mi(默认 request cpu 改成 200m)之后:已有的 Pod old 仍是 requests={'cpu': '100m', 'memory': '128Mi'} limits={'cpu': '400m', 'memory': '256Mi'}(没变:True);新建的 Pod new 是 requests={'cpu': '200m', 'memory': '128Mi'} limits={'cpu': '800m', 'memory': '400Mi'}LimitRange 的 type: PersistentVolumeClaim 约束 storage:5Gi 超过 1Gi、1Mi 低于 10Mi 都被拒绝,500Mi 通过。LimitRange 只在对象创建时起作用:把默认 limit 改成 800m / 400Mi 之后,已有的 Pod old 保持原来的值,新建的 Pod 才拿到新默认值。所以改了 LimitRange 不会“修正”已经在运行的 Pod。