4 ms·

1. It makes no sense to quota your cpu with the exception of very specific cases (like metered usage). You’re just throwing away compute cycles 2. Same applies

1. It makes no sense to quota your cpu with the exception of very specific cases (like metered usage). You’re just throwing away compute cycles 2. Same applies to dedicate cores for pretty much same reasons Having said that if you really really want quota but don’t want shit tail latency I suggest setting cfs_quota_period to under 5ms via kubelet flag

eric_khun 7y ago
Thanks! wouldn't that be an issue if a pod "take over" the node , if for some reasons a request use too much CPU?
- dilyevsky 7y ago
  Not really if you ensure every pod sets cpu request (which sets up cgroups cpu.shares) and your kubelet and system services are running in separate top-level cgroups (—kube-reserved and —system-reserved flags) you have reserved enforcement enabled. On full node contention every container will just consume its proportional share. This is not to say that someone malicious wouldn’t be able to dos a node but untrusted workload is a whole separate topic
rumanator 7y ago
> It makes no sense to quota your cpu with the exception of very specific cases (like metered usage). This is not true at all. Autoscaling depends on CPU quotas. More importantly, if you want to keep your application running well without getting chatty neighbors or getting your containers redeployed around for no apparent reason, you need to cover all resources with quotas.
- pluies 7y ago
  Agree re noisy neighbours, but autoscaling depends on _requests_ rather than _limits_, so you could define requests for HPA scaling but leave out the limits and have both autoscaling and no throttling.
  - EdSchouten 7y ago
    The problem with having no throttling is that the system will just keep on running happily, until you get to the point where resources become more limited. You will not get any early feedback that your system is constantly underprovisioned. Try doing this on a multi-tenant cluster, where new pods spawned by other teams/people come and go constantly. You won't be able to get any reliable performance characteristics in environments like that. For such clusters, it's necessary to set up stuff like the LimitRanger (https://kubernetes.io/docs/concepts/policy/limit-range/ https://kubernetes.io/docs/concepts/policy/limit-range/) to put a hard constant bound between requests and limits.
    - dilyevsky 7y ago
      And how will you get feedback on being throttled other than shit is randomly failing e.g connection timeouts?
      - snupples 7y ago
        Effective monitoring. Prometheus is free and open source. There are other paid options.
        dilyevsky 7y ago
        That was a trick question actually - use your Prometheus stack to alert on latency sensitive workload with usage over request and ignore everything else.
        snupples 7y ago
        Of course, you're missing the point. Depending on your application a little throttling doesn't hurt, and it can save other applications running on the same nodes that DO matter. In the meantime you can monitor rate of throttling and rate of CPU usage to limit ratio. Nothing stops you from doing this while also monitoring response latency. On the other hand CPU request DOES potentially leave unused CPU cycles on the table since it's a reservation on the node whether you're using it or not. Again needs may vary.
- dilyevsky 7y ago
  Autoscaling depends on requests not limits. Read my explanation on “chatty neighbors” in other thread.

eric_khun 7y ago

Thanks! wouldn't that be an issue if a pod "take over" the node , if for some reasons a request use too much CPU?

dilyevsky 7y ago
Not really if you ensure every pod sets cpu request (which sets up cgroups cpu.shares) and your kubelet and system services are running in separate top-level cgroups (—kube-reserved and —system-reserved flags) you have reserved enforcement enabled. On full node contention every container will just consume its proportional share. This is not to say that someone malicious wouldn’t be able to dos a node but untrusted workload is a whole separate topic

rumanator 7y ago

> It makes no sense to quota your cpu with the exception of very specific cases (like metered usage). This is not true at all. Autoscaling depends on CPU quotas. More importantly, if you want to keep your application running well without getting chatty neighbors or getting your containers redeployed around for no apparent reason, you need to cover all resources with quotas.

pluies 7y ago
Agree re noisy neighbours, but autoscaling depends on _requests_ rather than _limits_, so you could define requests for HPA scaling but leave out the limits and have both autoscaling and no throttling.
- EdSchouten 7y ago
  The problem with having no throttling is that the system will just keep on running happily, until you get to the point where resources become more limited. You will not get any early feedback that your system is constantly underprovisioned. Try doing this on a multi-tenant cluster, where new pods spawned by other teams/people come and go constantly. You won't be able to get any reliable performance characteristics in environments like that. For such clusters, it's necessary to set up stuff like the LimitRanger (https://kubernetes.io/docs/concepts/policy/limit-range/ https://kubernetes.io/docs/concepts/policy/limit-range/) to put a hard constant bound between requests and limits.
  - dilyevsky 7y ago
    And how will you get feedback on being throttled other than shit is randomly failing e.g connection timeouts?
    - snupples 7y ago
      Effective monitoring. Prometheus is free and open source. There are other paid options.
      - dilyevsky 7y ago
        That was a trick question actually - use your Prometheus stack to alert on latency sensitive workload with usage over request and ignore everything else.
        snupples 7y ago
        Of course, you're missing the point. Depending on your application a little throttling doesn't hurt, and it can save other applications running on the same nodes that DO matter. In the meantime you can monitor rate of throttling and rate of CPU usage to limit ratio. Nothing stops you from doing this while also monitoring response latency. On the other hand CPU request DOES potentially leave unused CPU cycles on the table since it's a reservation on the node whether you're using it or not. Again needs may vary.
dilyevsky 7y ago
Autoscaling depends on requests not limits. Read my explanation on “chatty neighbors” in other thread.