forked from docs/doc-exports
Compare commits
54 Commits
test-conta
...
update-met
| Author | SHA1 | Date | |
|---|---|---|---|
| c59b149892 | |||
| 9a6a028567 | |||
| 6f818add66 | |||
| 53bc92e1f5 | |||
| 48a9cbde3c | |||
| 904c1aad8b | |||
| 190f09501c | |||
| 06c8ac5e62 | |||
| 60127db659 | |||
| 66d959f7d2 | |||
| 043e229a46 | |||
| 0bfc29fc2c | |||
| 6f5e895214 | |||
| 605b8bd9b2 | |||
| aa6c3af702 | |||
| 68ad3e5adf | |||
| ec95a67a29 | |||
| f65b8dc631 | |||
| 4d9b299c10 | |||
| 1605c388fb | |||
| d78ff45820 | |||
| 64672e58fb | |||
| b3f7e0e837 | |||
| 7d7b02e5ca | |||
| bc0c808038 | |||
| 05458809ab | |||
| d2f00b744a | |||
| 6f60ff9f8d | |||
| 070036121f | |||
| cd96953687 | |||
| 8d0926f0e5 | |||
| f9e2808b7c | |||
| 26dfc1fff2 | |||
| c285e88a17 | |||
| 1f1f0cdb4f | |||
| 88d94aea83 | |||
| 71aa7049a2 | |||
| 5b25ae292f | |||
| 88e10a37f3 | |||
| a15d5e5f49 | |||
| a510c1f9fd | |||
| b9f4932025 | |||
| f63df09d85 | |||
| e733dda338 | |||
| 0381bf72d9 | |||
| 708fdb2d21 | |||
| 0110b557aa | |||
| 663e5d14cb | |||
| 289bb754d4 | |||
| 87153b4b9b | |||
| a0d8676db4 | |||
| 913a19b5f6 | |||
| c0bc4c43cf | |||
| a21b995e0a |
File diff suppressed because it is too large
Load Diff
115
.gitea/workflows/run-hcdc.yaml
Normal file
115
.gitea/workflows/run-hcdc.yaml
Normal file
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
60
docs/cce/umn/CVE-2025-23266.html
Normal file
60
docs/cce/umn/CVE-2025-23266.html
Normal file
@ -0,0 +1,60 @@
|
||||
<a name="CVE-2025-23266"></a><a name="CVE-2025-23266"></a>
|
||||
|
||||
<h1 class="topictitle1">Notice of the NVIDIA Container Toolkit Container Escape Vulnerabilities (CVE-2025-23266 and CVE-2025-23267)</h1>
|
||||
<div id="body32001227"><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_p1318192817101">NVIDIA Container Toolkit is an open-source tool package from NVIDIA. It allows you to use NVIDIA GPUs to speed up computing in a containerized environment. The toolkit includes a container runtime library and utilities for automatically configuring containers to leverage NVIDIA GPUs.</p>
|
||||
<div class="section" id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_section1217032912611"><h4 class="sectiontitle">Description</h4>
|
||||
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_en-us_topic_0193581139_table1565618845915" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Vulnerability details</caption><thead align="left"><tr id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_en-us_topic_0193581139_row065718811595"><th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.2.2.2.5.1.1"><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_en-us_topic_0193581139_p265798165915">Type</p>
|
||||
</th>
|
||||
<th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.2.2.2.5.1.2"><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_en-us_topic_0193581139_p465798195911">CVE-ID</p>
|
||||
</th>
|
||||
<th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.2.2.2.5.1.3"><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_p197165314415">Severity</p>
|
||||
</th>
|
||||
<th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.2.2.2.5.1.4"><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_p568860163217">Discovered</p>
|
||||
</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody><tr id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_en-us_topic_0193581139_row1120510564498"><td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.1 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_p111259410113">Container escape</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.2 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_p8553132017127"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23266" target="_blank" rel="noopener noreferrer">CVE-2025-23266</a></p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.3 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_p16697543175417">Critical</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.4 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_p26882020325">2025-07-17</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="CVE-2025-23266__en-us_topic_0000002394138741_row1682703812545"><td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.1 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_p1282723817549">Data tampering and denial of service</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.2 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_p8827103865410"><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23267" target="_blank" rel="noopener noreferrer">CVE-2025-23267</a></p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.3 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_p19827193895419">High</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.2.2.2.5.1.4 "><p id="CVE-2025-23266__en-us_topic_0000002394138741_p4827193818547">2025-07-17</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_section122155314507"><h4 class="sectiontitle">Impact</h4><p id="CVE-2025-23266__en-us_topic_0000002394138741_p556962214815">In NVIDIA Container Toolkit v1.17.7 and earlier versions, an attacker can run a malicious image, which may result in container escape and enables the attacker to obtain host permissions. Successful exploitation of these vulnerabilities may enable privilege escalation, data tampering, information leakage, and denial of service.</p>
|
||||
</div>
|
||||
<div class="section" id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_section226916579125"><h4 class="sectiontitle">Identification Method</h4><ol id="CVE-2025-23266__en-us_topic_0000002394138741_ol10950421495"><li id="CVE-2025-23266__en-us_topic_0000002394138741_li495092894">If the cluster does not have the CCE AI Suite (NVIDIA GPU) add-on installed or the add-on version is earlier than 2.0.0, these vulnerabilities are not relevant.<p id="CVE-2025-23266__en-us_topic_0000002394138741_p75860359503"><a name="CVE-2025-23266__en-us_topic_0000002394138741_li495092894"></a><a name="en-us_topic_0000002394138741_li495092894"></a></p>
|
||||
<p id="CVE-2025-23266__en-us_topic_0000002394138741_p11444832219"></p>
|
||||
<div class="note" id="CVE-2025-23266__en-us_topic_0000002394138741_note131811144201810"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="CVE-2025-23266__en-us_topic_0000002394138741_p558861081414">In earlier versions, CCE AI Suite (NVIDIA GPU) add-on are named gpu-beta or gpu-device-plugin.</p>
|
||||
</div></div>
|
||||
</li><li id="CVE-2025-23266__en-us_topic_0000002394138741_li68144233118">If the CCE AI Suite (NVIDIA GPU) add-on version is in the range of 2.0.0 to 2.2.1 or 2.5.0 to 2.8.1, log in to the GPU node and run the following command:<pre class="screen" id="CVE-2025-23266__en-us_topic_0000002394138741_screen1081432133116">nvidia-container-runtime --version</pre>
|
||||
<ul id="CVE-2025-23266__en-us_topic_0000002394138741_ul191419819590"><li id="CVE-2025-23266__en-us_topic_0000002394138741_li12141128135919">If no such command is displayed, these vulnerabilities are not present.</li><li id="CVE-2025-23266__en-us_topic_0000002394138741_li914114815594">If the version of nvidia-container-runtime is earlier than 1.17.8, these vulnerabilities are present.<p id="CVE-2025-23266__en-us_topic_0000002394138741_p155991657125816"><a name="CVE-2025-23266__en-us_topic_0000002394138741_li914114815594"></a><a name="en-us_topic_0000002394138741_li914114815594"></a><span><img id="CVE-2025-23266__en-us_topic_0000002394138741_image15351143412490" src="en-us_image_0000002365047420.png"></span></p>
|
||||
</li></ul>
|
||||
</li></ol>
|
||||
</div>
|
||||
<div class="section" id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_section0651319327"><h4 class="sectiontitle">Solution</h4><p id="CVE-2025-23266__en-us_topic_0000002394138741_p104132591912">Do not run an untrusted container image in the cluster before the vulnerabilities are fixed.</p>
|
||||
<p id="CVE-2025-23266__en-us_topic_0000002394138741_p93366712281">CCE will release a new version of the add-on to fix these vulnerabilities. For details, see <a href="cce_10_0141.html">CCE AI Suite (NVIDIA GPU) Release History</a>.</p>
|
||||
</div>
|
||||
<div class="section" id="CVE-2025-23266__en-us_topic_0000002394138741_en-us_topic_0000001159663171_section183061740102419"><h4 class="sectiontitle">Helpful Links</h4><p id="CVE-2025-23266__en-us_topic_0000002394138741_p174671921175419">NVIDIA Container Toolkit Security Bulletin: <a href="https://nvidia.custhelp.com/app/answers/detail/a_id/5659" target="_blank" rel="noopener noreferrer">https://nvidia.custhelp.com/app/answers/detail/a_id/5659</a></p>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<div class="familylinks">
|
||||
<div class="parentlink"><strong>Parent topic:</strong> <a href="cce_bulletin_0169.html">Security Vulnerability Responses</a></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@ -8,10 +8,28 @@
|
||||
</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody><tr id="cce_01_0300__row1672312793610"><td class="cellrowborder" valign="top" width="19.009999999999998%" headers="mcps1.3.1.2.3.1.1 "><p id="cce_01_0300__p372317712362">2025-05-23</p>
|
||||
<tbody><tr id="cce_01_0300__row153271013089"><td class="cellrowborder" valign="top" width="19.009999999999998%" headers="mcps1.3.1.2.3.1.1 "><p id="cce_01_0300__p93277135815">2025-07-25</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="80.99%" headers="mcps1.3.1.2.3.1.2 "><p id="cce_01_0300__p1832717138814">Added <a href="CVE-2025-23266.html">Notice of the NVIDIA Container Toolkit Container Escape Vulnerabilities (CVE-2025-23266 and CVE-2025-23267)</a>.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_01_0300__row198411117281"><td class="cellrowborder" valign="top" width="19.009999999999998%" headers="mcps1.3.1.2.3.1.1 "><p id="cce_01_0300__p9841101142815">2025-06-30</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="80.99%" headers="mcps1.3.1.2.3.1.2 "><p id="cce_01_0300__p18787624132814">Update:</p>
|
||||
<p id="cce_01_0300__p0787202432810">Updated <a href="cce_10_0197.html">Cluster Upgrade Overview</a>.</p>
|
||||
<p id="cce_01_0300__p871095682917">Updated <a href="cce_10_0302.html">Before You Start</a>.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_01_0300__row16582181610456"><td class="cellrowborder" valign="top" width="19.009999999999998%" headers="mcps1.3.1.2.3.1.1 "><p id="cce_01_0300__p14582171614519">2025-06-23</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="80.99%" headers="mcps1.3.1.2.3.1.2 "><p id="cce_01_0300__p56586223461">Update:</p>
|
||||
<p id="cce_01_0300__p4582191654511">Updated <a href="cce_10_0613.html">Overview</a>. Common I/O disks are the previous-generation product and cannot be created.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_01_0300__row1672312793610"><td class="cellrowborder" valign="top" width="19.009999999999998%" headers="mcps1.3.1.2.3.1.1 "><p id="cce_01_0300__p372317712362">2025-05-23</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="80.99%" headers="mcps1.3.1.2.3.1.2 "><p id="cce_01_0300__p37306202368">Update:</p>
|
||||
<ul id="cce_01_0300__ul7135332163612"><li id="cce_01_0300__li013619326366">Updated <a href="cce_10_0059.html">Configuring Network Policies to Restrict Pod Access</a>.</li><li id="cce_01_0300__li10221163312367">Updated <a href="cce_10_0462.html">Container Engines</a>.</li><li id="cce_01_0300__li299616330369">Updated <a href="cce_10_0476.html">Node OSs</a></li></ul>
|
||||
<ul id="cce_01_0300__ul7135332163612"><li id="cce_01_0300__li013619326366">Updated <a href="cce_10_0059.html">Configuring Network Policies to Restrict Pod Access</a>.</li><li id="cce_01_0300__li10221163312367">Updated <a href="cce_10_0462.html">Container Engines</a>.</li><li id="cce_01_0300__li299616330369">Updated <a href="cce_10_0476.html">Node OSs</a>.</li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_01_0300__row1257516131090"><td class="cellrowborder" valign="top" width="19.009999999999998%" headers="mcps1.3.1.2.3.1.1 "><p id="cce_01_0300__p105762136919">2025-05-12</p>
|
||||
|
||||
@ -67,7 +67,7 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0003__cce_10_0198_row1966913718588"><td class="cellrowborder" valign="top" width="20.02%" headers="mcps1.3.4.2.5.2.3.1.2.3.1.1 "><p id="cce_10_0003__cce_10_0198_p0669147185817">Data Disk</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.4.2.5.2.3.1.2.3.1.2 "><ul id="cce_10_0003__cce_10_0198_ul184351126605"><li id="cce_10_0003__cce_10_0198_en-us_topic_0000001199021246_li103472126407"><strong id="cce_10_0003__cce_10_0198_b53311531183510">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol113317316358"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol12331831193518"><b>Data Disk</b></span>. <strong id="cce_10_0003__cce_10_0198_b1633103163515">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.</li><li id="cce_10_0003__cce_10_0198_en-us_topic_0000001199021246_li18830161664015">If <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol16275444867446"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol5641816837446"><b>System Disk</b></span>, you do not need to add a default data disk. In this case, all data disks are common ones: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB. This function is available for clusters of v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, or later versions.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.4.2.5.2.3.1.2.3.1.2 "><ul id="cce_10_0003__cce_10_0198_ul184351126605"><li id="cce_10_0003__cce_10_0198_en-us_topic_0000001199021246_li103472126407"><strong id="cce_10_0003__cce_10_0198_b13284145912236">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol2284135972312"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol1284135952313"><b>Data Disk</b></span>. <strong id="cce_10_0003__cce_10_0198_b1828495914238">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.</li><li id="cce_10_0003__cce_10_0198_en-us_topic_0000001199021246_li18830161664015">If <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol16275444867446"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0003__cce_10_0198_uicontrol5641816837446"><b>System Disk</b></span>, you do not need to add a default data disk. In this case, all data disks are common ones: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB. This function is available for clusters of v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, or later versions.</li></ul>
|
||||
<p id="cce_10_0003__cce_10_0198_p3752312011">Click <strong id="cce_10_0003__cce_10_0198_b513813367555">Expand</strong> to configure <strong id="cce_10_0003__cce_10_0198_b13265825195416">Data Disk Space Allocation</strong>. This allocates space for container engines, images, and ephemeral storage to ensure their proper running. For details about how to allocate data disk space, see <a href="cce_10_0341.html">Space Allocation of a Data Disk</a>.</p>
|
||||
<p id="cce_10_0003__cce_10_0198_p1391618153118">For other data disks, a raw disk is created without any processing by default. You can also click <strong id="cce_10_0003__cce_10_0198_b16127101911540">Expand</strong> and select <strong id="cce_10_0003__cce_10_0198_b21351519135417">Mount Disk</strong> to mount the data disk to a specified directory. Data disks can also be used as <a href="cce_10_0391.html">local PVs</a> or <a href="cce_10_0726.html">local EVs</a>.</p>
|
||||
</td>
|
||||
|
||||
@ -3,32 +3,32 @@
|
||||
<h1 class="topictitle1">Overview</h1>
|
||||
<div id="body1522665832344"><p id="cce_10_0006__p1031812215459">A workload is an application running on Kubernetes. No matter how many components are there in your workload, you can run it in a group of Kubernetes pods. A workload is an abstract model of a group of pods in Kubernetes. Workloads in Kubernetes are classified as <span class="keyword" id="cce_10_0006__keyword1293375712468">Deployments</span>, <span class="keyword" id="cce_10_0006__keyword1541920224714">StatefulSets</span>, <span class="keyword" id="cce_10_0006__keyword1273972479">DaemonSets</span>, <span class="keyword" id="cce_10_0006__keyword21491010164711">jobs</span>, and <span class="keyword" id="cce_10_0006__keyword19556171584711">cron jobs</span>.</p>
|
||||
<p id="cce_10_0006__p11116113204610">CCE provides Kubernetes-native container deployment and management and supports lifecycle management of container workloads, including creation, configuration, monitoring, auto scaling, upgrade, uninstall, service discovery, and load balancing.</p>
|
||||
<div class="section" id="cce_10_0006__section9645114684816"><h4 class="sectiontitle">Overview of Pod</h4><p id="cce_10_0006__en-us_topic_0254767870_p356108173515">A pod is the smallest, simplest unit in the Kubernetes object model that you create or deploy. A pod is a group of one or more containers, with shared storage and network resources, and a specification for how to run the containers. Each pod has a separate IP address.</p>
|
||||
<div class="section" id="cce_10_0006__section9645114684816"><h4 class="sectiontitle">Overview of Pods</h4><p id="cce_10_0006__en-us_topic_0254767870_p356108173515">Pods are the smallest unit that you can create or deploy in Kubernetes. Each pod comprises one or more containers, shared storage (volumes), a unique IP address, and container runtime policies.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0254767870_p4629172611480">Pods can be used in either of the following ways:</p>
|
||||
<ul id="cce_10_0006__en-us_topic_0254767870_ul062982617481"><li id="cce_10_0006__en-us_topic_0254767870_li1629172611482">A pod runs only one container. This is the most common usage of pods in Kubernetes. You can consider a pod as a container, but Kubernetes directly manages pods instead of containers.</li><li id="cce_10_0006__en-us_topic_0254767870_li1962932615480">A pod runs multiple containers that need to be tightly coupled. In this scenario, a pod contains a main container and several sidecar containers, as shown in <a href="#cce_10_0006__en-us_topic_0254767870_fig347141918551">Figure 1</a>. For example, the main container is a web server that provides file services from a fixed directory, and sidecar containers periodically download files to this fixed directory.<div class="fignone" id="cce_10_0006__en-us_topic_0254767870_fig347141918551"><a name="cce_10_0006__en-us_topic_0254767870_fig347141918551"></a><a name="en-us_topic_0254767870_fig347141918551"></a><span class="figcap"><b>Figure 1 </b>Pod running multiple containers</span><br><span><img id="cce_10_0006__en-us_topic_0254767870_image1835215316361" src="en-us_image_0258392378.png"></span></div>
|
||||
<ul id="cce_10_0006__en-us_topic_0254767870_ul062982617481"><li id="cce_10_0006__en-us_topic_0254767870_li1629172611482">A pod runs a single container. This is the most common scenario in Kubernetes. In this case, a pod can be thought of as a container, although Kubernetes manages the pod rather than the container itself.</li><li id="cce_10_0006__en-us_topic_0254767870_li1962932615480">A pod runs multiple tightly coupled containers that need to share resources. In this case, the pod includes a main container and several sidecar containers, as shown in <a href="#cce_10_0006__en-us_topic_0254767870_fig347141918551">Figure 1</a>. For example, the main container might be a web server providing file services from a fixed directory, while sidecar containers periodically download files to that directory.<div class="fignone" id="cce_10_0006__en-us_topic_0254767870_fig347141918551"><a name="cce_10_0006__en-us_topic_0254767870_fig347141918551"></a><a name="en-us_topic_0254767870_fig347141918551"></a><span class="figcap"><b>Figure 1 </b>A pod running multiple containers</span><br><span><img id="cce_10_0006__en-us_topic_0254767870_image1835215316361" src="en-us_image_0258392378.png"></span></div>
|
||||
</li></ul>
|
||||
<p id="cce_10_0006__en-us_topic_0254767870_p9163143619182">In Kubernetes, pods are rarely created directly. Instead, Kubernetes controller manages pods through pod instances such as Deployments and jobs. A controller typically uses a pod template to create pods. The controller can also manage multiple pods and provide functions such as replica management, rolling upgrade, and self-healing.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0254767870_p9163143619182">In Kubernetes, you rarely create pods directly. Instead, controllers like Deployments and jobs create and manage them. These controllers typically use pod templates to create and manage pods, providing features like replica management, rolling upgrades, and self-healing.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0006__section1972719357496"><h4 class="sectiontitle">Overview of Deployment</h4><p id="cce_10_0006__en-us_topic_0249851113_p13243347131615">A pod is the smallest and simplest unit that you create or deploy in Kubernetes. It is designed to be an ephemeral, one-off entity. A pod can be evicted when node resources are insufficient and disappears along with a cluster node failure. Kubernetes provides controllers to manage pods. Controllers can create and manage pods, and provide replica management, rolling upgrade, and self-healing capabilities. The most commonly used controller is Deployment.</p>
|
||||
<div class="section" id="cce_10_0006__section1972719357496"><h4 class="sectiontitle">Overview of Deployments</h4><p id="cce_10_0006__en-us_topic_0249851113_p13243347131615">A pod is the smallest unit that you create or deploy in Kubernetes. It is evicted when resources are tight and gone if its node fails. Kubernetes provides controllers to manage pods. These controllers create and manage pods, providing features like replica management, rolling upgrades, and self-healing. The most common controller is Deployment.</p>
|
||||
<div class="fignone" id="cce_10_0006__en-us_topic_0249851113_fig12546173933714"><span class="figcap"><b>Figure 2 </b>Relationship between a Deployment and pods</span><br><span><img id="cce_10_0006__en-us_topic_0249851113_image5671529113711" src="en-us_image_0258095884.png"></span></div>
|
||||
<p id="cce_10_0006__en-us_topic_0249851113_p35371248184511">A Deployment can contain one or more pods. These pods have the same role. Therefore, the system automatically distributes requests to multiple pods of a Deployment.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249851113_p11715188281">A Deployment integrates a lot of functions, including online deployment, rolling upgrade, replica creation, and restoration of online jobs. To some extent, Deployments can be used to realize unattended rollout, which greatly reduces difficulties and operation risks in the rollout process.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249851113_p35371248184511">A Deployment runs one or more identical pods. Kubernetes load-balances traffic across them.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249851113_p11715188281">A Deployment handles rollout, rolling upgrades, scaling, and automatic replacement of failed pods. This enables zero-touch releases with minimal risk.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0006__section14888155424918"><h4 class="sectiontitle">Overview of StatefulSet</h4><p id="cce_10_0006__en-us_topic_0249896621_p12502102192418">All pods under a Deployment have the same characteristics except for the name and IP address. If required, a Deployment can use a pod template to create new pods. If not required, the Deployment can delete any one of the pods.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249896621_p2669143675415">However, Deployments cannot meet the requirements in some distributed scenarios when each pod requires its own status or in a distributed database where each pod requires independent storage.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249896621_p97277467269">Distributed stateful applications involve different roles for different responsibilities. For example, databases work in active/standby mode, and pods depend on each other. To deploy stateful applications in Kubernetes, ensure pods meet the following requirements:</p>
|
||||
<ul id="cce_10_0006__en-us_topic_0249896621_ul1181724132317"><li id="cce_10_0006__en-us_topic_0249896621_li10181102419231">Each pod must have a fixed identifier so that it can be recognized by other pods.</li><li id="cce_10_0006__en-us_topic_0249896621_li81819249237">Separate storage resources must be configured for each pod. In this way, the original data can be retrieved after a pod is deleted and restored. Otherwise, the pod status will be changed after the pod is rebuilt.</li></ul>
|
||||
<p id="cce_10_0006__en-us_topic_0249896621_p929315724313">To address the preceding requirements, Kubernetes provides StatefulSets.</p>
|
||||
<ol id="cce_10_0006__en-us_topic_0249896621_ol117020203559"><li id="cce_10_0006__en-us_topic_0249896621_li183871501692">StatefulSets provide a fixed name for each pod following a fixed number ranging from 0 to N. After a pod is rescheduled, the pod name and the hostname remain unchanged.</li><li id="cce_10_0006__en-us_topic_0249896621_li1789810518913">StatefulSets use a headless Service to allocate a fixed domain name for each pod.</li><li id="cce_10_0006__en-us_topic_0249896621_li43183204569">StatefulSets create PVCs with fixed identifiers to ensure that pods can access the same persistent data after being rescheduled.<div class="fignone" id="cce_10_0006__en-us_topic_0249896621_fig97542112114"><span class="figcap"><b>Figure 3 </b>StatefulSet</span><br><span><img id="cce_10_0006__en-us_topic_0249896621_image9125145402111" src="en-us_image_0258203193.png"></span></div>
|
||||
<div class="section" id="cce_10_0006__section14888155424918"><h4 class="sectiontitle">Overview of StatefulSets</h4><p id="cce_10_0006__en-us_topic_0249896621_p12502102192418">All pods under a Deployment are identical except for their names and IP addresses. Deployments can create new pods using a pod template and delete any pod when not needed.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249896621_p2669143675415">However, Deployments are not suitable for distributed scenarios where each pod requires its own status or independent storage, such as in distributed databases.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249896621_p97277467269">Distributed stateful applications often involve different roles and responsibilities. For example, databases may operate in active/standby mode, and pods may depend on each other. To deploy stateful applications in Kubernetes, pods must meet the following requirements:</p>
|
||||
