Container Service for Kubernetes:Enable CPU Suppress

How it works

CPU Suppress monitors total node CPU utilization against a configurable threshold (cpuSuppressThresholdPercent, default: 65%). The cpuset assigned to BE pods expands and contracts based on the headroom LS pods leave:

• LS load increases — CPU Suppress reduces the cpuset assigned to BE pods, protecting LS response times

• LS load decreases — CPU Suppress expands the cpuset for BE pods, reclaiming otherwise idle capacity

The figure below illustrates this dynamic relationship between the CPU threshold, LS pod usage, and the CPU restriction applied to BE pods.

The figure uses the following terms:

• CPU Threshold: the CPU utilization threshold of the node

• Pod (LS).Usage: CPU usage of LS pods

• CPU Restriction for BE: CPU resources available to BE pods

Set cpuSuppressThresholdPercent to the same value as the reserved CPU watermark in your dynamic resource overcommitment configuration to keep both mechanisms aligned.

Prerequisites

Before you begin, ensure that you have:

• An ACK Pro cluster. For more information, see Create an ACK Pro cluster

• ack-koordinator 0.4.0 or later installed. For more information, see ack-koordinator (ack-slo-manager)

For background on pod QoS classes and memory resource assignments, see Pod QoS classes and Assign memory resources to containers and pods in the Kubernetes documentation.

Billing

Installing and using ack-koordinator is free. Charges may apply in these cases:

• Worker node resources: ack-koordinator is a non-managed component. It consumes worker node resources after installation. You can control the resource requests for each module during installation.

• Prometheus metrics: If you enable Prometheus metrics for ack-koordinator and use Managed Service for Prometheus, the metrics count as custom metrics and incur charges. Fees depend on cluster size and application count. Before enabling, review the Billing page for Managed Service for Prometheus to understand the free quota and billing rules. For usage monitoring, see Query the amount of observable data and bills.

Enable CPU Suppress

CPU Suppress is configured at the cluster level through the ack-slo-config ConfigMap in the kube-system namespace.

1. Create a file named configmap.yaml with the following content:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: ack-slo-config
     namespace: kube-system
   data:
     resource-threshold-config: |
       {
         "clusterStrategy": {
           "enable": true
         }
       }

2. Apply the ConfigMap. The method depends on whether ack-slo-config already exists in your cluster:

   • If the ConfigMap exists, use the PATCH method to update only the relevant field without affecting other settings:

     kubectl patch cm -n kube-system ack-slo-config --patch "$(cat configmap.yaml)"

   • If the ConfigMap does not exist, create it:

     kubectl apply -f configmap.yaml

3. Verify that CPU Suppress is active by querying the CPU cores allocated to BE pods:

   cat /sys/fs/cgroup/cpuset/kubepods.slice/kubepods-besteffort.slice/cpuset.cpus

   Expected output:

   10-25,35-51,62-77,87-103

   This output confirms that BE pods are restricted to a subset of CPU cores and that CPU Suppress is working.

4. Optional: Configure the CPU utilization threshold by updating your configmap.yaml with the following content and reapplying it:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: ack-slo-config
     namespace: kube-system
   data:
     resource-threshold-config: |
       {
         "clusterStrategy": {
           "enable": true,
           "cpuSuppressThresholdPercent": 65
         }
       }

   The default threshold is 65%. Adjust cpuSuppressThresholdPercent to match your workload profile or the reserved CPU watermark in your dynamic resource overcommitment configuration.

Parameters

What's next

ack-koordinator provides additional resource limits for overcommitted workloads on a node:

• Enable container CPU QoS

• Enable container memory QoS

• Enable container L3 cache and memory bandwidth isolation