![Dockerfile
FROM ubuntu:14.04
ENV DEBIAN_FRONTEND noninteractive
ENV POSTMASTER_PASS password
RUN echo "force-unsafe-io" > /etc/dpkg/dpkg.cfg.d/02apt-speedup &&
apt-get update &&
apt-get --no-install-recommends -y install postfix sipcalc sasl2-bin
libsasl2-modules &&
apt-get clean
ADD rootfs /
ENTRYPOINT ["/start"]
EXPOSE 25](https://image.slidesharecdn.com/2017-03-1101-170311120523/85/2017-03-11-01-Docker-swarm-vs-Kubernetes-9-320.jpg)
![containers:
- name: debian-container
image: debian
volumeMounts:
- name: shared-data
mountPath: /pod-data
command: ["/bin/sh"]
args: ["-c", "echo Hello from the debian container > /pod-data/index.html"]
volumes:
- name: shared-data
emptyDir: {}
Pod](https://image.slidesharecdn.com/2017-03-1101-170311120523/85/2017-03-11-01-Docker-swarm-vs-Kubernetes-51-320.jpg)
2017-03-11 01 Игорь Родионов. Docker swarm vs Kubernetes
- 2. Зачем? ● Спрятать сложность ● Улучшить ИТ процессы ● Оптимальнее использовать ресурсы ● Обеспечить надежность
- 7. Containers ● FreeBSD Jail ● OpenVZ ● Virtuozzo Containers ● lmctfy ● Solaris containers ● LXC ● Docker ● rkt
- 8. Docker
- 9. Dockerfile FROM ubuntu:14.04 ENV DEBIAN_FRONTEND noninteractive ENV POSTMASTER_PASS password RUN echo "force-unsafe-io" > /etc/dpkg/dpkg.cfg.d/02apt-speedup && apt-get update && apt-get --no-install-recommends -y install postfix sipcalc sasl2-bin libsasl2-modules && apt-get clean ADD rootfs / ENTRYPOINT ["/start"] EXPOSE 25
- 10. Dockerfile > docker run -d -p 25:25 -e POSTMASTER_PASS=pass123 --name mail postfix
- 11. Dockerfile > docker run -d -p 80:80 --link mail:mail_gateway --name web wordpress
- 18. Н - надежность 0.2 0.2 X = 0.04
- 19. Н - надежность 0.2 0.2 X = 0.0080.2 X
- 20. В чем сложность? ● Как добавлять сервера в кластер? ● Как контролировать количество копий? ● Как обеспечить restart контейнера? ● Как балансировать нагрузку?
- 21. В чем сложность? ● Как деплоить контейнеры? ● Как конфигурировать контейнеры? ● Как обеспечить network между контейнерами? ● Что там с persistent storage?
- 22. В чем сложность? ● Как обеспечить разграничение доступа? ● Как собирать логи? ● Как ограничить cpumemory per container?
