Skip to content

Commit 1b9a962

Browse files
authored
Merge pull request #34164 from windsonsea/yhfdoc
[zh] resync windows pages: intro.md and windows-resource-management.md
2 parents 6327ca0 + 283ead0 commit 1b9a962

File tree

2 files changed

+82
-78
lines changed

2 files changed

+82
-78
lines changed

content/zh/docs/concepts/configuration/windows-resource-management.md

Lines changed: 54 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -46,90 +46,89 @@ Linux cgroup API 可用于收集 CPU、I/O 和内存使用统计数据。
4646
容器不能使用来自主机的标识,因为安全帐户管理器(Security Account Manager,SAM)是独立的。
4747

4848
<!--
49-
## Memory reservations {#resource-management-memory}
49+
## Memory management {#resource-management-memory}
5050
5151
Windows does not have an out-of-memory process killer as Linux does. Windows always
5252
treats all user-mode memory allocations as virtual, and pagefiles are mandatory.
5353
54-
Windows nodes do not overcommit memory for processes running in containers. The
54+
Windows nodes do not overcommit memory for processes. The
5555
net effect is that Windows won't reach out of memory conditions the same way Linux
5656
does, and processes page to disk instead of being subject to out of memory (OOM)
5757
termination. If memory is over-provisioned and all physical memory is exhausted,
5858
then paging can slow down performance.
5959
-->
60-
## 内存预留 {#resource-management-memory}
60+
## 内存管理 {#resource-management-memory}
6161

6262
Windows 不像 Linux 一样提供杀手(killer)机制,杀死内存不足的进程。
6363
Windows 始终将所有用户态内存分配视为虚拟内存,并强制使用页面文件(pagefile)。
6464

65-
Windows 节点不会为容器中运行的进程过量使用内存
65+
Windows 节点不会为进程过量使用内存
6666
最终结果是 Windows 不会像 Linux 那样达到内存不足的情况,Windows 将进程页面放到磁盘,
6767
不会因为内存不足(OOM)而终止进程。
6868
如果内存配置过量且所有物理内存都已耗尽,则换页性能就会降低。
69-
7069
<!--
71-
You can place bounds on memory use for workloads using the kubelet
72-
parameters `--kubelet-reserve` and/or `--system-reserve`; these account
73-
for memory usage on the node (outside of containers), and reduce
74-
[NodeAllocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable).
75-
As you deploy workloads, set resource limits on containers. This also subtracts from `NodeAllocatable` and prevents the scheduler from adding more pods once a node is full.
70+
## CPU management {#resource-management-cpu}
71+
72+
Windows can limit the amount of CPU time allocated for different processes but cannot
73+
guarantee a minimum amount of CPU time.
74+
75+
On Windows, the kubelet supports a command-line flag to set the
76+
[scheduling priority](https://docs.microsoft.com/windows/win32/procthread/scheduling-priorities) of the
77+
kubelet process: `--windows-priorityclass`. This flag allows the kubelet process to get
78+
more CPU time slices when compared to other processes running on the Windows host.
79+
More information on the allowable values and their meaning is available at
80+
[Windows Priority Classes](https://docs.microsoft.com/en-us/windows/win32/procthread/scheduling-priorities#priority-class).
81+
To ensure that running Pods do not starve the kubelet of CPU cycles, set this flag to `ABOVE_NORMAL_PRIORITY_CLASS` or above.
7682
-->
77-
你可以使用 kubelet 的 `--kubelet-reserve` 和/或 `--system-reserve`
78-
参数设定工作负载的内存使用边界;这些参数负责表示节点上(容器外)的内存用量,并会减少
79-
[节点可分配(NodeAllocatable)](/zh/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)内存量。
80-
在你部署工作负载时,会对容器设置资源限制值。
81-
这个限制值也会从 `NodeAllocatable` 中减去,并防止调度器在节点已满时增加更多 Pod。
83+
## CPU 管理 {#resource-management-cpu}
84+
85+
Windows 可以限制为不同进程分配的 CPU 时间长度,但无法保证最小的 CPU 时间长度。
86+
87+
在 Windows 上,kubelet 支持使用命令行标志来设置 kubelet 进程的[调度优先级](https://docs.microsoft.com/zh-cn/windows/win32/procthread/scheduling-priorities)
88+
`--windows-priorityclass`
89+
与 Windows 主机上运行的其他进程相比,此标志允许 kubelet 进程获取更多的 CPU 时间片。
90+
有关允许值及其含义的更多信息,请访问 [Windows 优先级类](https://docs.microsoft.com/zh-cn/windows/win32/procthread/scheduling-priorities#priority-class)
91+
为了确保运行的 Pod 不会耗尽 kubelet 的 CPU 时钟周期,
92+
要将此标志设置为 `ABOVE_NORMAL_PRIORITY_CLASS` 或更高。
8293

