Skip to content

Commit 7fb02f8

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #47751 from windsonsea/matchy
[zh] Add a blog: 2024-08-16-matchlabelkeys-podaffinity.md
2 parents 8baaba4 + e749d36 commit 7fb02f8

File tree

1 file changed

+240
-0
lines changed

1 file changed

+240
-0
lines changed

‎content/zh-cn/blog/_posts/2024-08-16-matchlabelkeys-podaffinity.md

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
---
2+
layout: blog
3+
title: 'Kubernetes 1.31：podAffinity 中的 matchLabelKeys 进阶至 Beta'
4+
date: 2024-08-16
5+
slug: matchlabelkeys-podaffinity
6+
author: >
7+
Kensei Nakada (Tetrate)
8+
---
9+
<!--
10+
layout: blog
11+
title: 'Kubernetes 1.31: MatchLabelKeys in PodAffinity graduates to beta'
12+
date: 2024-08-16
13+
slug: matchlabelkeys-podaffinity
14+
author: >
15+
Kensei Nakada (Tetrate)
16+
-->
17+
18+
<!--
19+
Kubernetes 1.29 introduced new fields `MatchLabelKeys` and `MismatchLabelKeys` in PodAffinity and PodAntiAffinity.
20+
21+
In Kubernetes 1.31, this feature moves to beta and the corresponding feature gate (`MatchLabelKeysInPodAffinity`) gets enabled by default.
22+
-->
23+
Kubernetes 1.29 在 podAffinity 和 podAntiAffinity 中引入了新的字段 `matchLabelKeys` 和 `mismatchLabelKeys`。
24+
25+
在 Kubernetes 1.31 中，此特性进阶至 Beta，并且相应的特性门控（`MatchLabelKeysInPodAffinity`）默认启用。
26+
27+
<!--
28+
## `MatchLabelKeys` - Enhanced scheduling for versatile rolling updates
29+
30+
During a workload's (e.g., Deployment) rolling update, a cluster may have Pods from multiple versions at the same time.
31+
However, the scheduler cannot distinguish between old and new versions based on the `LabelSelector` specified in PodAffinity or PodAntiAffinity. As a result, it will co-locate or disperse Pods regardless of their versions.
32+
-->
33+
## `matchLabelKeys` - 为多样化滚动更新增强了调度
34+
35+
在工作负载（例如 Deployment）的滚动更新期间，集群中可能同时存在多个版本的 Pod。
36+
然而，调度器无法基于 podAffinity 或 podAntiAffinity 中指定的 `labelSelector` 区分新旧版本。
37+
结果，调度器将并置或分散调度 Pod，不会考虑这些 Pod 的版本。
38+
39+
<!--
40+
This can lead to sub-optimal scheduling outcome, for example:
41+
- New version Pods are co-located with old version Pods (PodAffinity), which will eventually be removed after rolling updates.
42+
- Old version Pods are distributed across all available topologies, preventing new version Pods from finding nodes due to PodAntiAffinity.
43+
-->
44+
这可能导致次优的调度结果，例如：
45+
46+
- 新版本的 Pod 与旧版本的 Pod（podAffinity）并置在一起，这些旧版本的 Pod 最终将在滚动更新后被移除。
47+
- 旧版本的 Pod 被分布在所有可用的拓扑中，导致新版本的 Pod 由于 podAntiAffinity 无法找到节点。
48+
49+
<!--
50+
`MatchLabelKeys` is a set of Pod label keys and addresses this problem.
51+
The scheduler looks up the values of these keys from the new Pod's labels and combines them with `LabelSelector`
52+
so that PodAffinity matches Pods that have the same key-value in labels.
53+
54+
By using label [pod-template-hash](/docs/concepts/workloads/controllers/deployment/#pod-template-hash-label) in `MatchLabelKeys`,
55+
you can ensure that only Pods of the same version are evaluated for PodAffinity or PodAntiAffinity.