<ul id="cce_10_0006__en-us_topic_0249896621_ul1181724132317"><li id="cce_10_0006__en-us_topic_0249896621_li10181102419231">Each pod must have a unique, fixed identifier to be recognized by other pods.</li><li id="cce_10_0006__en-us_topic_0249896621_li81819249237">Each pod should be configured with separate storage resources to ensure data persistence. This allows the original data to be retained and retrieved even after a pod is deleted and recreated. Without dedicated storage, the pod's data will be lost upon deletion, and the new pod will initialize with a different state.</li></ul>
|
||||
<p id="cce_10_0006__en-us_topic_0249896621_p929315724313">To address these requirements, Kubernetes provides StatefulSets:</p>
|
||||
<ol id="cce_10_0006__en-us_topic_0249896621_ol117020203559"><li id="cce_10_0006__en-us_topic_0249896621_li183871501692">StatefulSets provide a fixed name for each pod, followed by a sequential numeric suffix (for example, pod-0, pod-1, ..., pod-N). After a pod is rescheduled, its name and hostname remain unchanged.</li><li id="cce_10_0006__en-us_topic_0249896621_li1789810518913">StatefulSets use a headless Service to allocate a fixed domain name for each pod.</li><li id="cce_10_0006__en-us_topic_0249896621_li43183204569">StatefulSets create PVCs with fixed identifiers. This ensures that pods can access the original persistent data after being rescheduled.<div class="fignone" id="cce_10_0006__en-us_topic_0249896621_fig97542112114"><span class="figcap"><b>Figure 3 </b>StatefulSet</span><br><span><img id="cce_10_0006__en-us_topic_0249896621_image9125145402111" src="en-us_image_0258203193.png"></span></div>
|
||||
</li></ol>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0006__section7846281504"><h4 class="sectiontitle">Overview of DaemonSet</h4><p id="cce_10_0006__en-us_topic_0249851114_p441104813815">A DaemonSet runs a pod on each node in a cluster and ensures that there is only one pod. This works well for certain system-level applications such as log collection and resource monitoring since they must run on each node and need only a few pods. A good example is kube-proxy.</p>
|
||||
<div class="section" id="cce_10_0006__section7846281504"><h4 class="sectiontitle">Overview of DaemonSet</h4><p id="cce_10_0006__en-us_topic_0249851114_p441104813815">A DaemonSet runs a pod on each node in a cluster and ensures that there is only one pod. This works well for certain system-level applications such as log collection and resource monitoring since they must run on each node. A good example is kube-proxy.</p>
|
||||
<p id="cce_10_0006__en-us_topic_0249851114_p5986375820">DaemonSets are closely related to nodes. If a node becomes faulty, the DaemonSet will not create the same pods on other nodes.</p>
|
||||
<div class="fignone" id="cce_10_0006__en-us_topic_0249851114_fig27588261914"><span class="figcap"><b>Figure 4 </b>DaemonSet</span><br><span><img id="cce_10_0006__en-us_topic_0249851114_image13336133243518" src="en-us_image_0258871213.png"></span></div>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0006__section153173319578"><h4 class="sectiontitle">Overview of Job and CronJob</h4><p id="cce_10_0006__en-us_topic_0249851115_p10889736123218">Jobs and CronJobs allow you to run short lived, one-off tasks in batch. They ensure the task pods run to completion.</p>
|
||||
<ul id="cce_10_0006__en-us_topic_0249851115_ul197714911354"><li id="cce_10_0006__en-us_topic_0249851115_li47711097352">A job is a resource object used by Kubernetes to control batch tasks. Jobs are different from long-term servo tasks (such as Deployments and StatefulSets). The former is started and terminated at specific times, while the latter runs unceasingly unless being terminated. The pods managed by a job will be automatically removed after successfully completing tasks based on user configurations.</li><li id="cce_10_0006__en-us_topic_0249851115_li249061111353">A CronJob runs a job periodically on a specified schedule. A CronJob object is similar to a line of a crontab file in Linux.</li></ul>
|
||||
<p id="cce_10_0006__en-us_topic_0249851115_p166171774387">This run-to-completion feature of jobs is especially suitable for one-off tasks, such as continuous integration (CI).</p>
|
||||
<div class="section" id="cce_10_0006__section153173319578"><h4 class="sectiontitle">Overview of Jobs and CronJobs</h4><p id="cce_10_0006__en-us_topic_0249851115_p10889736123218">Jobs and CronJobs are Kubernetes resources designed to manage short-lived, one-off tasks that run to completion.</p>
|
||||
<ul id="cce_10_0006__en-us_topic_0249851115_ul197714911354"><li id="cce_10_0006__en-us_topic_0249851115_li47711097352">A job is a resource object used to control batch tasks. Jobs start and terminate at specific times, unlike long-running services such as Deployments and StatefulSets, which run continuously unless terminated. Pods managed by a job are automatically removed after successfully completing their tasks, based on the specified settings.</li><li id="cce_10_0006__en-us_topic_0249851115_li249061111353">A CronJob runs a job periodically on a specified schedule. A CronJob object is similar to a line in a crontab file in Linux.</li></ul>
|
||||
<p id="cce_10_0006__en-us_topic_0249851115_p166171774387">The run-to-completion feature of workloads makes them particularly suitable for one-off tasks, such as continuous integration (CI) pipelines.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0006__section3891192610218"><h4 class="sectiontitle">Workload Lifecycle</h4>
|
||||
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="cce_10_0006__table488465253420" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Status description</caption><thead align="left"><tr id="cce_10_0006__row13888105212343"><th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.8.2.2.3.1.1"><p id="cce_10_0006__p1788975203415">Status</p>
|
||||
|
||||
@ -19,8 +19,8 @@
|
||||
<ul id="cce_10_0010__ul953218444116"><li id="cce_10_0010__li87791418174620">ClusterIP: used to make the Service only reachable from within a cluster.</li><li id="cce_10_0010__li17876227144612">NodePort: used for access from outside a cluster. A NodePort Service is accessed through the port on the node.</li><li id="cce_10_0010__li94953274615">LoadBalancer: used for access from outside a cluster. It is an extension of NodePort, to which a load balancer routes, and external systems only need to access the load balancer.</li></ul>
|
||||
<p id="cce_10_0010__p1677717174140">For details about the Service, see <a href="cce_10_0249.html">Overview</a>.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0010__section1248852094313"><a name="cce_10_0010__section1248852094313"></a><a name="section1248852094313"></a><h4 class="sectiontitle">Ingress</h4><p id="cce_10_0010__p96672218193">Services forward requests using layer-4 TCP and UDP protocols. Ingresses forward requests using layer-7 HTTP and HTTPS protocols. Domain names and paths can be used to achieve finer granularities.</p>
|
||||
<div class="fignone" id="cce_10_0010__fig816719454212"><span class="figcap"><b>Figure 2 </b>Ingress and Service</span><br><span><img id="cce_10_0010__en-us_topic_0249851122_image8371183511310" src="en-us_image_0258961458.png"></span></div>
|
||||
<div class="section" id="cce_10_0010__section1248852094313"><a name="cce_10_0010__section1248852094313"></a><a name="section1248852094313"></a><h4 class="sectiontitle">Ingress</h4><p id="cce_10_0010__p96672218193">Services forward requests using TCP and UDP at Layer 4. Ingresses forward requests using HTTP and HTTPS at Layer 7. Domain names and paths can be used for access of finer granularities.</p>
|
||||
<div class="fignone" id="cce_10_0010__fig816719454212"><span class="figcap"><b>Figure 2 </b>An ingress and associated Services</span><br><span><img id="cce_10_0010__en-us_topic_0249851122_image8371183511310" src="en-us_image_0258961458.png"></span></div>
|
||||
<p id="cce_10_0010__p174691141141410">For details about the ingress, see <a href="cce_10_0094.html">Overview</a>.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0010__section1286493159"><a name="cce_10_0010__section1286493159"></a><a name="section1286493159"></a><h4 class="sectiontitle">Access Scenarios</h4><p id="cce_10_0010__p1558001514155">Workload access scenarios can be categorized as follows:</p>
|
||||
|
||||
@ -92,7 +92,7 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0012__cce_10_0363_row1966913718588"><td class="cellrowborder" valign="top" width="20.02%" headers="mcps1.3.2.2.3.2.6.1.2.3.1.1 "><p id="cce_10_0012__cce_10_0363_p0669147185817">Data Disk</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.2.2.3.2.6.1.2.3.1.2 "><ul id="cce_10_0012__cce_10_0363_ul13347201216402"><li id="cce_10_0012__cce_10_0363_li103472126407"><strong id="cce_10_0012__cce_10_0363_b493614401788">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0012__cce_10_0363_uicontrol16936640683"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0012__cce_10_0363_uicontrol29366400810"><b>Data Disk</b></span>. <strong id="cce_10_0012__cce_10_0363_b79361840284">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.<ul id="cce_10_0012__cce_10_0363_ul324262033711"><li id="cce_10_0012__cce_10_0363_li1124252010378">Default data disk: used for container runtime and kubelet components. The disk size ranges from 20 GiB to 32768 GiB. The default value is 100 GiB.</li><li id="cce_10_0012__cce_10_0363_li6177165413374">Other common data disks: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.2.2.3.2.6.1.2.3.1.2 "><ul id="cce_10_0012__cce_10_0363_ul13347201216402"><li id="cce_10_0012__cce_10_0363_li103472126407"><strong id="cce_10_0012__cce_10_0363_b87711342223">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0012__cce_10_0363_uicontrol1378123452217"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0012__cce_10_0363_uicontrol107853413227"><b>Data Disk</b></span>. <strong id="cce_10_0012__cce_10_0363_b187815343221">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.<ul id="cce_10_0012__cce_10_0363_ul324262033711"><li id="cce_10_0012__cce_10_0363_li1124252010378">Default data disk: used for container runtime and kubelet components. The disk size ranges from 20 GiB to 32768 GiB. The default value is 100 GiB.</li><li id="cce_10_0012__cce_10_0363_li6177165413374">Other common data disks: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB.</li></ul>
|
||||
</li><li id="cce_10_0012__cce_10_0363_li18830161664015">If <span class="uicontrol" id="cce_10_0012__cce_10_0363_uicontrol2621173512497"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0012__cce_10_0363_uicontrol19561032184918"><b>System Disk</b></span>, you do not need to add a default data disk. In this case, all data disks are common ones: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB. This function is available for clusters of v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, or later versions.</li></ul>
|
||||
<div class="note" id="cce_10_0012__cce_10_0363_note95411755120"><span class="notetitle"> NOTE: </span><div class="notebody"><ul id="cce_10_0012__cce_10_0363_ul1388875765811"><li id="cce_10_0012__cce_10_0363_li9888165712586">If the node flavor is disk-intensive or ultra-high I/O, one data disk can be a local disk.</li><li id="cce_10_0012__cce_10_0363_li7888757125811">Local disks may break down and do not ensure data reliability. Store your service data in EVS disks, which are more reliable than local disks.</li></ul>
|
||||
</div></div>
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
<a name="cce_10_0018"></a><a name="cce_10_0018"></a>
|
||||
|
||||
<h1 class="topictitle1">Collecting Container Logs Using ICAgent</h1>
|
||||
<div id="body1522667123001"><p id="cce_10_0018__p78381781804">CCE works with AOM to collect workload logs. When a node is created, ICAgent (a DaemonSet named <strong id="cce_10_0018__b13829819578">icagent</strong> in the <strong id="cce_10_0018__b697274313582">kube-system</strong> namespace of a cluster) of AOM is installed by default. ICAgent collects workload logs and reports them to AOM. You can view workload logs on the CCE or AOM console.</p>
|
||||
<div id="body1522667123001"><p id="cce_10_0018__p78381781804">CCE can collect workload logs and report them to AOM 1.0. When a node is created, ICAgent (a DaemonSet named <strong id="cce_10_0018__b77653570117">icagent</strong> in the <strong id="cce_10_0018__b1876513573112">kube-system</strong> namespace of a cluster) is installed by default. ICAgent collects workload logs and reports them to AOM 1.0. You can view workload logs on the CCE or AOM 1.0 console.</p>
|
||||
<div class="section" id="cce_10_0018__section17884754413"><h4 class="sectiontitle">Constraints</h4><p id="cce_10_0018__p23831558355">ICAgent only collects text logs in .log, .trace, and .out formats.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0018__section1951732710"><h4 class="sectiontitle">Using ICAgent to Collect Logs</h4><ol id="cce_10_0018__ol1253654833013"><li id="cce_10_0018__li19284854163014"><span>When <a href="cce_10_0047.html">creating a workload</a>, set logging for the container.</span></li><li id="cce_10_0018__li2427158104715"><span>Click <span><img id="cce_10_0018__image134281583473" src="en-us_image_0000002218820458.png"></span> to add a log policy.</span><p><p id="cce_10_0018__p9862125810472">The following uses Nginx as an example. Log policies vary depending on workloads.</p>
|
||||
@ -31,7 +31,7 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0018__row6588187135510"><td class="cellrowborder" valign="top" width="22.12%" headers="mcps1.3.3.2.3.2.1.2.3.1.1 "><p id="cce_10_0018__p758720775520">Extended Host Path</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="77.88000000000001%" headers="mcps1.3.3.2.3.2.1.2.3.1.2 "><p id="cce_10_0018__p10159815204516">This parameter is mandatory only if <strong id="cce_10_0018__b1319582314326">Volume Type</strong> is set to <span class="uicontrol" id="cce_10_0018__uicontrol104741538114511"><b>HostPath</b></span>.</p>
|
||||
<td class="cellrowborder" valign="top" width="77.88000000000001%" headers="mcps1.3.3.2.3.2.1.2.3.1.2 "><p id="cce_10_0018__p10159815204516">This parameter is mandatory only if <strong id="cce_10_0018__b1319582314326">Volume Type</strong> is set to <span class="uicontrol" id="cce_10_0018__uicontrol104741538114511"><b>hostPath</b></span>.</p>
|
||||
<p id="cce_10_0018__p15012414486">Extended host paths contain pod IDs or container names to distinguish different containers into which the host path is mounted.</p>
|
||||
<p id="cce_10_0018__p158737185514">A level-3 directory is added to the original volume directory/subdirectory. You can easily obtain the files output by a single <span class="keyword" id="cce_10_0018__keyword1142267981799">Pod</span>.</p>
|
||||
<ul id="cce_10_0018__ul1358877135514"><li id="cce_10_0018__li115872725517"><strong id="cce_10_0018__b67128281231">None</strong>: No extended path is configured. </li><li id="cce_10_0018__li8587474550"><strong id="cce_10_0018__b37109352310">PodUID</strong>: ID of a pod.</li><li id="cce_10_0018__li14587127185513"><strong id="cce_10_0018__b1246417411639">PodName</strong>: name of a pod.</li><li id="cce_10_0018__li10587117175514"><strong id="cce_10_0018__b1232314820315">PodUID/ContainerName</strong>: ID of a pod or name of a container.</li><li id="cce_10_0018__li758816716559"><strong id="cce_10_0018__b15921753534">PodName/ContainerName</strong>: name of a pod or container.</li></ul>
|
||||
@ -39,7 +39,7 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0018__row1740653212476"><td class="cellrowborder" valign="top" width="22.12%" headers="mcps1.3.3.2.3.2.1.2.3.1.1 "><p id="cce_10_0018__p84061032144714">Collection Path</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="77.88000000000001%" headers="mcps1.3.3.2.3.2.1.2.3.1.2 "><p id="cce_10_0018__p157615551480">A collection path narrows down the scope of collection to specified logs. </p>
|
||||
<td class="cellrowborder" valign="top" width="77.88000000000001%" headers="mcps1.3.3.2.3.2.1.2.3.1.2 "><p id="cce_10_0018__p157615551480">A collection path narrows down the scope of collection to specified logs.</p>
|
||||
<ul id="cce_10_0018__ul1676055194810"><li id="cce_10_0018__li2761555134814">If no collection path is specified, log files in <strong id="cce_10_0018__b471281022817">.log</strong>, <strong id="cce_10_0018__b1171218102289">.trace</strong>, and <strong id="cce_10_0018__b1671221022818">.out</strong> formats will be collected from the specified path.</li><li id="cce_10_0018__li13761955144810"><strong id="cce_10_0018__b71586376261">/Path/**/</strong> indicates that all log files in <strong id="cce_10_0018__b559191242719">.log</strong>, <strong id="cce_10_0018__b1515321718274">.trace</strong>, and <strong id="cce_10_0018__b1766462192711">.out</strong> formats will be recursively collected from the specified path and all subdirectories at 5 levels deep.</li><li id="cce_10_0018__li27745518483">* in log file names indicates a fuzzy match.</li></ul>
|
||||
<p id="cce_10_0018__p197795574820">Example: The collection path <strong id="cce_10_0018__b591619449318">/tmp/**/test*.log</strong> indicates that all <strong id="cce_10_0018__b4875453173116">.log</strong> files prefixed with <strong id="cce_10_0018__b1651618112234">test</strong> will be collected from <strong id="cce_10_0018__b442040193212">/tmp</strong> and subdirectories at 5 levels deep.</p>
|
||||
<div class="caution" id="cce_10_0018__note1039671516135"><span class="cautiontitle"> CAUTION: </span><div class="cautionbody"><p id="cce_10_0018__p5396171516138">Ensure that ICAgent is of version 5.12.22 or later.</p>
|
||||
@ -154,8 +154,8 @@ spec:
|
||||
<td class="cellrowborder" valign="top" width="19.23%" headers="mcps1.3.4.7.2.4.1.2 "><p id="cce_10_0018__p6329709512">Extended host path</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="63.71%" headers="mcps1.3.4.7.2.4.1.3 "><p id="cce_10_0018__p32881805119">Extended host paths contain pod IDs or container names to distinguish different containers into which the host path is mounted.</p>
|
||||
<p id="cce_10_0018__p1728888115112">A level-3 directory is added to the original volume directory/subdirectory. You can easily obtain the files output by a single <span class="keyword" id="cce_10_0018__keyword2086484341">Pod</span>.</p>
|
||||
<ul id="cce_10_0018__ul2028828105113"><li id="cce_10_0018__li428815865110"><strong id="cce_10_0018__b1545738741">None</strong>: No extended path is configured. </li><li id="cce_10_0018__li62889814517"><strong id="cce_10_0018__b336551886">PodUID</strong>: ID of a pod.</li><li id="cce_10_0018__li528818135113"><strong id="cce_10_0018__b699631887">PodName</strong>: name of a pod.</li><li id="cce_10_0018__li62882084517"><strong id="cce_10_0018__b1011057369">PodUID/ContainerName</strong>: ID of a pod or name of a container.</li><li id="cce_10_0018__li528898175110"><strong id="cce_10_0018__b8818125942116">PodName/ContainerName</strong>: name of a pod or container.</li></ul>
|
||||
<p id="cce_10_0018__p1728888115112">A level-3 directory is added to the original volume directory/subdirectory. You can easily obtain the files output by a single <span class="keyword" id="cce_10_0018__keyword1139599226">Pod</span>.</p>
|
||||
<ul id="cce_10_0018__ul2028828105113"><li id="cce_10_0018__li428815865110"><strong id="cce_10_0018__b2096972405">None</strong>: No extended path is configured. </li><li id="cce_10_0018__li62889814517"><strong id="cce_10_0018__b1853265394">PodUID</strong>: ID of a pod.</li><li id="cce_10_0018__li528818135113"><strong id="cce_10_0018__b1166760841">PodName</strong>: name of a pod.</li><li id="cce_10_0018__li62882084517"><strong id="cce_10_0018__b1153089692">PodUID/ContainerName</strong>: ID of a pod or name of a container.</li><li id="cce_10_0018__li528898175110"><strong id="cce_10_0018__b8818125942116">PodName/ContainerName</strong>: name of a pod or container.</li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0018__row732915085118"><td class="cellrowborder" valign="top" width="17.06%" headers="mcps1.3.4.7.2.4.1.1 "><p id="cce_10_0018__p17329004514">policy.logs.rotate</p>
|
||||
@ -163,7 +163,7 @@ spec:
|
||||
<td class="cellrowborder" valign="top" width="19.23%" headers="mcps1.3.4.7.2.4.1.2 "><p id="cce_10_0018__p123292055113">Log dump</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="63.71%" headers="mcps1.3.4.7.2.4.1.3 "><p id="cce_10_0018__p1017113396539">Log dump refers to rotating log files on a local host.</p>
|
||||
<ul id="cce_10_0018__ul1617120398533"><li id="cce_10_0018__li71711639105316"><strong id="cce_10_0018__b4837638192520">Enabled</strong>: AOM scans log files every minute. When a log file exceeds 50 MB, it is dumped immediately. A new <strong id="cce_10_0018__b98429388254">.zip</strong> file is generated in the directory where the log file locates. For a log file, AOM stores only the latest 20 <strong id="cce_10_0018__b2216332192917">.zip</strong> files. When the number of <strong id="cce_10_0018__b1621653252914">.zip</strong> files exceeds 20, earlier <strong id="cce_10_0018__b1321623212917">.zip</strong> files will be deleted. After the dump is complete, the log file in AOM will be cleared.</li><li id="cce_10_0018__li817133985315"><strong id="cce_10_0018__b1147822082">Disabled</strong>: AOM does not dump log files.</li></ul>
|
||||
<ul id="cce_10_0018__ul1617120398533"><li id="cce_10_0018__li71711639105316"><strong id="cce_10_0018__b4837638192520">Enabled</strong>: AOM scans log files every minute. When a log file exceeds 50 MB, it is dumped immediately. A new <strong id="cce_10_0018__b98429388254">.zip</strong> file is generated in the directory where the log file locates. For a log file, AOM stores only the latest 20 <strong id="cce_10_0018__b2216332192917">.zip</strong> files. When the number of <strong id="cce_10_0018__b1621653252914">.zip</strong> files exceeds 20, earlier <strong id="cce_10_0018__b1321623212917">.zip</strong> files will be deleted. After the dump is complete, the log file in AOM will be cleared.</li><li id="cce_10_0018__li817133985315"><strong id="cce_10_0018__b904617367">Disabled</strong>: AOM does not dump log files.</li></ul>
|
||||
<div class="note" id="cce_10_0018__note121711639195319"><span class="notetitle"> NOTE: </span><div class="notebody"><ul id="cce_10_0018__ul817183918533"><li id="cce_10_0018__li9171183945310">AOM rotates log files using copytruncate. Before enabling log dumping, ensure that log files are written in the append mode. Otherwise, file holes may occur.</li><li id="cce_10_0018__li1117153914535">Currently, mainstream log components such as Log4j and Logback support log file rotation. If you have already set rotation for log files, skip the configuration. Otherwise, conflicts may occur.</li><li id="cce_10_0018__li317113915532">You are advised to configure log file rotation for your own services to flexibly control the size and number of rolled files.</li></ul>
|
||||
</div></div>
|
||||
</td>
|
||||
@ -173,7 +173,7 @@ spec:
|
||||
<td class="cellrowborder" valign="top" width="19.23%" headers="mcps1.3.4.7.2.4.1.2 "><p id="cce_10_0018__p14388112019519">Collection path</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="63.71%" headers="mcps1.3.4.7.2.4.1.3 "><p id="cce_10_0018__p63882201153">A collection path narrows down the scope of collection to specified logs.</p>
|
||||
<ul id="cce_10_0018__ul73883209510"><li id="cce_10_0018__li14388162011513">If no collection path is specified, log files in <strong id="cce_10_0018__b66511633">.log</strong>, <strong id="cce_10_0018__b1809733917">.trace</strong>, and <strong id="cce_10_0018__b902667841">.out</strong> formats will be collected from the specified path.</li><li id="cce_10_0018__li03886201854"><strong id="cce_10_0018__b1859325291">/Path/**/</strong> indicates that all log files in <strong id="cce_10_0018__b545945728">.log</strong>, <strong id="cce_10_0018__b925379927">.trace</strong>, and <strong id="cce_10_0018__b2124849760">.out</strong> formats will be recursively collected from the specified path and all subdirectories at 5 levels deep.</li><li id="cce_10_0018__li1938811201058">* in log file names indicates a fuzzy match.</li></ul>
|
||||
<ul id="cce_10_0018__ul73883209510"><li id="cce_10_0018__li14388162011513">If no collection path is specified, log files in <strong id="cce_10_0018__b2026342724">.log</strong>, <strong id="cce_10_0018__b1347420583">.trace</strong>, and <strong id="cce_10_0018__b853742260">.out</strong> formats will be collected from the specified path.</li><li id="cce_10_0018__li03886201854"><strong id="cce_10_0018__b225411883">/Path/**/</strong> indicates that all log files in <strong id="cce_10_0018__b460049641">.log</strong>, <strong id="cce_10_0018__b376857982">.trace</strong>, and <strong id="cce_10_0018__b678268777">.out</strong> formats will be recursively collected from the specified path and all subdirectories at 5 levels deep.</li><li id="cce_10_0018__li1938811201058">* in log file names indicates a fuzzy match.</li></ul>
|
||||
<p id="cce_10_0018__p17388152013515">Example: The collection path <strong id="cce_10_0018__b19951612237">/tmp/**/test*.log</strong> indicates that all <strong id="cce_10_0018__b49571315239">.log</strong> files prefixed with <strong id="cce_10_0018__b4958101202315">test</strong> will be collected from <strong id="cce_10_0018__b695815172316">/tmp</strong> and subdirectories at 5 levels deep.</p>
|
||||
<div class="caution" id="cce_10_0018__note153881220751"><span class="cautiontitle"> CAUTION: </span><div class="cautionbody"><p id="cce_10_0018__p938810204516">Ensure that ICAgent is of version 5.12.22 or later.</p>
|
||||
</div></div>
|
||||
@ -202,16 +202,12 @@ spec:
|
||||
<div class="section" id="cce_10_0018__section25851847232"><h4 class="sectiontitle">Viewing Logs</h4><p id="cce_10_0018__p209669599247">After a log collection path is configured and the workload is created, the ICAgent collects log files from the configured path. The collection takes about 1 minute.</p>
|
||||
<p id="cce_10_0018__p242194515304">After the log collection is complete, go to the workload details page and click <strong id="cce_10_0018__b13484541192818">Logs</strong> in the upper right corner to view logs.</p>
|
||||
<p id="cce_10_0018__p32989282515">You can also view logs on the AOM console.</p>
|
||||
<p id="cce_10_0018__p160613416815">You can also run the <strong id="cce_10_0018__b9741144192912">kubectl logs</strong> command to view the container stdout.</p>
|
||||
<pre class="screen" id="cce_10_0018__screen1210248152712"># View logs of a specified pod.
