# 高级 Pod 配置
LLMS index: [llms.txt](/llms.txt)
---
本页涵盖高级 Pod 配置主题，包括 [PriorityClass](#priorityclasses)、[RuntimeClass](#runtimeclasses)、
Pod 内的[安全上下文](#security-context)，并介绍[调度](/zh-cn/docs/concepts/scheduling-eviction/#scheduling)相关内容。
## PriorityClass {#priorityclasses}
**PriorityClass** 允许你设置 Pod 相对于其他 Pod 的重要性。
如果你为 Pod 分配了优先级类，Kubernetes 会根据你所指定的 PriorityClass 为该 Pod 设置 `.spec.priority` 字段
（你不能直接设置 `.spec.priority`）。如果 Pod 无法被调度，且原因是资源不足，
kube-scheduler
会尝试抢占较低优先级的 Pod，
以使较高优先级的 Pod 能够被调度。
PriorityClass 是一个集群级别的 API 对象，它将优先级类名称映射到一个整数优先级值。数值越大，优先级越高。
### 定义 PriorityClass {#defining-a-priorityclass}
```yaml
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: high-priority
value: 10000
globalDefault: false
description: "Priority class for high-priority workloads"
```
### 使用 PriorityClass 指定 Pod 优先级 {#specify-pod-priority-using-a-priorityclass}
apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- name: nginx
image: nginx
priorityClassName: high-priority
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
runtimeClassName: myclass
containers:
- name: mycontainer
image: nginx
apiVersion: v1
kind: Pod
metadata:
name: security-context-demo
spec:
securityContext: # 此项应用到整个 Pod
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
containers:
- name: sec-ctx-demo
image: registry.k8s.io/e2e-test-images/agnhost:2.45
command: ["sh", "-c", "sleep 1h"]
apiVersion: v1
kind: Pod
metadata:
name: security-context-demo-2
spec:
containers:
- name: sec-ctx-demo-2
image: gcr.io/google-samples/node-hello:1.0
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1000
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
注意：
你也可以使用 Pod 的 securityContext 来允许 Linux
容器进入特权模式。
特权模式会覆盖 securityContext 中的许多其他安全设置。
除非无法通过 securityContext 中的其他字段授予等效权限，否则应避免使用此设置。
你可以通过在 Pod 级别的安全上下文中设置 windowsOptions.hostProcess 标志，
以类似的特权模式运行 Windows 容器。有关详细信息和操作说明，
参阅创建 Windows HostProcess Pod。
apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- name: nginx
image: nginx
nodeSelector:
disktype: ssd
apiVersion: v1
kind: Pod
metadata:
name: with-node-affinity
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: topology.kubernetes.io/zone
operator: In
values:
- antarctica-east1
- antarctica-west1
containers:
- name: with-node-affinity
image: registry.k8s.io/pause:3.8
apiVersion: v1
kind: Pod
metadata:
name: with-pod-affinity
spec:
affinity:
podAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app
operator: In
values:
- database
topologyKey: topology.kubernetes.io/zone
containers:
- name: with-pod-affinity
image: registry.k8s.io/pause:3.8
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: myapp
image: nginx
tolerations:
- key: "key"
operator: "Equal"
value: "value"
effect: "NoSchedule"
---
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
name: kvisor-runtime
handler: kvisor-runtime
overhead:
podFixed:
memory: "2Gi"
cpu: "500m"
---
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
runtimeClassName: kvisor-runtime
containers:
- name: myapp
image: nginx
resources:
requests:
memory: "64Mi"
cpu: "250m"
limits:
memory: "128Mi"
cpu: "500m"