You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Within a namespace, a {{< glossary_tooltip text="Pod" term_id="Pod" >}} can consume as much CPU and memory as is allowed by the ResourceQuotas that apply to that namespace. As a cluster operator, or as a namespace-level administrator, you might also be concerned about making sure that a single object cannot monopolize all available resources within a namespace.
29
-
30
-
A LimitRange is a policy to constrain the resource allocations (limits and requests) that you can specify for each applicable object kind (such as Pod or {{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}}) in a namespace.
29
+
Within a namespace, a {{< glossary_tooltip text="Pod" term_id="Pod" >}} can consume as much CPU and memory
30
+
as is allowed by the ResourceQuotas that apply to that namespace.
31
+
As a cluster operator, or as a namespace-level administrator, you might also be concerned
32
+
about making sure that a single object cannot monopolize all available resources within a namespace.
33
+
34
+
A LimitRange is a policy to constrain the resource allocations (limits and requests) that you can specify for
35
+
each applicable object kind (such as Pod or {{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}})
- Enforce minimum and maximum compute resources usage per Pod or Container in a namespace.
48
-
- Enforce minimum and maximum storage request per {{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}} in a namespace.
54
+
- Enforce minimum and maximum storage request per
55
+
{{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}} in a namespace.
49
56
- Enforce a ratio between request and limit for a resource in a namespace.
50
-
- Set default request/limit for compute resources in a namespace and automatically inject them to Containers at runtime.
57
+
- Set default request/limit for compute resources in a namespace and automatically
58
+
inject them to Containers at runtime.
51
59
-->
52
-
53
60
一个 **LimitRange（限制范围）** 对象提供的限制能够做到：
54
61
55
62
- 在一个命名空间中实施对每个 Pod 或 Container 最小和最大的资源使用量的限制。
@@ -59,10 +66,11 @@ A _LimitRange_ provides constraints that can:
- The administrator creates a LimitRange in a namespace.
78
-
- Users create (or try to create) objects in that namespace, such as Pods or PersistentVolumeClaims.
79
-
- First, the `LimitRange` admission controller applies default request and limit values for all Pods (and their containers) that do not set compute resource requirements.
80
-
- Second, the `LimitRange` tracks usage to ensure it does not exceed resource minimum, maximum and ratio defined in any `LimitRange` present in the namespace.
81
-
- If you attempt to create or update an object (Pod or PersistentVolumeClaim) that violates a `LimitRange` constraint, your request to the API server will fail with an HTTP status code `403 Forbidden` and a message explaining the constraint that has been violated.
82
-
- If you add a `LimitRange` in a namespace that applies to compute-related resources such as
83
-
`cpu` and `memory`, you must specify
84
-
requests or limits for those values. Otherwise, the system may reject Pod creation.
85
-
- `LimitRange` validations occur only at Pod admission stage, not on running Pods.
86
+
- Users create (or try to create) objects in that namespace, such as Pods or
87
+
PersistentVolumeClaims.
88
+
- First, the LimitRange admission controller applies default request and limit values
89
+
for all Pods (and their containers) that do not set compute resource requirements.
90
+
- Second, the LimitRange tracks usage to ensure it does not exceed resource minimum,
91
+
maximum and ratio defined in any LimitRange present in the namespace.
92
+
- If you attempt to create or update an object (Pod or PersistentVolumeClaim) that violates
93
+
a LimitRange constraint, your request to the API server will fail with an HTTP status
94
+
code `403 Forbidden` and a message explaining the constraint that has been violated.
95
+
- If you add a LimitRange in a namespace that applies to compute-related resources
96
+
such as `cpu` and `memory`, you must specify requests or limits for those values.
97
+
Otherwise, the system may reject Pod creation.
98
+
- LimitRange validations occur only at Pod admission stage, not on running Pods.
86
99
If you add or modify a LimitRange, the Pods that already exist in that namespace
87
100
continue unchanged.
88
-
- If two or more `LimitRange` objects exist in the namespace, it is not deterministic which default value will be applied.
101
+
- If two or more LimitRange objects exist in the namespace, it is not deterministic
A `LimitRange` does **not** check the consistency of the default values it applies. This means that a default value for the _limit_ that is set by `LimitRange` may be less than the _request_ value specified for the container in the spec that a client submits to the API server. If that happens, the final Pod will not be schedulable.
