This document describes how to restrict the Pod bandwidth in TKE. Currently, TKE does not support Pod speed restriction; however, you can modify the CNI plugin to achieve it based on your actual scenario.
Notes
TKE supports using the bandwidth plugin of the community to restrict the network speed. Currently, it can be used in GlobalRouter mode and VPC-CNI shared ENI mode.
Currently, it is not supported for the VPC-CNI dedicated ENI mode.
Directions
Modifying CNI plugin
GlobalRouter mode
The GlobalRouter network mode is a routing policy for communication between the container network and VPC based on the global routing capabilities of the underlying VPC. It is suitable for common scenarios and seamlessly compatible with standard Kubernetes features. For more information, see GlobalRouter Mode.
Add args --bandwidth to enable the support for the bandwidth plugin.
VPC-CNI shared ENI mode
The VPC-CNI mode is the container network capability implemented based on CNI and VPC ENI in TKE, suitable for the scenarios with high requirements on latency. The open-source Bandwidth component supports outbound and inbound traffic shaping for the Pod, as well as bandwidth control.
1. Log in to the TKE console, click Clusters in the left sidebar.
2. On the cluster management page, click the cluster ID for which you want to enable security groups to go to the cluster details page.
3. On the cluster details page, click Add-on Management on the left sidebar. On the add-on management page, click eniipamd on the right of the component and select Modify global configurations.
4. In the global configuration, find the configuration item of the bandwidth plugin (path: agent.cniChaining.bandwidth) and change it to true.
Note:
You can enable or disable this feature simply by modifying the above parameters for the component tke-eni-agent. Deployment, enablement, and disablement are supported, which take effect only for newly-added Pods.
Specifying annotation in Pod
You can configure in the method provided by the community:
Use the kubernetes.io/ingress-bandwidth annotation to specify the inbound bandwidth cap.
Use the kubernetes.io/egress-bandwidth annotation to specify the outbound bandwidth cap.
Sample:
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
spec:
replicas:1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
annotations:
kubernetes.io/ingress-bandwidth: 10M
kubernetes.io/egress-bandwidth: 20M
spec:
containers:
-name: nginx
image: nginx
Configuration Verification
You can verify whether the configuration succeeds in the following two methods:
Method 1: log in to the Pod node and run the following command to check whether the caps have been added:
tc qdisc show
If a result similar to the following is returned, the caps have been added successfully:
qdisc tbf 1: dev vethc09123a1 root refcnt 2 rate 10Mbit burst 256Mb lat 25.0ms
qdisc ingress ffff: dev vethc09123a1 parent ffff:fff1 ----------------
qdisc tbf 1: dev 6116 root refcnt 2 rate 20Mbit burst 256Mb lat 25.0ms
Method 2: run the following command to use iperf for testing:
iperf -c <service IP> -p <service port> -i 1
If a result similar to the following is returned, the caps have been added successfully:
