玩k8s? Pod的资源限制&重启策略

最新推荐文章于 2026-07-06 09:18:28 发布

原创最新推荐文章于 2026-07-06 09:18:28 发布 · 2.1k 阅读

2 ·

本内容遵循CC 4.0 BY-SA版权协议

收录于

Docker容器与K8s

本文介绍了Kubernetes Pod的资源限制，包括内存和CPU的申请配额与限制配额，以及资源限制的重要性。同时，讲解了Pod的重启策略，如Always、OnFailure和Never，并给出了不同场景下的适用情况。最后，详细阐述了健康检查机制，包括livenessProbe和readinessProbe，以及httpGet、exec和tcpSocket三种检查方法的应用示例。

Pod 资源限制&重启策略

文章目录

Pod 资源限制&重启策略

1.1: 资源限制

官方文档

https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

Pod资源配额有两种：

申请配额：调度时使用，参考是否有节点满足该配置

spec.containers[].resources.limits.cpu

spec.containers[].resources.limits.memory
限制配额：容器能使用的最大配置

spec.containers[].resources.requests.cpu

spec.containers[].resources.requests.memory
容器资源限制：
1、内存
2、CPU

limits：实际最大使用的配额

requests：申请的配额，主要用于k8s做资源调度分配时参考值

一般limits比requests大一些
资源限制好处：避免某容器资源利用率异常突发影响其他容器，可能会产生雪崩效应！

  - name: wp
    image: wordpress
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"

示例：

[root@k8s-master1 demo]# vim resources.yaml
apiVersion: v1
kind: Pod
metadata:
  name: frontend
spec:
  containers:
  - name: db
    image: mysql
    env: "设定变量"
    - name: MYSQL_ROOT_PASSWORD
      value: "password"
    resources: "资源限额"
      requests: "请求资源"
        memory: "64Mi" "请求内存64M"
        cpu: "250m" "一秒钟能够使用一个cpu核心资源的25%的资源"
      limits: "最大限制资源"
        memory: "128Mi" "最大限制内存128M"
        cpu: "500m" "一秒钟能够使用一个cpu核心资源的50%资源"
  - name: wp
    image: wordpress
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"
[root@k8s-master1 demo]# kubectl apply -f resources.yaml 
pod/frontend created
[root@k8s-master1 demo]# kubectl describe pod  frontend "查看创建过程"
[root@k8s-master1 demo]# kubectl get pods
NAME               READY   STATUS    RESTARTS   AGE
frontend           2/2     Running   0          2m39s
[root@k8s-master1 demo]# kubectl get pods -o wide
NAME       READY   STATUS    RESTARTS   AGE     IP            NODE        NOMINATED NODE   READINESS GATES
frontend   2/2     Running   0          3m55s   10.244.1.33   k8s-node1   <none>           <none>
[root@k8s-master1 demo]#  kubectl describe nodes k8s-node1
...
  Namespace                   Name                                          CPU Requests  CPU Limits  Memory Requests  Memory Limits  AGE
  ---------                   ----                                          ------------  ----------  ---------------  -------------  ---
  default                     frontend                                      500m (12%)    1 (25%)     128Mi (7%)       256Mi (14%)    4m42s
...
Allocated resources:
  (Total limits may be over 100 percent, i.e., overcommitted.)
  Resource           Requests      Limits
  --------           --------      ------
  cpu                920m (23%)    1320m (33%)
  memory             1308Mi (76%)  1878Mi (109%)
  ephemeral-storage  0 (0%)        0 (0%)
  hugepages-1Gi      0 (0%)        0 (0%)
  hugepages-2Mi      0 (0%)        0 (0%)
Events:              <none>
[root@k8s-master1 demo]# kubectl get pods
NAME       READY   STATUS    RESTARTS   AGE
frontend   2/2     Running   0          6m9s
[root@k8s-master1 demo]# kubectl describe nodes 192.168.100.202 "查看节点信息"

[root@k8s-master1 demo]# kubectl get ns "查看命名空间"
NAME                   STATUS   AGE
default                Active   3d1h
ingress-nginx          Active   3d1h
kube-node-lease        Active   3d1h
kube-public            Active   3d1h
kube-system            Active   3d1h
kubernetes-dashboard   Active   3d1h

