Configuring a Node Pool

Constraints

The default node pool DefaultPool does not support the following management operations.

Configuration Management

CCE allows you to highly customize Kubernetes parameter settings on core components in a cluster. For more information, see kubelet.

This function is supported only in clusters of v1.15 and later. It is not displayed for clusters earlier than v1.15.

1. Log in to the CCE console.
2. Click the cluster name to access the cluster console. Choose Nodes in the navigation pane and click the Node Pools tab on the right.
3. Choose More > Manage in the Operation column of the target node pool
4. On the Manage Components page on the right, change the values of the following Kubernetes parameters:

   Table 1 kubelet

   Parameter	Description	Default Value	Modification	Remarks
   cpu-manager-policy	CPU management policy configuration. For details, see CPU Scheduling. none: disables pods from exclusively occupying CPUs. Select this value if you want a large pool of shareable CPU cores. static: enables pods to exclusively occupy CPUs. Select this value if your workload is sensitive to latency in CPU cache and scheduling.	none	None	None
   kube-api-qps	Query per second (QPS) for communicating with kube-apiserver.	100	None	None
   kube-api-burst	Burst to use while talking with kube-apiserver.	100	None	None
   max-pods	Maximum number of pods managed by kubelet.	For a CCE cluster, the maximum number of pods is determined based on the maximum number of pods on a node.	None	None
   pod-pids-limit	Limited number of PIDs in Kubernetes	-1	None	None
   with-local-dns	Whether to use the local IP address as the ClusterDNS of the node.	false	None	None
   event-qps	QPS limit for event creation	5	None	None
   allowed-unsafe-sysctls	Insecure system configuration allowed. Starting from v1.17.17, CCE enables pod security policies for kube-apiserver. Add corresponding configurations to allowedUnsafeSysctls of a pod security policy to make the policy take effect. (This configuration is not required for clusters earlier than v1.17.17.) For details, see Example of Enabling Unsafe Sysctls in Pod Security Policy.	[]	None	None
   over-subscription-resource	Whether to enable node oversubscription. If this parameter is set to true, node oversubscription is enabled.	true	None	None
   colocation	Whether to enable hybrid deployment on nodes. If this parameter is set to true, hybrid deployment is enabled on nodes.	true	None	None
   kube-reserved-mem system-reserved-mem	Reserved node memory.	Depends on node specifications. For details, see Node Resource Reservation Policy.	None	The sum of kube-reserved-mem and system-reserved-mem is less than half of the memory.
   topology-manager-policy	Set the topology management policy. Valid values are as follows: restricted: kubelet accepts only pods that achieve optimal NUMA alignment on the requested resources. best-effort: kubelet preferentially selects pods that implement NUMA alignment on CPU and device resources. none (default): The topology management policy is disabled. single-numa-node: kubelet allows only pods that are aligned to the same NUMA node in terms of CPU and device resources.	none	None	NOTICE: Modifying topology-manager-policy and topology-manager-scope will restart kubelet, and the resource allocation of pods will be recalculated based on the modified policy. In this case, running pods may restart or even fail to receive any resources.
   topology-manager-scope	Set the resource alignment granularity of the topology management policy. Valid values are as follows: container (default) pod	container
   resolv-conf	DNS resolution configuration file specified by the container	The default value is null.	None	None
   runtime-request-timeout	Timeout interval of all runtime requests except long-running requests (pull, logs, exec, and attach).	The default value is 2m0s.	None	None
   registry-pull-qps	Maximum number of image pulls per second.	The default value is 5.	The value ranges from 1 to 50.	None
   registry-burst	Maximum number of burst image pulls.	The default value is 10.	The value ranges from 1 to 100 and must be greater than or equal to the value of registry-pull-qps.	None
   serialize-image-pulls	When this function is enabled, kubelet is notified to pull only one image at a time.	The default value is true.	None	None

   Table 2 kube-proxy

   Parameter	Description	Default Value	Modification
   conntrack-min	Maximum number of connection tracking entries To obtain the value, run the following command: sysctl -w net.nf_conntrack_max	131072	None
   conntrack-tcp-timeout-close-wait	Wait time of a closed TCP connection To obtain the value, run the following command: sysctl -w net.netfilter.nf_conntrack_tcp_timeout_close_wait	1h0m0s	None

   Table 3 Docker (available only for node pools that use Docker)

   Parameter	Description	Default Value	Modification
   native-umask	`--exec-opt native.umask	normal	Cannot be changed.
   docker-base-size	`--storage-opts dm.basesize	0	Cannot be changed.
   insecure-registry	Address of an insecure image registry	false	Cannot be changed.
   limitcore	Maximum size of a core file in a container. The unit is byte. If not specified, the value is infinity.	5368709120	None
   default-ulimit-nofile	Limit on the number of handles in a container	{soft}:{hard}	The value cannot exceed the value of the kernel parameter nr_open and cannot be a negative number. You can run the following command to obtain the kernel parameter nr_open: sysctl -a | grep nr_open
   image-pull-progress-timeout	If the image fails to be pulled before time outs, the image pull will be canceled.	The default value is 1m0s.	This parameter is supported in v1.25.3-r0 and later.

   Table 4 containerd (available only for node pools that use containerd)

   Parameter	Description	Default Value	Modification
   devmapper-base-size	Available data space of a single container	None	Cannot be changed.
   limitcore	Maximum size of a core file in a container. The unit is byte. If not specified, the value is infinity.	5368709120	None
   default-ulimit-nofile	Limit on the number of handles in a container	1048576	The value cannot exceed the value of the kernel parameter nr_open and cannot be a negative number. You can run the following command to obtain the kernel parameter nr_open: sysctl -a | grep nr_open
   image-pull-progress-timeout	If the image fails to be pulled before time outs, the image pull will be canceled.	The default value is 1m0s.	This parameter is supported in v1.25.3-r0 and later.

5. Click OK.