https://ops.docs.72602.space/using/k8s/cgroup/index.html Kubernetes 深度集成 cgroup 来实现容器资源管理和隔离。以下是 cgroup 与 K8s 结合的详细方式： 1. K8s 资源模型与 cgroup 映射 1.1 资源请求和限制 apiVersion: v1 kind: Pod spec: containers: - name: app resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" ephemeral-storage: "2Gi" 对应 cgroup 配置： cpu.shares = 256 (250m × 1024 / 1000) cpu.cfs_quota_us = 50000 (500m × 100000 / 1000) memory.limit_in_bytes = 134217728 (128Mi) 2. K8s cgroup 驱动 2.1 cgroupfs 驱动 # kubelet 配置 --cgroup-driver=cgroupfs --cgroup-root=/sys/fs/cgroup 2.2 systemd 驱动（推荐） # kubelet 配置 --cgroup-driver=systemd --cgroup-root=/sys/fs/cgroup 3. K8s cgroup 层级结构 3.1 cgroup v1 层级 /sys/fs/cgroup/ ├── cpu,cpuacct/kubepods/ │ ├── burstable/pod-uid-1/ │ │ ├── container-1/ │ │ └── container-2/ │ └── guaranteed/pod-uid-2/ │ └── container-1/ ├── memory/kubepods/ └── pids/kubepods/ 3.2 cgroup v2 统一层级 /sys/fs/cgroup/kubepods/ ├── pod-uid-1/ │ ├── container-1/ │ └── container-2/ └── pod-uid-2/ └── container-1/ 4. QoS 等级与 cgroup 配置 4.1 Guaranteed (最高优先级) resources: limits: cpu: "500m" memory: "128Mi" requests: cpu: "500m" memory: "128Mi" cgroup 配置： Hugo en