# Configure Pods and Containers

This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.Configure Pods and ContainersPerform common configuration tasks for Pods and containers.1: Assign Memory Resources to Containers and Pods2: Assign CPU Resources to Containers and Pods3: Assign Devices to Pods and Containers3.1: Set Up DRA in a Cluster3.2: Allocate Devices to Workloads with DRA4: Assign Pod-level CPU and memory resources5: Configure GMSA for Windows Pods and containers6: Resize CPU and Memory Resources assigned to Containers7: Configure RunAsUserName for Windows pods and containers8: Create a Windows HostProcess Pod9: Configure Quality of Service for Pods10: Assign Extended Resources to a Container11: Configure a Pod to Use a Volume for Storage12: Configure a Pod to Use a PersistentVolume for Storage13: Configure a Pod to Use a Projected Volume for Storage14: Configure a Security Context for a Pod or Container15: Configure Service Accounts for Pods16: Pull an Image from a Private Registry17: Configure Liveness, Readiness and Startup Probes18: Assign Pods to Nodes19: Assign Pods to Nodes using Node Affinity20: Configure Pod Initialization21: Attach Handlers to Container Lifecycle Events22: Configure a Pod to Use a ConfigMap23: Share Process Namespace between Containers in a Pod24: Use a User Namespace With a Pod25: Use an Image Volume With a Pod26: Create static Pods27: Translate a Docker Compose File to Kubernetes Resources28: Enforce Pod Security Standards by Configuring the Built-in Admission Controller29: Enforce Pod Security Standards with Namespace Labels30: Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller1 - Assign Memory Resources to Containers and PodsThis page shows how to assign a memory request and a memory limit to a Container. A Container is guaranteed to have as much memory as it requests, but is not allowed to use more memory than its limit.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Each node in your cluster must have at least 300 MiB of memory.A few of the steps on this page require you to run the metrics-server service in your cluster. If you have the metrics-server running, you can skip those steps.If you are running Minikube, run the following command to enable the metrics-server:minikube addons enable metrics-server To see whether the metrics-server is running, or another provider of the resource metrics API (metrics.k8s.io), run the following command:kubectl get apiservices If the resource metrics API is available, the output includes a reference to metrics.k8s.io.NAME v1beta1.metrics.k8s.io Create a namespaceCreate a namespace so that the resources you create in this exercise are isolated from the rest of your cluster.kubectl create namespace mem-example Specify a memory request and a memory limitTo specify a memory request for a Container, include the resources:requests field in the Container's resource manifest. To specify a memory limit, include resources:limits.In this exercise, you create a Pod that has one Container. The Container has a memory request of 100 MiB and a memory limit of 200 MiB. Here's the configuration file for the Pod:pods/resource/memory-request-limit.yaml apiVersion: v1 kind: Pod metadata: name: memory-demo namespace: mem-example spec: containers: - name: memory-demo-ctr image: polinux/stress resources: requests: memory: "100Mi" limits: memory: "200Mi" command: ["stress"] args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"] The args section in the configuration file provides arguments for the Container when it starts. The "--vm-bytes", "150M" arguments tell the Container to attempt to allocate 150 MiB of memory.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/resource/memory-request-limit.yaml --namespace=mem-example Verify that the Pod Container is running:kubectl get pod memory-demo --namespace=mem-example View detailed information about the Pod:kubectl get pod memory-demo --output=yaml --namespace=mem-example The output shows that the one Container in the Pod has a memory request of 100 MiB and a memory limit of 200 MiB.... resources: requests: memory: 100Mi limits: memory: 200Mi ... Run kubectl top to fetch the metrics for the pod:kubectl top pod memory-demo --namespace=mem-example The output shows that the Pod is using about 162,900,000 bytes of memory, which is about 150 MiB. This is greater than the Pod's 100 MiB request, but within the Pod's 200 MiB limit.NAME CPU(cores) MEMORY(bytes) memory-demo <something> 162856960 Delete your Pod:kubectl delete pod memory-demo --namespace=mem-example Exceed a Container's memory limitA Container can exceed its memory request if the Node has memory available. But a Container is not allowed to use more than its memory limit. If a Container allocates more memory than its limit, the Container becomes a candidate for termination. If the Container continues to consume memory beyond its limit, the Container is terminated. If a terminated Container can be restarted, the kubelet restarts it, as with any other type of runtime failure.In this exercise, you create a Pod that attempts to allocate more memory than its limit. Here is the configuration file for a Pod that has one Container with a memory request of 50 MiB and a memory limit of 100 MiB:pods/resource/memory-request-limit-2.yaml apiVersion: v1 kind: Pod metadata: name: memory-demo-2 namespace: mem-example spec: containers: - name: memory-demo-2-ctr image: polinux/stress resources: requests: memory: "50Mi" limits: memory: "100Mi" command: ["stress"] args: ["--vm", "1", "--vm-bytes", "250M", "--vm-hang", "1"] In the args section of the configuration file, you can see that the Container will attempt to allocate 250 MiB of memory, which is well above the 100 MiB limit.