Skip to content

Commit 79b608f

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #36372 from windsonsea/cgpyhf
[zh] Sync1.25 /concepts/architecture/cgroups.md
2 parents 6efdf87 + dbe2431 commit 79b608f

File tree

1 file changed

+240
-0
lines changed
  • content/zh-cn/docs/concepts/architecture

1 file changed

+240
-0
lines changed

‎content/zh-cn/docs/concepts/architecture/cgroups.md

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
---
2+
title: 关于 cgroup v2
3+
content_type: concept
4+
weight: 50
5+
---
6+
<!--
7+
title: About cgroup v2
8+
content_type: concept
9+
weight: 50
10+
-->
11+
12+
<!-- overview -->
13+
14+
<!--
15+
On Linux, {{< glossary_tooltip text="control groups" term_id="cgroup" >}}
16+
constrain resources that are allocated to processes.
17+
18+
The {{< glossary_tooltip text="kubelet" term_id="kubelet" >}} and the
19+
underlying container runtime need to interface with cgroups to enforce
20+
[resource mangement for pods and containers](/docs/concepts/configuration/manage-resources-containers/) which
21+
includes cpu/memory requests and limits for containerized workloads.
22+
23+
There are two versions of cgroups in Linux: cgroup v1 and cgroup v2. cgroup v2 is
24+
the new generation of the `cgroup` API.
25+
-->
26+
在 Linux 上，{{< glossary_tooltip text="控制组" term_id="cgroup" >}}约束分配给进程的资源。
27+
28+
{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} 和底层容器运行时都需要对接 cgroup
29+
来强制执行[为 Pod 和容器管理资源](/zh-cn/docs/concepts/configuration/manage-resources-containers/)，
30+
这包括为容器化工作负载配置 CPU/内存请求和限制。
31+
32+
Linux 中有两个 cgroup 版本：cgroup v1 和 cgroup v2。cgroup v2 是新一代的 `cgroup` API。
33+
34+
<!-- body -->
35+
36+
<!--
37+
## What is cgroup v2? {#cgroup-v2}
38+
-->
39+
## 什么是 cgroup v2？ {#cgroup-v2}
40+
41+
{{< feature-state for_k8s_version="v1.25" state="stable" >}}
42+
43+
<!--
44+
cgroup v2 is the next version of the Linux `cgroup` API. cgroup v2 provides a
45+
unified control system with enhanced resource management
46+
capabilities.
47+
-->
48+
cgroup v2 是 Linux `cgroup` API 的下一个版本。cgroup v2 提供了一个具有增强资源管理能力的统一控制系统。
49+
50+
<!--
51+
cgroup v2 offers several improvements over cgroup v1, such as the following:
52+
53+
- Single unified hierarchy design in API
54+
- Safer sub-tree delegation to containers
55+
- Newer features like [Pressure Stall Information](https://www.kernel.org/doc/html/latest/accounting/psi.html)
56+
- Enhanced resource allocation management and isolation across multiple resources
57+
- Unified accounting for different types of memory allocations (network memory, kernel memory, etc)
58+
- Accounting for non-immediate resource changes such as page cache write backs
59+
-->
60+
cgroup v2 对 cgroup v1 进行了多项改进，例如：
61+
62+
- API 中单个统一的层次结构设计
63+
- 更安全的子树委派给容器
64+
- 更新的功能特性，
65+
例如[压力阻塞信息（Pressure Stall Information，PSI）](https://www.kernel.org/doc/html/latest/accounting/psi.html)
66+
- 跨多个资源的增强资源分配管理和隔离
67+
- 统一核算不同类型的内存分配（网络内存、内核内存等）
68+
- 考虑非即时资源变化，例如页面缓存回写
69+
70+
<!--
71+
Some Kubernetes features exclusively use cgroup v2 for enhanced resource
72+
management and isolation. For example, the
73+
[MemoryQoS](/blog/2021/11/26/qos-memory-resources/) feature improves memory QoS
74+
and relies on cgroup v2 primitives.
75+
-->
76+
一些 Kubernetes 特性专门使用 cgroup v2 来增强资源管理和隔离。
77+
例如，[MemoryQoS](/blog/2021/11/26/qos-memory-resources/) 特性改进了内存 QoS 并依赖于 cgroup v2 原语。
78+
79+
<!--
80+
## Using cgroup v2 {#using-cgroupv2}
81+
82+