|
||||
kubectl logs <pod_name>
|
||||
kubectl logs -f <pod_name> # Similar to <strong id="cce_10_0018__b34131514579">tail -f</strong>
|
||||
|
||||
# View logs of a specified container in a specified pod.
|
||||
kubectl logs <pod_name> -c <container_name>
|
||||
|
||||
kubectl logs pod_name -c container_name -n namespace (one-off query)
|
||||
kubectl logs -f <pod_name> -n namespace (real-time query in tail -f mode)</pre>
|
||||
<p id="cce_10_0018__p160613416815">You can also run the <strong id="cce_10_0018__b699413283512">kubectl logs</strong> command to view the container stdout.</p>
|
||||
<ul id="cce_10_0018__ul1250775418420"><li id="cce_10_0018__li35074541742">View the logs of a specified pod.<pre class="screen" id="cce_10_0018__screen18206109556">kubectl logs <i><span class="varname" id="cce_10_0018__varname1277517298911"><pod_name></span></i> -n <i><span class="varname" id="cce_10_0018__varname746213329912"><namespace></span></i></pre>
|
||||
</li><li id="cce_10_0018__li193333401053">View the logs of a specified pod in real time.<pre class="screen" id="cce_10_0018__screen73911048357">kubectl logs -f <i><span class="varname" id="cce_10_0018__varname1551920386912"><pod_name></span></i> -n <i><span class="varname" id="cce_10_0018__varname15549835990"><namespace></span></i></pre>
|
||||
</li><li id="cce_10_0018__li157481141478">View logs of a specified container in a specified pod.<pre class="screen" id="cce_10_0018__screen437143714715">kubectl logs <i><span class="varname" id="cce_10_0018__varname1541816421097"><pod_name></span></i> -c <i><span class="varname" id="cce_10_0018__varname3838164713913"><container_name></span></i> -n <i><span class="varname" id="cce_10_0018__varname11814521897"><namespace></span></i></pre>
|
||||
</li><li id="cce_10_0018__li157531051278">View the logs of a specified container in a specified pod in real time.<pre class="screen" id="cce_10_0018__screen12800441689">kubectl logs -f <i><span class="varname" id="cce_10_0018__varname722819579917"><pod_name></span></i> -c <i><span class="varname" id="cce_10_0018__varname49521702107"><container_name></span></i> -n <i><span class="varname" id="cce_10_0018__varname73741143105"><namespace></span></i></pre>
|
||||
</li></ul>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
|
||||
@ -123,7 +123,7 @@
|
||||
<tr id="cce_10_0028__row14617175691617"><td class="cellrowborder" valign="top" width="20%" headers="mcps1.3.4.11.2.3.1.1 "><p id="cce_10_0028__p6617456171619">Container CIDR Block</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="80%" headers="mcps1.3.4.11.2.3.1.2 "><p id="cce_10_0028__p6617135619168">Specify the CIDR block for containers, which determines the maximum number of containers allowed in the cluster. This parameter is available only for CCE standard clusters. CCE standard clusters allow both manual and automatic CIDR block settings.</p>
|
||||
<ul id="cce_10_0028__ul1912520183312"><li id="cce_10_0028__li112581173311"><strong id="cce_10_0028__b1751792413330">Manually set</strong>: You can customize the container CIDR blocks as needed. For cross-VPC passthrough networking, <strong id="cce_10_0028__b9991830145312">make sure the container CIDR block does not overlap with the VPC CIDR block to be accessed</strong> to prevent conflicts. For details, see <a href="cce_bestpractice_00004.html">Planning CIDR Blocks for a Cluster</a>. The VPC network model allows you to configure multiple CIDR blocks, and container CIDR blocks can be added even after the cluster is created. For details, see <a href="cce_10_0680.html">Adding a Container CIDR Block for a Cluster</a>.</li><li id="cce_10_0028__li13504185216810"><strong id="cce_10_0028__b542814461349">Auto select</strong>: CCE will randomly allocate a non-conflicting CIDR block from the ranges 172.16.0.0/16 to 172.31.0.0/16, or from 10.0.0.0/12, 10.16.0.0/12, 10.32.0.0/12, 10.48.0.0/12, 10.64.0.0/12, 10.80.0.0/12, 10.96.0.0/12, and 10.112.0.0/12. Since the allocated CIRD block cannot be modified after the cluster is created, you are advised to manually configure the CIDR blocks, especially in commercial scenarios.</li></ul>
|
||||
<ul id="cce_10_0028__ul1912520183312"><li id="cce_10_0028__li112581173311"><strong id="cce_10_0028__b1751792413330">Manually set</strong>: You can customize the container CIDR blocks as needed. For cross-VPC passthrough networking, <strong id="cce_10_0028__b9991830145312">make sure the container CIDR block does not overlap with the VPC CIDR block to be accessed</strong> to prevent conflicts. For details, see <a href="cce_bestpractice_00004.html">Planning CIDR Blocks for a Cluster</a>. The VPC network model allows you to configure multiple CIDR blocks, and container CIDR blocks can be added even after the cluster is created. For details, see <a href="cce_10_0680.html">Adding a Container CIDR Block for a Cluster</a>.</li><li id="cce_10_0028__li13504185216810"><strong id="cce_10_0028__b542814461349">Auto select</strong>: CCE will randomly allocate a non-conflicting CIDR block from the ranges 172.16.0.0/16 to 172.31.0.0/16, or from 10.0.0.0/12, 10.16.0.0/12, 10.32.0.0/12, 10.48.0.0/12, 10.64.0.0/12, 10.80.0.0/12, 10.96.0.0/12, and 10.112.0.0/12. Since the allocated CIDR block cannot be modified after the cluster is created, you are advised to manually configure the CIDR blocks, especially in commercial scenarios.</li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0028__row5402194810320"><td class="cellrowborder" valign="top" width="20%" headers="mcps1.3.4.11.2.3.1.1 "><p id="cce_10_0028__p44501828121020">Pod IP Addresses Reserved for Each Node (supported by CCE standard clusters using a VPC network)</p>
|
||||
|
||||
@ -17,9 +17,9 @@
|
||||
<div class="section" id="cce_10_0034__en-us_topic_0226102211_section92541494210"><h4 class="sectiontitle">Prerequisites</h4><p id="cce_10_0034__en-us_topic_0226102211_p996134411315">Before installing this add-on, you have one available cluster and there is a node running properly. If no cluster is available, create one according to <a href="cce_10_0028.html">Creating a CCE Standard/Turbo Cluster</a>.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0034__section1152424015224"><a name="cce_10_0034__section1152424015224"></a><a name="section1152424015224"></a><h4 class="sectiontitle">Installing the Add-on</h4><ol id="cce_10_0034__ol595195015265"><li id="cce_10_0034__li13183153352515"><span>Log in to the CCE console and click the cluster name to access the cluster console. In the navigation pane, choose <strong id="cce_10_0034__b09296116387"><span id="cce_10_0034__text77103384818">Add-ons</span></strong>, locate <strong id="cce_10_0034__b189291711193814">NGINX Ingress Controller</strong> on the right, and click <strong id="cce_10_0034__b189301611123814">Install</strong>.</span></li><li id="cce_10_0034__li6185135511235"><span>On the <strong id="cce_10_0034__b168313930105924">Install Add-on</strong> page, configure the specifications as needed.</span><p><p id="cce_10_0034__p12804745248">You can adjust the number of add-on pods and resource quotas as required. High availability is not possible with a single pod. If an error occurs on the node where the add-on instance runs, the add-on will fail.</p>
|
||||
</p></li><li id="cce_10_0034__li584045813266"><span>Configure the add-on parameters.</span><p><ul id="cce_10_0034__ul741422082911"><li id="cce_10_0034__li0953175016455"><a name="cce_10_0034__li0953175016455"></a><a name="li0953175016455"></a><strong id="cce_10_0034__b247210618418">Ingress Class</strong>: Enter a controller name. The name of each controller in the same cluster must be unique and cannot be set to <strong id="cce_10_0034__b10472106174115">cce</strong> (which is the unique identifier of the ELB ingress controller.) When creating an ingress, you can specify the controller name to declare which controller should manage this ingress.</li><li id="cce_10_0034__li43911954164512"><strong id="cce_10_0034__b87211241203016">Add-on Namespace</strong>: Select a namespace for the ingress controller.</li><li id="cce_10_0034__li194268504296"><strong id="cce_10_0034__b7357351122419">Load Balancer</strong>: Select a shared or dedicated load balancer. If no load balancer is available, create one. The load balancer has at least two listeners, and ports 80 and 443 are not occupied by listeners.</li><li id="cce_10_0034__li19869530141118"><strong id="cce_10_0034__b266512513184">Admission Check</strong>: Admission control is performed on Ingresses to ensure that the controller can generate valid configurations. Admission verification is performed on the configuration of Nginx Ingresses. If the verification fails, the request will be intercepted. For details about admission verification, see <a href="https://kubernetes.github.io/ingress-nginx/e2e-tests/#admission-admission-controller" target="_blank" rel="noopener noreferrer">Access Control</a>.<div class="note" id="cce_10_0034__note13941342101413"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="cce_10_0034__ul13288250171411"><li id="cce_10_0034__li1228817507146">Admission check slows down the responses to Ingress requests.</li><li id="cce_10_0034__li172581224167">Only add-ons of version 2.4.1 or later support admission verification.</li></ul>
|
||||
</p></li><li id="cce_10_0034__li584045813266"><span>Configure the add-on parameters.</span><p><ul id="cce_10_0034__ul741422082911"><li id="cce_10_0034__li0953175016455"><a name="cce_10_0034__li0953175016455"></a><a name="li0953175016455"></a><strong id="cce_10_0034__b247210618418">Ingress Class</strong>: Enter a controller name. The name of each controller in the same cluster must be unique and cannot be set to <strong id="cce_10_0034__b10472106174115">cce</strong> (which is the unique identifier of the LoadBalancer ingress controller.) When creating an ingress, you can specify the controller name to declare which controller should manage this ingress.</li><li id="cce_10_0034__li43911954164512"><strong id="cce_10_0034__b87211241203016">Add-on Namespace</strong>: Select a namespace for the ingress controller.</li><li id="cce_10_0034__li194268504296"><strong id="cce_10_0034__b7357351122419">Load Balancer</strong>: Select a shared or dedicated load balancer. If no load balancer is available, create one. The load balancer has at least two listeners, and ports 80 and 443 are not occupied by listeners.</li><li id="cce_10_0034__li19869530141118"><strong id="cce_10_0034__b266512513184">Admission Check</strong>: Admission control is performed on Ingresses to ensure that the controller can generate valid configurations. Admission verification is performed on the configuration of Nginx Ingresses. If the verification fails, the request will be intercepted. For details about admission verification, see <a href="https://kubernetes.github.io/ingress-nginx/e2e-tests/#admission-admission-controller" target="_blank" rel="noopener noreferrer">Access Control</a>.<div class="note" id="cce_10_0034__note13941342101413"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="cce_10_0034__ul13288250171411"><li id="cce_10_0034__li1228817507146">Admission check slows down the responses to Ingress requests.</li><li id="cce_10_0034__li172581224167">Only add-ons of version 2.4.1 or later support admission verification.</li></ul>
|
||||
</div></div>
|
||||
</li><li id="cce_10_0034__li66142206315"><strong id="cce_10_0034__b6241732145011">Nginx Parameters</strong>: You can configure the <strong id="cce_10_0034__b1463512386289">nginx.conf</strong> file, which will affect all managed ingresses. You can select <strong id="cce_10_0034__b3983161532">GUI</strong> or <strong id="cce_10_0034__b14983910318">YAML</strong>. <strong id="cce_10_0034__b16984512310">GUI</strong> is supported by the NGINX Ingress Controller of version 2.2.75, 2.6.26, 3.0.1, or later.<p id="cce_10_0034__p1512810221947">To configure custom parameters supported by the Kubernetes community, choose <strong id="cce_10_0034__b23282119319">YAML</strong> and find the related parameters in <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/" target="_blank" rel="noopener noreferrer">ConfigMaps</a>. For example, you can use the <strong id="cce_10_0034__b19750151011317">keep-alive-requests</strong> parameter to describe how to set the maximum number of requests for keeping active connections to 100.</p>
|
||||
</li><li id="cce_10_0034__li66142206315"><strong id="cce_10_0034__b6241732145011">Nginx Parameters</strong>: You can configure the <strong id="cce_10_0034__b1463512386289">nginx.conf</strong> file, which will affect all managed ingresses. You can select <strong id="cce_10_0034__b2018813117246">GUI</strong> or <strong id="cce_10_0034__b1918851122410">YAML</strong>. <strong id="cce_10_0034__b1818819182420">GUI</strong> is supported by the NGINX Ingress Controller of version 2.2.75, 2.6.26, 3.0.1, or later.<p id="cce_10_0034__p1512810221947">To configure custom parameters supported by the Kubernetes community, choose <strong id="cce_10_0034__b159349548328">YAML</strong> and find the related parameters in <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/" target="_blank" rel="noopener noreferrer">ConfigMaps</a>. For example, you can use the <strong id="cce_10_0034__b19750151011317">keep-alive-requests</strong> parameter to describe how to set the maximum number of requests for keeping active connections to 100.</p>
|
||||
<pre class="screen" id="cce_10_0034__screen6950408718">{
|
||||
"keep-alive-requests": "100"
|
||||
}</pre>
|
||||
|
||||
@ -3,8 +3,6 @@
|
||||
<h1 class="topictitle1">Logging In to a Container</h1>
|
||||
<div id="body0000001151211236"><div class="section" id="cce_10_00356__section7379040716"><h4 class="sectiontitle">Scenario</h4><p id="cce_10_00356__p1134114511811">If you encounter unexpected problems when using a container, you can log in to the container to debug it.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_00356__section1536420242714"><h4 class="sectiontitle">Notes and Constraints</h4><ul id="cce_10_00356__cce_10_0671_ul1462211293114"><li id="cce_10_00356__cce_10_0671_li126227294120">When kubectl is used in CloudShell, permissions are determined by the logged-in user.</li><li id="cce_10_00356__cce_10_0671_li277014321913">When using CloudShell to access a CCE cluster or container, you can open up to 15 instances concurrently.</li><li id="cce_10_00356__cce_10_0671_li1443882717216">The kubectl certificate in CloudShell is valid for one day. You can reset its validity period by accessing CloudShell through the CCE console.</li></ul>
|
||||
</div>
|
||||
<div class="section" id="cce_10_00356__section1293318163114"><h4 class="sectiontitle">Using kubectl</h4><ol id="cce_10_00356__ol1392823394416"><li id="cce_10_00356__li1681024195710"><span>Use kubectl to access the cluster. For details, see <a href="cce_10_0107.html">Accessing a Cluster Using kubectl</a>.</span></li><li id="cce_10_00356__li1020013819415"><span>Run the following command to view the created pod:</span><p><pre class="screen" id="cce_10_00356__screen156898195914">kubectl get pod</pre>
|
||||
<div class="p" id="cce_10_00356__p18257204595920">The example output is as follows:<pre class="screen" id="cce_10_00356__screen7944553592">NAME READY STATUS RESTARTS AGE
|
||||
nginx-59d89cb66f-mhljr 1/1 Running 0 11m</pre>
|
||||
|
||||
@ -95,7 +95,7 @@
|
||||
<p id="cce_10_0048__p102354303348">A Service provides external access for pods. With a static IP address, a Service forwards access traffic to pods and automatically balances load for these pods.</p>
|
||||
<p id="cce_10_0048__p13343123113612">You can also create a Service after creating a workload. For details about Services of different types, see <a href="cce_10_0249.html">Overview</a>.</p>
|
||||
<div class="p" id="cce_10_0048__p310913521612"><strong id="cce_10_0048__b21631580735239">(Optional) Advanced Settings</strong><ul id="cce_10_0048__ul142811417"><li id="cce_10_0048__li0421513417"><strong id="cce_10_0048__cce_10_0047_b15415314859">Upgrade</strong>: Specify the upgrade mode and parameters of the workload. <strong id="cce_10_0048__cce_10_0047_b153151558165913">Rolling upgrade</strong> and <strong id="cce_10_0048__cce_10_0047_b1621251402">Replace upgrade</strong> are available. For details, see <a href="cce_10_0397.html">Configuring Workload Upgrade Policies</a>.</li><li id="cce_10_0048__li206428507436"><strong id="cce_10_0048__b1840219331836">Pod Management Policies</strong><p id="cce_10_0048__p151323251334">For some distributed systems, the StatefulSet sequence is unnecessary and/or should not occur. These systems require only uniqueness and identifiers.</p>
|
||||
<ul id="cce_10_0048__ul758812493316"><li id="cce_10_0048__li258832417338"><strong id="cce_10_0048__b13534251116">OrderedReady</strong>: The StatefulSet will deploy, delete, or scale pods in order and one by one. (The StatefulSet continues only after the previous pod is ready or deleted.) This is the default policy.</li><li id="cce_10_0048__li1558862416338"><strong id="cce_10_0048__b112293521039">Parallel</strong>: The StatefulSet will create pods in parallel to match the desired scale without waiting, and will delete all pods at once.</li></ul>
|
||||
<ul id="cce_10_0048__ul758812493316"><li id="cce_10_0048__li258832417338"><strong id="cce_10_0048__b11948213194116">OrderedReady</strong>: This is the default policy. The StatefulSet will deploy, delete, or scale pods in order and one by one. It continues only after the previous pod is ready or deleted.</li><li id="cce_10_0048__li1558862416338"><strong id="cce_10_0048__b112293521039">Parallel</strong>: The StatefulSet will create pods in parallel to match the desired scale without waiting, and will delete all pods at once.</li></ul>
|
||||
</li><li id="cce_10_0048__li7127180594"><strong id="cce_10_0048__cce_10_0047_b289714923012">Scheduling</strong>: Configure affinity and anti-affinity policies for flexible workload scheduling. Load affinity and node affinity are provided.<ul id="cce_10_0048__cce_10_0047_ul16976133413332"><li id="cce_10_0048__cce_10_0047_li7687143311331"><strong id="cce_10_0048__cce_10_0047_b1243811103214">Load Affinity</strong>: Common load affinity policies are offered for quick load affinity deployment.<ul id="cce_10_0048__cce_10_0047_ul1865517492338"><li id="cce_10_0048__cce_10_0047_li7393234068"><strong id="cce_10_0048__cce_10_0047_b15439175514563">Not configured</strong>: No load affinity policy is configured.</li><li id="cce_10_0048__cce_10_0047_li84431255153310"><strong id="cce_10_0048__cce_10_0047_b1069211531709">Multi-AZ deployment preferred</strong>: Workload pods are <strong id="cce_10_0048__cce_10_0047_b126921353203">preferentially</strong> scheduled to nodes in different AZs through pod anti-affinity.</li><li id="cce_10_0048__cce_10_0047_li10775194183413"><strong id="cce_10_0048__cce_10_0047_b1667575214119">Forcible multi-AZ deployment</strong>: Workload pods are forcibly scheduled to nodes in different AZs through pod anti-affinity (<strong id="cce_10_0048__cce_10_0047_b10853186174217">podAntiAffinity</strong>). If there are fewer AZs than pods, the extra pods will fail to run.</li><li id="cce_10_0048__cce_10_0047_li177960111349"><strong id="cce_10_0048__cce_10_0047_b18931103644418">Customize affinity</strong>: Affinity and anti-affinity policies can be customized. For details, see <a href="cce_10_0893.html">Configuring Workload Affinity or Anti-affinity Scheduling (podAffinity or podAntiAffinity)</a>.</li></ul>
|
||||
</li><li id="cce_10_0048__cce_10_0047_li136191442193318"><strong id="cce_10_0048__cce_10_0047_b540915914458">Node Affinity</strong>: Common node affinity policies are offered for quick load affinity deployment.<ul id="cce_10_0048__cce_10_0047_ul106562113415"><li id="cce_10_0048__cce_10_0047_li3815113910617"><strong id="cce_10_0048__cce_10_0047_b129361841585">Not configured</strong>: No node affinity policy is configured.</li><li id="cce_10_0048__cce_10_0047_li11588172453415"><strong id="cce_10_0048__cce_10_0047_b1354131044913">Specify node</strong>: Workload pods can be deployed on specified nodes through node affinity (<strong id="cce_10_0048__cce_10_0047_b17387313105016">nodeAffinity</strong>). If no node is specified, the pods will be randomly scheduled based on the default scheduling policy of the cluster.</li><li id="cce_10_0048__cce_10_0047_li12588142414347"><strong id="cce_10_0048__cce_10_0047_b1143642735217">Specify node pool</strong>: Workload pods can be deployed in a specified node pool through node affinity (<strong id="cce_10_0048__cce_10_0047_b1443715272523">nodeAffinity</strong>). If no node pool is specified, the pods will be randomly scheduled based on the default scheduling policy of the cluster.</li><li id="cce_10_0048__cce_10_0047_li14588192418347"><strong id="cce_10_0048__cce_10_0047_b145411819458">Customize affinity</strong>: Affinity and anti-affinity policies can be customized. For details, see <a href="cce_10_0892.html">Configuring Node Affinity Scheduling (nodeAffinity)</a>.</li></ul>
|
||||
</li></ul>
|
||||
|
||||
@ -67,7 +67,7 @@
|
||||
<tr id="cce_10_0059__row19522163363014"><td class="cellrowborder" valign="top" width="33.33333333333333%" headers="mcps1.3.5.2.1.4.1.1 mcps1.3.5.2.1.4.2.1 "><p id="cce_10_0059__p14522113320305">Supported OS</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="33.33333333333333%" headers="mcps1.3.5.2.1.4.1.2 mcps1.3.5.2.1.4.2.2 "><p id="cce_10_0059__p36942011103714">EulerOS</p>
|
||||
<p id="cce_10_0059__p8522163311308">HCE 2.0</p>
|
||||
<p id="cce_10_0059__p8522163311308">HCE OS 2.0</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="33.33333333333333%" headers="mcps1.3.5.2.1.4.1.3 mcps1.3.5.2.1.4.2.3 "><p id="cce_10_0059__p45221033113015">HCE OS 2.0</p>
|
||||
</td>
|
||||
|
||||
@ -14,9 +14,9 @@
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_bulletin_0059.html">Kubernetes 1.27 Release Notes</a></strong><br>
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_bulletin_0058.html">Kubernetes 1.25 Release Notes</a></strong><br>
|
||||
<li class="ulchildlink"><strong><a href="cce_bulletin_0058.html">Kubernetes 1.25 (EOM) Release Notes</a></strong><br>
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_bulletin_0027.html">Kubernetes 1.23 Release Notes</a></strong><br>
|
||||
<li class="ulchildlink"><strong><a href="cce_bulletin_0027.html">Kubernetes 1.23 (EOM) Release Notes</a></strong><br>
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_bulletin_0026.html">Kubernetes 1.21 (EOM) Release Notes</a></strong><br>
|
||||
</li>
|
||||
|
||||
@ -100,7 +100,7 @@
|
||||
<p id="cce_10_0132__p2317112419618">Typical scenario: Disk I/O suspension causes process suspension.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="33%" headers="mcps1.3.6.4.1.2.2.4.1.3 "><p id="cce_10_0132__p16872758114011">Warning event</p>
|
||||
<p id="cce_10_0132__p173071159247">Listening object: <strong id="cce_10_0132__b592872265">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0132__p173071159247">Listening object: <strong id="cce_10_0132__b1029490566">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0132__p153079591241">Matching rule: "task \\S+:\\w+ blocked for more than \\w+ seconds\\."</p>
|
||||
</td>
|
||||
</tr>
|
||||
@ -112,7 +112,7 @@
|
||||
</div></div>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="33%" headers="mcps1.3.6.4.1.2.2.4.1.3 "><p id="cce_10_0132__p944535317711">Warning event</p>
|
||||
<p id="cce_10_0132__p183981710948">Listening object: <strong id="cce_10_0132__b1027686576">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0132__p183981710948">Listening object: <strong id="cce_10_0132__b967989253">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0132__p83993101042">Matching rule: <strong id="cce_10_0132__b15200817134219">Remounting filesystem read-only</strong></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
@ -42,7 +42,7 @@ cd /usr/local/nvidia/bin && ./nvidia-smi</pre>
|
||||
<p id="cce_10_0141__p78452015208"><span><img id="cce_10_0141__image5372171217135" src="en-us_image_0000002253620561.png"></span></p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0141__section95451728192112"><a name="cce_10_0141__section95451728192112"></a><a name="section95451728192112"></a><h4 class="sectiontitle">Obtaining the Driver Link from Public Network</h4><ol id="cce_10_0141__ol1138125974915"><li id="cce_10_0141__li19138125912498"><span>Log in to the CCE console.</span></li><li id="cce_10_0141__li111387599493"><span>Create a node. In the <strong id="cce_10_0141__b2312250103712">Specifications</strong> area, select the GPU node flavor. The GPU card models are displayed in the lower part of the area.</span><p><p id="cce_10_0141__p1618510475363"></p>
|
||||
</p></li></ol><ol start="3" id="cce_10_0141__ol195031456154814"><li id="cce_10_0141__li16232124410505"><span>Log in to the <a href="https://www.nvidia.com/en-us/drivers/" target="_blank" rel="noopener noreferrer">NVIDIA driver download page</a> and search for the driver information. The OS must be <strong id="cce_10_0141__b2476101012208">Linux 64-bit</strong>.</span><p><div class="fignone" id="cce_10_0141__fig11696366517"><span class="figcap"><b>Figure 1 </b>Selecting parameters</span><br><span><img id="cce_10_0141__image1519115318213" src="en-us_image_0000002218820674.png"></span></div>
|
||||
</p></li></ol><ol start="3" id="cce_10_0141__ol195031456154814"><li id="cce_10_0141__li16232124410505"><span>Log in to the <a href="https://www.nvidia.com/en-us/drivers/" target="_blank" rel="noopener noreferrer">NVIDIA driver download page</a> and search for the driver information. The OS must be <strong id="cce_10_0141__b14922141114113">Linux 64-bit</strong>.</span><p><div class="fignone" id="cce_10_0141__fig11696366517"><span class="figcap"><b>Figure 1 </b>Selecting parameters</span><br><span><img id="cce_10_0141__image1519115318213" src="en-us_image_0000002218820674.png"></span></div>
|
||||
</p></li><li id="cce_10_0141__li1682301014493"><span>After confirming the driver information, click <span class="uicontrol" id="cce_10_0141__uicontrol1411775314551"><b>Find</b></span>. On the displayed page, find the driver to be downloaded and click <span class="uicontrol" id="cce_10_0141__uicontrol163131533185618"><b>View</b></span>.</span><p><div class="fignone" id="cce_10_0141__fig7873421145213"><span class="figcap"><b>Figure 2 </b>Viewing the driver information</span><br><span><img id="cce_10_0141__image29015595501" src="en-us_image_0000002218820658.png"></span></div>
|
||||
</p></li><li id="cce_10_0141__li624514474513"><span>Click <strong id="cce_10_0141__b89621609439">Download</strong> and copy the download link.</span><p><div class="fignone" id="cce_10_0141__fig635212293546"><span class="figcap"><b>Figure 3 </b>Obtaining the link</span><br><span><img id="cce_10_0141__image99782175560" src="en-us_image_0000002253620537.png"></span></div>
|
||||
</p></li></ol>
|
||||
|
||||
@ -10,8 +10,6 @@
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_10_0189.html">Namespace Permissions (Kubernetes RBAC-based)</a></strong><br>
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_10_0957.html">Using the AccessPolicy API to Manage Namespace Permissions (Kubernetes RBAC-based)</a></strong><br>
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_10_0245.html">Example: Designing and Configuring Permissions for Users in a Department</a></strong><br>
|
||||
</li>
|
||||
<li class="ulchildlink"><strong><a href="cce_10_0190.html">Permission Dependency of the CCE Console</a></strong><br>
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
|
||||
<h1 class="topictitle1">Synchronizing the Data of Cloud Servers</h1>
|
||||