56+
-->
57+
`matchLabelKeys` 是一组 Pod 标签键，可以解决上述问题。
58+
调度器从新 Pod 的标签中查找这些键的值，并将其与 `labelSelector` 结合，
59+
以便 podAffinity 匹配到具有相同标签键值的 Pod。
60+
61+
通过在 `matchLabelKeys` 中使用标签
62+
[pod-template-hash](/zh-cn/docs/concepts/workloads/controllers/deployment/#pod-template-hash-label)，
63+
你可以确保对 podAffinity 或 podAntiAffinity 进行评估时仅考虑相同版本的 Pod。
64+
65+
```yaml
66+
apiVersion: apps/v1
67+
kind: Deployment
68+
metadata:
69+
name: application-server
70+
...
71+
affinity:
72+
podAffinity:
73+
requiredDuringSchedulingIgnoredDuringExecution:
74+
- labelSelector:
75+
matchExpressions:
76+
- key: app
77+
operator: In
78+
values:
79+
- database
80+
topologyKey: topology.kubernetes.io/zone
81+
matchLabelKeys:
82+
- pod-template-hash
83+
```
84+
85+
<!--
86+
The above matchLabelKeys will be translated in Pods like:
87+
-->
88+
上述 Pod 中的 `matchLabelKeys` 将被转换为：
89+
90+
<!--
91+
# Added from matchLabelKeys; Only Pods from the same replicaset will match this affinity.
92+
-->
93+
```yaml
94+
kind: Pod
95+
metadata:
96+
name: application-server
97+
labels:
98+
pod-template-hash: xyz
99+
...
100+
affinity:
101+
podAffinity:
102+
requiredDuringSchedulingIgnoredDuringExecution:
103+
- labelSelector:
104+
matchExpressions:
105+
- key: app
106+
operator: In
107+
values:
108+
- database
109+
- key: pod-template-hash # 从 matchLabelKeys 添加; 只有来自同一 ReplicaSet 的 Pod 将与此亲和性匹配
110+
operator: In
111+
values:
112+
- xyz
113+
topologyKey: topology.kubernetes.io/zone
114+
matchLabelKeys:
115+
- pod-template-hash
116+
```
117+
118+
<!--
119+
## `MismatchLabelKeys` - Service isolation
120+
121+
`MismatchLabelKeys` is a set of Pod label keys, like `MatchLabelKeys`,
122+
which looks up the values of these keys from the new Pod's labels, and merge them with `LabelSelector` as `key notin (value)`
123+
so that PodAffinity does _not_ match Pods that have the same key-value in labels.
124+
125+
Suppose all Pods for each tenant get `tenant` label via a controller or a manifest management tool like Helm.
126+
-->
127+
## `mismatchLabelKeys` - 服务隔离
128+
129+
`mismatchLabelKeys` 是一组 Pod 标签键，类似于 `matchLabelKeys`，
130+
它在新 Pod 的标签中查找这些键的值，并将其与 `labelSelector` 合并为 `key notin (value)`，
131+
以便 podAffinity **不**会匹配到具有相同标签键值的 Pod。
132+
133+
假设每个租户的所有 Pod 通过控制器或像 Helm 这样的清单管理工具得到 `tenant` 标签。
134+
135+
<!--
136+
Although the value of `tenant` label is unknown when composing each workload's manifest,
137+
the cluster admin wants to achieve exclusive 1:1 tenant to domain placement for a tenant isolation.
138+
139+
`MismatchLabelKeys` works for this usecase;
140+
By applying the following affinity globally using a mutating webhook,
141+
the cluster admin can ensure that the Pods from the same tenant will land on the same domain exclusively,
142+
meaning Pods from other tenants won't land on the same domain.
143+
-->
144+
尽管在组合每个工作负载的清单时，`tenant` 标签的值是未知的，
145+
但集群管理员希望实现租户与域之间形成排他性的 1:1 对应关系，以便隔离租户。
146+
147+
`mismatchLabelKeys` 适用于这一使用场景；