其中cpu值比较抽象，可以这么理解：

1核=1000m

1.5核=1500m

那上面限制配置就是1核的二分之一（500m），即该容器最大使用半核CPU。

该值也可以写成浮点数，更容易理解：

半核=0.5

1核=1

1.5核=1.5

1.2 重启策略

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
    - name: java
      image: lizhenliang/java-demo
    restartPolicy: Always "重启策略字段"

restartPolicy字段有三个可选值：

Always：当容器终止退出后，总是重启容器，默认策略。
OnFailure：当容器异常退出（退出状态码非0,不正常退出）时，才重启容器。适于job
Never：当容器终止退出，从不重启容器。适于job

守护进程式：要求持续性运行，例如nginx、mysql、redis
预期终止：批处理

演示

[root@k8s-master1 demo]# vim pod3.yaml

apiVersion: v1
kind: Pod
metadata:
  name: foo
spec:
  containers:
  - name: busybox
    image: busybox
    args:
    - /bin/sh
    - -c
    - sleep 15; exit 3 "返回状态非零值3"
[root@k8s-master1 demo]# kubectl apply -f pod3.yaml
pod/foo created
[root@k8s-master1 demo]# kubectl get pods "返回非零值,报error"
NAME       READY   STATUS    RESTARTS   AGE
foo        0/1     Error     1          7m50s
[root@k8s-master1 demo]# vim pod3.yaml

apiVersion: v1
kind: Pod
metadata:
  name: foo
spec:
  containers:
  - name: busybox
    image: busybox
    args:
    - /bin/sh
    - -c
    - sleep 15; "删除返回值"

1.3 健康检查

默认情况下，kubelet 根据容器状态作为健康依据，但不能容器中应用程序状态，例如程序假死。这就会导致无法提供服务，丢失流量。因此引入健康检查机制确保容器健康存活。

健康检查有两种类型：

livenessProbe

如果检查失败，将杀死容器，根据Pod的restartPolicy来操作。
readinessProbe

如果检查失败，Kubernetes会把Pod从service endpoints中剔除。

这两种类型支持三种检查方法：

Probe支持以下三种检查方法：

httpGet

发送HTTP请求，返回200-400范围状态码为成功。
exec

执行Shell命令返回状态码是0为成功。
tcpSocket

发起TCP Socket建立成功。

示例：

#probe.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    test: liveness
  name: liveness-exec
spec:
  containers:
  - name: liveness
    image: busybox
    args:
    - /bin/sh
    - -c
    - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 60
    livenessProbe:
      exec:
        command:
        - cat
        - /tmp/healthy
      initialDelaySeconds: 5
      periodSeconds: 5