The recommended way to use cgroup v2 is to use a Linux distribution that
83+
enables and uses cgroup v2 by default.
84+
85+
To check if your distribution uses cgroup v2, refer to [Identify cgroup version on Linux nodes](#check-cgroup-version).
86+
-->
87+
## 使用 cgroup v2 {#using-cgroupv2}
88+
89+
使用 cgroup v2 的推荐方法是使用一个默认启用 cgroup v2 的 Linux 发行版。
90+
91+
要检查你的发行版是否使用 cgroup v2，请参阅[识别 Linux 节点上的 cgroup 版本](#check-cgroup-version)。
92+
93+
<!--
94+
### Requirements
95+
96+
cgroup v2 has the following requirements:
97+
98+
* OS distribution enables cgroup v2
99+
* Linux Kernel version is 5.8 or later
100+
* Container runtime supports cgroup v2. For example:
101+
* [containerd](https://containerd.io/) v1.4 and later
102+
* [cri-o](https://cri-o.io/) v1.20 and later
103+
* The kubelet and the container runtime are configured to use the [systemd cgroup driver](/docs/setup/production-environment/container-runtimes#systemd-cgroup-driver)
104+
-->
105+
### 要求 {#requirements}
106+
107+
cgroup v2 具有以下要求：
108+
109+
* 操作系统发行版启用 cgroup v2
110+
* Linux 内核为 5.8 或更高版本
111+
* 容器运行时支持 cgroup v2。例如：
112+
* [containerd](https://containerd.io/) v1.4 和更高版本
113+
* [cri-o](https://cri-o.io/) v1.20 和更高版本
114+
* kubelet 和容器运行时被配置为使用
115+
[systemd cgroup 驱动](/zh-cn/docs/setup/production-environment/container-runtimes#systemd-cgroup-driver)
116+
117+
<!--
118+
### Linux Distribution cgroup v2 support
119+
120+
For a list of Linux distributions that use cgroup v2, refer to the [cgroup v2 documentation](https://github.com/opencontainers/runc/blob/main/docs/cgroup-v2.md)
121+
-->
122+
### Linux 发行版 cgroup v2 支持 {#linux-distribution-cgroup-v2-support}
123+
124+
有关使用 cgroup v2 的 Linux 发行版的列表，
125+
请参阅 [cgroup v2 文档](https://github.com/opencontainers/runc/blob/main/docs/cgroup-v2.md)。
126+
127+
<!-- the list should be kept in sync with https://github.com/opencontainers/runc/blob/main/docs/cgroup-v2.md -->
128+
<!--
129+
* Container Optimized OS (since M97)
130+
* Ubuntu (since 21.10, 22.04+ recommended)
131+
* Debian GNU/Linux (since Debian 11 bullseye)
132+
* Fedora (since 31)
133+
* Arch Linux (since April 2021)
134+
* RHEL and RHEL-like distributions (since 9)
135+
-->
136+
* Container-Optimized OS（从 M97 开始）
137+
* Ubuntu（从 21.10 开始，推荐 22.04+）
138+
* Debian GNU/Linux（从 Debian 11 Bullseye 开始）
139+
* Fedora（从 31 开始）
140+
* Arch Linux（从 2021 年 4 月开始）
141+
* RHEL 和类似 RHEL 的发行版（从 9 开始）
142+
143+
<!--
144+
To check if your distribution is using cgroup v2, refer to your distribution's
145+
documentation or follow the instructions in [Identify the cgroup version on Linux nodes](#check-cgroup-version).
146+
147+
You can also enable cgroup v2 manually on your Linux distribution by modifying
148+
the kernel cmdline boot arguments. If your distribution uses GRUB,
149+
`systemd.unified_cgroup_hierarchy=1` should be added in `GRUB_CMDLINE_LINUX`
150+
under `/etc/default/grub`, followed by `sudo update-grub`. However, the
151+
recommended approach is to use a distribution that already enables cgroup v2 by
152+
default.
153+
-->
154+
要检查你的发行版是否使用 cgroup v2，
155+
请参阅你的发行版文档或遵循[识别 Linux 节点上的 cgroup 版本](#check-cgroup-version)中的指示说明。
156+
157+
你还可以通过修改内核 cmdline 引导参数在你的 Linux 发行版上手动启用 cgroup v2。
158+
如果你的发行版使用 GRUB，则应在 `/etc/default/grub` 下的 `GRUB_CMDLINE_LINUX`
159+
中添加 `systemd.unified_cgroup_hierarchy=1`，
160+
然后执行 `sudo update-grub`。不过，推荐的方法仍是使用一个默认已启用 cgroup v2 的发行版。
161+
162+
<!--
163+
