Cpu Performance

CPU and Performance Configuration

Configure workloads for deterministic CPU performance, correct scheduling policies, and reliable storage and image management.

CPU Isolation

For workloads requiring exclusive CPU access (Guaranteed QoS with dedicated CPUs), all containers in the pod must meet these requirements:

> Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

• CPU requests and limits must be identical and specified in whole units (e.g., 2, not 2.5 or 2000m)
• runtimeClassName must be specified
• Annotations must disable CPU and IRQ load-balancing

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
  annotations:
    cpu-load-balancing.crio.io: "disable"
    irq-load-balancing.crio.io: "disable"
spec:
  template:
    spec:
      runtimeClassName: performance-rt
      containers:
        - name: app
          resources:
            requests:
              cpu: "2"
              memory: 256Mi
            limits:
              cpu: "2"
              memory: 256Mi

CPU Pool Scheduling Policies

Containers must use the correct scheduling policy for their CPU pool type.

Exclusive CPU Pool

Workloads in the exclusive CPU pool must use real-time (RT) scheduling policy with priority less than 10.

> Required for: Far-Edge (mandatory), all others (optional)

Isolated CPU Pool

Workloads in the isolated CPU pool must also use RT scheduling policy.

> Required for: Far-Edge (mandatory), all others (optional)

Shared CPU Pool

Workloads in the shared CPU pool must use non-RT scheduling policies (e.g., SCHED_OTHER) to share CPU time fairly with other applications and kernel threads.

> Required for: Far-Edge (mandatory), all others (optional)

CPU Pool Consistency

If one container in a pod selects an exclusive CPU pool, all containers in that pod must select the same CPU pool type.

> Required for: Far-Edge (mandatory), all others (optional)

Image Pull Policy

Containers must use IfNotPresent as the image pull policy. This ensures pods can restart even if the image registry is temporarily unavailable.

> Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

containers:
  - name: app
    image: registry.example.com/app:v1.2.3
    imagePullPolicy: IfNotPresent

Pod Ownership

Workload pods must be deployed as part of a ReplicaSet (via Deployment) or StatefulSet. Do not use naked pods or DaemonSets — they lack proper lifecycle management for updates, scaling, and recovery.

> Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

Storage Provisioning

Persistent Volume Reclaim Policy

Persistent volumes used by workloads must have a reclaim policy of Delete. This ensures storage is cleaned up when the workload is removed from the cluster.

> Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

apiVersion: v1
kind: PersistentVolume
metadata:
  name: app-pv
spec:
  persistentVolumeReclaimPolicy: Delete

Storage Provisioner

Multi-node clusters must not use local storage provisioners (kubernetes.io/no-provisioner, topolvm.io). Local storage is only appropriate for single-node clusters, where only one local provisioner type should be installed (LVMS or no-provisioner).

> Required for: all profiles (mandatory)

Implementation Checklist

• [ ] CPU-isolated workloads have identical CPU requests and limits in whole units
• [ ] CPU-isolated pods specify runtimeClassName and disable CPU/IRQ load-balancing
• [ ] Exclusive/isolated CPU pool workloads use RT scheduling policy
• [ ] Shared CPU pool workloads use non-RT scheduling policy (SCHED_OTHER)
• [ ] All containers in a pod use the same CPU pool type
• [ ] imagePullPolicy: IfNotPresent is set on all containers
• [ ] Workloads are deployed via Deployments or StatefulSets (no naked pods)
• [ ] Persistent volumes have persistentVolumeReclaimPolicy: Delete
• [ ] Multi-node clusters do not use local storage provisioners

Certsuite Test Mapping

| Guidance | Certsuite Test ID | Profiles | |----------|-------------------|----------| | CPU isolation | lifecycle-cpu-isolation | Telco/Far-Edge/Extended: mandatory, Non-Telco: optional | | Exclusive CPU pool RT scheduling | performance-exclusive-cpu-pool-rt-scheduling-policy | Far-Edge: mandatory, all others: optional | | Isolated CPU pool RT scheduling | performance-isolated-cpu-pool-rt-scheduling-policy | Far-Edge: mandatory, all others: optional | | Shared CPU pool non-RT scheduling | performance-shared-cpu-pool-non-rt-scheduling-policy | Far-Edge: mandatory, all others: optional | | CPU pool consistency | performance-exclusive-cpu-pool | Far-Edge: mandatory, all others: optional | | Image pull policy | lifecycle-image-pull-policy | Telco/Far-Edge/Extended: mandatory, Non-Telco: optional | | Pod ownership | lifecycle-pod-owner-type | Telco/Far-Edge/Extended: mandatory, Non-Telco: optional | | PV reclaim policy | lifecycle-persistent-volume-reclaim-policy | Telco/Far-Edge/Extended: mandatory, Non-Telco: optional | | Storage provisioner | lifecycle-storage-provisioner | All profiles: mandatory |

References

• CPU Manager for Kubernetes
• Topology Manager
• Configure Quality of Service for Pods
• Persistent Volumes
• Red Hat Best Practices for Kubernetes Guide
• Red Hat Best Practices Test Suite for Kubernetes (certsuite)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: RedHatProductSecurity
• Source: RedHatProductSecurity/prodsec-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.