上述示例：启动容器第一件事创建文件，停止30s，删除该文件，再停止60s，确保容器还在运行中。

验证现象：容器启动正常，30s后异常，会restartPolicy策略自动重建，容器继续正常，反复现象。

[root@k8s-master ~]# kubectl apply -f probe.yaml 
pod/liveness-exec created
[root@k8s-master ~]# kubectl get pods
NAME                      READY   STATUS              RESTARTS   AGE
liveness-exec             0/1     ContainerCreating   0          6s
tomcat-85c798b5d5-68f99   1/1     Running             0          4h16m
[root@k8s-master ~]# kubectl get pods
NAME                      READY   STATUS    RESTARTS   AGE
liveness-exec             1/1     Running   1          109s
tomcat-85c798b5d5-68f99   1/1     Running   0          4h18m
//显示已经重启了
[root@k8s-master ~]# kubectl describe pod liveness-exec		"查看pod的详细信息"
Name:         liveness-exec
Namespace:    default
Priority:     0
Node:         k8s-node2/192.168.100.130
Start Time:   Mon, 05 Oct 2020 16:58:19 +0800
Labels:       test=liveness
Annotations:  Status:  Running
IP:           10.244.0.8
IPs:
  IP:  10.244.0.8
Containers:
  liveness:
    Container ID:  docker://ce8af829f7ddcd5ccaba0f8e05a3363157a323d499ee4c2b2a5f7468844e9dde
    Image:         busybox
    Image ID:      docker-pullable://busybox@sha256:d366a4665ab44f0648d7a00ae3fae139d55e32f9712c67accd604bb55df9d05a
    Port:          <none>
    Host Port:     <none>
    Args:
      /bin/sh
      -c
      touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 60
    State:          Running
      Started:      Mon, 05 Oct 2020 17:02:18 +0800
    Last State:     Terminated
      Reason:       Error
      Exit Code:    137
      Started:      Mon, 05 Oct 2020 17:01:04 +0800
      Finished:     Mon, 05 Oct 2020 17:02:15 +0800
    Ready:          True
    Restart Count:  3
    Liveness:       exec [cat /tmp/healthy] delay=5s timeout=1s period=5s #success=1 #failure=3
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-9mc9t (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-9mc9t:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-9mc9t
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason     Age                  From                Message
  ----     ------     ----                 ----                -------
  Normal   Scheduled  <unknown>            default-scheduler   Successfully assigned default/liveness-exec to k8s-node2
  Normal   Pulled     91s (x3 over 4m3s)   kubelet, k8s-node2  Successfully pulled image "busybox"
  Normal   Created    91s (x3 over 4m3s)   kubelet, k8s-node2  Created container liveness
  Normal   Started    91s (x3 over 4m3s)   kubelet, k8s-node2  Started container liveness
  Warning  Unhealthy  50s (x9 over 3m30s)  kubelet, k8s-node2  Liveness probe failed: cat: can't open '/tmp/healthy': No such file or directory
  Normal   Killing    50s (x3 over 3m20s)  kubelet, k8s-node2  Container liveness failed liveness probe, will be restarted
  Normal   Pulling    20s (x4 over 4m15s)  kubelet, k8s-node2  Pulling image "busybox"
  
 //No such file or directory "健康检查失败"
 
   Normal   Created    4m35s (x3 over 7m7s)   kubelet, k8s-node2  Created container liveness
  Normal   Started    4m35s (x3 over 7m7s)   kubelet, k8s-node2  Started container liveness
  Warning  Unhealthy  3m54s (x9 over 6m34s)  kubelet, k8s-node2  Liveness probe failed: cat: can't open '/tmp/healthy': No such file or directory
  Normal   Killing    3m54s (x3 over 6m24s)  kubelet, k8s-node2  Container liveness failed liveness probe, will be restarted
  Normal   Pulling    2m9s (x5 over 7m19s)   kubelet, k8s-node2  Pulling image "busybox"
//重新构建容器

示例 1: exec 方式:

[root@k8s-master1 demo]# vim exec.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    test: liveness
  name: liveness-exec
spec:
  containers:
  - name: liveness
    image: busybox
    args:
    - /bin/sh
    - -c
    - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy;sleep 30 "创建容器的时候创建healthy文件,等待30秒,删除,作为生产测试"
    livenessProbe: "生命探针的配置,与上面的创建文件策略无关"
      exec:
        command:
        - cat
        - /tmp/healthy
      initialDelaySeconds: 5 "容器初始化完成5秒后触发探针"
      periodSeconds: 5 "探针周期5秒,每5秒发一个探针"

[root@k8s-master1 demo]# kubectl apply -f exec.yaml 
pod/liveness-exec created
[root@k8s-master1 demo]# kubectl get pod -w
NAME            READY   STATUS              RESTARTS   AGE
liveness-exec   0/1     ContainerCreating   0          11s "创建"
liveness-exec   1/1     Running             0          17s
liveness-exec   1/1     Running             1          79s "探针探测healthy资源丢失,开始重启"
liveness-exec   1/1     Running             2          2m40s
liveness-exec   1/1     Running             3          3m49s "一直重启中"
liveness-exec   1/1     Running             4          4m50s
liveness-exec   1/1     Running             5          6m6s
liveness-exec   0/1     CrashLoopBackOff    5          7m5s "容器挂了或者正在被删除的状态"
liveness-exec   1/1     Running             6          8m45s
liveness-exec   0/1     CrashLoopBackOff    6          9m44s
liveness-exec   1/1     Running             7          12m "重启"

示例 2: httpGet 方式,检测tomact 探针:

