1. Edit the Kubelet Configuration File 1 vim /etc/systemd/system/kubelet.service.d/10-kubeadm.conf Modify the relevant Kubelet parameters ExecStart=/usr/local/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS You can list the available parameters with the following command: 1 kubelet --help For example, if you need to change --sync-frequency in KUBELET_KUBECONFIG_ARGS, the period for syncing container configuration, the default value is 1 min.

1. Background As shown above, the business team needs to isolate the services in a namespace, forbidding access from workloads in the bar namespace while allowing users to reach the service through a Load Balancer (LB) via NodePort. It is easy to write a network policy: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 apiVersion: networking.

1. How to Deploy Jenkins To make the tests below easier, let me first introduce two ways to deploy Jenkins. Here I use the shaowenchen/jenkins:2.277.4 image. In a production environment, you should replace it with the official jenkins/jenkins image or your own custom image. 1.1 Running with docker-compose The docker-compose.yaml file

1. Configure Larger -Xms -Xmx Parameters Jenkins is an orchestration engine written in Java, and it stops the world (STW) during a Full GC. At large build scale, STW can prevent Jenkins from handling new requests. To avoid frequent STW while also increasing concurrency, it is recommended to set a larger heap, -Xms3g -Xmx6g -XX:MaxRAM=6g.

1. Network Isolation in Kubernetes Kubernetes introduced Network Policy in 1.3. It defines entities through ipBlock, podSelector, and namespaceSelector, and controls their From (Ingress) and To (Egress) traffic behavior. But Kubernetes only defines the network policy; the actual implementation depends on the network plugin. Today, network plugins such as Calico, Cilium, and Weave Net all support network isolation.