<div id="body1559203372010"><div class="section" id="cce_10_0184__section2175132617712"><h4 class="sectiontitle">Scenario</h4><p id="cce_10_0184__p179715213166">Each node in a cluster is a cloud server or physical machine. After a cluster node is created, you can change the cloud server name or specifications as required. Modifying node specifications will affect services. Perform the operation on nodes one by one.</p>
|
||||
<p id="cce_10_0184__p116412521617">Some information of CCE nodes is maintained independently from the ECS console. After you change the name, EIP, or specifications of an ECS on the ECS console, <span class="keyword" id="cce_10_0184__keyword1089112476574">synchronize the ECS</span> with the target node on the CCE console. After the synchronization, information on both consoles is consistent.</p>
|
||||
<p id="cce_10_0184__p116412521617">Some information of CCE nodes is maintained independently from the ECS console. After you change the name, EIP, or specifications of an ECS on the ECS console, <span class="keyword" id="cce_10_0184__keyword941733216373">synchronize the ECS</span> with the target node on the CCE console. After the synchronization, information on both consoles is consistent.</p>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0184__section299918342346"><h4 class="sectiontitle">Notes and Constraints</h4><ul id="cce_10_0184__ul121015107312"><li id="cce_10_0184__li3101810193119">Data, including the VM status, ECS names, number of CPUs, size of memory, ECS specifications, and public IP addresses, can be synchronized.</li><li id="cce_10_0184__li8102110103118">The following data cannot be synchronized: OS, image ID, and disk configuration.</li></ul>
|
||||
</div>
|
||||
|
||||
@ -1,13 +1,13 @@
|
||||
<a name="cce_10_0185"></a><a name="cce_10_0185"></a>
|
||||
|
||||
<h1 class="topictitle1">Logging In to a Node</h1>
|
||||
<div id="body1559203372010"><div class="section" id="cce_10_0185__section1492661620507"><h4 class="sectiontitle">Prerequisites</h4><ul id="cce_10_0185__ul119041718185518"><li id="cce_10_0185__li12182723114411">Before you log in to a node using SSH, ensure that the SSH port (22 by default) is enabled in the security group of the node. </li><li id="cce_10_0185__li490481815515">Before you log in to a node (an ECS) using SSH through the Internet, ensure that the ECS already has an EIP bound.</li><li id="cce_10_0185__li16904121855510">Only login to a running ECS is allowed.</li><li id="cce_10_0185__li3827103362110">Only the user <strong id="cce_10_0185__b197020279318"><span id="cce_10_0185__text12656192763716">linux</span></strong> can log in to a Linux server.</li></ul>
|
||||
<div id="body1559203372010"><div class="section" id="cce_10_0185__section1492661620507"><h4 class="sectiontitle">Prerequisites</h4><ul id="cce_10_0185__ul119041718185518"><li id="cce_10_0185__li12182723114411">Before you log in to a node using SSH, ensure that the SSH port (22 by default) is enabled in the security group of the node. </li><li id="cce_10_0185__li490481815515">Before you log in to a node (an ECS) using SSH through the Internet, ensure that the ECS already has an EIP bound.</li><li id="cce_10_0185__li16904121855510">Only login to a running ECS is allowed.</li><li id="cce_10_0185__li3827103362110">Only the user <strong id="cce_10_0185__b197020279318"><span id="cce_10_0185__text12656192763716">linux</span></strong><strong id="cce_10_0185__b1468219125715"></strong> can log in to a Linux server.</li></ul>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0185__section1391822316511"><h4 class="sectiontitle">Login Modes</h4><p id="cce_10_0185__p9647194820547">You can log in to an ECS in either of the following modes:</p>
|
||||
<ul id="cce_10_0185__ul03289813567"><li id="cce_10_0185__li3821114685618">Management console (VNC)<p id="cce_10_0185__p957217278576"><a name="cce_10_0185__li3821114685618"></a><a name="li3821114685618"></a>If an ECS has no EIP, log in to the ECS console and click <strong id="cce_10_0185__b2647192473610">Remote Login</strong> in the same row as the ECS.</p>
|
||||
<p id="cce_10_0185__p14616164455714">For details, see <a href="https://docs.otc.t-systems.com/en-us/usermanual/ecs/en-us_topic_0093263550.html" target="_blank" rel="noopener noreferrer">Login Using VNC</a>.</p>
|
||||
</li><li id="cce_10_0185__li1893519588571">SSH<p id="cce_10_0185__p14702017584"><a name="cce_10_0185__li1893519588571"></a><a name="li1893519588571"></a>This mode applies only to ECSs running Linux. Usually, you can use a remote login tool, such as PuTTY, Xshell, and SecureCRT, to log in to your ECS. If none of the remote login tools can be used, log in to the ECS console and click <strong id="cce_10_0185__b6609145220365">Remote Login</strong> in the same row as the ECS to view the connection status and running status of the ECS.</p>
|
||||
<div class="note" id="cce_10_0185__note207919182211"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="cce_10_0185__ul1678102051"><li id="cce_10_0185__li980235455">When you use the Windows OS to log in to a Linux node, set <strong id="cce_10_0185__b16493233638">Auto-login username</strong> to <strong id="cce_10_0185__b19521524171510"><span id="cce_10_0185__text37277158556">linux</span></strong>.</li><li id="cce_10_0185__li17802205258">The CCE console does not support node OS upgrade. Do not upgrade the node OS using the <strong id="cce_10_0185__b1291344241719">yum update</strong> command. Otherwise, the container networking components will be unavailable. </li></ul>
|
||||
<div class="note" id="cce_10_0185__note207919182211"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="cce_10_0185__ul1678102051"><li id="cce_10_0185__li980235455">When you use the Windows OS to log in to a Linux node, set <strong id="cce_10_0185__b241714328579">Auto-login username</strong> to <strong id="cce_10_0185__b6417103215716"><span id="cce_10_0185__text37277158556">linux</span></strong>.</li><li id="cce_10_0185__li17802205258">The CCE console does not support node OS upgrade. Do not upgrade the node OS using the <strong id="cce_10_0185__b1291344241719">yum update</strong> command. Otherwise, the container networking components will be unavailable. </li></ul>
|
||||
</div></div>
|
||||
</li></ul>
|
||||
</div>
|
||||
|
||||
@ -54,7 +54,7 @@
|
||||
<div class="section" id="cce_10_0189__section1273861718819"><a name="cce_10_0189__section1273861718819"></a><a name="section1273861718819"></a><h4 class="sectiontitle">Using kubectl to Configure Namespace Permissions</h4><div class="note" id="cce_10_0189__note175512112562"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="cce_10_0189__p13538151245610">When you access a cluster using kubectl, CCE uses the <strong id="cce_10_0189__b384710277513">kubeconfig</strong> file generated on the cluster for authentication. This file contains user information, based on which CCE determines which Kubernetes resources can be accessed via kubectl. Since the <strong id="cce_10_0189__b13536322116">kubeconfig</strong> file contains user identity details, the permissions associated with that user are inherited when accessing the cluster via kubectl. For details about user permissions, see <a href="cce_10_0187.html#cce_10_0187__section1464135853519">Cluster Permissions (IAM-based) and Namespace Permissions (Kubernetes RBAC-based)</a>.</p>
|
||||
</div></div>
|
||||
<p id="cce_10_0189__p201194431987">In addition to cluster-admin, admin, edit, and view, you can define Roles and RoleBindings to configure the permissions to add, delete, modify, and obtain resources, such as pods, Deployments, and Services, in the namespace.</p>
|
||||
<p id="cce_10_0189__p9324202361517">The procedure for creating a Role is very simple. To be specific, specify a namespace and then define rules. The rules in the following example are to allow GET and LIST operations on pods in the default namespace.</p>
|
||||
<p id="cce_10_0189__p9324202361517">The definition of a Role is simple. You just specify a namespace and some rules. For example, the following rules allow you to perform GET and LIST operations on pods in the <strong id="cce_10_0189__en-us_topic_0249851132_b18822141015514">default</strong> namespace.</p>
|
||||
<pre class="screen" id="cce_10_0189__screen197388108173">kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
@ -83,7 +83,7 @@ subjects:
|
||||
name: 0c97ac3cb280f4d91fa7c0096739e1f8 # User ID of the user-example
|
||||
apiGroup: rbac.authorization.k8s.io</pre>
|
||||
<p id="cce_10_0189__p195507214188">The <strong id="cce_10_0189__b158631241144713">subjects</strong> section binds a Role with an IAM user so that the IAM user can obtain the permissions defined in the Role, as shown in the following figure.</p>
|
||||
<div class="fignone" id="cce_10_0189__fig9473195372813"><span class="figcap"><b>Figure 2 </b>Binding a role to a user</span><br><span><img id="cce_10_0189__en-us_topic_0249851132_image35211083405" src="en-us_image_0262051194.png"></span></div>
|
||||
<div class="fignone" id="cce_10_0189__fig9473195372813"><span class="figcap"><b>Figure 2 </b>Binding a Role to a user</span><br><span><img id="cce_10_0189__en-us_topic_0249851132_image35211083405" src="en-us_image_0262051194.png"></span></div>
|
||||
<p id="cce_10_0189__p430545215225">You can also specify a user group in the <strong id="cce_10_0189__b193732864815">subjects</strong> section. In this case, all users in the user group obtain the permissions defined in the Role.</p>
|
||||
<pre class="screen" id="cce_10_0189__screen2269203813232">...
|
||||
subjects:
|
||||
|
||||
@ -23,7 +23,7 @@
|
||||
|
||||
<div class="tablenoborder"><a name="cce_10_0193__table16382122344317"></a><a name="table16382122344317"></a><table cellpadding="4" cellspacing="0" summary="" id="cce_10_0193__table16382122344317" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Recommended requested resources and resource limits for volcano-admission</caption><thead align="left"><tr id="cce_10_0193__row121622711434"><th align="left" class="cellrowborder" valign="top" width="20%" id="mcps1.3.3.2.2.2.1.2.4.2.6.1.1"><p id="cce_10_0193__p0216227174312">Cluster Scale</p>
|
||||
</th>
|
||||
<th align="left" class="cellrowborder" valign="top" width="20%" id="mcps1.3.3.2.2.2.1.2.4.2.6.1.2"><p id="cce_10_0193__p192168275433">CPU Request(m)</p>
|
||||
<th align="left" class="cellrowborder" valign="top" width="20%" id="mcps1.3.3.2.2.2.1.2.4.2.6.1.2"><p id="cce_10_0193__p192168275433">CPU Request (m)</p>
|
||||
</th>
|
||||
<th align="left" class="cellrowborder" valign="top" width="20%" id="mcps1.3.3.2.2.2.1.2.4.2.6.1.3"><p id="cce_10_0193__p8216172717430">vCPU Limit (m)</p>
|
||||
</th>
|
||||
@ -765,7 +765,7 @@ workload_balancer_third_party_types: ''</pre>
|
||||
<p id="cce_10_0193__p6646145622517">This section describes how to configure volcano-scheduler.</p>
|
||||
<div class="note" id="cce_10_0193__note13388133393710"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="cce_10_0193__p83326372378">Only Volcano of v1.7.1 and later support this function. </p>
|
||||
</div></div>
|
||||
<p id="cce_10_0193__p195053623613">Log in to the CCE console and click the cluster name to access the cluster console. In the navigation pane, choose <strong id="cce_10_0193__b63121803269">Settings</strong> and click the <strong id="cce_10_0193__b73131309268">Scheduling</strong> tab. In the <strong id="cce_10_0193__b6313130152619">Select Cluster Scheduler</strong> area, select <strong id="cce_10_0193__b93139014269">Volcano scheduler</strong>, find the expert mode, and click <strong id="cce_10_0193__b1331314017264">Try Now</strong>.</p>
|
||||
<p id="cce_10_0193__p195053623613">Log in to the CCE console and click the cluster name to access the cluster console. In the navigation pane, choose <strong id="cce_10_0193__b14411174794417">Settings</strong> and click the <strong id="cce_10_0193__b94116477448">Scheduling</strong> tab. In the <strong id="cce_10_0193__b041174720440">Select Cluster Scheduler</strong> area, select <strong id="cce_10_0193__b19412194717448">Volcano scheduler</strong>, find the expert mode, and click <strong id="cce_10_0193__b1341254710440">Try Now</strong>.</p>
|
||||
<p id="cce_10_0193__p112531142104212"></p>
|
||||
<p id="cce_10_0193__p1566143416357"></p>
|
||||
<ul id="cce_10_0193__ul6676425408"><li id="cce_10_0193__li46762264018">Using <strong id="cce_10_0193__b073919506719">resource_exporter</strong>:<pre class="screen" id="cce_10_0193__screen7651947143817">...
|
||||
@ -1112,7 +1112,7 @@ workload_balancer_third_party_types: ''</pre>
|
||||
<p id="cce_10_0193__en-us_topic_0000001609894173_p4910191692212">v1.23</p>
|
||||
<p id="cce_10_0193__en-us_topic_0000001609894173_p091021662211">v1.25</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="51.42%" headers="mcps1.3.8.3.2.4.1.3 "><ul id="cce_10_0193__en-us_topic_0000001609894173_ul72541248141916"><li id="cce_10_0193__en-us_topic_0000001609894173_li122546488191">Fixed the issue that the counting pipeline pod of the networkresource add-on occupies supplementary network interfaces (sub-ENIs).</li><li id="cce_10_0193__en-us_topic_0000001609894173_li16254248191912">Fixed the issue where the binpack add-on scores nodes with insufficient resources.</li><li id="cce_10_0193__en-us_topic_0000001609894173_li8254204861913">Fixed the issue of processing resources in the pod with unknown end status.</li><li id="cce_10_0193__en-us_topic_0000001609894173_li2255448151914">Optimized event output.</li><li id="cce_10_0193__en-us_topic_0000001609894173_li1525519484195">Supported HA deployment by default.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="51.42%" headers="mcps1.3.8.3.2.4.1.3 "><ul id="cce_10_0193__en-us_topic_0000001609894173_ul72541248141916"><li id="cce_10_0193__en-us_topic_0000001609894173_li122546488191">Fixed the issue that the counting pipeline pod of the networkresource add-on occupies supplementary network interfaces.</li><li id="cce_10_0193__en-us_topic_0000001609894173_li16254248191912">Fixed the issue where the binpack add-on scores nodes with insufficient resources.</li><li id="cce_10_0193__en-us_topic_0000001609894173_li8254204861913">Fixed the issue of processing resources in the pod with unknown end status.</li><li id="cce_10_0193__en-us_topic_0000001609894173_li2255448151914">Optimized event output.</li><li id="cce_10_0193__en-us_topic_0000001609894173_li1525519484195">Supported HA deployment by default.</li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0193__en-us_topic_0000001609894173_row328716461974"><td class="cellrowborder" valign="top" width="15.21%" headers="mcps1.3.8.3.2.4.1.1 "><p id="cce_10_0193__en-us_topic_0000001609894173_p132879461770">1.7.1</p>
|
||||
|
||||
@ -123,6 +123,20 @@
|
||||
<td class="cellrowborder" valign="top" width="18.49630073985203%" headers="mcps1.3.5.6.2.3.1.7.1.6 "><p id="cce_10_0197__p17651164084113">This function is gradually replaced by EVS snapshot backup.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0197__row9651940144110"><td class="cellrowborder" valign="top" width="16.306738652269544%" headers="mcps1.3.5.6.2.3.1.7.1.1 "><p id="cce_10_0197__p1365110406419">EVS snapshot backup</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="15.456908618276344%" headers="mcps1.3.5.6.2.3.1.7.1.2 "><p id="cce_10_0197__p3651184012411">Master node disks, including component images, configurations, logs, and etcd data</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="12.74745050989802%" headers="mcps1.3.5.6.2.3.1.7.1.3 "><p id="cce_10_0197__p1683020419555">One-click backup on a web page (manually triggered)</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="18.49630073985203%" headers="mcps1.3.5.6.2.3.1.7.1.4 "><p id="cce_10_0197__p965124012419">1-5 minutes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="18.49630073985203%" headers="mcps1.3.5.6.2.3.1.7.1.5 "><p id="cce_10_0197__p9651040104113">20 minutes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="18.49630073985203%" headers="mcps1.3.5.6.2.3.1.7.1.6 "><p id="cce_10_0197__p1419134263912">This function is coming soon.</p>
|
||||
<p id="cce_10_0197__p0664142611390">After this function is released, it will replace CBR cloud server backup.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
@ -76,7 +76,7 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0198__row1966913718588"><td class="cellrowborder" valign="top" width="20.02%" headers="mcps1.3.4.2.3.2.4.1.2.3.1.1 "><p id="cce_10_0198__p0669147185817">Data Disk</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.4.2.3.2.4.1.2.3.1.2 "><ul id="cce_10_0198__ul184351126605"><li id="cce_10_0198__en-us_topic_0000001199021246_li103472126407"><strong id="cce_10_0198__b53311531183510">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0198__uicontrol113317316358"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0198__uicontrol12331831193518"><b>Data Disk</b></span>. <strong id="cce_10_0198__b1633103163515">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.</li><li id="cce_10_0198__en-us_topic_0000001199021246_li18830161664015">If <span class="uicontrol" id="cce_10_0198__uicontrol16275444867446"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0198__uicontrol5641816837446"><b>System Disk</b></span>, you do not need to add a default data disk. In this case, all data disks are common ones: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB. This function is available for clusters of v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, or later versions.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.4.2.3.2.4.1.2.3.1.2 "><ul id="cce_10_0198__ul184351126605"><li id="cce_10_0198__en-us_topic_0000001199021246_li103472126407"><strong id="cce_10_0198__b13284145912236">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0198__uicontrol2284135972312"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0198__uicontrol1284135952313"><b>Data Disk</b></span>. <strong id="cce_10_0198__b1828495914238">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.</li><li id="cce_10_0198__en-us_topic_0000001199021246_li18830161664015">If <span class="uicontrol" id="cce_10_0198__uicontrol16275444867446"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0198__uicontrol5641816837446"><b>System Disk</b></span>, you do not need to add a default data disk. In this case, all data disks are common ones: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB. This function is available for clusters of v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, or later versions.</li></ul>
|
||||
<p id="cce_10_0198__p3752312011">Click <strong id="cce_10_0198__b513813367555">Expand</strong> to configure <strong id="cce_10_0198__b13265825195416">Data Disk Space Allocation</strong>. This allocates space for container engines, images, and ephemeral storage to ensure their proper running. For details about how to allocate data disk space, see <a href="cce_10_0341.html">Space Allocation of a Data Disk</a>.</p>
|
||||
<p id="cce_10_0198__p1391618153118">For other data disks, a raw disk is created without any processing by default. You can also click <strong id="cce_10_0198__b16127101911540">Expand</strong> and select <strong id="cce_10_0198__b21351519135417">Mount Disk</strong> to mount the data disk to a specified directory. Data disks can also be used as <a href="cce_10_0391.html">local PVs</a> or <a href="cce_10_0726.html">local EVs</a>.</p>
|
||||
</td>
|
||||
|
||||
@ -1,13 +1,13 @@
|
||||
<a name="cce_10_0249"></a><a name="cce_10_0249"></a>
|
||||
|
||||
<h1 class="topictitle1">Overview</h1>
|
||||
<div id="body1599887621732"><div class="section" id="cce_10_0249__section674023294115"><h4 class="sectiontitle">Direct Access to a Pod</h4><p id="cce_10_0249__en-us_topic_0249851121_p182313125309">After a pod is created, the following problems may occur if you directly access the pod:</p>
|
||||
<ul id="cce_10_0249__en-us_topic_0249851121_ul15494121517303"><li id="cce_10_0249__en-us_topic_0249851121_li10494815133012">The pod can be deleted and recreated at any time by a controller such as a Deployment, and the result of accessing the pod becomes unpredictable.</li><li id="cce_10_0249__en-us_topic_0249851121_li20826546103110">The IP address of the pod is allocated only after the pod is started. Before the pod is started, the IP address of the pod is unknown.</li><li id="cce_10_0249__en-us_topic_0249851121_li1452731723014">An application is usually composed of multiple pods that run the same image. Accessing pods one by one is not efficient.</li></ul>
|
||||
<p id="cce_10_0249__en-us_topic_0249851121_p191728509184">For example, an application uses Deployments to create the frontend and backend. The frontend calls the backend for computing, as shown in <a href="#cce_10_0249__en-us_topic_0249851121_fig2173165051811">Figure 1</a>. Three pods are running in the backend, which are independent and replaceable. When a backend pod is re-created, the new pod is assigned with a new IP address, of which the frontend pod is unaware.</p>
|
||||
<div id="body1599887621732"><div class="section" id="cce_10_0249__section674023294115"><h4 class="sectiontitle">Direct Access to a Pod</h4><p id="cce_10_0249__en-us_topic_0249851121_p182313125309">After a pod is created, accessing it directly can result in certain problems:</p>
|
||||
<ul id="cce_10_0249__en-us_topic_0249851121_ul15494121517303"><li id="cce_10_0249__en-us_topic_0249851121_li10494815133012">The pod can be deleted and recreated at any time by a controller such as a Deployment. If the pod is recreated, access to it may fail.</li><li id="cce_10_0249__en-us_topic_0249851121_li20826546103110">An IP address cannot be assigned to a pod until the pod is started. Before the pod is started, its IP address is unknown.</li><li id="cce_10_0249__en-us_topic_0249851121_li1452731723014">Applications usually run on multiple pods that use the same image. Accessing pods one by one is not efficient.</li></ul>
|
||||
<p id="cce_10_0249__en-us_topic_0249851121_p191728509184">For example, Deployments are used to deploy the frontend and backend of an application. The frontend calls the backend for computing, as shown in <a href="#cce_10_0249__en-us_topic_0249851121_fig2173165051811">Figure 1</a>. Three pods are running in the backend, and they are independent and replaceable. When a backend pod is recreated, the new pod is assigned a new IP address, but the frontend pod is unaware of this change.</p>
|
||||
<div class="fignone" id="cce_10_0249__en-us_topic_0249851121_fig2173165051811"><a name="cce_10_0249__en-us_topic_0249851121_fig2173165051811"></a><a name="en-us_topic_0249851121_fig2173165051811"></a><span class="figcap"><b>Figure 1 </b>Inter-pod access</span><br><span><img id="cce_10_0249__en-us_topic_0249851121_image178354246205" src="en-us_image_0258894622.png"></span></div>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0249__section84961935194115"><h4 class="sectiontitle">Using Services for Pod Access</h4><p id="cce_10_0249__en-us_topic_0249851121_p173502035163111">Kubernetes Services are used to solve the preceding pod access problems. A Service has a fixed IP address. (When a CCE cluster is created, a Service CIDR block is set, which is used to allocate IP addresses to Services.) A Service forwards requests accessing the Service to pods based on labels, and at the same time, perform load balancing for these pods.</p>
|
||||
<p id="cce_10_0249__en-us_topic_0249851121_p1359552620518">In the preceding example, a Service is added for the frontend pod to access the backend pods. In this way, the frontend pod does not need to be aware of the changes on backend pods, as shown in <a href="#cce_10_0249__en-us_topic_0249851121_fig163156154816">Figure 2</a>.</p>
|
||||
<div class="section" id="cce_10_0249__section84961935194115"><h4 class="sectiontitle">Using Services for Pod Access</h4><p id="cce_10_0249__en-us_topic_0249851121_p173502035163111">Kubernetes Services are used to solve the preceding pod access problems. A Service has a fixed IP address. (When you create a CCE cluster, you need to specify a Service CIDR block, which is used to allocate IP addresses to Services.) A Service distributes requests across pods based on labels and balances the loads for these pods.</p>
|
||||
<p id="cce_10_0249__en-us_topic_0249851121_p1359552620518">In the preceding example, a Service is created for the frontend pod to access the backend pods. In this way, the frontend pod does not need to be aware of the changes on backend pods, as shown in <a href="#cce_10_0249__en-us_topic_0249851121_fig163156154816">Figure 2</a>.</p>
|
||||
<div class="fignone" id="cce_10_0249__en-us_topic_0249851121_fig163156154816"><a name="cce_10_0249__en-us_topic_0249851121_fig163156154816"></a><a name="en-us_topic_0249851121_fig163156154816"></a><span class="figcap"><b>Figure 2 </b>Accessing pods through a Service</span><br><span><img id="cce_10_0249__en-us_topic_0249851121_image1926812771312" src="en-us_image_0258889981.png"></span></div>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0249__section12500411413"><h4 class="sectiontitle">Service Types</h4><p id="cce_10_0249__p133861126184815">Kubernetes allows you to specify a Service of a required type. The values and actions of different types of Services are as follows:</p>
|
||||
|
||||
@ -39,7 +39,7 @@
|
||||
</li><li id="cce_10_0251__li7651155094013"><strong id="cce_10_0251__b514020733120">SNI</strong>: stands for Server Name Indication (SNI), which is an extended protocol of TLS. SNI allows multiple TLS-compliant domain names for external access using the same IP address and port number, and different domain names can use different security certificates. After SNI is enabled, the client is allowed to submit the requested domain name when initiating a TLS handshake request. After receiving the TLS request, the load balancer searches for the certificate based on the domain name in the request. If the certificate corresponding to the domain name is found, the load balancer returns the certificate for authorization. Otherwise, the default certificate (server certificate) is returned for authorization.<div class="note" id="cce_10_0251__note59161057134120"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="cce_10_0251__ul341785816517"><li id="cce_10_0251__li1541715805115">The <strong id="cce_10_0251__b17512414311">SNI</strong> option is available only when <strong id="cce_10_0251__b77525411312">HTTPS</strong> is used.</li></ul>
|
||||
<ul id="cce_10_0251__ul2041716583512"><li id="cce_10_0251__li541725835112">This function is supported only in clusters of v1.15.11 or later.</li><li id="cce_10_0251__li1265688165219">Only one domain name can be specified for each SNI certificate. Wildcard-domain certificates are supported.</li><li id="cce_10_0251__li742517462581">For ingresses connected to the same ELB port, do not configure SNIs with the same domain name but different certificates. Otherwise, the SNIs will be overwritten.</li></ul>
|
||||
</div></div>
|
||||
</li><li id="cce_10_0251__li58516183919"><strong id="cce_10_0251__b1962254816312">Security Policy</strong>: combinations of different TLS versions and supported cipher suites available to HTTPS listeners.<p id="cce_10_0251__p15856189913">For details about security policies, see <em id="cce_10_0251__i436812054613">Elastic Load Balance User Guide</em>.</p>
|
||||
</li><li id="cce_10_0251__li58516183919"><strong id="cce_10_0251__b1962254816312">Security Policy</strong>: combinations of different TLS versions and supported cipher suites available to HTTPS listeners.<p id="cce_10_0251__p15856189913">For details about security policies, see <em id="cce_10_0251__i155222233215">Elastic Load Balance User Guide</em>.</p>
|
||||