[root@k8s-master1 demo]# vim httpGet.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    test: liveness
  name: liveness-http
spec:
  containers:
  - name: nginx
    image: nginx
    livenessProbe:
      httpGet:
        path: /index.html "探测URI路径,"
        port: 80
        httpHeaders:
        - name: Custom-Header
          value: Awesome
      initialDelaySeconds: 3
      periodSeconds: 3
[root@k8s-master1 demo]# kubectl get pod -w 
NAME            READY   STATUS              RESTARTS   AGE
liveness-http   0/1     ContainerCreating   0          15s
liveness-http   1/1     Running             0          4m16s   "探针检测nginx首页一直存在,不杀死容器,利用重启策略,重新建资源"

[root@k8s-master1 demo]# vim httpGet.yaml
...
  containers:
  - name: nginx
    image: nginx
    livenessProbe:
      httpGet:
        path: /healthy "探测URI路径,"
        port: 80
        httpHeaders:
        - name: Custom-Header
          value: Awesome
      initialDelaySeconds: 3
      periodSeconds: 3

[root@k8s-master1 demo]# kubectl describe pod  liveness-http
...
  Normal   Scheduled  <unknown>            default-scheduler   Successfully assigned default/liveness-http to k8s-node2
  Normal   Pulling    17m (x4 over 40m)    kubelet, k8s-node2  Pulling image "nginx"
  Normal   Created    17m (x4 over 40m)    kubelet, k8s-node2  Created container nginx
  Normal   Started    17m (x4 over 40m)    kubelet, k8s-node2  Started container nginx
  Warning  Unhealthy  13m (x11 over 35m)   kubelet, k8s-node2  Liveness probe failed: HTTP probe failed with statuscode: 404
  Normal   Killing    5m49s (x4 over 29m)  kubelet, k8s-node2  Container nginx failed liveness probe, will be restarted
  Normal   Pulled     5m22s (x5 over 40m)  kubelet, k8s-node2  Successfully pulled image "nginx"
"报404错误,一直重启的状态"
[root@k8s-master1 demo]# kubectl get pods
NAME            READY   STATUS    RESTARTS   AGE
liveness-http   1/1     Running   4          43m
"RESTARTS 参数显示一直重启,已经杀死资源并重启了4次,不断创建新的资源尝试"

示例3：tcpSocket方式

[root@k8s-master1 demo]# vim tcpSocket.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: liveness-tcp
  labels:
    app: liveness-tcp
spec:
  containers:
  - name: liveness-tcp
    image: nginx
    ports:
    - containerPort: 80
    readinessProbe:
      tcpSocket:
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 10
    livenessProbe:
      tcpSocket:
        port: 80
      initialDelaySeconds: 15
      periodSeconds: 20
[root@k8s-master1 demo]# kubectl apply -f tcpSocket.yaml 
pod/liveness-tcp created

[root@k8s-master1 demo]# kubectl get pods -w 
NAME            READY   STATUS    RESTARTS   AGE
liveness-http   1/1     Running   5          47m
liveness-tcp    0/1     Running   0          16s
liveness-tcp    1/1     Running   0          18s
"一直running不会触发删除重启策略"
//修改配置测试
[root@k8s-master1 demo]# vim tcpSocket.yaml 
...
    livenessProbe:
      tcpSocket:
        port: 8080 "端口改为8080"
...        

[root@k8s-master1 demo]# kubectl apply -f tcpSocket.yaml 
pod/liveness-tcp created

[root@k8s-master1 demo]# kubectl get pods -w
NAME            READY   STATUS              RESTARTS   AGE
liveness-http   1/1     Running             5          50m
liveness-tcp    0/1     ContainerCreating   0          7s
liveness-tcp    0/1     Running             0          16s
liveness-http   1/1     Running             6          52m
liveness-http   1/1     Running             7          64m

"显示这个资源再不断删除尝试重建重启,已经重启"
demo]# kubectl apply -f tcpSocket.yaml 
pod/liveness-tcp created

[root@k8s-master1 demo]# kubectl get pods -w
NAME            READY   STATUS              RESTARTS   AGE
liveness-http   1/1     Running             5          50m
liveness-tcp    0/1     ContainerCreating   0          7s
liveness-tcp    0/1     Running             0          16s
liveness-http   1/1     Running             6          52m
liveness-http   1/1     Running             7          64m

"显示这个资源再不断删除尝试重建重启,已经重启"

标签

#kubernetes #docker #pod资源