8394
<!--
84-
When you set memory resource limits for Windows containers, you should either set a limit and leave the memory request unspecified, or set the request equal to the limit.
95+
## Resource reservation {#resource-reservation}
8596
86-
On Windows, good practice to avoid over-provisioning is to configure the kubelet
87-
with a system reserved memory of at least 2GiB to account for Windows, Kubernetes
88-
and container runtime overheads.
97+
To account for memory and CPU used by the operating system, the container runtime, and by
98+
Kubernetes host processes such as the kubelet, you can (and should) reserve
99+
memory and CPU resources with the `--kube-reserved` and/or `--system-reserved` kubelet flags.
100+
On Windows these values are only used to calculate the node's
101+
[allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) resources.
89102
-->
90-
{{< note >}}
91-
当你为 Windows 容器设置内存资源限制时,你应设置一个内存限制但不指定内存请求,
92-
或将请求值设为等于限制值。
93-
{{< /note >}}
103+
## 资源预留 {#resource-reservation}
94104

95-
在 Windows 上,避免过量配置的良好做法是为 kubelet 配置至少 2GiB 的系统预留内存,
96-
以满足 Windows、Kubernetes 和容器运行时开销。
105+
为了满足操作系统、容器运行时和 kubelet 等 Kubernetes 主机进程使用的内存和 CPU,
106+
你可以(且应该)用 `--kube-reserved` 和/或 `--system-reserved` kubelet 标志来预留内存和 CPU 资源。
107+
在 Windows 上,这些值仅用于计算节点的[可分配](/zh/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)资源。
97108

98109
<!--
99-
## CPU reservations {#resource-management-cpu}
110+
As you deploy workloads, set resource memory and CPU limits on containers.
111+
This also subtracts from `NodeAllocatable` and helps the cluster-wide scheduler in determining which pods to place on which nodes.
100112
101-
To account for CPU use by the operating system, the container runtime, and by
102-
Kubernetes host processes such as the kubelet, you can (and should) reserve a
103-
percentage of total CPU. You should determine this CPU reservation taking account of to the number of CPU cores available on the node. To decide on the CPU percentage to reserve, identify the maximum pod density for each node and monitor the CPU usage of the system services running there, then choose a value that meets your workload needs.
113+
Scheduling pods without limits may over-provision the Windows nodes and in extreme
114+
cases can cause the nodes to become unhealthy.
104115
-->
105-
## CPU 预留 {#resource-management-cpu}
116+
{{< caution >}}
117+
在你部署工作负载时,需对容器设置内存和 CPU 资源的限制。
118+
这也会从 `NodeAllocatable` 中减去,帮助集群范围的调度器决定哪些 Pod 放到哪些节点上。
106119

107-
为了满足操作系统、容器运行时和 kubelet 等 Kubernetes 主机进程的 CPU 使用量,
108-
你可以(且应该)从 CPU 总量中预留一定百分比。
109-
你应该根据节点上可用的 CPU 核数来确定这个 CPU 预留量。
110-
要决定预留的 CPU 百分比,需确定每个节点的最大 Pod 密度,
111-
并监控节点上运行的系统服务的 CPU 使用量,然后选择一个满足工作负载需求的值。
120+
若调度 Pod 时未设置限制值,可能对 Windows 节点过量配置资源。
121+
在极端情况下,这会让节点变得不健康。
122+
{{< /caution >}}
112123

113124
<!--
114-
You can place bounds on CPU usage for workloads using the
115-
kubelet parameters `--kubelet-reserve` and/or `--system-reserve` to
116-
account for CPU usage on the node (outside of containers).
117-
This reduces `NodeAllocatable`.
118-
The cluster-wide scheduler then takes this reservation into account when determining pod placement.
119-
120-
On Windows, the kubelet supports a command-line flag to set the priority of the
121-
kubelet process: `--windows-priorityclass`. This flag allows the kubelet process to get more CPU time slices when compared to other processes running on the Windows host.
122-
More information on the allowable values and their meaning is available at
123-
[Windows Priority Classes](https://docs.microsoft.com/en-us/windows/win32/procthread/scheduling-priorities#priority-class).
124-
To ensure that running Pods do not starve the kubelet of CPU cycles, set this flag to `ABOVE_NORMAL_PRIORITY_CLASS` or above.
125+
On Windows, a good practice is to reserve at least 2GiB of memory.
126+
127+
To determine how much CPU to reserve,
128+
identify the maximum pod density for each node and monitor the CPU usage of
129+
the system services running there, then choose a value that meets your workload needs.
125130
-->
126-
你可以使用 kubelet 的 `--kubelet-reserve` 和/或 `--system-reserve`
127-
参数设定工作负载的 CPU 使用边界,以统计节点上(容器外)的 CPU 使用量。
128-
这会减少 `NodeAllocatable`
129-
然后集群范围的调度器在决定放置 Pod 时会考虑这个预留量。
131+
在 Windows 上,一种好的做法是预留至少 2GiB 的内存。
130132

