How it Works

CPU isolation utilizes a containerd Node Resource Interface (NRI) plugin (v0.3.0) that subscribes for pod or container lifecycle events.

NRI is a common framework for plugging extensions into OCI-compatible container runtimes. It provides basic mechanisms for plugins to track the state of containers and to make limited changes to their configuration.

Using the NRI Plugin

The following built-in rules apply for the plugin:

  • The CPU isolator ignores containers in a pod with prefix name as "vpc-"

  • If the annotation smi.cisco.com/cpuset exists, CPU isolator adjusts the CPU set using its value

  • Otherwise the value of environment "CPUSET_KUBEPODS" is used.

The following steps describe how to start the NRI plugin:

  • Retain the CPU set for K8s to all CPUs

  • During a CreateContainer event, the plugin adjusts the container's CPU set based on the following conditions:

    • if it is a VPC container, it does nothing so that VPP workers can be pinned to isolated CPUs

    • for other non-VPC containers, it creates a customized CPU set to exclude the isolated CPU