我们会为apiserver配置监听启⽤了⼀种或多种形式的客户端 authentication 的安全HTTPS端⼝（443）。应启⽤⼀种或 多种 authorization 形式，特别是允许 anonymous requests 或 service account tokens 的情况下 应为Node配置集群的公共根证书，以便安全地连接到apiserver。例如，在默认的GCE部署中，提供给kubelet的客户端 - name: sleep-forever image: gcr.io/google_containers/pause:0.8.0 resources: requests: cpu: 100m memory: 100Mi 13-Node 39 将 cpu 和 memory 值设置为您要保留的资源量。将该⽂件放在清单⽬录中（kubelet的 name: php-redis image: gcr.io/google_samples/gb-frontend:v3 resources: requests: cpu: 100m memory: 100Mi env: - name: GET_HOSTS_FROM

拉取 #command: [ "/bin/sh", "-ce", "ping -c 3 1.1.1.1" ] #容器入口程序及参数 resources: requests: #资源需求，定义了容器所需要的最小资源量，便于调度，不 能小于jvm中的Xms memory: "256Mi" cpu: "200m" memory: "256Mi" defaultRequest: # 定 义 默 认 的 资 源 需 求 ， 同 创 建 pod 时 指 定 的 resources/requests cpu: 200m memory: "256Mi" min: #定义最小的资源用量 cpu: 50m resourcequota-testxx namespace: default spec: hard: pods: "10" requests.cpu: "4" #同cpu: 4，cpu资源需求的总量限额 requests.memory: 2Gi #同memory: 2Gi，内存资源需求的总量限额 limits.cpu:

resources and businesses How to ensure load balancing of cluster nodes 1 2 Improper resource requests 3 Multi-tenant resource preemption How to expand horizontally more quickly and flexibly 4 Region1 request of Pod. However, in many cases, some nodes have low resource requests but high load, while some nodes have high resource requests but low load. Dynamic-Scheduler Node1 Node2 Kube-scheduler Pod replicas CronHPA scale up How to solve the problem of improper resource requests Node Resource Oversold Node resource requests are full, but the actual load is not high. Node Allocatable Resource Allocated

app: wordpress 15 spec: 16 accessModes: 17 - ReadWriteOnce 18 resources: 19 requests: 20 storage: 20Gi 21 storageClassName: wordpress-sc-001 22 --- 23 apiVersion: v1 24 app: wordpress 30 spec: 31 accessModes: 32 - ReadWriteOnce 33 resources: 34 requests: 35 storage: 20Gi 36 storageClassName: wordpress-sc-001 创建⼀个Secret变量存放MySQL密码 2. 部署MySQL容器组 app: wordpress 22 spec: 23 accessModes: 75 24 - ReadWriteOnce 25 resources: 26 requests: 27 storage: 20Gi 28 --- 29 apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2

resources: limits: cpu: 2000m memory: 1024Mi requests: cpu: 1000m memory: 1024Mi securityContext: accessModes }} - {{ . | quote }} {{- end }} resources: requests: storage: {{ .Values.persistentVolume.size | quote }} {{- if .Values.persistentVolume the curly braces after 'resources:'. # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi autoscaling: enabled: false minReplicas: 1

Kubernetes Resource Management How it works • Specified and “metered” on a per container basis • Requests • What a container is guaranteed to get – won’t be scheduled if not available • Limits • Restrictions the namespace level • Resource Quotas can be applied by an administrator at a namespace level • Requests • Limits • Numeric count of allowed instances of objects 16 Kubernetes Resource Management

Kubernetes Resource Management How it works • Specified and “metered” on a per container basis • Requests • What a container is guaranteed to get – won’t be scheduled if not available • Limits • Restrictions the namespace level • Resource Quotas can be applied by an administrator at a namespace level • Requests • Limits • Numeric count of allowed instances of objects 16 Kubernetes Resource Management

nvidia-gpu-type! • value: Telsa-K80! • ��NodeSelector����! • nodeSelectorTerms! CPU�Mem����! • requests! • ��������! • ������! • limits! • ��������! • ������! • �����������! Nvidia GPU Driver!

End of last show Time 1 week - 1 hour 8 min 15 min 15 min 20min End of show Participants API Requests Application architecture Application architecture PHP-based Admin application Shared state

● Mobile device support ● Cost estimates ● CI/CD pipelines ● ...and more! Additional feature requests Get involved Try out Dashboard github.com/kubernetes/dashboard github.com/kubernetes/minikube