<div class="note" id="cce_10_0251__note885111811917"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="cce_10_0251__ul6851018492"><li id="cce_10_0251__li15851118697"><strong id="cce_10_0251__b145331732163211">Security Policy</strong> is available only when <strong id="cce_10_0251__b7534173216327">HTTPS</strong> is selected.</li><li id="cce_10_0251__li285171815918">This function is supported only in clusters of v1.17.9 or later.</li></ul>
|
||||
</div></div>
|
||||
</li><li id="cce_10_0251__li03351122552"><strong id="cce_10_0251__b665691110482">Backend Protocol</strong>:<p id="cce_10_0251__p53133720554">When the <a href="#cce_10_0251__li6851318392">listener</a> is HTTP-compliant, only <strong id="cce_10_0251__b1711814563211">HTTP</strong> can be selected.</p>
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
<h1 class="topictitle1">Creating a LoadBalancer Ingress Using kubectl</h1>
|
||||
<div id="body0000001204453469"><p id="cce_10_0252__p1557481754814">This section uses an <a href="cce_10_0047.html#cce_10_0047__section155246177178">Nginx workload</a> as an example to describe how to create a LoadBalancer ingress using kubectl.</p>
|
||||
<ul id="cce_10_0252__ul849465471710"><li id="cce_10_0252__li17883121171816">If no load balancer is available in the same VPC, CCE can automatically create a load balancer when creating an ingress. For details, see <a href="#cce_10_0252__section3675115714214">Automatically Creating a Load Balancer While Creating an Ingress</a>.</li><li id="cce_10_0252__li549455416173">If a load balancer is available in the same VPC, perform the operation by referring to <a href="#cce_10_0252__section32300431736">Associating an Existing Load Balancer to an Ingress While Creating the Ingress</a>.</li></ul>
|
||||
<div class="section" id="cce_10_0252__section8926910153415"><a name="cce_10_0252__section8926910153415"></a><a name="section8926910153415"></a><div class="dropdownexpand"><div class="dropdowntitle" onclick="ExpandorCollapseNode(this)"><h4 class="sectiontitle">Ingress API Version Upgrade in CCE Clusters v1.23</h4></div><div class="dropdowncontext"><p id="cce_10_0252__p192611033418">In CCE clusters of v1.23 or later, the ingress version is switched to <strong id="cce_10_0252__b19267106347">networking.k8s.io/v1</strong>.</p>
|
||||
<div class="section" id="cce_10_0252__section8926910153415"><a name="cce_10_0252__section8926910153415"></a><a name="section8926910153415"></a><div class="dropdownexpand"><div class="dropdowntitle" onclick="ExpandorCollapseNode(this)"><h4 class="sectiontitle">Ingress API Version Upgrade in CCE Clusters v1.23</h4></div><div class="dropdowncontext"></div><div class="dropdowncontext"><p id="cce_10_0252__p192611033418">In CCE clusters of v1.23 or later, the ingress version is switched to <strong id="cce_10_0252__b19267106347">networking.k8s.io/v1</strong>.</p>
|
||||
<p id="cce_10_0252__p11926191033418">Compared with v1beta1, v1 has the following differences in parameters:</p>
|
||||
<ul id="cce_10_0252__ul13926101018345"><li id="cce_10_0252__li19926191083416">The ingress type is specified by <strong id="cce_10_0252__b0926161011344">spec.ingressClassName</strong> instead of <strong id="cce_10_0252__b119261410123416">kubernetes.io/ingress.class</strong> in <strong id="cce_10_0252__b11151359144410">annotations</strong>.</li><li id="cce_10_0252__li129264101348">The format of <strong id="cce_10_0252__b571072213484">backend</strong> has changed.</li><li id="cce_10_0252__li179261510143415">The <strong id="cce_10_0252__b1783119292013">pathType</strong> parameter must be specified for each path. The options are as follows:<ul id="cce_10_0252__ul2926131012341"><li id="cce_10_0252__li192661083418"><strong id="cce_10_0252__b958119196203">ImplementationSpecific</strong>: The matching method depends on Ingress Controller. The matching method defined by <strong id="cce_10_0252__b1683113113519">ingress.beta.kubernetes.io/url-match-mode</strong> is used in CCE, which is the same as v1beta1.</li><li id="cce_10_0252__li209261310173414"><strong id="cce_10_0252__b19854141864510">Exact</strong>: exact matching of the URL, which is case-sensitive.</li><li id="cce_10_0252__li179264101349"><strong id="cce_10_0252__b0441291458">Prefix</strong>: matching based on the URL prefix separated by a slash (/). The match is case-sensitive, and elements in the path are matched one by one. A path element refers to a list of labels in the path separated by a slash (/).</li></ul>
|
||||
</li></ul>
|
||||
|
||||
@ -67,7 +67,7 @@
|
||||
<td class="cellrowborder" valign="top" width="19.11%" headers="mcps1.3.5.5.3.3.2.5.1.2 "><p id="cce_10_0296__p15861381131">A combined policy. The priorities for the policies are as follows: priority > least-waste > random.</p>
|
||||
<p id="cce_10_0296__p1458623819320">It is an enhanced least-waste policy configured based on the node pool or scaling group priority. If multiple node pools meet the condition, the least-waste policy is used for further decision-making.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="32.16%" headers="mcps1.3.5.5.3.3.2.5.1.3 "><p id="cce_10_0296__p1531734565517">This policy allows you to configure the priorities of node pools or scaling groups through the console or API, while the least-waste policy can effectively minimize resource waste in various scenarios. The priority policy is used as the <strong id="cce_10_0296__b1728171714115">default preferred policy</strong> thanks to its good universality.</p>
|
||||
<td class="cellrowborder" valign="top" width="32.16%" headers="mcps1.3.5.5.3.3.2.5.1.3 "><p id="cce_10_0296__p1531734565517">This policy allows you to configure the priorities of node pools or scaling groups through the console or API, while the least-waste policy can effectively minimize resource waste in various scenarios. The priority policy is used as the <strong id="cce_10_0296__b9741113322911">default preferred policy</strong> thanks to its good universality.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="38.97%" headers="mcps1.3.5.5.3.3.2.5.1.4 "><p id="cce_10_0296__p7937135781718">Assume that auto scaling is enabled for node pools 1 and 2 in the cluster and the scale-out upper limit is not reached. The policy for scaling out the number of pods for a workload is as follows:</p>
|
||||
<ol id="cce_10_0296__ol1893717573177"><li id="cce_10_0296__li593785741713">Pending pods trigger the Autoscaler to determine the scale-out process.</li><li id="cce_10_0296__li189371557131710">Autoscaler simulates the scheduling phase and evaluates that some pending pods can be scheduled to the added nodes in both node pools 1 and 2.</li><li id="cce_10_0296__li29371457181711">Autoscaler evaluates that node pool 1 has a higher priority than node pool 2. Therefore, Autoscaler selects node pool 1 for scale-out.</li></ol>
|
||||
|
||||
@ -580,6 +580,20 @@
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.6.3.1.7.1.6 "><p id="cce_10_0302__en-us_topic_0000001199021198_p17651164084113">This function is gradually replaced by EVS snapshot backup.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0302__en-us_topic_0000001199021198_row9651940144110"><td class="cellrowborder" valign="top" width="16%" headers="mcps1.3.6.3.1.7.1.1 "><p id="cce_10_0302__en-us_topic_0000001199021198_p1365110406419">EVS snapshot backup</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="15%" headers="mcps1.3.6.3.1.7.1.2 "><p id="cce_10_0302__en-us_topic_0000001199021198_p3651184012411">Master node disks, including component images, configurations, logs, and etcd data</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="13%" headers="mcps1.3.6.3.1.7.1.3 "><p id="cce_10_0302__en-us_topic_0000001199021198_p1683020419555">One-click backup on a web page (manually triggered)</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="19%" headers="mcps1.3.6.3.1.7.1.4 "><p id="cce_10_0302__en-us_topic_0000001199021198_p965124012419">1-5 minutes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="14.000000000000002%" headers="mcps1.3.6.3.1.7.1.5 "><p id="cce_10_0302__en-us_topic_0000001199021198_p9651040104113">20 minutes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.6.3.1.7.1.6 "><p id="cce_10_0302__en-us_topic_0000001199021198_p1419134263912">This function is coming soon.</p>
|
||||
<p id="cce_10_0302__en-us_topic_0000001199021198_p0664142611390">After this function is released, it will replace CBR cloud server backup.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
@ -94,7 +94,7 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0363__row1966913718588"><td class="cellrowborder" valign="top" width="20.02%" headers="mcps1.3.4.3.3.2.4.1.2.3.1.1 "><p id="cce_10_0363__p0669147185817">Data Disk</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.4.3.3.2.4.1.2.3.1.2 "><ul id="cce_10_0363__ul13347201216402"><li id="cce_10_0363__li103472126407"><strong id="cce_10_0363__b493614401788">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0363__uicontrol16936640683"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0363__uicontrol29366400810"><b>Data Disk</b></span>. <strong id="cce_10_0363__b79361840284">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.<ul id="cce_10_0363__ul324262033711"><li id="cce_10_0363__li1124252010378">Default data disk: used for container runtime and kubelet components. The disk size ranges from 20 GiB to 32768 GiB. The default value is 100 GiB.</li><li id="cce_10_0363__li6177165413374">Other common data disks: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.4.3.3.2.4.1.2.3.1.2 "><ul id="cce_10_0363__ul13347201216402"><li id="cce_10_0363__li103472126407"><strong id="cce_10_0363__b87711342223">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0363__uicontrol1378123452217"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0363__uicontrol107853413227"><b>Data Disk</b></span>. <strong id="cce_10_0363__b187815343221">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.<ul id="cce_10_0363__ul324262033711"><li id="cce_10_0363__li1124252010378">Default data disk: used for container runtime and kubelet components. The disk size ranges from 20 GiB to 32768 GiB. The default value is 100 GiB.</li><li id="cce_10_0363__li6177165413374">Other common data disks: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB.</li></ul>
|
||||
</li><li id="cce_10_0363__li18830161664015">If <span class="uicontrol" id="cce_10_0363__uicontrol2621173512497"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0363__uicontrol19561032184918"><b>System Disk</b></span>, you do not need to add a default data disk. In this case, all data disks are common ones: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB. This function is available for clusters of v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, or later versions.</li></ul>
|
||||
<div class="note" id="cce_10_0363__note95411755120"><span class="notetitle"> NOTE: </span><div class="notebody"><ul id="cce_10_0363__ul1388875765811"><li id="cce_10_0363__li9888165712586">If the node flavor is disk-intensive or ultra-high I/O, one data disk can be a local disk.</li><li id="cce_10_0363__li7888757125811">Local disks may break down and do not ensure data reliability. Store your service data in EVS disks, which are more reliable than local disks.</li></ul>
|
||||
</div></div>
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
|
||||
<h1 class="topictitle1">Creating an Nginx Ingress Using kubectl</h1>
|
||||
<div id="body0000001159132006"><p id="cce_10_0364__p3861320152812">This section uses an <a href="cce_10_0047.html#cce_10_0047__section155246177178">Nginx workload</a> as an example to describe how to create an Nginx ingress using kubectl.</p>
|
||||
<div class="section" id="cce_10_0364__section084115985013"><a name="cce_10_0364__section084115985013"></a><a name="section084115985013"></a><div class="dropdownexpand"><div class="dropdowntitle" onclick="ExpandorCollapseNode(this)"><h4 class="sectiontitle">Ingress API Version Upgrade in CCE Clusters v1.23</h4></div><div class="dropdowncontext"><p id="cce_10_0364__p10742171892110">In CCE clusters of v1.23 or later, the ingress version is switched to <strong id="cce_10_0364__b18568943203216">networking.k8s.io/v1</strong>.</p>
|
||||
<div class="section" id="cce_10_0364__section084115985013"><a name="cce_10_0364__section084115985013"></a><a name="section084115985013"></a><div class="dropdownexpand"><div class="dropdowntitle" onclick="ExpandorCollapseNode(this)"><h4 class="sectiontitle">Ingress API Version Upgrade in CCE Clusters v1.23</h4></div><div class="dropdowncontext"></div><div class="dropdowncontext"><p id="cce_10_0364__p10742171892110">In CCE clusters of v1.23 or later, the ingress version is switched to <strong id="cce_10_0364__b18568943203216">networking.k8s.io/v1</strong>.</p>
|
||||
<p id="cce_10_0364__p20567113755215">Compared with v1beta1, v1 has the following differences in parameters:</p>
|
||||
<ul id="cce_10_0364__ul1047013217172"><li id="cce_10_0364__li10471183221719">The ingress type is specified by <strong id="cce_10_0364__b554645310324">spec.ingressClassName</strong> instead of <strong id="cce_10_0364__b10546953133213">kubernetes.io/ingress.class</strong> in <strong id="cce_10_0364__b85473536327">annotations</strong>.</li><li id="cce_10_0364__li7135111819196">The format of <strong id="cce_10_0364__b20186273336">backend</strong> has changed.</li><li id="cce_10_0364__li10689134614221">The <strong id="cce_10_0364__b1889316613911">pathType</strong> parameter must be specified for each path. The options are as follows:<ul id="cce_10_0364__ul3253194702213"><li id="cce_10_0364__li456213366269"><strong id="cce_10_0364__b1719418277173">ImplementationSpecific</strong>: The matching method depends on Ingress Controller. The matching method defined by <strong id="cce_10_0364__b2693913999">ingress.beta.kubernetes.io/url-match-mode</strong> is used in CCE, which is the same as v1beta1.</li><li id="cce_10_0364__li5172153972613"><strong id="cce_10_0364__b8201155219426">Exact</strong>: exact matching of the URL, which is case-sensitive.</li><li id="cce_10_0364__li584094916222"><strong id="cce_10_0364__b2048754104211">Prefix</strong>: matching based on the URL prefix separated by a slash (/). The match is case-sensitive, and elements in the path are matched one by one. A path element refers to a list of labels in the path separated by a slash (/).</li></ul>
|
||||
</li></ul>
|
||||
|
||||
@ -123,7 +123,7 @@ metadata:
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="14.000000000000002%" headers="mcps1.3.3.5.3.2.5.1.3 "><p id="cce_10_0380__p7360105617584">Yes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="51%" headers="mcps1.3.3.5.3.2.5.1.4 "><p id="cce_10_0380__p936095685819">Driver type. If an EVS disk is used, the parameter value is fixed at <span class="parmvalue" id="cce_10_0380__parmvalue330635280"><b>disk.csi.everest.io</b></span>.</p>
|
||||
<td class="cellrowborder" valign="top" width="51%" headers="mcps1.3.3.5.3.2.5.1.4 "><p id="cce_10_0380__p936095685819">Driver type. If an EVS disk is used, the parameter value is fixed at <span class="parmvalue" id="cce_10_0380__parmvalue1121200374"><b>disk.csi.everest.io</b></span>.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0380__row13957193955813"><td class="cellrowborder" valign="top" width="11%" headers="mcps1.3.3.5.3.2.5.1.1 "><p id="cce_10_0380__p1132211331519">EVS</p>
|
||||
@ -132,8 +132,8 @@ metadata:
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="14.000000000000002%" headers="mcps1.3.3.5.3.2.5.1.3 "><p id="cce_10_0380__p13360145610589">Yes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="51%" headers="mcps1.3.3.5.3.2.5.1.4 "><p id="cce_10_0380__p17361105611585">If an EVS disk is used, the parameter value can be <span class="parmvalue" id="cce_10_0380__parmvalue771666110"><b>ext4</b></span> or <span class="parmvalue" id="cce_10_0380__parmvalue988868842"><b>xfs</b></span>.</p>
|
||||
<div class="p" id="cce_10_0380__p1036185645819">The restrictions on using <span class="parmvalue" id="cce_10_0380__parmvalue716121274"><b>xfs</b></span> are as follows:<ul id="cce_10_0380__ul03616566583"><li id="cce_10_0380__li7361115605816">The nodes must run CentOS 7, HCE OS 2.0, or Ubuntu 22.04, and the Everest version in the cluster must be 2.3.2 or later.</li><li id="cce_10_0380__li5361156125820">Only common containers are supported.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="51%" headers="mcps1.3.3.5.3.2.5.1.4 "><p id="cce_10_0380__p17361105611585">If an EVS disk is used, the parameter value can be <span class="parmvalue" id="cce_10_0380__parmvalue1079257909"><b>ext4</b></span> or <span class="parmvalue" id="cce_10_0380__parmvalue1239687976"><b>xfs</b></span>.</p>
|
||||
<div class="p" id="cce_10_0380__p1036185645819">The restrictions on using <span class="parmvalue" id="cce_10_0380__parmvalue1666719131"><b>xfs</b></span> are as follows:<ul id="cce_10_0380__ul03616566583"><li id="cce_10_0380__li7361115605816">The nodes must run CentOS 7, HCE OS 2.0, or Ubuntu 22.04, and the Everest version in the cluster must be 2.3.2 or later.</li><li id="cce_10_0380__li5361156125820">Only common containers are supported.</li></ul>
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
@ -153,7 +153,7 @@ metadata:
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="14.000000000000002%" headers="mcps1.3.3.5.3.2.5.1.3 "><p id="cce_10_0380__p636185665814">Yes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="51%" headers="mcps1.3.3.5.3.2.5.1.4 "><p id="cce_10_0380__p103626560585">The parameter value is fixed at <span class="parmvalue" id="cce_10_0380__parmvalue410198236"><b>true</b></span>, which indicates that the EVS device type is <strong id="cce_10_0380__b1021717869">SCSI</strong>. No other parameter values are allowed.</p>
|
||||
<td class="cellrowborder" valign="top" width="51%" headers="mcps1.3.3.5.3.2.5.1.4 "><p id="cce_10_0380__p103626560585">The parameter value is fixed at <span class="parmvalue" id="cce_10_0380__parmvalue70974216"><b>true</b></span>, which indicates that the EVS device type is <strong id="cce_10_0380__b1776423110">SCSI</strong>. No other parameter values are allowed.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0380__row1967312234013"><td class="cellrowborder" valign="top" width="11%" headers="mcps1.3.3.5.3.2.5.1.1 "><p id="cce_10_0380__p10936142812010">SFS</p>
|
||||
|
||||
@ -70,7 +70,7 @@
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<ul id="cce_10_0382__ul915183720207"><li id="cce_10_0382__li131618109208">CCE DataPlane V2 is released with restrictions. To use this feature, submit a service ticket to CCE.</li><li id="cce_10_0382__li201583762011">After DataPlane V2 network acceleration is enabled, pods on HCE OS 2.0 use Earliest Departure Time (EDT) to limit the egress bandwidth. The ingress bandwidth limitation is not supported. In other network modes, a Token Bucket Filter (TBF) qdisc is used to limit the bandwidth.</li><li id="cce_10_0382__li1011717215237">Pod bandwidth limitation applies to regular containers (runC as the container runtime), not secure containers (Kata Containers as the container runtime).</li><li id="cce_10_0382__li3430191715236">Pod bandwidth limitation does not apply to hostNetwork pods.</li></ul>
|
||||
<ul id="cce_10_0382__ul915183720207"><li id="cce_10_0382__li131618109208">CCE DataPlane V2 is released with restrictions. To use this feature, submit a service ticket to CCE.</li><li id="cce_10_0382__li201583762011">After DataPlane V2 network acceleration is enabled, pods on the nodes running HCE OS 2.0 use EDT to limit the egress bandwidth. The ingress bandwidth limitation is not supported. In other network modes, a Token Bucket Filter (TBF) qdisc is used to limit the bandwidth.</li><li id="cce_10_0382__li1011717215237">Pod bandwidth limitation applies to regular containers (runC as the container runtime), not secure containers (Kata Containers as the container runtime).</li><li id="cce_10_0382__li3430191715236">Pod bandwidth limitation does not apply to hostNetwork pods.</li></ul>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0382__section2378202810330"><h4 class="sectiontitle">Using the CCE Console</h4><p id="cce_10_0382__p176971010203413">When creating a workload on the console, you can set pod ingress and egress bandwidth limits by clicking <strong id="cce_10_0382__b14297643149">Network Configuration</strong> in the <span class="uicontrol" id="cce_10_0382__uicontrol3231769353"><b>Advanced Settings</b></span> area.</p>
|
||||
|
||||
@ -74,7 +74,7 @@
|
||||
<div class="section" id="cce_10_0384__section102385261413"><h4 class="sectiontitle">Compatible kubelet Oversubscription</h4><div class="notice" id="cce_10_0384__note111619321513"><span class="noticetitle"><img src="public_sys-resources/notice_3.0-en-us.png"> </span><div class="noticebody"><div class="p" id="cce_10_0384__p10679133852220"><strong id="cce_10_0384__b1912720762219">Specifications</strong><ul id="cce_10_0384__ul19383164411191"><li id="cce_10_0384__li10766125111429">Cluster version<ul id="cce_10_0384__ul62201752154212"><li id="cce_10_0384__li1532115594220">v1.19: v1.19.16-r4 or later</li><li id="cce_10_0384__li3107145714213">v1.21: v1.21.7-r0 or later</li><li id="cce_10_0384__li15200194771716">v1.23: v1.23.5-r0 or later</li><li id="cce_10_0384__li514922914311">v1.25 or later</li></ul>
|
||||
</li><li id="cce_10_0384__li4200184712177">Cluster type: CCE standard or Turbo</li><li id="cce_10_0384__li132001147111715">Node OS: EulerOS 2.9 (kernel-4.18.0-147.5.1.6.h729.6.eulerosv2r9.x86_64) or HCE OS 2.0</li><li id="cce_10_0384__li9200947201717">Node type: ECS</li><li id="cce_10_0384__li10364142632218">Volcano version: 1.7.0 or later</li></ul>
|
||||
</div>
|
||||
<div class="p" id="cce_10_0384__p181841243211"><strong id="cce_10_0384__b417872014395">Constraints</strong><ul id="cce_10_0384__ul81841437118"><li id="cce_10_0384__li1741118264206">Before enabling oversubscription, ensure that the overcommit add-on is not enabled on Volcano.</li><li id="cce_10_0384__li3852121519212">Modifying the label of an oversubscribed node does not affect the running pods.</li><li id="cce_10_0384__li269881617214">Running pods cannot be converted between online and offline services. To convert services, rebuild pods.</li><li id="cce_10_0384__li1149628182118">If the label <strong id="cce_10_0384__b646532916397">volcano.sh/oversubscription=true</strong> is configured for a node in the cluster, the <strong id="cce_10_0384__b174656298390">oversubscription</strong> configuration must be added to the Volcano add-on. Otherwise, the scheduling of oversold nodes will be abnormal. Ensure that you have correctly configure labels because the scheduler does not check the add-on and node configurations. For details, see <a href="#cce_10_0384__table152481219311">Table 1</a>.</li><li id="cce_10_0384__li49631856162112">To disable oversubscription, perform the following operations:<ul id="cce_10_0384__ul1112232242215"><li id="cce_10_0384__li12124162022210">Remove the <strong id="cce_10_0384__b139669453393">volcano.sh/oversubscription</strong> label from the oversubscribed node.</li><li id="cce_10_0384__li91251620132217">Set <strong id="cce_10_0384__b34165481393">over-subscription-resource</strong> to <strong id="cce_10_0384__b1541754812396">false</strong>.</li><li id="cce_10_0384__li12125420162210">Modify the configmap of Volcano Scheduler named <strong id="cce_10_0384__b13578205033915">volcano-scheduler-configmap</strong> and remove the oversubscription add-on.</li></ul>
|
||||
<div class="p" id="cce_10_0384__p181841243211"><strong id="cce_10_0384__b417872014395">Constraints</strong><ul id="cce_10_0384__ul81841437118"><li id="cce_10_0384__li1741118264206">Before enabling oversubscription, ensure that the overcommit add-on is not enabled on Volcano.</li><li id="cce_10_0384__li3852121519212">Modifying the label of an oversubscribed node does not affect the running pods.</li><li id="cce_10_0384__li269881617214">Running pods cannot be converted between online and offline services. To convert services, rebuild pods.</li><li id="cce_10_0384__li1149628182118">If the label <strong id="cce_10_0384__b646532916397">volcano.sh/oversubscription=true</strong> is configured for a node in the cluster, the <strong id="cce_10_0384__b174656298390">oversubscription</strong> configuration must be added to the Volcano add-on. Otherwise, the scheduling of oversold nodes will be abnormal. Ensure that you have correctly configure labels because the scheduler does not check the add-on and node configurations. For details, see <a href="#cce_10_0384__table152481219311">Table 1</a>.</li><li id="cce_10_0384__li49631856162112">To disable oversubscription, perform the following operations:<ul id="cce_10_0384__ul1112232242215"><li id="cce_10_0384__li12124162022210">Remove the <strong id="cce_10_0384__b139669453393">volcano.sh/oversubscription</strong> label from the oversubscribed node.</li><li id="cce_10_0384__li12125420162210">Modify the configmap of Volcano Scheduler named <strong id="cce_10_0384__b13578205033915">volcano-scheduler-configmap</strong> and remove the oversubscription add-on.</li></ul>
|
||||
</li><li id="cce_10_0384__li8879133410365">If you have set <strong id="cce_10_0384__b296455418394">cpu-manager-policy</strong> to statically bind CPU cores on a node, do not assign the QoS class of Guaranteed to offline pods. This is because offline pods may occupy the CPUs of online pods, leading to an online pod startup failure and offline pods failing to start even though they have been successfully scheduled. To prevent this, switch the pods to online pods if CPU core binding is required.</li><li id="cce_10_0384__li10184184311113">If <strong id="cce_10_0384__b1330924394614">cpu-manager-policy</strong> is set to static CPU core binding on a node, do not bind CPU cores to all online pods. This is because doing so can cause online pods to occupy all available CPU or memory resources, leaving only a small number of oversubscribed resources.</li></ul>
|
||||
</div>
|
||||
</div></div>
|
||||
@ -145,8 +145,6 @@ data:
|
||||
- name: cce-gpu
|
||||
...</pre>
|
||||
</div>
|
||||
</p></li><li id="cce_10_0384__li11364155010439"><span>Enable node oversubscription.</span><p><p id="cce_10_0384__p1958412304184">A label can be configured to use oversubscribed resources only after the oversubscription feature is enabled for a node. Related nodes can be created only in a node pool. To enable the oversubscription feature, perform the following steps:</p>
|
||||
<ol type="a" id="cce_10_0384__ol181230455528"><li id="cce_10_0384__li15123445115219">Create a node pool.</li><li id="cce_10_0384__li512314518521">Choose <strong id="cce_10_0384__b459139194016">Manage</strong> in the <strong id="cce_10_0384__b145911913409">Operation</strong> column of the created node pool.</li><li id="cce_10_0384__li111231945135219">On the <strong id="cce_10_0384__b15254185317104">Manage Components</strong> page, enable <strong id="cce_10_0384__b201201528122217">Node oversubscription feature (over-subscription-resource)</strong> and click <strong id="cce_10_0384__b52341544229">OK</strong>.</li></ol>
|
||||
</p></li><li id="cce_10_0384__li182861216174415"><span>Set the node oversubscription label.</span><p><p id="cce_10_0384__p15827102792019">The <strong id="cce_10_0384__b176001451961">volcano.sh/oversubscription</strong> label needs to be configured for an oversubscribed node. If this label is set for a node and the value is <strong id="cce_10_0384__b6944921463">true</strong>, the node is an oversubscribed node. Otherwise, the node is not an oversubscribed node.</p>
|
||||
<pre class="screen" id="cce_10_0384__screen4181417171812">kubectl label node 192.168.0.0 volcano.sh/oversubscription=true</pre>
|
||||
<p id="cce_10_0384__p1172017528912">An oversubscribed node also supports the oversubscription thresholds, as listed in <a href="#cce_10_0384__table1853397191112">Table 2</a>. For example:</p>
|
||||
@ -160,39 +158,39 @@ Labels: ...
