Chapter 2. Working with pods

Procedure

1. Change to the project by entering the following command:

   $ oc project <project_name>

   Copy to Clipboard Toggle word wrap

2. Obtain a list of pods by entering the following command:

   $ oc get pods

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                       READY   STATUS    RESTARTS   AGE
   console-698d866b78-bnshf   1/1     Running   2          165m
   console-698d866b78-m87pm   1/1     Running   2          165m

   Copy to Clipboard Toggle word wrap

3. Optional: Add the -o wide flags to view the pod IP address and the node where the pod is located. For example:

   $ oc get pods -o wide

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                       READY   STATUS    RESTARTS   AGE    IP            NODE                           NOMINATED NODE
   console-698d866b78-bnshf   1/1     Running   2          166m   10.128.0.24   ip-10-0-152-71.ec2.internal    <none>
   console-698d866b78-m87pm   1/1     Running   2          166m   10.129.0.23   ip-10-0-173-237.ec2.internal   <none>

   Copy to Clipboard Toggle word wrap

Procedure

1. View the usage statistics by entering the following command:

   $ oc adm top pods -n <namespace>

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                         CPU(cores)   MEMORY(bytes)
   console-7f58c69899-q8c8k     0m           22Mi
   console-7f58c69899-xhbgg     0m           25Mi
   downloads-594fcccf94-bcxk8   3m           18Mi
   downloads-594fcccf94-kv4p6   2m           15Mi

   Copy to Clipboard Toggle word wrap

2. Optional: Add the --selector='' label to view usage statistics for pods with labels. Note that you must choose the label query to filter on, such as =, ==, or !=. For example:

   $ oc adm top pod --selector='<pod_name>'

   Copy to Clipboard Toggle word wrap

1. Write an object definition JSON file, and specify the data traffic speed using kubernetes.io/ingress-bandwidth and kubernetes.io/egress-bandwidth annotations. For example, to limit both pod egress and ingress bandwidth to 10M/s:

   Limited Pod object definition

   {
       "kind": "Pod",
       "spec": {
           "containers": [
               {
                   "image": "openshift/hello-openshift",
                   "name": "hello-openshift"
               }
           ]
       },
       "apiVersion": "v1",
       "metadata": {
           "name": "iperf-slow",
           "annotations": {
               "kubernetes.io/ingress-bandwidth": "10M",
               "kubernetes.io/egress-bandwidth": "10M"
           }
       }
   }

   Copy to Clipboard Toggle word wrap

2. Create the pod using the object definition:

   $ oc create -f <file_or_dir_path>

   Copy to Clipboard Toggle word wrap

1. Create a Pod spec or edit existing pods to include the system-cluster-critical priority class:

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-pdb
   spec:
     template:
       metadata:
         name: critical-pod
       priorityClassName: system-cluster-critical 

   1

   Copy to Clipboard Toggle word wrap

   1

   Default priority class for pods that should never be evicted from a node.

   Alternatively, you can specify system-node-critical for pods that are important to the cluster but can be removed if necessary.

2. Create the pod:

   $ oc create -f <file-name>.yaml

   Copy to Clipboard Toggle word wrap

1. In the Topology view, click the node to reveal the side pane.

2. From the Actions drop-down list, select Add HorizontalPodAutoscaler to open the Add HorizontalPodAutoscaler form.

   Figure 2.2. Add HorizontalPodAutoscaler

   

   View larger image

   

3. From the Add HorizontalPodAutoscaler form, define the name, minimum and maximum pod limits, the CPU and memory usage, and click Save.

   Note

   If any of the values for CPU and memory usage are missing, a warning is displayed.

Procedure

1. In the OpenShift Container Platform web console, click Operators OperatorHub.
2. Choose VerticalPodAutoscaler from the list of available Operators, and click Install.
3. On the Install Operator page, ensure that the Operator recommended namespace option is selected. This installs the Operator in the mandatory openshift-vertical-pod-autoscaler namespace, which is automatically created if it does not exist.
4. Click Install.

Verification

1. Verify the installation by listing the VPA components:

   1. Navigate to Workloads Pods.
   2. Select the openshift-vertical-pod-autoscaler project from the drop-down menu and verify that there are four pods running.
   3. Navigate to Workloads Deployments to verify that there are four deployments running.