148+
通过使用变更性质的 Webhook 在全局应用以下亲和性，
149+
集群管理员可以确保来自同一租户的 Pod 将以独占方式落到同一域上，
150+
这意味着来自其他租户的 Pod 不会落到同一域上。
151+
152+
<!--
153+
# ensures the pods of this tenant land on the same node pool
154+
# ensures only Pods from this tenant lands on the same node pool
155+
-->
156+
```yaml
157+
affinity:
158+
podAffinity: # 确保此租户的 Pod 落在同一节点池上
159+
requiredDuringSchedulingIgnoredDuringExecution:
160+
- matchLabelKeys:
161+
- tenant
162+
topologyKey: node-pool
163+
podAntiAffinity: # 确保只有此租户的 Pod 落在同一节点池上
164+
requiredDuringSchedulingIgnoredDuringExecution:
165+
- mismatchLabelKeys:
166+
- tenant
167+
labelSelector:
168+
matchExpressions:
169+
- key: tenant
170+
operator: Exists
171+
topologyKey: node-pool
172+
```
173+
174+
<!--
175+
The above matchLabelKeys and mismatchLabelKeys will be translated to like:
176+
-->
177+
上述的 `matchLabelKeys` 和 `mismatchLabelKeys` 将被转换为：
178+
179+
<!--
180+
# ensures the pods of this tenant land on the same node pool
181+
# ensures only Pods from this tenant lands on the same node pool
182+
-->
183+
```yaml
184+
kind: Pod
185+
metadata:
186+
name: application-server
187+
labels:
188+
tenant: service-a
189+
spec:
190+
affinity:
191+
podAffinity: # 确保此租户的 Pod 落在同一节点池上
192+
requiredDuringSchedulingIgnoredDuringExecution:
193+
- matchLabelKeys:
194+
- tenant
195+
topologyKey: node-pool
196+
labelSelector:
197+
matchExpressions:
198+
- key: tenant
199+
operator: In
200+
values:
201+
- service-a
202+
podAntiAffinity: # 确保只有此租户的 Pod 落在同一节点池上
203+
requiredDuringSchedulingIgnoredDuringExecution:
204+
- mismatchLabelKeys:
205+
- tenant
206+
labelSelector:
207+
matchExpressions:
208+
- key: tenant
209+
operator: Exists
210+
- key: tenant
211+
operator: NotIn
212+
values:
213+
- service-a
214+
topologyKey: node-pool
215+
```
216+
217+
<!--
218+
## Getting involved
219+
220+
These features are managed by Kubernetes [SIG Scheduling](https://github.com/kubernetes/community/tree/master/sig-scheduling).
221+
222+
Please join us and share your feedback. We look forward to hearing from you!
223+
-->
224+
## 参与其中
225+
226+
这些特性由 Kubernetes
227+
[SIG Scheduling](https://github.com/kubernetes/community/tree/master/sig-scheduling) 管理。
228+
229+
请加入我们并分享你的反馈。我们期待听到你的声音！
230+
231+
<!--
232+
## How can I learn more?
233+
234+
- [The official document of PodAffinity](/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity)
235+
- [KEP-3633: Introduce MatchLabelKeys and MismatchLabelKeys to PodAffinity and PodAntiAffinity](https://github.com/kubernetes/enhancements/blob/master/keps/sig-scheduling/3633-matchlabelkeys-to-podaffinity/README.md#story-2)
236+
-->
237+
## 了解更多
238+
239+
- [podAffinity 的官方文档](/zh-cn/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity)
240+
- [KEP-3633：将 matchLabelKeys 和 mismatchLabelKeys 引入 podAffinity 和 podAntiAffinity](https://github.com/kubernetes/enhancements/blob/master/keps/sig-scheduling/3633-matchlabelkeys-to-podaffinity/README.md#story-2)

0 commit comments

Comments
 (0)