@briandorsey #kubernetes #GOTOber

Transcription

1 1

2 Kubernetes Changing the way we think and talk about computing GOTO Berlin - December

3 What is this talk? Container 3

4 Brian Dorsey Developer Advocate - Google Cloud platform 4

5 Containers? Yes/No if yes GOTO slide 7; if no GOTO slide 15; 5

6 Containers

7 The Old Way: Shared Machines No isolation app app app app No namespacing Common libs Highly coupled apps and OS libs kernel Bare Metal 7

8 The Old Way: Virtual Machines Some isolation app app libs libs kernel kernel app app libs libs kernel kernel Expensive and inefficient Still highly coupled to the guest OS Hard to manage Hypervisor 8

9 The New Way: Containers App specific isolation Lightweight & efficient app app libs libs app app libs libs Independent of the host Linux distribution Lots of containers to manage kernel Hypervisor 9

10 Container Images An image is a stack of Read-Only file system layers. Usual process: build push to repository pull to execution host start container from image App PHP & Apache Libs Debian 10

11 Image Layers Read / Write A container is a process started with kernel restrictions a stack of shared Read-Only file system layers plus a process specific ReadWrite layer Read / Write Read / Write App PHP & Apache Libs Debian Every new container gets a new Read-Write later. All containers from the same image start from exactly the same state! 11

12 Mounting Host Directories It's possible to mount host directories into a container's filesystem. These are mutable and do outlive the container. Read / Write host dir App PHP & Apache Libs They're only available on that host. Debian 12

13 Why containers? Performance Repeatability Quality of service Accounting Portability A fundamentally different way of managing applications Images by Connie Zhou 13

14 Containers are awesome! Let s run lots of them! 14

15 Kubernetes

16 PaaS Virtual Machines Physical Computers 16

17 PaaS Container Clusters Virtual Machines Physical Computers 17

18 Kubernetes Greek for Helmsman ; also the root of the words governor and cybernetic Runs and manages containers Inspired and informed by Google s experiences and internal systems Supports multiple cloud and bare-metal environments Supports multiple container runtimes 100% Open source, written in Go Manage applications, not machines 18

19 Everything at Google runs in containers: Gmail, Web Search, Maps,... MapReduce, batch,... GFS, Colossus,... Even Google s Cloud Platform: VMs run in containers! 19

20 Everything at Google runs in containers: Gmail, Web Search, Maps,... MapReduce, batch,... GFS, Colossus,... Even Google s Cloud Platform: VMs run in containers! We launch over 2 billion containers per week 20

21 A toolkit for running distributed systems in production co-locating helper processes naming and discovery mounting storage systems load balancing distributing secrets rolling updates application health checking resource monitoring replicating application instances log access and ingestion horizontal auto-scaling support for introspection and debugging 21

22 Start with a Cluster Laptop to high-availability multi-node cluster Hosted or self managed On-Premise or Cloud Bare Metal or Virtual Machines Most OSes (inc. RedHat Atomic, Fedora, CentOS) Or just a bunch of Raspberry PIs Many options, See Matrix for details Kubernetes Cluster Matrix: 22

23 Start with a Cluster Kubernetes Master Scheduler API Server Kubelet Kubelet Kubelet 23

24 Setting up a cluster Choose a platform: GCE, AWS, Azure, Rackspace, Ubuntu, Juju Then run: export KUBERNETES_PROVIDER=<your_provider>; curl -ss bash Or choose a distro such as RedHat Atomic, CoreOS Tectonic, Mirantis Murano (OpenStack), Mesos Or use a recipes for bare metal configurations for Centos, Fedora, etc Use a hosted option such as Google Container Engine 24

25 Deploy containers $ kubectl run my-nginx --image=nginx --replicas=2 --port=80 25

26 26

27 A pod of whales containers Consumers The atom of scheduling for containers An application specific logical host Hosts containers and volumes Each has its own routable IP address (no NAT) Web Server Ephemeral s are functionally identical and therefore ephemeral and replaceable Volume 27

28 s Can be used to group multiple containers & shared volumes Consumers git Repo Containers within a pod are tightly coupled Shared namespaces Containers in a pod share IP, port and IPC namespaces Containers in a pod talk to each other through localhost Git Synchronizer Node.js App Container Volume 28

29 Networking (across nodes) s have IPs which are routable s can reach each other without NAT Even across nodes /24 No Brokering of Port Numbers These are fundamental requirements /24 Many solutions Flannel, Weave, OpenVSwitch, Cloud Provider / /24 29

30 Create a service $ kubectl expose rc my-nginx --port=80 --type=loadbalancer 30

31 Services Client A logical grouping of pods that perform the same function grouped by label selector VIP Load balances incoming requests across constituent pods Service Label selector: type = FE Choice of pod is random but supports session affinity (ClientIP) Gets a stable virtual IP and port also a DNS name Container type = FE Container type = FE Container Container type = FE 31