|
||||
Annotations: ...
|
||||
volcano.sh/evicting-cpu-high-watermark: 70</pre>
|
||||
|
||||
<div class="tablenoborder"><a name="cce_10_0384__table1853397191112"></a><a name="table1853397191112"></a><table cellpadding="4" cellspacing="0" summary="" id="cce_10_0384__table1853397191112" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Node oversubscription annotations</caption><thead align="left"><tr id="cce_10_0384__row105951715118"><th align="left" class="cellrowborder" valign="top" width="22%" id="mcps1.3.9.4.2.7.2.3.1.1"><p id="cce_10_0384__p185951711115">Parameter</p>
|
||||
<div class="tablenoborder"><a name="cce_10_0384__table1853397191112"></a><a name="table1853397191112"></a><table cellpadding="4" cellspacing="0" summary="" id="cce_10_0384__table1853397191112" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Node oversubscription annotations</caption><thead align="left"><tr id="cce_10_0384__row105951715118"><th align="left" class="cellrowborder" valign="top" width="22%" id="mcps1.3.9.3.2.7.2.3.1.1"><p id="cce_10_0384__p185951711115">Parameter</p>
|
||||
</th>
|
||||
<th align="left" class="cellrowborder" valign="top" width="78%" id="mcps1.3.9.4.2.7.2.3.1.2"><p id="cce_10_0384__p259510717114">Description</p>
|
||||
<th align="left" class="cellrowborder" valign="top" width="78%" id="mcps1.3.9.3.2.7.2.3.1.2"><p id="cce_10_0384__p259510717114">Description</p>
|
||||
</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody><tr id="cce_10_0384__row45951176117"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.4.2.7.2.3.1.1 "><p id="cce_10_0384__p259557171110">volcano.sh/evicting-cpu-high-watermark</p>
|
||||
<tbody><tr id="cce_10_0384__row45951176117"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.3.2.7.2.3.1.1 "><p id="cce_10_0384__p259557171110">volcano.sh/evicting-cpu-high-watermark</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.4.2.7.2.3.1.2 "><p id="cce_10_0384__p41092413154">Upper limit for CPU usage. When the CPU usage of a node exceeds the specified value, offline job eviction is triggered and the node becomes unschedulable.</p>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.3.2.7.2.3.1.2 "><p id="cce_10_0384__p41092413154">Upper limit for CPU usage. When the CPU usage of a node exceeds the specified value, offline job eviction is triggered and the node becomes unschedulable.</p>
|
||||
<p id="cce_10_0384__p259511741114">The default value is <strong id="cce_10_0384__b44974543419">80</strong>, indicating that offline job eviction is triggered when the CPU usage of a node exceeds 80%.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0384__row11595577116"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.4.2.7.2.3.1.1 "><p id="cce_10_0384__p1859513716115">volcano.sh/evicting-cpu-low-watermark</p>
|
||||
<tr id="cce_10_0384__row11595577116"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.3.2.7.2.3.1.1 "><p id="cce_10_0384__p1859513716115">volcano.sh/evicting-cpu-low-watermark</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.4.2.7.2.3.1.2 "><p id="cce_10_0384__p17595137161114">Lower limit for CPU usage. When the CPU usage of a node is higher than the upper limit, offline jobs will be evicted. The node accepts the offline jobs again only when the CPU usage of the node is lower than the lower limit.</p>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.3.2.7.2.3.1.2 "><p id="cce_10_0384__p17595137161114">Lower limit for CPU usage. When the CPU usage of a node is higher than the upper limit, offline jobs will be evicted. The node accepts the offline jobs again only when the CPU usage of the node is lower than the lower limit.</p>
|
||||
<p id="cce_10_0384__p16595197161115">The default value is <strong id="cce_10_0384__b1914818330384">30</strong>, indicating that offline jobs are accepted again when the CPU usage of a node is lower than 30%.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0384__row17595167181110"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.4.2.7.2.3.1.1 "><p id="cce_10_0384__p1459517791112">volcano.sh/evicting-memory-high-watermark</p>
|
||||
<tr id="cce_10_0384__row17595167181110"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.3.2.7.2.3.1.1 "><p id="cce_10_0384__p1459517791112">volcano.sh/evicting-memory-high-watermark</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.4.2.7.2.3.1.2 "><p id="cce_10_0384__p13595770114">Upper limit for memory usage. When the memory usage of a node exceeds the specified value, offline job eviction is triggered and the node becomes unschedulable.</p>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.3.2.7.2.3.1.2 "><p id="cce_10_0384__p13595770114">Upper limit for memory usage. When the memory usage of a node exceeds the specified value, offline job eviction is triggered and the node becomes unschedulable.</p>
|
||||
<p id="cce_10_0384__p125952715117">The default value is <strong id="cce_10_0384__b2040511225392">60</strong>, indicating that offline job eviction is triggered when the memory usage of a node exceeds 60%.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0384__row45958731118"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.4.2.7.2.3.1.1 "><p id="cce_10_0384__p105958710119">volcano.sh/evicting-memory-low-watermark</p>
|
||||
<tr id="cce_10_0384__row45958731118"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.3.2.7.2.3.1.1 "><p id="cce_10_0384__p105958710119">volcano.sh/evicting-memory-low-watermark</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.4.2.7.2.3.1.2 "><p id="cce_10_0384__p10595197171117">Lower limit for memory usage. When the memory usage of a node is higher than the upper limit, offline jobs will be evicted. The node accepts the offline jobs again only when the memory usage of the node is lower than the lower limit.</p>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.3.2.7.2.3.1.2 "><p id="cce_10_0384__p10595197171117">Lower limit for memory usage. When the memory usage of a node is higher than the upper limit, offline jobs will be evicted. The node accepts the offline jobs again only when the memory usage of the node is lower than the lower limit.</p>
|
||||
<p id="cce_10_0384__p1259519712115">The default value is <strong id="cce_10_0384__b176291225104013">30</strong>, indicating that offline jobs are accepted again when the memory usage of a node is lower than 30%.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="cce_10_0384__row25953771110"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.4.2.7.2.3.1.1 "><p id="cce_10_0384__p19595974119">volcano.sh/oversubscription-types</p>
|
||||
<tr id="cce_10_0384__row25953771110"><td class="cellrowborder" valign="top" width="22%" headers="mcps1.3.9.3.2.7.2.3.1.1 "><p id="cce_10_0384__p19595974119">volcano.sh/oversubscription-types</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.4.2.7.2.3.1.2 "><p id="cce_10_0384__p1359567101115">Oversubscribed resource type. Options:</p>
|
||||
<td class="cellrowborder" valign="top" width="78%" headers="mcps1.3.9.3.2.7.2.3.1.2 "><p id="cce_10_0384__p1359567101115">Oversubscribed resource type. Options:</p>
|
||||
<ul id="cce_10_0384__ul440551111316"><li id="cce_10_0384__li34075114137"><strong id="cce_10_0384__b1785335734812">cpu</strong>: oversubscribed CPU</li><li id="cce_10_0384__li14401151191319"><strong id="cce_10_0384__b1271616194910">memory</strong>: oversubscribed memory</li><li id="cce_10_0384__li240551141315"><strong id="cce_10_0384__b16367132814491">cpu,memory</strong>: oversubscribed CPU and memory</li></ul>
|
||||
<p id="cce_10_0384__p175951741117">The default value is <strong id="cce_10_0384__b1181107142511">cpu,memory</strong>.</p>
|
||||
</td>
|
||||
@ -219,7 +217,7 @@ preemptionPolicy: PreemptLowerPriority
|
||||
value: -90000
|
||||
|
||||
EOF</pre>
|
||||
</p></li><li id="cce_10_0384__li8503750144419"><span>Deploy online and offline jobs and configure PriorityClasses for these jobs.</span><p><p id="cce_10_0384__p16825144217223">The <strong id="cce_10_0384__b26751520144020">volcano.sh/qos-level</strong> annotation needs to be added to distinguish offline jobs. The value is an integer ranging from -7 to 7. If the value is less than 0, the job is an offline job. If the value is greater than or equal to 0, the job is an online job. You do not need to set this annotation for online jobs. For both online and offline jobs, set <strong id="cce_10_0384__b1352116047">schedulerName</strong> to <strong id="cce_10_0384__b576546895">volcano</strong> to enable Volcano.</p>
|
||||
</p></li><li id="cce_10_0384__li8503750144419"><span>Deploy online and offline jobs and configure PriorityClasses for these jobs.</span><p><p id="cce_10_0384__p16825144217223">The <strong id="cce_10_0384__b26751520144020">volcano.sh/qos-level</strong> annotation needs to be added to distinguish offline jobs. The value is an integer ranging from -7 to 7. If the value is less than 0, the job is an offline job. If the value is greater than or equal to 0, the job is an online job. You do not need to set this annotation for online jobs. For both online and offline jobs, set <strong id="cce_10_0384__b923062896">schedulerName</strong> to <strong id="cce_10_0384__b1872363566">volcano</strong> to enable Volcano.</p>
|
||||
<div class="note" id="cce_10_0384__note881010430447"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="cce_10_0384__p7811184318442">The priorities between online jobs and between offline jobs are not differentiated, and the value validity is not verified. If the value of <strong id="cce_10_0384__b1330893254011">volcano.sh/qos-level</strong> of an offline job is not a negative integer ranging from -7 to 0, the job is processed as an online job.</p>
|
||||
</div></div>
|
||||
<p id="cce_10_0384__p84551082233">For an offline job:</p>
|
||||
|
||||
@ -511,7 +511,7 @@ spec:
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="56.99999999999999%" headers="mcps1.3.11.2.2.5.1.3 "><p id="cce_10_0385__p18882328885">If the pod uses <strong id="cce_10_0385__b192375332571">hostNetwork</strong>, the ELB forwards the request to the host network after this annotation is used.</p>
|
||||
<p id="cce_10_0385__p128822282088">Options:</p>
|
||||
<ul id="cce_10_0385__ul6882202812817"><li id="cce_10_0385__li1888220285811"><strong id="cce_10_0385__b676113564">true</strong>: enabled</li><li id="cce_10_0385__li1988219284818"><strong id="cce_10_0385__b131375249434210">false</strong> (default): disabled</li></ul>
|
||||
<ul id="cce_10_0385__ul6882202812817"><li id="cce_10_0385__li1888220285811"><strong id="cce_10_0385__b2081592279">true</strong>: enabled</li><li id="cce_10_0385__li1988219284818"><strong id="cce_10_0385__b131375249434210">false</strong> (default): disabled</li></ul>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="19%" headers="mcps1.3.11.2.2.5.1.4 "><p id="cce_10_0385__p1688232810812">v1.9 or later</p>
|
||||
</td>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -156,7 +156,7 @@
|
||||
</li></ol>
|
||||
</p></li><li id="cce_10_0425__li15561124416020"><span>Enable the numa-aware add-on and the <strong id="cce_10_0425__b9915151215516">resource_exporter</strong> function.</span><p><p id="cce_10_0425__p14912576012"><strong id="cce_10_0425__b1822402215554">Volcano 1.7.1 or later</strong></p>
|
||||
<ol type="a" id="cce_10_0425__ol29221109112"><li id="cce_10_0425__li1219753519197">Log in to the CCE console and click the cluster name to access the cluster console. Choose <strong id="cce_10_0425__b230434843215"><span id="cce_10_0425__text6199203591915">Add-ons</span></strong> in the navigation pane, locate <strong id="cce_10_0425__b203041648203220">Volcano Scheduler</strong> on the right, and click <strong id="cce_10_0425__b193049482329">Edit</strong>.</li><li id="cce_10_0425__li62262475194">In the <strong id="cce_10_0425__b610531743916">Extended Functions</strong> area, enable <strong id="cce_10_0425__b512018174511">NUMA Topology Scheduling</strong> and click <strong id="cce_10_0425__b4130132616457">OK</strong>.</li></ol>
|
||||
<div class="p" id="cce_10_0425__p187571154204"><strong id="cce_10_0425__b050622018563">Volcano earlier than 1.7.1</strong><ol type="a" id="cce_10_0425__ol0122828903"><li id="cce_10_0425__li2611115310117">Log in to the CCE console and click the cluster name to access the cluster console. In the navigation pane, choose <strong id="cce_10_0425__b1792244174710">Settings</strong> and click the <strong id="cce_10_0425__b16715162815487">Scheduling</strong> tab. Select <strong id="cce_10_0425__b250723964910">Volcano scheduler</strong>, find the expert mode, and click <strong id="cce_10_0425__b1265615347336">Try Now</strong>.<p id="cce_10_0425__p2949165711111"></p>
|
||||
<div class="p" id="cce_10_0425__p187571154204"><strong id="cce_10_0425__b050622018563">Volcano earlier than 1.7.1</strong><ol type="a" id="cce_10_0425__ol0122828903"><li id="cce_10_0425__li2611115310117">Log in to the CCE console and click the cluster name to access the cluster console. In the navigation pane, choose <strong id="cce_10_0425__b020111884411">Settings</strong> and click the <strong id="cce_10_0425__b52081813446">Scheduling</strong> tab. Select <strong id="cce_10_0425__b182012183444">Volcano scheduler</strong>, find the expert mode, and click <strong id="cce_10_0425__b1921181815449">Try Now</strong>.<p id="cce_10_0425__p2949165711111"></p>
|
||||
</li><li id="cce_10_0425__li14122192815012">Enable <strong id="cce_10_0425__b112316322512">resource_exporter_enable</strong> to collect node NUMA information. The following is an example in JSON format:<pre class="screen" id="cce_10_0425__screen7651947143817">{
|
||||
"plugins": {
|
||||
"eas_service": {
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
<ol id="cce_10_0497__ol159620307494"><li id="cce_10_0497__li192248593919"><span>Log in to the ELB console, choose <strong id="cce_10_0497__b19661312565">Elastic Load Balance</strong> > <strong id="cce_10_0497__b0597837135617">Certificates</strong>, locate the certificate, and find the <strong id="cce_10_0497__b148313125716">secret_id</strong> in the certificate description.</span><p><p id="cce_10_0497__p0642182672313">The <strong id="cce_10_0497__b4781163016591">secret_id</strong> is the <strong id="cce_10_0497__b6916153715598">metadata.uid</strong> of the secret in the cluster. Use this UID to obtain the secret name in the cluster.</p>
|
||||
<div class="p" id="cce_10_0497__p2196533194914">Run the following kubectl command to obtain the secret name (replace <em id="cce_10_0497__i1242116942"><secret_id></em> with the actual value):<pre class="screen" id="cce_10_0497__screen10477123615153">kubectl get secret --all-namespaces -o jsonpath='{range .items[*]}{"uid:"}{.metadata.uid}{" namespace:"}{.metadata.namespace}{" name:"}{.metadata.name}{"\n"}{end}' | grep <i><span class="varname" id="cce_10_0497__varname355565362315"><secret_id></span></i></pre>
|
||||
</div>
|
||||
</p></li><li id="cce_10_0497__li19149486344"><span>Only clusters of v1.19.16-r2, v1.21.5-r0, v1.23.3-r0, and later versions support certificates required by load balancers. For clusters of the earlier versions, see <a href="#cce_10_0497__li49931854113415">Solution 1</a>. For clusters of other versions, see <a href="#cce_10_0497__li1126485713418">Solution 2</a>.</span><p><ul id="cce_10_0497__ul799385417345"><li id="cce_10_0497__li49931854113415"><a name="cce_10_0497__li49931854113415"></a><a name="li49931854113415"></a>Solution 1: Replace the certificate used by an ingress with the one used by the load balancer. Then, you can create or edit the certificate on the ELB console.<ol type="a" id="cce_10_0497__ol7391527153413"><li id="cce_10_0497__li1039162719345">Log in to the CCE console and click the cluster name to access the cluster console. Choose <strong id="cce_10_0497__b14991131353620"><span id="cce_10_0497__text3381227163415">Services & Ingresses</span></strong> in the navigation pane, click the <strong id="cce_10_0497__b10991513113610">Ingresses</strong> tab, locate the row containing the ingress that uses the certificate, and choose <strong id="cce_10_0497__b10992171383617">More</strong> > <strong id="cce_10_0497__b999261313366">Update</strong> in the <strong id="cce_10_0497__b10992313143620">Operation</strong> column. If multiple ingresses are using this certificate, update the certificate for all of these ingresses. To check which ingresses are using a certificate, use the <strong id="cce_10_0497__b155535286219">secretName</strong> parameter in <strong id="cce_10_0497__b86425502111">spec.tls</strong> of the ingress YAML files.<p id="cce_10_0497__p538142717349">Run the following kubectl command to obtain the ingresses using a certificate (replace <i><span class="varname" id="cce_10_0497__varname103892793413"><secret_name></span></i> with the actual value):</p>
|
||||
</p></li><li id="cce_10_0497__li19149486344"><span>Only clusters of v1.19.16-r2, v1.21.5-r0, v1.23.3-r0, and later versions support certificates required by load balancers. For clusters of the earlier versions, see <a href="#cce_10_0497__li49931854113415">Solution 1</a>. For clusters of other versions, see <a href="#cce_10_0497__li1126485713418">Solution 2</a>.</span><p><ul id="cce_10_0497__ul799385417345"><li id="cce_10_0497__li49931854113415"><a name="cce_10_0497__li49931854113415"></a><a name="li49931854113415"></a>Solution 1: Replace the certificate used by an ingress with the one used by the load balancer. Then, you can create or edit the certificate on the ELB console.<ol type="a" id="cce_10_0497__ol7391527153413"><li id="cce_10_0497__li1039162719345">Log in to the CCE console and click the cluster name to access the cluster console. Choose <strong id="cce_10_0497__b14991131353620"><span id="cce_10_0497__text3381227163415">Services & Ingresses</span></strong> in the navigation pane, click the <strong id="cce_10_0497__b10991513113610">Ingresses</strong> tab, locate the row containing the ingress that uses the certificate, and choose <strong id="cce_10_0497__b10992171383617">More</strong> > <strong id="cce_10_0497__b999261313366">Update</strong> in the <strong id="cce_10_0497__b10992313143620">Operation</strong> column. If multiple ingresses are using this certificate, update the certificate for all of these ingresses. To check which ingresses are using a certificate, use the <strong id="cce_10_0497__b141546531621">secretName</strong> parameter in <strong id="cce_10_0497__b615455318210">spec.tls</strong> of the ingress YAML files.<p id="cce_10_0497__p538142717349">Run the following kubectl command to obtain the ingresses using a certificate (replace <i><span class="varname" id="cce_10_0497__varname103892793413"><secret_name></span></i> with the actual value):</p>
|
||||
<pre class="screen" id="cce_10_0497__screen63962710340">kubectl get ingress --all-namespaces -o jsonpath='{range .items[*]}{"namespace:"}{.metadata.namespace}{" name:"}{.metadata.name}{" tls:"}{.spec.tls[*]}{"\n"}{end}' | grep <i><span class="varname" id="cce_10_0497__varname738152713343"><secret_name></span></i></pre>
|
||||
</li><li id="cce_10_0497__li339727183416">When configuring a listener, select <strong id="cce_10_0497__b1200193932913">ELB server certificate</strong> for <strong id="cce_10_0497__b06897973010">Certificate Source</strong> and click <strong id="cce_10_0497__b1980735163219">OK</strong>. In this way, the certificate can be created or edited on the ELB console.</li><li id="cce_10_0497__li93911272344">On the <strong id="cce_10_0497__b75707411619"><span id="cce_10_0497__text1266312153316">ConfigMaps and Secrets</span></strong> page, delete the target secret. Before the deletion, back up data.</li></ol>
|
||||
</li><li id="cce_10_0497__li1126485713418"><a name="cce_10_0497__li1126485713418"></a><a name="li1126485713418"></a>Solution 2: Overwrite the certificate used by an ingress with the corresponding secret resource of the cluster to prevent the certificate being updated on the ELB console during the cluster upgrade.<p id="cce_10_0497__p113291850193410"><a name="cce_10_0497__li1126485713418"></a><a name="li1126485713418"></a>Log in to the CCE console and click the cluster name to access the cluster console. Choose <strong id="cce_10_0497__b2681232195718"><span id="cce_10_0497__text083514442311">ConfigMaps and Secrets</span></strong> from the navigation pane, click the <strong id="cce_10_0497__b16309104213584">Secrets</strong> tab, locate the row containing the target secret, click <strong id="cce_10_0497__b10591151915912">Update</strong> in the <strong id="cce_10_0497__b779113143918">Operation</strong> column, and enter the certificate you are using.</p>
|
||||
|
||||
@ -23,7 +23,7 @@ spec:
|
||||
<div class="section" id="cce_10_0552__section3877163611611"><h4 class="sectiontitle">Notes and Constraints</h4><p id="cce_10_0552__p19614184551619">To use this feature, the following conditions must be met:</p>
|
||||
<ul id="cce_10_0552__ul9614164581618"><li id="cce_10_0552__li11614345111611">The cluster version must be v1.23 or later.</li><li id="cce_10_0552__li16841028143712">The node OS is HCE OS 2.0.</li><li id="cce_10_0552__li76142045171614">The CPU management policy does not apply to ECS (PM) nodes in CCE Turbo clusters.</li></ul>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0552__section135842493165"><h4 class="sectiontitle">Procedure</h4><ol id="cce_10_0552__ol72741615245"><li id="cce_10_0552__li330462393220"><span>Log in to the CCE console.</span></li><li id="cce_10_0552__li2075471341"><span>Click the cluster name to access the cluster console. Choose <span class="uicontrol" id="cce_10_0552__uicontrol14682104464238"><b>Nodes</b></span> in the navigation pane. In the right pane, click the <strong id="cce_10_0552__b16123533194238">Node Pools</strong> tab.</span></li><li id="cce_10_0552__li952182622915"><span>Select a node pool whose OS is HCE OS 2.0 and choose <span class="uicontrol" id="cce_10_0552__uicontrol3520268294"><b>Manage</b></span> in the <strong id="cce_10_0552__b1439850102412">Operation</strong> column.</span></li><li id="cce_10_0552__li20922452316"><span>On the <span class="uicontrol" id="cce_10_0552__uicontrol129199122321"><b>Manage Configurations</b></span> page, change the <strong id="cce_10_0552__b169201212183217">cpu-manager-policy</strong> value to <strong id="cce_10_0552__b3654358125916">enhanced-static</strong> in the <strong id="cce_10_0552__b61436531356">kubelet</strong> area.</span></li><li id="cce_10_0552__li206411338151114"><span>Click <strong id="cce_10_0552__b7736191543213">OK</strong>.</span></li></ol>
|
||||
<div class="section" id="cce_10_0552__section135842493165"><h4 class="sectiontitle">Procedure</h4><ol id="cce_10_0552__ol72741615245"><li id="cce_10_0552__li330462393220"><span>Log in to the CCE console.</span></li><li id="cce_10_0552__li2075471341"><span>Click the cluster name to access the cluster console. Choose <span class="uicontrol" id="cce_10_0552__uicontrol14682104464238"><b>Nodes</b></span> in the navigation pane. In the right pane, click the <strong id="cce_10_0552__b16123533194238">Node Pools</strong> tab.</span></li><li id="cce_10_0552__li952182622915"><span>Select a node pool whose OS is HCE OS 2.0 and choose <span class="uicontrol" id="cce_10_0552__uicontrol35407515015"><b>Manage</b></span> in the <strong id="cce_10_0552__b155404513015">Operation</strong> column.</span></li><li id="cce_10_0552__li20922452316"><span>On the <span class="uicontrol" id="cce_10_0552__uicontrol129199122321"><b>Manage Configurations</b></span> page, change the <strong id="cce_10_0552__b169201212183217">cpu-manager-policy</strong> value to <strong id="cce_10_0552__b3654358125916">enhanced-static</strong> in the <strong id="cce_10_0552__b61436531356">kubelet</strong> area.</span></li><li id="cce_10_0552__li206411338151114"><span>Click <strong id="cce_10_0552__b7736191543213">OK</strong>.</span></li></ol>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0552__section1879811281710"><h4 class="sectiontitle">Verification</h4><p id="cce_10_0552__p111281837193818">Take a node with 8 vCPUs and 32 GiB of memory as an example. Deploy a workload whose CPU request is 1 and limit is 2 in the cluster beforehand.</p>
|
||||
<ol id="cce_10_0552__ol19151204143817"><li id="cce_10_0552__li183451339123912"><span>Log in to a node in the node pool and view the <strong id="cce_10_0552__b6895152210323">/var/lib/kubelet/cpu_manager_state</strong> output.</span><p><pre class="screen" id="cce_10_0552__screen734951853913">cat /var/lib/kubelet/cpu_manager_state</pre>
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
|
||||
<h1 class="topictitle1">Collecting Control Plane Component Logs</h1>
|
||||
<div id="body0000001709722974"><p id="cce_10_0554__p58681151939">CCE allows you to collect the logs of master nodes. On the <strong id="cce_10_0554__b102311591311"><span id="cce_10_0554__text1164315336613">Logging</span></strong> page, you can select one or more control plane components (kube-controller-manager, kube-apiserver, and kube-scheduler) whose logs need to be reported.</p>
|
||||
<div class="section" id="cce_10_0554__section15915571101"><h4 class="sectiontitle">Constraints</h4><ul id="cce_10_0554__ul1145273617100"><li id="cce_10_0554__li124521636151014">The cluster version must be v1.21.7-r0 or later, v1.23.5-r0 or later, or 1.25.</li><li id="cce_10_0554__li945218367100">There is required LTS resource quota.</li></ul>
|
||||
<div class="section" id="cce_10_0554__section15915571101"><h4 class="sectiontitle">Notes and Constraints</h4><ul id="cce_10_0554__ul1145273617100"><li id="cce_10_0554__li124521636151014">The cluster version must be v1.21.7-r0 or later, v1.23.5-r0 or later, or 1.25.</li><li id="cce_10_0554__li945218367100">There is required LTS resource quota.</li></ul>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0554__section133166619593"><a name="cce_10_0554__section133166619593"></a><a name="section133166619593"></a><h4 class="sectiontitle">Control Plane Components</h4><p id="cce_10_0554__p11944191815598">There are three control plane log types. Each log stream corresponds to a component of the Kubernetes control plane. To learn more about these components, see <a href="https://kubernetes.io/docs/concepts/overview/components/" target="_blank" rel="noopener noreferrer">Kubernetes Components</a>.</p>
|
||||
|
||||