131-
在 Windows 上,kubelet 支持使用命令行标志来设置 kubelet 进程的优先级:`--windows-priorityclass`
132-
与 Windows 主机上运行的其他进程相比,此标志允许 kubelet 进程获取更多的 CPU 时间片。
133-
有关允许值及其含义的更多信息,请访问 [Windows 优先级类](https://docs.microsoft.com/zh-cn/windows/win32/procthread/scheduling-priorities#priority-class)
134-
为了确保运行的 Pod 不会耗尽 kubelet 的 CPU 时钟周期,
135-
要将此标志设置为 `ABOVE_NORMAL_PRIORITY_CLASS` 或更高。
133+
要决定预留多少 CPU,需明确每个节点的最大 Pod 密度,
134+
并监控节点上运行的系统服务的 CPU 使用率,然后选择一个满足工作负载需求的值。

content/zh/docs/concepts/windows/intro.md

Lines changed: 28 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -81,17 +81,19 @@ Some node features are only available if you use a specific
8181
including:
8282
8383
* HugePages: not supported for Windows containers
84-
* Privileged containers: not supported for Windows containers
84+
* Privileged containers: not supported for Windows containers.
85+
[HostProcess Containers](/docs/tasks/configure-pod-container/create-hostprocess-pod/) offer similar functionality.
8586
* TerminationGracePeriod: requires containerD
8687
-->
8788
## 兼容性与局限性 {#limitations}
8889

8990
某些节点层面的功能特性仅在使用特定[容器运行时](#container-runtime)时才可用;
9091
另外一些特性则在 Windows 节点上不可用,包括:
9192

92-
* 巨页(HugePages):Windows 容器当前不支持
93-
* 特权容器:Windows 容器当前不支持
94-
* TerminationGracePeriod:需要 containerD
93+
* 巨页(HugePages):Windows 容器当前不支持。
94+
* 特权容器:Windows 容器当前不支持。
95+
[HostProcess 容器](/zh/docs/tasks/configure-pod-container/create-hostprocess-pod/)提供类似功能。
96+
* TerminationGracePeriod:需要 containerD。
9597

9698
<!--
9799
Not all features of shared namespaces are supported. See [API compatibility](#api)
@@ -133,7 +135,7 @@ Kubernetes 关键组件在 Windows 上的工作方式与在 Linux 上相同。
133135
Pod capabilities, properties and events are supported with Windows containers:
134136
* Single or multiple containers per Pod with process isolation and volume sharing
135137
* Pod `status` fields
136-
* Readiness and Liveness probes
138+
* Readiness, liveness, and startup probes
137139
* postStart & preStop container lifecycle hooks
138140
* ConfigMap, Secrets: as environment variables or volumes
139141
* `emptyDir` volumes
@@ -163,7 +165,7 @@ Kubernetes 关键组件在 Windows 上的工作方式与在 Linux 上相同。
163165

164166
* 每个 Pod 有一个或多个容器,具有进程隔离和卷共享能力
165167
* Pod `status` 字段
166-
* Readiness 和 Liveness 探针
168+
* 就绪、存活和启动探针
167169
* postStart 和 preStop 容器生命周期回调
168170
* ConfigMap 和 Secret:作为环境变量或卷
169171
* `emptyDir`
@@ -270,10 +272,11 @@ Some kubelet command line options behave differently on Windows, as described be
270272
[NodeAllocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)
271273
* Eviction by using `--enforce-node-allocable` is not implemented
272274
* Eviction by using `--eviction-hard` and `--eviction-soft` are not implemented
273-
* A kubelet running on a Windows node does not have memory
274-
restrictions. `--kubelet-reserve` and `--system-reserve` do not set limits on
275-
kubelet or processes running on the host. This means kubelet or a process on the host
276-
could cause memory resource starvation outside the node-allocatable and scheduler.
275+
* When running on a Windows node the kubelet does not have memory or CPU
276+
restrictions. `--kube-reserved` and `--system-reserved` only subtract from `NodeAllocatable`
277+
and do not guarantee resource provided for workloads.
278+
See [Resource Management for Windows nodes](/docs/concepts/configuration/windows-resource-management/#resource-reservation)
279+
for more information.
277280
* The `MemoryPressure` Condition is not implemented
278281
* The kubelet does not take OOM eviction actions
279282
-->
@@ -283,10 +286,9 @@ Some kubelet command line options behave differently on Windows, as described be
283286
[NodeAllocatable](/zh/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)
284287
* 未实现使用 `--enforce-node-allocable` 驱逐。
285288
* 未实现使用 `--eviction-hard``--eviction-soft` 驱逐。
286-
* 在 Windows 节点上运行的 kubelet 没有内存限制。
287-
`--kubelet-reserve``--system-reserve` 没有对主机上运行的 kubelet 或进程设置限制。
288-
这意味着 kubelet 或主机上的进程使用的内存可能会超过节点可分配内存和调度器设定的内存,
289-
从而造成内存资源不足。
289+
* 在 Windows 节点上运行时,kubelet 没有内存或 CPU 限制。
290+
`--kube-reserved``--system-reserved` 仅从 `NodeAllocatable` 中减去,并且不保证为工作负载提供的资源。
291+
有关更多信息,请参考 [Windows 节点的资源管理](/zh/docs/concepts/configuration/windows-resource-management/#resource-reservation)
290292
* 未实现 `MemoryPressure` 条件。
291293
* kubelet 不会执行 OOM 驱逐操作。
292294

