Orchestration in Docker

Transcription

1 Orchestration in Docker Swarm mode, Docker services and declarative application deployment Mike Goelzer & Victor Vieux Docker

2 Orchestration Overview Mike Goelzer / mgoelzer@docker.com / gh: mgoelzer

3 Orchestration in Docker Orchestration Swarm Mode Docker Services Security Routing mesh Container Healthcheck

4 Swarm Mode $ docker swarm init

5 Swarm Mode $ docker swarm init $ docker swarm join <IP of manager>:2377

6 Swarm Mode $ docker swarm init $ docker swarm join <IP of manager>:2377

7 Services mynet $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest

8 Services mynet $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest

9 Failure mynet $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest

10 Failure mynet $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest

11 Desired State Actual State mynet $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest

12 Converge Back to Desired State mynet $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest

13 Scaling mynet $ docker service scale frontend=6

14 Scaling mynet $ docker service scale frontend=10

15 Global Services mynet $ docker service create --mode=global --name prometheus prom/prometheus

16 Constraints docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"

17 Constraints docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd" $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp --constraint engline.labels.com.example.storage==ssd frontend_image:latest

18 Constraints docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd" $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp --constraint engline.labels.com.example.storage==ssd frontend_image:latest $ docker service scale frontend=10

19 Services

20 Services are grouped into stacks

21 Swarm mode orchestration is optional You don t have to use it 1.12 is fully backwards compatible Will not break existing deployments and scripts

22 Routing Mesh :8080 Manager :8080 : frontend frontend frontend User accesses myapp.com:8080 : Operator reserves a swarm-wide ingress port (8080) for myapp Every node listens on 8080 Container-aware routing mesh can transparently reroute traffic from 3 to a node that is running container Built in load balancing into the DNS-based service discovery $ docker service create --replicas 3 --name frontend --network mynet -p 8080:80 frontend_image:latest

23 Routing Mesh: Published Ports 1 frontend :8080 :8080 Manager : frontend frontend User accesses myapp.com:8080 : Operator reserves a swarm-wide ingress port (8080) for myapp Every node listens on 8080 Container-aware routing mesh can transparently reroute traffic from 3 to a node that is running container Built in load balancing into the DNS-based service discovery $ docker service create --replicas 3 --name frontend --network mynet -p 8080:80 frontend_image:latest

24 Security out of the box Cryptographic Identity Workload segregation (think PCI) There is no insecure mode : TLS mutual auth TLS encryption Certificate rotation

25 Container Health Check in Dockerfile HEALTHCHECK --interval=5m --timeout=3s --retries 3 CMD curl -f exit 1 Checks every 5 minutes that web server can return index page within 3 seconds. Three consecutive failures puts container in an unhealthy state.

26 Orchestration Deep Dive + demo at the end Victor Vieux / vieux@docker.com / gh: vieux

27 Swarm Topology

28 Swarm Topology Manager

29 Swarm Topology Each has a role Roles are dynamic Programmable Topology Manager

30 Docker swarm mode communication internals Internal Distributed State Store Raft consensus group Manager Manager Manager grpc Gossip network

31 Quorum Layer Internal Distributed State Store Raft consensus group Manager Manager Manager Strongly consistent: Holds desired state Simple to operate Blazing fast (in-memory reads, domain specific indexing,...) Secure

32 -to- Gossip Gossip network Eventually consistent: Routing mesh, load balancing rules,... High volume, p2p network between workers Secure: Symmetric encryption with key rotation in Raft

33 Breakdown docker service create API Accepts command from client and creates service object Manager R A F T Orchestrator Allocator Scheduler Reconciliation loop for service objects and creates tasks Allocates IP addresses to tasks Assigns nodes to tasks Dispatcher Checks in on workers Executor Connects to dispatcher to check on assigned tasks Executes the tasks assigned to worker node

34 Internal Load Balancer

35 Ingress Load Balancer

36 Secure by default with end-to-end encryption Manager TLS Manager TLS Manager TLS Cryptographic node identity Automatic encryption and mutual auth (TLS) Certificate Authority Certificate Authority Certificate Authority Automatic cert rotation External CA integration TLS TLS TLS

37 DEMO

38 Questions? Victor Vieux Mike Goelzer

39 Victor Vieux Mike Goelzer