@ -44,7 +44,7 @@
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0554__section1883701101111"><h4 class="sectiontitle">Enabling Control Plane Logging</h4><p id="cce_10_0554__p126238295311"><strong id="cce_10_0554__b1180172663417">Enabling control plane logging during cluster creation</strong></p>
|
||||
<ol id="cce_10_0554__ol7219545201112"><li id="cce_10_0554__li6836511185811">Log in to the CCE console.</li><li id="cce_10_0554__li1283621110581">In the upper right corner, click <strong id="cce_10_0554__b15789814153210">Create Cluster</strong>. Then, configure the parameters and click <strong id="cce_10_0554__b15285133215474">Next: Select Add-on</strong>.</li><li id="cce_10_0554__li1932603355813">On the displayed page, select <strong id="cce_10_0554__b690818158491">Cloud Native Log Collection</strong> and click <strong id="cce_10_0554__b5831345494">Next: Add-on Configuration</strong>.</li><li id="cce_10_0554__li1483631175820">On the displayed page, select <strong id="cce_10_0554__b331813114518">Control Plane Logs</strong> for <strong id="cce_10_0554__b15645137105118">Cloud Native Log Collection</strong>.<p id="cce_10_0554__p163268466177"></p>
|
||||
<ol id="cce_10_0554__ol7219545201112"><li id="cce_10_0554__li6836511185811">Log in to the CCE console.</li><li id="cce_10_0554__li1283621110581">Click <strong id="cce_10_0554__b153101221369">Create Cluster</strong>. Then, configure the parameters and click <strong id="cce_10_0554__b931082119614">Next: Select Add-on</strong>.</li><li id="cce_10_0554__li1932603355813">On the displayed page, select <strong id="cce_10_0554__b690818158491">Cloud Native Log Collection</strong> and click <strong id="cce_10_0554__b5831345494">Next: Add-on Configuration</strong>.</li><li id="cce_10_0554__li1483631175820">On the displayed page, select <strong id="cce_10_0554__b331813114518">Control Plane Logs</strong> for <strong id="cce_10_0554__b15645137105118">Cloud Native Log Collection</strong>.<p id="cce_10_0554__p163268466177"></p>
|
||||
</li><li id="cce_10_0554__li189746151115">Click <strong id="cce_10_0554__b358214685212">Next: Confirm configuration</strong>.</li></ol>
|
||||
<div class="p" id="cce_10_0554__p871324410308"><strong id="cce_10_0554__b97823310164">Enabling control plane logging for an existing cluster</strong><ol id="cce_10_0554__ol38732022182716"><li id="cce_10_0554__li13873172219274">Log in to the CCE console and click the cluster name to access the cluster console. In the navigation pane, choose <strong id="cce_10_0554__b628517393918">Logging</strong>.</li><li id="cce_10_0554__li17873022162717">Click the <strong id="cce_10_0554__b177716167186">Control Plane Logs</strong> tab and modify the settings in <strong id="cce_10_0554__b238610581918">Logging Settings</strong>.<div class="fignone" id="cce_10_0554__fig98810154215"><span class="figcap"><b>Figure 1 </b>Modifying logging settings</span><br><span><img id="cce_10_0554__image153861344516" src="en-us_image_0000002253779657.png"></span></div>
|
||||
</li><li id="cce_10_0554__li198731722132710">Determine whether to enable logging for each component. If yes, click <span><img id="cce_10_0554__image34861534151720" src="en-us_image_0000002218660022.png"></span>.</li></ol>
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
<div class="section" id="cce_10_0555__section1995018241214"><h4 class="sectiontitle">Constraints</h4><ul id="cce_10_0555__ul38996572032"><li id="cce_10_0555__li1437118282351">Up to 100 log rules can be created for each cluster.</li><li id="cce_10_0555__li3899057134">The Cloud Native Log Collection add-on cannot collect .gz, .tar, and .zip logs and cannot access symbolic links of logs.</li><li id="cce_10_0555__li48992575320">If the node <a href="cce_10_0341.html#cce_10_0341__section1473612279214">storage driver</a> is Device Mapper, container file logs must be collected from the path where the data disk is attached to the node.</li><li id="cce_10_0555__li789910571632">If the container runtime is containerd, each stdout log cannot be in multiple lines. (This does not apply to the Cloud Native Log Collection add-on of version 1.3.0 or later.)</li><li id="cce_10_0555__li1319974510478">If a volume is mounted to the directory of a service container, this add-on cannot collect data from the parent directory. In this case, you need to configure a complete data directory.</li><li id="cce_10_0555__li930217527219">If the lifetime of a container is less than 1 minute, logs cannot be collected in a timely manner. As a result, logs may be lost.</li></ul>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0555__section53625241484"><h4 class="sectiontitle">Enabling Logging on the Console</h4><ol id="cce_10_0555__ol7318196796"><li id="cce_10_0555__li03181161493"><span>Enable logging.</span><p><p id="cce_10_0555__p18411191814578"><strong id="cce_10_0555__b7437453122312">Enabling logging during cluster creation</strong></p>
|
||||
<ol type="a" id="cce_10_0555__ol183617113584"><li id="cce_10_0555__li6836511185811">Log in to the CCE console.</li><li id="cce_10_0555__li1283621110581">Click <strong id="cce_10_0555__b1081016564140">Create</strong><strong id="cce_10_0555__b1236194719215"> Cluster</strong> from the top menu.</li><li id="cce_10_0555__li1076913581016">Configure the parameters by referring to <a href="cce_10_0028.html">Creating a CCE Standard/Turbo Cluster</a>. Then, click <span class="uicontrol" id="cce_10_0555__uicontrol133868598013"><b>Next: Select Add-on</b></span> in the lower right corner.</li><li id="cce_10_0555__li163681377132">On the <strong id="cce_10_0555__b553513241554">Select Add-on</strong> page, select <strong id="cce_10_0555__b25361624053">Cloud Native Log Collection</strong>.</li><li id="cce_10_0555__en-us_topic_0000001757561941_li1483631175820">Click <strong id="cce_10_0555__b1787703317193">Next: Add-on Configuration</strong> in the lower right corner and select the required logs.<ul id="cce_10_0555__ul15382152171319"><li id="cce_10_0555__li11382142171315">Container logs: A log collection policy named <strong id="cce_10_0555__b665404815196">default-stdout</strong> will be created, and stdout logs in all namespaces will be reported to LTS.</li><li id="cce_10_0555__li03821021171318">Kubernetes events: A log collection policy named <strong id="cce_10_0555__b163281917172013">default-event</strong> will be created, and Kubernetes events in all namespaces will be reported to LTS.</li></ul>
|
||||
<ol type="a" id="cce_10_0555__ol183617113584"><li id="cce_10_0555__li6836511185811">Log in to the CCE console.</li><li id="cce_10_0555__li1283621110581">Click <strong id="cce_10_0555__b2464341634">Create</strong><strong id="cce_10_0555__b16466348311"> Cluster</strong> from the top menu.</li><li id="cce_10_0555__li1076913581016">Configure the parameters by referring to <a href="cce_10_0028.html">Creating a CCE Standard/Turbo Cluster</a>. Then, click <span class="uicontrol" id="cce_10_0555__uicontrol133868598013"><b>Next: Select Add-on</b></span> in the lower right corner.</li><li id="cce_10_0555__li163681377132">On the <strong id="cce_10_0555__b553513241554">Select Add-on</strong> page, select <strong id="cce_10_0555__b25361624053">Cloud Native Log Collection</strong>.</li><li id="cce_10_0555__en-us_topic_0000001757561941_li1483631175820">Click <strong id="cce_10_0555__b1787703317193">Next: Add-on Configuration</strong> in the lower right corner and select the required logs.<ul id="cce_10_0555__ul15382152171319"><li id="cce_10_0555__li11382142171315">Container logs: A log collection policy named <strong id="cce_10_0555__b665404815196">default-stdout</strong> will be created, and stdout logs in all namespaces will be reported to LTS.</li><li id="cce_10_0555__li03821021171318">Kubernetes events: A log collection policy named <strong id="cce_10_0555__b163281917172013">default-event</strong> will be created, and Kubernetes events in all namespaces will be reported to LTS.</li></ul>
|
||||
</li><li id="cce_10_0555__en-us_topic_0000001757561941_li19681527171613">Click <strong id="cce_10_0555__b205211845354">Next: Confirm configuration</strong> in the lower right corner. On the displayed page, click <strong id="cce_10_0555__b55217452057">Submit</strong>.</li></ol>
|
||||
</p></li><li id="cce_10_0555__li193114172910"><span>View and configure log collection policies.</span><p><ol type="a" id="cce_10_0555__ol1431973318574"><li id="cce_10_0555__li1931973335715">On the CCE console, click the cluster name to access the cluster console. In the navigation pane, choose <strong id="cce_10_0555__b15558833102218"><span id="cce_10_0555__text67912038372">Logging</span></strong>.</li><li id="cce_10_0555__li10603839205711"><p id="cce_10_0555__p2604131442418"><a name="cce_10_0555__li10603839205711"></a><a name="li10603839205711"></a>Click <strong id="cce_10_0555__b17604111432413">View Log Collection Policies</strong> in the upper right corner.</p>
|
||||
<p id="cce_10_0555__li10603839205711p0">All log collection policies reported to LTS are displayed.</p>
|
||||
@ -23,9 +23,9 @@
|
||||
</thead>
|
||||
<tbody><tr id="cce_10_0555__row669314101768"><td class="cellrowborder" valign="top" width="8%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.1 "><p id="cce_10_0555__p169316101963">Log Type</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><p id="cce_10_0555__p5693610564"><strong id="cce_10_0555__b497338715">Container standard output</strong>: used to collect container stdout logs. You can create a log collection policy by namespace, workload name, or instance label.</p>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><p id="cce_10_0555__p5693610564"><strong id="cce_10_0555__b541124698">Container standard output</strong>: used to collect container stdout logs. You can create a log collection policy by namespace, workload name, or instance label.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><p id="cce_10_0555__p6693010767"><strong id="cce_10_0555__b270938178">Container file log</strong>: used to collect text logs. You can specify a workload or instance label to create a log collection policy.</p>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><p id="cce_10_0555__p6693010767"><strong id="cce_10_0555__b1231486688">Container file log</strong>: used to collect text logs. You can specify a workload or instance label to create a log collection policy.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><p id="cce_10_0555__p369317101617"><strong id="cce_10_0555__b186410191176">Node file log</strong>: used to collect logs from a node. Only one file path can be configured for a log collection policy.</p>
|
||||
</td>
|
||||
@ -34,9 +34,9 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0555__row1869371011614"><td class="cellrowborder" valign="top" width="8%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.1 "><p id="cce_10_0555__p96934102619">Log Source</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><ul id="cce_10_0555__ul1469317101666"><li id="cce_10_0555__li1769314101061"><strong id="cce_10_0555__b660057536">All containers</strong>: You can specify all containers in a namespace. If this parameter is not specified, logs of containers in all namespaces will be collected.</li><li id="cce_10_0555__li1693151015616"><strong id="cce_10_0555__b331220939">Workload</strong>: You can specify a workload and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li><li id="cce_10_0555__li06938104617"><strong id="cce_10_0555__b391466222">Workload with target label</strong>: You can specify a workload by label and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><ul id="cce_10_0555__ul1469317101666"><li id="cce_10_0555__li1769314101061"><strong id="cce_10_0555__b408037650">All containers</strong>: You can specify all containers in a namespace. If this parameter is not specified, logs of containers in all namespaces will be collected.</li><li id="cce_10_0555__li1693151015616"><strong id="cce_10_0555__b1204507806">Workload</strong>: You can specify a workload and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li><li id="cce_10_0555__li06938104617"><strong id="cce_10_0555__b602343138">Workload with target label</strong>: You can specify a workload by label and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li></ul>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><ul id="cce_10_0555__ul269381019616"><li id="cce_10_0555__li16933101664"><strong id="cce_10_0555__b412319155">Workload</strong>: You can specify a workload and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li><li id="cce_10_0555__li1669311101161"><strong id="cce_10_0555__b900337732">Workload with target label</strong>: You can specify a workload by label and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><ul id="cce_10_0555__ul269381019616"><li id="cce_10_0555__li16933101664"><strong id="cce_10_0555__b1639761660">Workload</strong>: You can specify a workload and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li><li id="cce_10_0555__li1669311101161"><strong id="cce_10_0555__b1276722362">Workload with target label</strong>: You can specify a workload by label and its containers. If this parameter is not specified, logs of all containers running the workload will be collected.</li></ul>
|
||||
<p id="cce_10_0555__p16693171011611">You also need to specify the log collection path. For details, see the <a href="#cce_10_0555__li87655474588">log path configuration requirements</a>.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="23%" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><p id="cce_10_0555__p116933101664"><strong id="cce_10_0555__b16893544192019">Collection Path</strong>: used to configure the log collection path. For details, see the <a href="#cce_10_0555__li87655474588">log path configuration requirements</a>.</p>
|
||||
@ -46,9 +46,9 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0555__row769351010619"><td class="cellrowborder" valign="top" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.1 "><p id="cce_10_0555__p269491010614">Log Format</p>
|
||||
</td>
|
||||
<td class="cellrowborder" colspan="4" valign="top" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><ul id="cce_10_0555__ul869412103615"><li id="cce_10_0555__li86941101269"><strong id="cce_10_0555__b1040982962">Single-line</strong><p id="cce_10_0555__p869431018612">Each log contains only one line of text. The newline character \n denotes the start of a new log.</p>
|
||||
</li><li id="cce_10_0555__li369420105617"><strong id="cce_10_0555__b694122194">Multi-line</strong><p id="cce_10_0555__p1969418108616">Some programs (for example, Java program) print a log that occupies multiple lines. By default, logs are collected by line. If you want to display logs as a single message, you can enable multi-line logging and use the regular pattern. When you select <strong id="cce_10_0555__b56129678">Multi-line</strong>, configure <strong id="cce_10_0555__b1958818069">Log Matching Format</strong>.</p>
|
||||
<p id="cce_10_0555__p8694510161">For example, if logs need to be collected by line and each log starts with a date and occupies three lines, you can set <strong id="cce_10_0555__b1761583613">Log Matching Format</strong> to the regular expression of the date, for example, <strong id="cce_10_0555__b293895163">\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}.*</strong>.</p>
|
||||
<td class="cellrowborder" colspan="4" valign="top" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><ul id="cce_10_0555__ul869412103615"><li id="cce_10_0555__li86941101269"><strong id="cce_10_0555__b865109605">Single-line</strong><p id="cce_10_0555__p869431018612">Each log contains only one line of text. The newline character \n denotes the start of a new log.</p>
|
||||
</li><li id="cce_10_0555__li369420105617"><strong id="cce_10_0555__b437524006">Multi-line</strong><p id="cce_10_0555__p1969418108616">Some programs (for example, Java program) print a log that occupies multiple lines. By default, logs are collected by line. If you want to display logs as a single message, you can enable multi-line logging and use the regular pattern. When you select <strong id="cce_10_0555__b1301281406">Multi-line</strong>, configure <strong id="cce_10_0555__b2071850135">Log Matching Format</strong>.</p>
|
||||
<p id="cce_10_0555__p8694510161">For example, if logs need to be collected by line and each log starts with a date and occupies three lines, you can set <strong id="cce_10_0555__b2039547748">Log Matching Format</strong> to the regular expression of the date, for example, <strong id="cce_10_0555__b509891045">\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}.*</strong>.</p>
|
||||
<div class="p" id="cce_10_0555__p369418101463">The three lines starting with the date are regarded as a log.<pre class="screen" id="cce_10_0555__screen16694191014611">2022-01-01 00:00:00 Exception in thread "main" java.lang.RuntimeException: Something has gone wrong, aborting!
|
||||
at com.myproject.module.MyProject.badMethod(MyProject.java:22)
|
||||
at com.myproject.module.MyProject.oneMoreMethod(MyProject.java:18)</pre>
|
||||
@ -60,8 +60,8 @@ at com.myproject.module.MyProject.oneMoreMethod(MyProject.java:18)</pre>
|
||||
<tr id="cce_10_0555__row1369491011610"><td class="cellrowborder" valign="top" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.1 "><p id="cce_10_0555__p56941410768">LTS Collection</p>
|
||||
</td>
|
||||
<td class="cellrowborder" colspan="4" valign="top" headers="mcps1.3.3.2.2.2.1.3.3.2.6.1.2 "><p id="cce_10_0555__p1469414108617">This parameter is used to configure the log group and log stream for log reporting.</p>
|
||||
<ul id="cce_10_0555__ul8694310061"><li id="cce_10_0555__li269410109613"><strong id="cce_10_0555__b1547792719220">Centralized</strong>: The default log group (<strong id="cce_10_0555__b1947711274227">k8s-log-</strong><em id="cce_10_0555__i16477727132215">{Cluster ID}</em>) and default log stream (<strong id="cce_10_0555__b4477172792213">stdout-</strong><em id="cce_10_0555__i6477227132215">{Cluster ID}</em>) are automatically selected.</li><li id="cce_10_0555__li1969431013614"><strong id="cce_10_0555__b6140638191813">Custom</strong>: Select a log group and log stream from the drop-down list.<ul id="cce_10_0555__ul26946100611"><li id="cce_10_0555__li169411107614"><strong id="cce_10_0555__b19866758122313">Log Group</strong>: A log group is the basic unit for LTS to manage logs. If you do not have a log group, CCE prompts you to create one. The default name is <strong id="cce_10_0555__b304410870">k8s-log-</strong><em id="cce_10_0555__i1165756574">{Cluster ID}</em>, for example, <strong id="cce_10_0555__b529813433">k8s-log-bb7eaa87-07dd-11ed-ab6c-0255ac1001b3</strong>.</li><li id="cce_10_0555__li1269415102611"><strong id="cce_10_0555__b98848727">Log Stream</strong>: A log stream is the basic unit for reading and writing logs. You can put different types of logs into different streams to ease management. When you install the add-on or create a log collection policy based on the policy template, the following log streams are automatically created:<p id="cce_10_0555__p2694131010611">- <strong id="cce_10_0555__b1245864880">stdout-</strong><em id="cce_10_0555__i93004590">{Cluster ID}</em> for container logs, for example, <strong id="cce_10_0555__b241726757">stdout-bb7eaa87-07dd-11ed-ab6c-0255ac1001b3</strong></p>
|
||||
<p id="cce_10_0555__p116946104619">- <strong id="cce_10_0555__b1944728033">event-</strong><em id="cce_10_0555__i142844410">{Cluster ID}</em> for Kubernetes events, for example, <strong id="cce_10_0555__b135594273">event-bb7eaa87-07dd-11ed-ab6c-0255ac1001b3</strong></p>
|
||||
<ul id="cce_10_0555__ul8694310061"><li id="cce_10_0555__li269410109613"><strong id="cce_10_0555__b1547792719220">Centralized</strong>: The default log group (<strong id="cce_10_0555__b1947711274227">k8s-log-</strong><em id="cce_10_0555__i16477727132215">{Cluster ID}</em>) and default log stream (<strong id="cce_10_0555__b4477172792213">stdout-</strong><em id="cce_10_0555__i6477227132215">{Cluster ID}</em>) are automatically selected.</li><li id="cce_10_0555__li1969431013614"><strong id="cce_10_0555__b6140638191813">Custom</strong>: Select a log group and log stream from the drop-down list.<ul id="cce_10_0555__ul26946100611"><li id="cce_10_0555__li169411107614"><strong id="cce_10_0555__b19866758122313">Log Group</strong>: A log group is the basic unit for LTS to manage logs. If you do not have a log group, CCE prompts you to create one. The default name is <strong id="cce_10_0555__b1393040243">k8s-log-</strong><em id="cce_10_0555__i1282116826">{Cluster ID}</em>, for example, <strong id="cce_10_0555__b1613475008">k8s-log-bb7eaa87-07dd-11ed-ab6c-0255ac1001b3</strong>.</li><li id="cce_10_0555__li1269415102611"><strong id="cce_10_0555__b1549304971">Log Stream</strong>: A log stream is the basic unit for reading and writing logs. You can put different types of logs into different streams to ease management. When you install the add-on or create a log collection policy based on the policy template, the following log streams are automatically created:<p id="cce_10_0555__p2694131010611">- <strong id="cce_10_0555__b267622045">stdout-</strong><em id="cce_10_0555__i159149061">{Cluster ID}</em> for container logs, for example, <strong id="cce_10_0555__b936652102">stdout-bb7eaa87-07dd-11ed-ab6c-0255ac1001b3</strong></p>
|
||||
<p id="cce_10_0555__p116946104619">- <strong id="cce_10_0555__b2030552358">event-</strong><em id="cce_10_0555__i14220303">{Cluster ID}</em> for Kubernetes events, for example, <strong id="cce_10_0555__b1205181461">event-bb7eaa87-07dd-11ed-ab6c-0255ac1001b3</strong></p>
|
||||
</li></ul>
|
||||
</li></ul>
|
||||
<p id="cce_10_0555__p12465650672"></p>
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
<h1 class="topictitle1">Overview</h1>
|
||||
<div id="body0000001709722970"><p id="cce_10_0557__p15811134085211">Kubernetes logs allow you to locate and rectify faults. This section describes how to manage Kubernetes logs using different methods.</p>
|
||||
<p id="cce_10_0557__p1581110407521">The following are Kubernetes log management methods:</p>
|
||||
<ul id="cce_10_0557__ul1581124010529"><li id="cce_10_0557__li1581184015527">Use the Cloud Native Log Collection add-on to collect application logs and report them to LTS, which provides log statistics and analysis. For details, see <a href="cce_10_0555.html">Collecting Container Logs Using the Cloud Native Log Collection Add-on</a>.</li><li id="cce_10_0557__li72390542383">Connect CCE to AOM. For details, see <a href="cce_10_0018.html">Collecting Container Logs Using ICAgent</a>.</li><li id="cce_10_0557__li1811240125214">Collect control plane component logs and Kubernetes audit logs from the CCE control plane and add them to the LTS log streams in your account. For details, see <a href="cce_10_0554.html">Collecting Control Plane Component Logs</a> and <a href="cce_10_0792.html">Collecting Audit Logs</a>.</li><li id="cce_10_0557__li08111840105213">Collect Kubernetes events and add them to the LTS log stream in your account for persistent storage and statistical analysis. For details, see <a href="cce_10_0793.html">Collecting Kubernetes Events</a>.</li></ul>
|
||||
<ul id="cce_10_0557__ul1581124010529"><li id="cce_10_0557__li1581184015527">Use the Cloud Native Log Collection add-on to collect application logs and report them to LTS, which provides log statistics and analysis. For details, see <a href="cce_10_0555.html">Collecting Container Logs Using the Cloud Native Log Collection Add-on</a>.</li><li id="cce_10_0557__li72390542383">Connect CCE to AOM 1.0. For details, see <a href="cce_10_0018.html">Collecting Container Logs Using ICAgent</a>.</li><li id="cce_10_0557__li1811240125214">Collect control plane component logs and Kubernetes audit logs from the CCE control plane and add them to the LTS log streams in your account. For details, see <a href="cce_10_0554.html">Collecting Control Plane Component Logs</a> and <a href="cce_10_0792.html">Collecting Audit Logs</a>.</li><li id="cce_10_0557__li08111840105213">Collect Kubernetes events and add them to the LTS log stream in your account for persistent storage and statistical analysis. For details, see <a href="cce_10_0793.html">Collecting Kubernetes Events</a>.</li></ul>
|
||||
</div>
|
||||
<div>
|
||||
<div class="familylinks">
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -291,7 +291,7 @@ spec:
|
||||
</li></ol>
|
||||
</p></li></ol>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0625__section15626135823118"><h4 class="sectiontitle">Using Subdirectories of an Existing SFS Turbo File System Through kubectl</h4><ol id="cce_10_0625__ol15626135823114"><li id="cce_10_0625__li1862614589311"><span>Use kubectl to access the cluster.</span></li><li id="cce_10_0625__li126261358203111"><span>Create a PV.</span><p><ol type="a" id="cce_10_0625__ol206261758183113"><li id="cce_10_0625__li186261858193110"><a name="cce_10_0625__li186261858193110"></a><a name="li186261858193110"></a>Create the <strong id="cce_10_0625__b303136625">pv-sfsturbo.yaml</strong> file.<div class="p" id="cce_10_0625__p962618581313">Example:<pre class="screen" id="cce_10_0625__screen1626205811316">apiVersion: v1
|
||||
<div class="section" id="cce_10_0625__section15626135823118"><h4 class="sectiontitle">Using Subdirectories of an Existing SFS Turbo File System Through kubectl</h4><ol id="cce_10_0625__ol15626135823114"><li id="cce_10_0625__li1862614589311"><span>Use kubectl to access the cluster.</span></li><li id="cce_10_0625__li126261358203111"><span>Create a PV.</span><p><ol type="a" id="cce_10_0625__ol206261758183113"><li id="cce_10_0625__li186261858193110"><a name="cce_10_0625__li186261858193110"></a><a name="li186261858193110"></a>Create the <strong id="cce_10_0625__b129295921">pv-sfsturbo.yaml</strong> file.<div class="p" id="cce_10_0625__p962618581313">Example:<pre class="screen" id="cce_10_0625__screen1626205811316">apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
annotations:
|
||||
@ -300,9 +300,9 @@ metadata:
|
||||
name: <i><span class="varname" id="cce_10_0625__varname1562765816317">pv-sfsturbo</span></i> # PV name
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany # Access mode. The value must be <strong id="cce_10_0625__b993775346">ReadWriteMany</strong> for SFS Turbo.