32 Labels These are important Dashboard Dashboard show: type = FE type = FE frontend frontend type = FE show: version = v2 version = v2 version = v2 Behavior Benefits Metadata with semantic meaning Membership identifier The only Grouping Mechanism Allow for intent of many users (e.g. dashboards) Build higher level systems Queryable by Selectors 32

33 Replication Controllers Replication Replication Controller Controller #pods = 2 version = v1 version= v1 frontend frontend version = v1 version = v2 Replication Controller #pods = 1 version = v2 show: version = v2 show: version = v2 Behavior Keeps s running Gives direct control of #s Grouped by Label Selector Benefits Recreates s, maintains desired state Fine-grained control for scaling Standard grouping semantics 33

34 Replication Controller Replication Controllers Replication Controller Canonical example of control loops Have one job: ensure N copies of a pod if too few, start new ones if too many, kill some group == selector Replicated pods are fungible - Name = backend Selector = { name : backend } Template = {... } NumReplicas = 4 Start 1 more How many? 3 How many? OK 4 No implied order or identity API Server 34

35 Managing Deployments

36 Scale $ kubectl scale rc my-nginx --replicas=5 36

37 Scaling Example Replication Replication Controller Controller version = v1 type = FE 1 4 #pods = 2 frontend frontend version= v1 version = v1 version = v1 version = v1 type = FE type = FE type = FE type = FE show: version = v2 Service Service name = frontend Label selectors: version = 1.0 Label selector: type = Frontend type = FE 37

38 Canary Replication Replication Controller Controller version = v1 type = BE #pods = 2 frontend frontend version= v1 version = v1 version = v2 type = BE type = BE type = BE show: version = v2 Replication Replication Controller Controller version = v2 type = BE #pods = 1 show: version = v2 Service Service name = backend Label selectors: version = 1.0 Label selector: type = Frontend type = BE 38

39 Rolling Update $ kubectl rolling-update frontend --image=frontend:v2 39

40 Rolling Update Replication Replication Controller Controller version = v1 type = BE #pods = 2 frontend version= v1 version = v2 v1 version = v2 type = BE type = BE type = BE show: version = v2 Replication Controller version = v2 type = BE #pods = 2 show: version = v2 Service Service name = backend Label selectors: version = 1.0 Label selector: type = Frontend type = BE 40

41 Autoscale $ kubectl autoscale rc frontend --min=1 --max=20 41

42 Horizontal Autoscaling Beta (1.1) Replication Replication Controller Controller name=locust role=worker 2 1 #pods = 4 frontend frontend name=locust name=locust name=locust name=locust role=worker role=worker role=worker role=worker show: version = v2 70% CPU Scale CPU Target% = 50 40% CPU Heapster >< 50% CPU 42

43 Managing State

44 I still have questions about state! Database In a cluster of ephemeral containers Application state must exist outside of the container 44

45 Volumes Bound to the that encloses it Look like Directories to Containers What and where they are determined by Volume Type Many Volume options EmptyDir HostPath nfs, iscsi (and similar services) Cloud Provider Block Storage 45

46 Outside the Cluster Database e.g.: MySQL managed by DBAs or managed cloud services App App App App App App App App App 46

47 Adapt to run in the Cluster App App App App App App App App App Database e.g.: MySQL runs in a pod and mounts a filesystem provided by the cluster 47

48 Cluster Native App App App App App App App App App ex: run Cassandra or Riak inside the cluster 48

49 Cluster native - MySQL on Vitess Open source MySQL scaling solution Vitess has been serving all YouTube database traffic since 2011 Replication, dynamic sharding, caching and more Designed for a distributed, containerized world Kubernetes configs included 49

50 Secrets Problem: how to grant a pod access to a secured something? don t put secrets in the container image! 12-factor says: config comes from the environment Kubernetes is the environment Secret node Manage secrets via the Kubernetes API Inject them as virtual volumes into s late-binding tmpfs - never touches disk App 50

51 Wrap-up

52 Kubernetes status & plans Open sourced in June, 2014 v1.0 in July, 2015, v1.1 in November 2015 Google Container Engine (GKE) hosted Kubernetes - don t think about cluster setup GA in August, 2015 PaaSes: RedHat OpenShift, Deis, Stratos Distros: CoreOS Tectonic, Mirantis Murano (OpenStack), RedHat Atomic, Mesos Working towards a 1.2 release 52

53 Google Container Engine (GA) -- Demo Managed Kubernetes (Kubernetes v1.1) Manages Kubernetes master uptime Manages Updates Cluster Resize via Managed Instance Groups Cluster Node Autoscaling Centralized Logging Google Cloud VPN support 53

54 Kubernetes is Open Source We want your help! Slack: 54

55 PaaS Yo ap ur p? Container Clusters Virtual Machines Physical Computers 55

56 Tweet questions afterwards Slides: goo.gl/ni1gam Questions 56

57 57