How are Kubernetes CPU limits enforced?

Question

Are Kubernetes CPU limits "hard" limits?

Say I have a node with 1 CPU with two pods scheduled and running/ready/active, each with requests.limits.cpu of 500m. Pod A uses up 1 CPU for a while--this is normal/allowed. Eventually, pod B wants some CPU. Will Kubernetes (or Linux) make sure that pod B can get the .5 CPU it asks for?

Update on Thu Jun 23 16:55:25 UTC 2016

I'm still looking for a definitive answer, but it sounds like these may be hard limits in Linux/Docker. @danielmartins wrote this in the k8s slack channel:

I believe you can find this out by running docker inspect on the containers in which you set the limits. Checking one of my containers, I see that Kubernetes set CpuPeriod, CpuQuota for them. The Docker docs (https://docs.docker.com/engine/reference/run/) mention the CFS documentation (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt), and from the information there, it seems that these are hard limits

Answer 1

For kubernetes v1.2+, CPU resource limits are enforced using hardcapping, and requests are enforced using shares.

The change was noted in the release note and there is an issue open to update the documentation.

Answer 2

Kubernetes just manages the containers. As far as I know, it is actually the container engine (Docker, rkt) which implements the CPU limitation. That limitation is not a hard limit, as you already observed. but rather a percentage of the available resources.

Kubernetes (if set up with monitoring for this purpose), takes the used resource values and uses them to determine if you need a new pod (assuming you have set up some auto scaling). Kubernetes can not rate limit the existing pod since it is not actually running the containers in the pod.