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/resource/memory-request-limit-2.yaml --namespace=mem-example View detailed information about the Pod:kubectl get pod memory-demo-2 --namespace=mem-example At this point, the Container might be running or killed. Repeat the preceding command until the Container is killed:NAME READY STATUS RESTARTS AGE memory-demo-2 0/1 OOMKilled 1 24s Get a more detailed view of the Container status:kubectl get pod memory-demo-2 --output=yaml --namespace=mem-example The output shows that the Container was killed because it is out of memory (OOM):lastState: terminated: containerID: 65183c1877aaec2e8427bc95609cc52677a454b56fcb24340dbd22917c23b10f exitCode: 137 finishedAt: 2017-06-20T20:52:19Z reason: OOMKilled startedAt: null The Container in this exercise can be restarted, so the kubelet restarts it. Repeat this command several times to see that the Container is repeatedly killed and restarted:kubectl get pod memory-demo-2 --namespace=mem-example The output shows that the Container is killed, restarted, killed again, restarted again, and so on:kubectl get pod memory-demo-2 --namespace=mem-example NAME READY STATUS RESTARTS AGE memory-demo-2 0/1 OOMKilled 1 37s kubectl get pod memory-demo-2 --namespace=mem-example NAME READY STATUS RESTARTS AGE memory-demo-2 1/1 Running 2 40s View detailed information about the Pod history:kubectl describe pod memory-demo-2 --namespace=mem-example The output shows that the Container starts and fails repeatedly:... Normal Created Created container with id 66a3a20aa7980e61be4922780bf9d24d1a1d8b7395c09861225b0eba1b1f8511 ... Warning BackOff Back-off restarting failed container View detailed information about your cluster's Nodes:kubectl describe nodes The output includes a record of the Container being killed because of an out-of-memory condition:Warning OOMKilling Memory cgroup out of memory: Kill process 4481 (stress) score 1994 or sacrifice child Delete your Pod:kubectl delete pod memory-demo-2 --namespace=mem-example Specify a memory request that is too big for your NodesMemory requests and limits are associated with Containers, but it is useful to think of a Pod as having a memory request and limit. The memory request for the Pod is the sum of the memory requests for all the Containers in the Pod. Likewise, the memory limit for the Pod is the sum of the limits of all the Containers in the Pod.Pod scheduling is based on requests. A Pod is scheduled to run on a Node only if the Node has enough available memory to satisfy the Pod's memory request.In this exercise, you create a Pod that has a memory request so big that it exceeds the capacity of any Node in your cluster. Here is the configuration file for a Pod that has one Container with a request for 1000 GiB of memory, which likely exceeds the capacity of any Node in your cluster.pods/resource/memory-request-limit-3.yaml apiVersion: v1 kind: Pod metadata: name: memory-demo-3 namespace: mem-example spec: containers: - name: memory-demo-3-ctr image: polinux/stress resources: requests: memory: "1000Gi" limits: memory: "1000Gi" command: ["stress"] args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"] Create the Pod:kubectl apply -f https://k8s.io/examples/pods/resource/memory-request-limit-3.yaml --namespace=mem-example View the Pod status:kubectl get pod memory-demo-3 --namespace=mem-example The output shows that the Pod status is PENDING. That is, the Pod is not scheduled to run on any Node, and it will remain in the PENDING state indefinitely:kubectl get pod memory-demo-3 --namespace=mem-example NAME READY STATUS RESTARTS AGE memory-demo-3 0/1 Pending 0 25s View detailed information about the Pod, including events:kubectl describe pod memory-demo-3 --namespace=mem-example The output shows that the Container cannot be scheduled because of insufficient memory on the Nodes:Events: ... Reason Message ------ ------- ... FailedScheduling No nodes are available that match all of the following predicates:: Insufficient memory (3). Memory unitsThe memory resource is measured in bytes. You can express memory as a plain integer or a fixed-point integer with one of these suffixes: E, P, T, G, M, K, Ei, Pi, Ti, Gi, Mi, Ki. For example, the following represent approximately the same value:128974848, 129e6, 129M, 123Mi Delete your Pod:kubectl delete pod memory-demo-3 --namespace=mem-example If you do not specify a memory limitIf you do not specify a memory limit for a Container, one of the following situations applies:The Container has no upper bound on the amount of memory it uses. The Container could use all of the memory available on the Node where it is running which in turn could invoke the OOM Killer. Further, in case of an OOM Kill, a container with no resource limits will have a greater chance of being killed.The Container is running in a namespace that has a default memory limit, and the Container is automatically assigned the default limit. Cluster administrators can use a LimitRange to specify a default value for the memory limit.Motivation for memory requests and limitsBy configuring memory requests and limits for the Containers that run in your cluster, you can make efficient use of the memory resources available on your cluster's Nodes. By keeping a Pod's memory request low, you give the Pod a good chance of being scheduled. By having a memory limit that is greater than the memory request, you accomplish two things:The Pod can have bursts of activity where it makes use of memory that happens to be available.The amount of memory a Pod can use during a burst is limited to some reasonable amount.Clean upDelete your namespace. This deletes all the Pods that you created for this task:kubectl delete namespace mem-example What's