|
||||
- ReadWriteMany # Access mode. The value must be <strong id="cce_10_0625__b1682474562">ReadWriteMany</strong> for SFS Turbo.
|
||||
capacity:
|
||||
<strong id="cce_10_0625__b1273685874">storage: <i><span class="varname" id="cce_10_0625__varname209826907">500Gi</span></i></strong> # SFS Turbo volume capacity
|
||||
<strong id="cce_10_0625__b1247915342">storage: <i><span class="varname" id="cce_10_0625__varname387709424">500Gi</span></i></strong> # SFS Turbo volume capacity
|
||||
csi:
|
||||
driver: sfsturbo.csi.everest.io # Dependent storage driver for the mounting
|
||||
fsType: nfs
|
||||
@ -362,7 +362,7 @@ spec:
|
||||
<td class="cellrowborder" valign="top" width="16%" headers="mcps1.3.6.2.2.2.1.1.3.2.4.1.2 "><p id="cce_10_0625__p46284583314">Yes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="60%" headers="mcps1.3.6.2.2.2.1.1.3.2.4.1.3 "><p id="cce_10_0625__p14628958183117">A reclaim policy is supported when the cluster version is or later than 1.19.10 and the Everest version is or later than 1.2.9. For details, see <a href="cce_10_0378.html#cce_10_0378__section19999142414413">PV Reclaim Policy</a>.</p>
|
||||
<p id="cce_10_0625__p1362855833119"><strong id="cce_10_0625__b155867568">Retain</strong>: When a PVC is deleted, both the PV and underlying storage resources will be retained. You need to manually delete these resources. After the PVC is deleted, the PV is in the <strong id="cce_10_0625__b1520900336">Released</strong> state and cannot be bound to a PVC again.</p>
|
||||
<p id="cce_10_0625__p1362855833119"><strong id="cce_10_0625__b1783712519">Retain</strong>: When a PVC is deleted, both the PV and underlying storage resources will be retained. You need to manually delete these resources. After the PVC is deleted, the PV is in the <strong id="cce_10_0625__b2082038724">Released</strong> state and cannot be bound to a PVC again.</p>
|
||||
<p id="cce_10_0625__p116281058153117"><strong id="cce_10_0625__b735716192914">Delete</strong>: This parameter can be configured when subdirectories are automatically created, indicating that the PV is deleted when a PVC is deleted.</p>
|
||||
</td>
|
||||
</tr>
|
||||
@ -403,7 +403,7 @@ spec:
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="16%" headers="mcps1.3.6.2.2.2.1.1.3.2.4.1.2 "><p id="cce_10_0625__p5629258123114">Yes</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="60%" headers="mcps1.3.6.2.2.2.1.1.3.2.4.1.3 "><p id="cce_10_0625__p7629358133118">The StorageClass name of SFS Turbo volumes is <strong id="cce_10_0625__b1942469617">csi-sfsturbo</strong>.</p>
|
||||
<td class="cellrowborder" valign="top" width="60%" headers="mcps1.3.6.2.2.2.1.1.3.2.4.1.3 "><p id="cce_10_0625__p7629358133118">The StorageClass name of SFS Turbo volumes is <strong id="cce_10_0625__b180549281">csi-sfsturbo</strong>.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
@ -411,7 +411,7 @@ spec:
|
||||
</div>
|
||||
</li><li id="cce_10_0625__li106291658193117">Run the following command to create a PV:<pre class="screen" id="cce_10_0625__screen762935823111">kubectl apply -f pv-sfsturbo.yaml</pre>
|
||||
</li></ol>
|
||||
</p></li><li id="cce_10_0625__li663111586311"><span>Create a PVC.</span><p><ol type="a" id="cce_10_0625__ol15631558113115"><li id="cce_10_0625__li9631195819314">Create the <strong id="cce_10_0625__b1341472831">pvc-sfsturbo.yaml</strong> file.<pre class="screen" id="cce_10_0625__screen1363112586311">apiVersion: v1
|
||||
</p></li><li id="cce_10_0625__li663111586311"><span>Create a PVC.</span><p><ol type="a" id="cce_10_0625__ol15631558113115"><li id="cce_10_0625__li9631195819314">Create the <strong id="cce_10_0625__b999605548">pvc-sfsturbo.yaml</strong> file.<pre class="screen" id="cce_10_0625__screen1363112586311">apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: <i><span class="varname" id="cce_10_0625__varname1763135811316">pvc-sfsturbo</span></i>
|
||||
@ -421,12 +421,12 @@ metadata:
|
||||
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany # The value must be <strong id="cce_10_0625__b1766470846">ReadWriteMany</strong> for SFS Turbo.
|
||||
- ReadWriteMany # The value must be <strong id="cce_10_0625__b1664919121">ReadWriteMany</strong> for SFS Turbo.
|
||||
resources:
|
||||
requests:
|
||||
<strong id="cce_10_0625__b2035063829">storage: <i><span class="varname" id="cce_10_0625__varname859115299">500Gi</span></i></strong> # SFS Turbo volume capacity.
|
||||
<strong id="cce_10_0625__b1981417918">storageClassName: <i><span class="varname" id="cce_10_0625__varname123053233">csi-sfsturbo</span></i></strong> # StorageClass name of the SFS Turbo file system, which must be the same as that of the PV
|
||||
<strong id="cce_10_0625__b1566200411">volumeName: <i><span class="varname" id="cce_10_0625__varname360562489">pv-sfsturbo</span></i></strong> # PV name</pre>
|
||||
<strong id="cce_10_0625__b929959415">storage: <i><span class="varname" id="cce_10_0625__varname1296505875">500Gi</span></i></strong> # SFS Turbo volume capacity.
|
||||
<strong id="cce_10_0625__b340056459">storageClassName: <i><span class="varname" id="cce_10_0625__varname1299064119">csi-sfsturbo</span></i></strong> # StorageClass name of the SFS Turbo file system, which must be the same as that of the PV
|
||||
<strong id="cce_10_0625__b2012415138">volumeName: <i><span class="varname" id="cce_10_0625__varname875791533">pv-sfsturbo</span></i></strong> # PV name</pre>
|
||||
|
||||
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="cce_10_0625__table3631958193117" frame="border" border="1" rules="all"><caption><b>Table 5 </b>Key parameters</caption><thead align="left"><tr id="cce_10_0625__row146321858143116"><th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.6.2.3.2.1.1.3.2.4.1.1"><p id="cce_10_0625__p6632175818310">Parameter</p>
|
||||
</th>
|
||||
|
||||
@ -565,12 +565,12 @@
|
||||
</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody><tr id="cce_10_0652__row1170915321921"><td class="cellrowborder" valign="top" width="13.050000000000002%" headers="mcps1.3.6.2.1.6.1.1 "><p id="cce_10_0652__p670911321926">Maximum size of a container <strong id="cce_10_0652__b706433838">core</strong> file</p>
|
||||
<tbody><tr id="cce_10_0652__row1170915321921"><td class="cellrowborder" valign="top" width="13.050000000000002%" headers="mcps1.3.6.2.1.6.1.1 "><p id="cce_10_0652__p670911321926">Maximum size of a container <strong id="cce_10_0652__b106043570">core</strong> file</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="12.970000000000004%" headers="mcps1.3.6.2.1.6.1.2 "><p id="cce_10_0652__p157098328217">limitcore</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="27.740000000000002%" headers="mcps1.3.6.2.1.6.1.3 "><p id="cce_10_0652__p17097324213">Maximum size of a core file in a container. The unit is byte.</p>
|
||||
<p id="cce_10_0652__p1970910327218">If not specified, the value is <strong id="cce_10_0652__b889180877">infinity</strong>.</p>
|
||||
<p id="cce_10_0652__p1970910327218">If not specified, the value is <strong id="cce_10_0652__b1439271286">infinity</strong>.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="18.500000000000004%" headers="mcps1.3.6.2.1.6.1.4 "><p id="cce_10_0652__p270913321223">Default: 5368709120</p>
|
||||
</td>
|
||||
@ -586,7 +586,7 @@
|
||||
<td class="cellrowborder" valign="top" width="18.500000000000004%" headers="mcps1.3.6.2.1.6.1.4 "><p id="cce_10_0652__p16709103210210">Default: 1048576</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="27.740000000000002%" headers="mcps1.3.6.2.1.6.1.5 "><p id="cce_10_0652__p0709143213210">The value cannot exceed the value of the kernel parameter <strong id="cce_10_0652__b7301143015102">nr_open</strong> and cannot be a negative number.</p>
|
||||
<p id="cce_10_0652__p77092327210">You can run the following command to obtain the kernel parameter <strong id="cce_10_0652__b1583099143">nr_open</strong>:</p>
|
||||
<p id="cce_10_0652__p77092327210">You can run the following command to obtain the kernel parameter <strong id="cce_10_0652__b848437943">nr_open</strong>:</p>
|
||||
<pre class="screen" id="cce_10_0652__screen870919321321">sysctl -a | grep nr_open</pre>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
@ -97,7 +97,7 @@
|
||||
</tr>
|
||||
<tr id="cce_10_0653__en-us_topic_0000001199021246_row1966913718588"><td class="cellrowborder" valign="top" width="20.02%" headers="mcps1.3.2.2.3.2.3.2.2.3.1.1 "><p id="cce_10_0653__en-us_topic_0000001199021246_p0669147185817">Data Disk</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.2.2.3.2.3.2.2.3.1.2 "><ul id="cce_10_0653__ul138301057194017"><li id="cce_10_0653__cce_10_0363_li103472126407"><strong id="cce_10_0653__cce_10_0363_b493614401788">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0653__cce_10_0363_uicontrol16936640683"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0653__cce_10_0363_uicontrol29366400810"><b>Data Disk</b></span>. <strong id="cce_10_0653__cce_10_0363_b79361840284">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.<ul id="cce_10_0653__cce_10_0363_ul324262033711"><li id="cce_10_0653__cce_10_0363_li1124252010378">Default data disk: used for container runtime and kubelet components. The disk size ranges from 20 GiB to 32768 GiB. The default value is 100 GiB.</li><li id="cce_10_0653__cce_10_0363_li6177165413374">Other common data disks: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB.</li></ul>
|
||||
<td class="cellrowborder" valign="top" width="79.97999999999999%" headers="mcps1.3.2.2.3.2.3.2.2.3.1.2 "><ul id="cce_10_0653__ul138301057194017"><li id="cce_10_0653__cce_10_0363_li103472126407"><strong id="cce_10_0653__cce_10_0363_b87711342223">At least one default data disk must be added</strong> for storing container runtime and kubelet components if <span class="uicontrol" id="cce_10_0653__cce_10_0363_uicontrol1378123452217"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0653__cce_10_0363_uicontrol107853413227"><b>Data Disk</b></span>. <strong id="cce_10_0653__cce_10_0363_b187815343221">This data disk cannot be deleted or detached. Otherwise, the node will be unavailable.</strong> This function is available for clusters of a version earlier than v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, or v1.29.4-r0.<ul id="cce_10_0653__cce_10_0363_ul324262033711"><li id="cce_10_0653__cce_10_0363_li1124252010378">Default data disk: used for container runtime and kubelet components. The disk size ranges from 20 GiB to 32768 GiB. The default value is 100 GiB.</li><li id="cce_10_0653__cce_10_0363_li6177165413374">Other common data disks: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB.</li></ul>
|
||||
</li><li id="cce_10_0653__cce_10_0363_li18830161664015">If <span class="uicontrol" id="cce_10_0653__cce_10_0363_uicontrol2621173512497"><b>System Component Storage</b></span> is set to <span class="uicontrol" id="cce_10_0653__cce_10_0363_uicontrol19561032184918"><b>System Disk</b></span>, you do not need to add a default data disk. In this case, all data disks are common ones: You can set the data disk size to a value ranging from 10 GiB to 32768 GiB. The default value is 100 GiB. This function is available for clusters of v1.23.18-r0, v1.25.13-r0, v1.27.10-r0, v1.28.8-r0, v1.29.4-r0, or later versions.</li></ul>
|
||||
<div class="note" id="cce_10_0653__note21798915509"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="cce_10_0653__p13544143175218">After the data disk configuration is modified, the modification takes effect only on newly added nodes. The configuration cannot be synchronized to existing nodes even if they are reset.</p>
|
||||
</div></div>
|
||||
@ -105,7 +105,7 @@
|
||||
<div class="dropdownexpand"><div class="dropdowntitle" onclick="ExpandorCollapseNode(this)"><p id="cce_10_0653__en-us_topic_0000001199021246_p3752312011">Expand the area and configure the following parameters:</p></div>
|
||||
<div class="dropdowncontext"><ul id="cce_10_0653__en-us_topic_0000001199021246_ul197721145155911"><li id="cce_10_0653__en-us_topic_0000001199021246_li12110343014"><strong id="cce_10_0653__b11121533832215">Data Disk Space Allocation</strong>: allocates space for container engines, images, and ephemeral storage for them to run properly. For details about how to allocate data disk space, see <a href="cce_10_0341.html">Space Allocation of a Data Disk</a>.<div class="note" id="cce_10_0653__note165242505419"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="cce_10_0653__p196522251548">After the data disk space allocation configuration is modified, the modification takes effect only for new nodes. The configuration cannot take effect for the existing nodes even if they are reset.</p>
|
||||
</div></div>
|
||||
</li><li id="cce_10_0653__en-us_topic_0000001199021246_li1095641711169"><strong id="cce_10_0653__b71171410204510">Enabled</strong>: Data disk encryption safeguards your data. Snapshots generated from encrypted disks and disks created using these snapshots automatically inherit the encryption setting. <ul id="cce_10_0653__en-us_topic_0000001199021246_ul1924511512168"><li id="cce_10_0653__en-us_topic_0000001199021246_li4245181561611"><strong id="cce_10_0653__b1122736904">Not encrypted</strong> is selected by default.</li><li id="cce_10_0653__en-us_topic_0000001199021246_li17245415121616">After setting <strong id="cce_10_0653__b119442517458">Data Disk Encryption</strong> to <strong id="cce_10_0653__b6194192554518">Enabled</strong>, choose an existing key. If no key is available, click <strong id="cce_10_0653__b2019512253459">View Key List</strong> and create a key. After the key is created, click the refresh icon next to the text box.</li></ul>
|
||||
</li><li id="cce_10_0653__en-us_topic_0000001199021246_li1095641711169"><strong id="cce_10_0653__b71171410204510">Enabled</strong>: Data disk encryption safeguards your data. Snapshots generated from encrypted disks and disks created using these snapshots automatically inherit the encryption setting. <ul id="cce_10_0653__en-us_topic_0000001199021246_ul1924511512168"><li id="cce_10_0653__en-us_topic_0000001199021246_li4245181561611"><strong id="cce_10_0653__b211242923">Not encrypted</strong> is selected by default.</li><li id="cce_10_0653__en-us_topic_0000001199021246_li17245415121616">After setting <strong id="cce_10_0653__b119442517458">Data Disk Encryption</strong> to <strong id="cce_10_0653__b6194192554518">Enabled</strong>, choose an existing key. If no key is available, click <strong id="cce_10_0653__b2019512253459">View Key List</strong> and create a key. After the key is created, click the refresh icon next to the text box.</li></ul>
|
||||
<div class="note" id="cce_10_0653__note17572111875311"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="cce_10_0653__p05729189537">After the <strong id="cce_10_0653__b7507148121716">Data Disk Encryption</strong> is modified, the modification takes effect only on newly added nodes. The configuration cannot be synchronized to existing nodes even if they are reset.</p>
|
||||
</div></div>
|
||||
</li></ul>
|
||||
|
||||
@ -50,7 +50,7 @@
|
||||
</div></div>
|
||||
</p></li></ol>
|
||||
</div>
|
||||
<div class="section" id="cce_10_0656__section7117453155012"><a name="cce_10_0656__section7117453155012"></a><a name="section7117453155012"></a><h4 class="sectiontitle">Migrating Nodes from the Default Node Pool to a Custom Node Pool</h4><ol id="cce_10_0656__ol10650132575118"><li id="cce_10_0656__li1765032575120"><span>Log in to the CCE console and click the cluster name to access the cluster console.</span></li><li id="cce_10_0656__li4650132575113"><span>In the navigation pane, choose <span class="uicontrol" id="cce_10_0656__uicontrol7381192011385"><b>Nodes</b></span> and click the <span class="uicontrol" id="cce_10_0656__uicontrol7381720113812"><b>Node Pools</b></span> tab.</span></li><li id="cce_10_0656__li15651172514517"><span>Locate the target node pool and choose <strong id="cce_10_0656__b17230173873816">More</strong> > <strong id="cce_10_0656__b66841812397">Accept Node</strong>.</span></li><li id="cce_10_0656__li1856013330389"><span>In the <span class="uicontrol" id="cce_10_0656__uicontrol20561193318385"><b>Accept Node</b></span> dialog box, select the nodes that meet the following conditions:</span><p><ul id="cce_10_0656__ul1966705163816"><li id="cce_10_0656__li36671851103812">The nodes and the current node pool are deployed in the same VPC and subnet.</li><li id="cce_10_0656__li19667185113385">The nodes and the current node pool are in the same cloud server group.</li><li id="cce_10_0656__li2667135153814">The billing mode of the nodes is supported by the current node pool.</li><li id="cce_10_0656__li26671451183818">The nodes are running and they are from the default node pool.</li><li id="cce_10_0656__li1766718517385">The flavor, AZ, resource reservation, container engine, and OS configurations of the nodes are the same as those of the node pool.</li></ul>
|
||||
<div class="section" id="cce_10_0656__section7117453155012"><a name="cce_10_0656__section7117453155012"></a><a name="section7117453155012"></a><h4 class="sectiontitle">Migrating Nodes from the Default Node Pool to a Custom Node Pool</h4><ol id="cce_10_0656__ol10650132575118"><li id="cce_10_0656__li1765032575120"><span>Log in to the CCE console and click the cluster name to access the cluster console.</span></li><li id="cce_10_0656__li4650132575113"><span>In the navigation pane, choose <span class="uicontrol" id="cce_10_0656__uicontrol7381192011385"><b>Nodes</b></span> and click the <span class="uicontrol" id="cce_10_0656__uicontrol7381720113812"><b>Node Pools</b></span> tab.</span></li><li id="cce_10_0656__li15651172514517"><span>Locate the target node pool and choose <strong id="cce_10_0656__b1144865192212">More</strong> > <strong id="cce_10_0656__b1744815517223">Migrate Node</strong>.</span></li><li id="cce_10_0656__li1856013330389"><span>In the <span class="uicontrol" id="cce_10_0656__uicontrol120205811228"><b>Migrate Node</b></span> dialog box, select the nodes that meet the following conditions:</span><p><ul id="cce_10_0656__ul1966705163816"><li id="cce_10_0656__li36671851103812">The nodes and the current node pool are deployed in the same VPC and subnet.</li><li id="cce_10_0656__li19667185113385">The nodes and the current node pool are in the same cloud server group.</li><li id="cce_10_0656__li2667135153814">The billing mode of the nodes is supported by the current node pool.</li><li id="cce_10_0656__li26671451183818">The nodes are running and they are from the default node pool.</li><li id="cce_10_0656__li1766718517385">The flavor, AZ, resource reservation, container engine, and OS configurations of the nodes are the same as those of the node pool.</li></ul>
|
||||
</p></li><li id="cce_10_0656__li5651102516519"><span>Click <strong id="cce_10_0656__b0354153674818">OK</strong>.</span><p><div class="note" id="cce_10_0656__note9651125145110"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="cce_10_0656__ul17651152520513"><li id="cce_10_0656__li365132575112">After nodes are migrated into a node pool, the pool's resource tags, Kubernetes labels, and Kubernetes taints will be synchronized to the nodes. If there is a conflict, the node pool's configurations will take precedence.</li><li id="cce_10_0656__li42279347352">After the migration, the pool's security group will take over the nodes' original security group.</li><li id="cce_10_0656__li0982821191117">After the migration, the pool's agency will take over the nodes' original agency.</li><li id="cce_10_0656__li2227173403518">After the migration, the nodes' original login mode will remain unchanged.</li><li id="cce_10_0656__li652931133617">After a node is migrated to a node pool after being accepted by the cluster, its acceptance tag will be removed. Scaling in the node pool may result in the removal of the node.</li></ul>
|
||||
</div></div>
|
||||
</p></li></ol>
|
||||
|
||||
@ -69,7 +69,7 @@
|
||||
<p id="cce_10_0659__cce_10_0132_p2317112419618">Typical scenario: Disk I/O suspension causes process suspension.</p>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="33%" headers="mcps1.3.5.4.1.2.2.4.1.3 "><p id="cce_10_0659__cce_10_0132_p16872758114011">Warning event</p>
|
||||
<p id="cce_10_0659__cce_10_0132_p173071159247">Listening object: <strong id="cce_10_0659__cce_10_0132_b592872265">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0659__cce_10_0132_p173071159247">Listening object: <strong id="cce_10_0659__cce_10_0132_b1029490566">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0659__cce_10_0132_p153079591241">Matching rule: "task \\S+:\\w+ blocked for more than \\w+ seconds\\."</p>
|
||||
</td>
|
||||
</tr>
|
||||
@ -81,7 +81,7 @@
|
||||
</div></div>
|
||||
</td>
|
||||
<td class="cellrowborder" valign="top" width="33%" headers="mcps1.3.5.4.1.2.2.4.1.3 "><p id="cce_10_0659__cce_10_0132_p944535317711">Warning event</p>
|
||||
<p id="cce_10_0659__cce_10_0132_p183981710948">Listening object: <strong id="cce_10_0659__cce_10_0132_b1027686576">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0659__cce_10_0132_p183981710948">Listening object: <strong id="cce_10_0659__cce_10_0132_b967989253">/dev/kmsg</strong></p>
|
||||
<p id="cce_10_0659__cce_10_0132_p83993101042">Matching rule: <strong id="cce_10_0659__cce_10_0132_b15200817134219">Remounting filesystem read-only</strong></p>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user