2. Optional: Verify the installation in the OpenShift Container Platform CLI using the following command:

   $ oc get all -n openshift-vertical-pod-autoscaler

   Copy to Clipboard Toggle word wrap

   The output shows four pods and four deployments:

   Example output

   NAME                                                    READY   STATUS    RESTARTS   AGE
   pod/vertical-pod-autoscaler-operator-85b4569c47-2gmhc   1/1     Running   0          3m13s
   pod/vpa-admission-plugin-default-67644fc87f-xq7k9       1/1     Running   0          2m56s
   pod/vpa-recommender-default-7c54764b59-8gckt            1/1     Running   0          2m56s
   pod/vpa-updater-default-7f6cc87858-47vw9                1/1     Running   0          2m56s
   
   NAME                  TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
   service/vpa-webhook   ClusterIP   172.30.53.206   <none>        443/TCP   2m56s
   
   NAME                                               READY   UP-TO-DATE   AVAILABLE   AGE
   deployment.apps/vertical-pod-autoscaler-operator   1/1     1            1           3m13s
   deployment.apps/vpa-admission-plugin-default       1/1     1            1           2m56s
   deployment.apps/vpa-recommender-default            1/1     1            1           2m56s
   deployment.apps/vpa-updater-default                1/1     1            1           2m56s
   
   NAME                                                          DESIRED   CURRENT   READY   AGE
   replicaset.apps/vertical-pod-autoscaler-operator-85b4569c47   1         1         1       3m13s
   replicaset.apps/vpa-admission-plugin-default-67644fc87f       1         1         1       2m56s
   replicaset.apps/vpa-recommender-default-7c54764b59            1         1         1       2m56s
   replicaset.apps/vpa-updater-default-7f6cc87858                1         1         1       2m56s

   Copy to Clipboard Toggle word wrap

1. Change to the location of the project for the workload object you want to scale.

   1. Create a VPA CR YAML file:

      apiVersion: autoscaling.k8s.io/v1
      kind: VerticalPodAutoscaler
      metadata:
        name: vpa-recommender
      spec:
        targetRef:
          apiVersion: "apps/v1"
          kind:       Deployment 

      1

      
          name:       frontend 

      2

      
        updatePolicy:
          updateMode: "Auto" 

      3

      
        resourcePolicy: 

      4

      
          containerPolicies:
          - containerName: my-opt-sidecar
            mode: "Off"
        recommenders: 

      5

      
          - name: my-recommender

      Copy to Clipboard Toggle word wrap

      1

      Specify the type of workload object you want this VPA to manage: Deployment, StatefulSet, Job, DaemonSet, ReplicaSet, or ReplicationController.

      2

      Specify the name of an existing workload object you want this VPA to manage.

      3

      Specify the VPA mode:

      • Auto to automatically apply the recommended resources on pods associated with the controller. The VPA terminates existing pods and creates new pods with the recommended resource limits and requests.
      • Recreate to automatically apply the recommended resources on pods associated with the workload object. The VPA terminates existing pods and creates new pods with the recommended resource limits and requests. Use the Recreate mode rarely, only if you need to ensure that the pods restart whenever the resource request changes.
      • Initial to automatically apply the recommended resources to newly-created pods associated with the workload object. The VPA does not update the pods as it learns new resource recommendations.
      • Off to only generate resource recommendations for the pods associated with the workload object. The VPA does not update the pods as it learns new resource recommendations and does not apply the recommendations to new pods.

      4

      Optional. Specify the containers you want to opt-out and set the mode to Off.

      5

      Optional. Specify an alternative recommender.

   2. Create the VPA CR:

      $ oc create -f <file-name>.yaml

      Copy to Clipboard Toggle word wrap

      After a few moments, the VPA learns the resource usage of the containers in the pods associated with the workload object.

      You can view the VPA recommendations by using the following command:

      $ oc get vpa <vpa-name> --output yaml

      Copy to Clipboard Toggle word wrap

      The output shows the recommendations for CPU and memory requests, similar to the following:

      Example output

      ...
      status:
      
      ...
      
        recommendation:
          containerRecommendations:
          - containerName: frontend
            lowerBound: 

      1

      
              cpu: 25m
              memory: 262144k
            target: 

      2

      
              cpu: 25m
              memory: 262144k
            uncappedTarget: 

      3

      
              cpu: 25m
              memory: 262144k
            upperBound: 

      4

      
              cpu: 262m
              memory: "274357142"
          - containerName: backend
            lowerBound:
              cpu: 12m
              memory: 131072k
            target:
              cpu: 12m
              memory: 131072k
            uncappedTarget:
              cpu: 12m
              memory: 131072k
            upperBound:
              cpu: 476m
              memory: "498558823"
      
      ...

      Copy to Clipboard Toggle word wrap

      1

      lowerBound is the minimum recommended resource levels.

      2

      target is the recommended resource levels.

      3

      upperBound is the highest recommended resource levels.

      4

      uncappedTarget is the most recent resource recommendations.