@@ -488,15 +490,17 @@ Pod 的所有 [`securityContext`](/docs/reference/kubernetes-api/workload-resour
488490
字段都无法在 Windows 上生效。
489491

490492
<!--
491-
### Node problem detector
493+
## Node problem detector
492494
493495
The node problem detector (see
494496
[Monitor Node Health](/docs/tasks/debug/debug-cluster/monitor-node-health/))
495-
is not compatible with Windows.
497+
has preliminary support for Windows.
498+
For more information, visit the project's [GitHub page](https://github.com/kubernetes/node-problem-detector#windows).
496499
-->
497-
### 节点问题检测器 {#node-problem-detector}
500+
## 节点问题检测器 {#node-problem-detector}
498501

499-
节点问题检测器(参考[节点健康监测](/zh/docs/tasks/debug/debug-cluster/monitor-node-health/))与 Windows 不兼容。
502+
节点问题检测器(参考[节点健康监测](/zh/docs/tasks/debug/debug-cluster/monitor-node-health/))初步支持 Windows。
503+
有关更多信息,请访问该项目的 [GitHub 页面](https://github.com/kubernetes/node-problem-detector#windows)
500504

501505
<!--
502506
### Pause container
@@ -562,7 +566,7 @@ The following container runtimes work with Windows:
562566
{{% thirdparty-content %}}
563567

564568
<!--
565-
#### cri-containerd
569+
#### ContainerD
566570
567571
{{< feature-state for_k8s_version="v1.20" state="stable" >}}
568572
@@ -571,7 +575,7 @@ as the container runtime for Kubernetes nodes that run Windows.
571575
572576
Learn how to [install ContainerD on a Windows node](/docs/setup/production-environment/container-runtimes/#install-containerd).
573577
-->
574-
#### cri-containerd {#cri-containerd}
578+
#### ContainerD {#containerd}
575579

576580
{{< feature-state for_k8s_version="v1.20" state="stable" >}}
577581

@@ -666,17 +670,18 @@ If you have what looks like a bug, or you would like to
666670
make a feature request, please follow the [SIG Windows contributing guide](https://github.com/kubernetes/community/blob/master/sig-windows/CONTRIBUTING.md#reporting-issues-and-feature-requests) to create a new issue.
667671
You should first search the list of issues in case it was
668672
reported previously and comment with your experience on the issue and add additional
669-
logs. SIG-Windows Slack is also a great avenue to get some initial support and
673+
logs. SIG Windows channel on the Kubernetes Slack is also a great avenue to get some initial support and
670674
troubleshooting ideas prior to creating a ticket.
671675
-->
672676
### 报告问题和功能请求 {#report-issue-and-feature-request}
673677

674678
如果你发现疑似 bug,或者你想提出功能请求,请按照
675679
[SIG Windows 贡献指南](https://github.com/kubernetes/community/blob/master/sig-windows/CONTRIBUTING.md#reporting-issues-and-feature-requests)
676680
新建一个 Issue。
677-
您应该先搜索 issue 列表,以防之前报告过这个问题,凭你对该问题的经验添加评论,
681+
你应该先搜索 issue 列表,以防之前报告过这个问题,凭你对该问题的经验添加评论,
678682
并随附日志信息。
679-
SIG Windows Slack 也是一个很好的途径,让你在创建工单之前获得一些初始支持和故障排查的思路。
683+
Kubernetes Slack 上的 SIG Windows 频道也是一个很好的途径,
684+
可以在创建工单之前获得一些初始支持和故障排查思路。
680685

681686
## {{% heading "whatsnext" %}}
682687

0 commit comments

Comments
 (0)