### Migrating to cgroup v2 {#migrating-cgroupv2}
164+
165+
To migrate to cgroup v2, ensure that you meet the [requirements](#requirements), then upgrade
166+
to a kernel version that enables cgroup v2 by default.
167+
168+
The kubelet automatically detects that the OS is running on cgroup v2 and
169+
performs accordingly with no additional configuration required.
170+
-->
171+
### 迁移到 cgroup v2 {#migrating-cgroupv2}
172+
173+
要迁移到 cgroup v2，需确保满足[要求](#requirements)，然后升级到一个默认启用 cgroup v2 的内核版本。
174+
175+
kubelet 能够自动检测操作系统是否运行在 cgroup v2 上并相应调整其操作，无需额外配置。
176+
177+
<!--
178+
There should not be any noticeable difference in the user experience when
179+
switching to cgroup v2, unless users are accessing the cgroup file system
180+
directly, either on the node or from within the containers.
181+
182+
cgroup v2 uses a different API than cgroup v1, so if there are any
183+
applications that directly access the cgroup file system, they need to be
184+
updated to newer versions that support cgroup v2. For example:
185+
-->
186+
切换到 cgroup v2 时，用户体验应没有任何明显差异，除非用户直接在节点上或从容器内访问 cgroup 文件系统。
187+
188+
cgroup v2 使用一个与 cgroup v1 不同的 API，因此如果有任何应用直接访问 cgroup 文件系统，
189+
则需要将这些应用更新为支持 cgroup v2 的版本。例如：
190+
191+
<!--
192+
* Some third-party monitoring and security agents may depend on the cgroup filesystem.
193+
Update these agents to versions that support cgroup v2.
194+
* If you run [cAdvisor](https://github.com/google/cadvisor) as a stand-alone
195+
DaemonSet for monitoring pods and containers, update it to v0.43.0 or later.
196+
* If you use JDK, prefer to use JDK 11.0.16 and later or JDK 15 and later, which [fully support cgroup v2](https://bugs.openjdk.org/browse/JDK-8230305).
197+
-->
198+
* 一些第三方监控和安全代理可能依赖于 cgroup 文件系统。你要将这些代理更新到支持 cgroup v2 的版本。
199+
* 如果以独立的 DaemonSet 的形式运行 [cAdvisor](https://github.com/google/cadvisor) 以监控 Pod 和容器，
200+
需将其更新到 v0.43.0 或更高版本。
201+
* 如果你使用 JDK，推荐使用 JDK 11.0.16 及更高版本或 JDK 15 及更高版本，
202+
以便[完全支持 cgroup v2](https://bugs.openjdk.org/browse/JDK-8230305)。
203+
204+
<!--
205+
## Identify the cgroup version on Linux Nodes {#check-cgroup-version}
206+
207+
The cgroup version depends on on the Linux distribution being used and the
208+
default cgroup version configured on the OS. To check which cgroup version your
209+
distribution uses, run the `stat -fc %T /sys/fs/cgroup/` command on
210+
the node:
211+
-->
212+
## 识别 Linux 节点上的 cgroup 版本 {#check-cgroup-version}
213+
214+
cgroup 版本取决于正在使用的 Linux 发行版和操作系统上配置的默认 cgroup 版本。
215+
要检查你的发行版使用的是哪个 cgroup 版本，请在该节点上运行 `stat -fc %T /sys/fs/cgroup/` 命令：
216+
217+
```shell
218+
stat -fc %T /sys/fs/cgroup/
219+
```
220+
221+
<!--
222+
For cgroup v2, the output is `cgroup2fs`.
223+
224+
For cgroup v1, the output is `tmpfs.`
225+
-->
226+
对于 cgroup v2，输出为 `cgroup2fs`。
227+
228+
对于 cgroup v1，输出为 `tmpfs`。
229+
230+
## {{% heading "whatsnext" %}}
231+
232+
<!--
233+
- Learn more about [cgroups](https://man7.org/linux/man-pages/man7/cgroups.7.html)
234+
- Learn more about [container runtime](/docs/concepts/architecture/cri)
235+
- Learn more about [cgroup drivers](/docs/setup/production-environment/container-runtimes#cgroup-drivers)
236+
-->
237+
- 进一步了解 [cgroups](https://man7.org/linux/man-pages/man7/cgroups.7.html)
238+
- 进一步了解[容器运行时](/zh-cn/docs/concepts/architecture/cri)
239+
- 进一步了解 [cgroup 驱动](/zh-cn/docs/setup/production-environment/container-runtimes#cgroup-drivers)
240+

0 commit comments

Comments
 (0)