121
+
A LimitRange does **not** check the consistency of the default values it applies.
122
+
This means that a default value for the _limit_ that is set by LimitRange may be
123
+
less than the _request_ value specified for the container in the spec that a client
124
+
submits to the API server. If that happens, the final Pod will not be schedulable.
108
125
109
-
For example, you define a `LimitRange` with this manifest:
126
+
For example, you define a LimitRange with this manifest:
110
127
-->
111
128
## Pod 的 LimitRange 和准入检查 {#limitrange-and-admission-checks-for-pod}
112
129
113
-
`LimitRange`**不**检查所应用的默认值的一致性。
114
-
这意味着 `LimitRange` 设置的 **limit** 的默认值可能小于客户端提交给 API 服务器的规约中为容器指定的 **request** 值。
130
+
LimitRange **不**检查所应用的默认值的一致性。
131
+
这意味着 LimitRange 设置的 **limit** 的默认值可能小于客户端提交给 API 服务器的规约中为容器指定的 **request** 值。
115
132
如果发生这种情况，最终 Pod 将无法调度。
116
133
117
-
例如，你使用如下清单定义一个 `LimitRange`：
134
+
例如，你使用如下清单定义一个 LimitRange：
135
+
136
+
{{< note >}}
137
+
<!--
138
+
The following examples operate within the default namespace of your cluster, as the namespace
139
+
parameter is undefined and the LimitRange scope is limited to the namespace level.
140
+
This implies that any references or operations within these examples will interact
141
+
with elements within the default namespace of your cluster. You can override the
142
+
operating namespace by configuring namespace in the `metadata.namespace` field.
Examples of policies that could be created using `LimitRange` are:
179
+
Examples of policies that could be created using LimitRange are:
148
180
149
-
- In a 2 node cluster with a capacity of 8 GiB RAM and 16 cores, constrain Pods in a namespace to request 100m of CPU with a max limit of 500m for CPU and request 200Mi for Memory with a max limit of 600Mi for Memory.
150
-
- Define default CPU limit and request to 150m and memory default request to 300Mi for Containers started with no cpu and memory requests in their specs.
181
+
- In a 2 node cluster with a capacity of 8 GiB RAM and 16 cores, constrain Pods in a
182
+
namespace to request 100m of CPU with a max limit of 500m for CPU and request 200Mi
183
+
for Memory with a max limit of 600Mi for Memory.
184
+
- Define default CPU limit and request to 150m and memory default request to 300Mi for
185
+
Containers started with no cpu and memory requests in their specs.
151
186
-->
152
187
## 资源约束示例 {#example-resource-constraints}
153
188
@@ -159,8 +194,9 @@ Examples of policies that could be created using `LimitRange` are:
159
194
150m，内存默认需求值 300Mi。
160
195
161
196
<!--
162
-
In the case where the total limits of the namespace is less than the sum of the limits of the Pods/Containers,
163
-
there may be contention for resources. In this case, the Containers or Pods will not be created.
197
+
In the case where the total limits of the namespace is less than the sum of the limits
198
+
of the Pods/Containers, there may be contention for resources. In this case, the
199
+
Containers or Pods will not be created.
164
200
-->
165
201
在命名空间的总限制值小于 Pod 或 Container 的限制值的总和的情况下，可能会产生资源竞争。
166
202
在这种情况下，将不会创建 Container 或 Pod。
@@ -182,7 +218,8 @@ For examples on using limits, see:
182
218
- [how to configure minimum and maximum Storage consumption per namespace](/docs/tasks/administer-cluster/limit-storage-consumption/#limitrange-to-limit-requests-for-storage).
183
219
- a [detailed example on configuring quota per namespace](/docs/tasks/administer-cluster/manage-resources/quota-memory-cpu-namespace/).
184
220
185
-
Refer to the [LimitRanger design document](https://git.k8s.io/design-proposals-archive/resource-management/admission_control_limit_range.md) for context and historical information.
221
+
Refer to the [LimitRanger design document](https://git.k8s.io/design-proposals-archive/resource-management/admission_control_limit_range.md)
222
+
for context and historical information.
186
223
-->
187
224
关于使用限值的例子，可参阅：
188
225
@@ -193,4 +230,5 @@ Refer to the [LimitRanger design document](https://git.k8s.io/design-proposals-a
0 commit comments