Keeping an Eye on Secure Containers: Detecting Container Drift with Admission Controllers
At Box, we use Kubernetes (K8s) to manage hundreds of microservices that enable us to stream data …
Kubernetes v1.22, released in August 2021, introduces a new alpha feature that enhances how Linux nodes manage memory resources. This advancement marks a significant step forward for developers and DevOps teams in resource management.
In previous versions, Kubernetes did not support quality guarantees for memory. This meant there could be issues when allocating memory resources, especially if containers exceeded their limits. With the introduction of Memory QoS (Quality of Service), you can now ensure that critical processes are always allocated sufficient memory.
An example of a Pod configuration might look like this:
apiVersion: v1
kind: Pod
metadata:
name: example
spec:
containers:
- name: nginx
resources:
requests:
memory: "64Mi"
cpu: "250m"
limits:
memory: "64Mi"
cpu: "500m"
Here, spec.containers[].resources.requests and spec.containers[].resources.limits are crucial for planning and executing your containers. While CPU is considered a “compressible” resource, this was not the case for memory in cgroup v1. If a container exceeded its memory limit, it would be terminated by the kernel with an OOM (Out of Memory) kill.
Thanks to the new cgroup v2, Kubernetes now offers an improved implementation that ensures complete protection for memory resources. Memory QoS uses the memory controller of cgroup v2 to ensure that your Pods always have the necessary memory resources.
When you set memory.min to the memory requests, this memory is reserved and never reclaimed by the kernel. This guarantees the availability of memory for your Kubernetes Pods. Additionally, memory.high throttles memory usage when containers reach their limits to prevent system overload.
Here is a table detailing the functions of the two parameters and their correspondences to the resources of Kubernetes containers:
| File | Description |
|---|---|
| memory.min | memory.min specifies the minimum amount of memory that must always be available to the cgroup, i.e., memory that can never be reclaimed by the system. If the cgroup's memory usage reaches this limit and cannot be increased, the system's OOM killer is activated.
We assign it to the container's memory amount |
| memory.high | memory.high is the throttle limit for memory usage. This is the primary mechanism for controlling a cgroup's memory usage. If a cgroup's memory usage exceeds the limit set here, the cgroup's processes are throttled and put under severe reclaim pressure.
|
With these new features in Kubernetes, you can not only increase the reliability of your applications but also improve the efficiency of your resource management. ayedo is proud to be a partner in this innovative area of Kubernetes development and is happy to assist you in implementing these new capabilities.
Source: Kubernetes Blog
At Box, we use Kubernetes (K8s) to manage hundreds of microservices that enable us to stream data …
The Security Profiles Operator (SPO) is a pivotal extension for Kubernetes, significantly …
Introduction The Kubernetes community is facing a significant change: the removal of the Dockershim …