Procedure

1. In the OpenShift Container Platform web console, click Operators Installed Operators.
2. Switch to the openshift-vertical-pod-autoscaler project.
3. For the VerticalPodAutoscaler Operator, click the Options menu and select Uninstall Operator.
4. Optional: To remove all operands associated with the Operator, in the dialog box, select Delete all operand instances for this operator checkbox.
5. Click Uninstall.

6. Optional: Use the OpenShift CLI to remove the VPA components:

   1. Delete the VPA namespace:

      $ oc delete namespace openshift-vertical-pod-autoscaler

      Copy to Clipboard Toggle word wrap

   2. Delete the VPA custom resource definition (CRD) objects:

      $ oc delete crd verticalpodautoscalercheckpoints.autoscaling.k8s.io

      Copy to Clipboard Toggle word wrap

      $ oc delete crd verticalpodautoscalercontrollers.autoscaling.openshift.io

      Copy to Clipboard Toggle word wrap

      $ oc delete crd verticalpodautoscalers.autoscaling.k8s.io

      Copy to Clipboard Toggle word wrap

      Deleting the CRDs removes the associated roles, cluster roles, and role bindings.

      Note

      This action removes from the cluster all user-created VPA CRs. If you re-install the VPA, you must create these objects again.

   3. Delete the MutatingWebhookConfiguration object by running the following command:

      $ oc delete MutatingWebhookConfiguration vpa-webhook-config

      Copy to Clipboard Toggle word wrap

   4. Delete the VPA Operator:

      $ oc delete operator/vertical-pod-autoscaler.openshift-vertical-pod-autoscaler

      Copy to Clipboard Toggle word wrap

1. Create a secret object that contains the data you want to keep secret. The specific data required for each secret type is descibed in the following sections.

   Example YAML object that creates an opaque secret

   apiVersion: v1
   kind: Secret
   metadata:
     name: test-secret
   type: Opaque 

   1

   
   data: 

   2

   
     username: <username>
     password: <password>
   stringData: 

   3

   
     hostname: myapp.mydomain.com
     secret.properties: |
       property1=valueA
       property2=valueB

   Copy to Clipboard Toggle word wrap

   1

   Specifies the type of secret.

   2

   Specifies encoded string and data.

   3

   Specifies decoded string and data.

   Use either the data or stringdata fields, not both.

2. Update the pod’s service account to reference the secret:

   YAML of a service account that uses a secret

   apiVersion: v1
   kind: ServiceAccount
    ...
   secrets:
   - name: test-secret

   Copy to Clipboard Toggle word wrap

3. Create a pod, which consumes the secret as an environment variable or as a file (using a secret volume):

   YAML of a pod populating files in a volume with secret data

   apiVersion: v1
   kind: Pod
   metadata:
     name: secret-example-pod
   spec:
     containers:
       - name: secret-test-container
         image: busybox
         command: [ "/bin/sh", "-c", "cat /etc/secret-volume/*" ]
         volumeMounts: 

   1

   
             - name: secret-volume
               mountPath: /etc/secret-volume 

   2

   
               readOnly: true 

   3

   
     volumes:
       - name: secret-volume
         secret:
           secretName: test-secret 

   4

   
     restartPolicy: Never

   Copy to Clipboard Toggle word wrap

   1

   Add a volumeMounts field to each container that needs the secret.

   2

   Specifies an unused directory name where you would like the secret to appear. Each key in the secret data map becomes the filename under mountPath.

   3

   Set to true. If true, this instructs the driver to provide a read-only volume.

   4

   Specifies the name of the secret.

   YAML of a pod populating environment variables with secret data

   apiVersion: v1
   kind: Pod
   metadata:
     name: secret-example-pod
   spec:
     containers:
       - name: secret-test-container
         image: busybox
         command: [ "/bin/sh", "-c", "export" ]
         env:
           - name: TEST_SECRET_USERNAME_ENV_VAR
             valueFrom:
               secretKeyRef: 

   1

   
                 name: test-secret
                 key: username
     restartPolicy: Never

   Copy to Clipboard Toggle word wrap

   1

   Specifies the environment variable that consumes the secret key.

   YAML of a build config populating environment variables with secret data

   apiVersion: build.openshift.io/v1
   kind: BuildConfig
   metadata:
     name: secret-example-bc
   spec:
     strategy:
       sourceStrategy:
         env:
         - name: TEST_SECRET_USERNAME_ENV_VAR
           valueFrom:
             secretKeyRef: 

   1

   
               name: test-secret
               key: username
         from:
           kind: ImageStreamTag
           namespace: openshift
           name: 'cli:latest'

   Copy to Clipboard Toggle word wrap

   1

   Specifies the environment variable that consumes the secret key.