How it Works
CPU isolation utilizes a containerd Node Resource Interface (NRI) plugin (v0.3.0) that subscribes for pod or container lifecycle events.
NRI is a common framework for plugging extensions into OCI-compatible container runtimes. It provides basic mechanisms for plugins to track the state of containers and to make limited changes to their configuration.
Using the NRI Plugin
The following built-in rules apply for the plugin:
-
The CPU isolator ignores containers in a pod with prefix name as "vpc-"
-
If the annotation smi.cisco.com/cpuset exists, CPU isolator adjusts the CPU set using its value
-
Otherwise the value of environment "CPUSET_KUBEPODS" is used.
The following steps describe how to start the NRI plugin:
-
Retain the CPU set for K8s to all CPUs
-
During a CreateContainer event, the plugin adjusts the container's CPU set based on the following conditions:
-
if it is a VPC container, it does nothing so that VPP workers can be pinned to isolated CPUs
-
for other non-VPC containers, it creates a customized CPU set to exclude the isolated CPU
-