- 23. Инструменты
- 24. Кластер
- 25. Swarm Swarm-у рознь Docker version >= 1.12 Mode < 1.12 Container
- 27. Требования ● nodes available with network ● ports tcp 2377, 7946 ● ports udp 4789, 7946 ● docker >= 1.12
- 28. Cluster Init $ docker swarm init --advertise-addr <CURRENT IP>
- 29. Add worker $ docker swarm join-token worker
- 30. Add worker $ docker swarm join --token SWMTKN-1-49nj1cmql0jkz5s954yi3oex3ne dyz0fb0xx14ie39trti4wxv-8vxv8rssmk74 3ojnwacrr2e7c <MASTER IP>:2377
- 31. Add manager $ docker swarm join-token manager
- 32. Add manager $ docker swarm join --token SWMTKN-1-55ya5072akuzqr7kiy0rgy0akhw ohp8of73zhxojpebkkwbtwd-0jfwgomkyvwl fp0m73poapoe0 <MASTER IP>:2377
- 33. Cluster info $ docker node info ID HOSTNAME STATUS AVAILABILITY MANAGER STATUS 03g1y59jwfg7cf99w4lt0f662 worker2 Ready Active 9j68exjopxe7wfl6yuxml7a7j worker1 Ready Active dxn1zf6l61qsb1josjja83ngz * manager1 Ready Active Leader
- 34. Leave cluster $ docker swarm leave
- 38. Создание кластера ● Host OS ● Iaas Provider ● Network plugin ● Configuration manager
- 40. Создание кластера ● AWS - Kops / Juju / SaltStack ● Google Cloud - Hosted ● Azure - Hosted
- 41. $ aws iam create-group --group-name kops $ export arns="arn:aws:iam::aws:policy/AmazonEC2FullAccess arn:aws:iam::aws:policy/AmazonRoute53FullAccess arn:aws:iam::aws:policy/AmazonS3FullAccess arn:aws:iam::aws:policy/IAMFullAccess arn:aws:iam::aws:policy/AmazonVPCFullAccess" $ for arn in $arns; do aws iam attach-group-policy --policy-arn "$arn" --group-name kops; done $ aws iam create-user --user-name kops $ aws iam add-user-to-group --user-name kops --group-name kops $ aws iam create-access-key --user-name kops Создание кластера - права
- 42. $ ID=$(uuidgen) && aws route53 create-hosted-zone --name subdomain.example.com --caller-reference $ID Создание кластера - DNS
- 43. $ aws s3api put-bucket-versioning --bucket prefix-example --versioning-configuration Status=Enabled Создание кластера - State
- 44. export NAME=myfirstcluster.example.com export KOPS_STATE_STORE=s3://prefix-example-com-state-store Создание кластера - State
- 45. Создание кластера $ kops create cluster --node-count 3 --zones us-west-2a,us-west-2b --master-zones us-west-2a,us-west-2b --dns-zone kubernetes.com --node-size t2.medium --master-size t2.medium ${NAME}
- 46. Запуск
- 47. Запуск $ docker service create -p 25:25 -e POSTMASTER_PASS=pass123 --name mail postfix
- 48. Replica count $ docker service update postfix --replicas 3
- 50. $ kubectl create -f pod.yaml Pod
- 51. containers: - name: debian-container image: debian volumeMounts: - name: shared-data mountPath: /pod-data command: ["/bin/sh"] args: ["-c", "echo Hello from the debian container > /pod-data/index.html"] volumes: - name: shared-data emptyDir: {} Pod
- 52. Pod ● Atomic ● Share network (localhost:port) ● Share volumes
- 53. $ kubectl create -f replica_ctrl.yaml Replica controller
- 54. apiVersion: v1 kind: ReplicationController metadata: name: nginx spec: replicas: 3 selector: app: nginx template: {POD TEMPLATE} Replica controller
- 55. Network
- 56. Mesh network $ docker service create -p 25:25 -e POSTMASTER_PASS=pass123 --name mail postfix
- 57. Mesh network
- 58. Overlay network $ docker network create --driver overlay --subnet 10.0.9.0/24 --opt encrypted my-network
- 59. Overlay network $ docker network create --driver overlay --subnet 10.0.9.0/24 --opt encrypted my-network
- 60. Overlay network
- 62. $ kubectl create -f service.yaml Service
- 63. apiVersion: v1 kind: Service metadata: name: my-service spec: type: LoadBalancer ports: - port: 80 targetPort: 80 protocol: TCP name: http selector: app: WebApp Service
- 64. Service type ● LoadBalancer ● ClusterIP ● Node Port
- 65. Networking & DNS ● Contiv ● Flannel ● GCE networking ● Linux bridging ● Calico ● Kube-DNS ● SkyDNS
- 67. Secrets $ echo “This is secret” | docker secret create my_secret -
- 68. Secrets $ docker service create --secret my_secret --name mail postfix $ cat /run/secrets/my_secret This is secret
- 70. Configmap apiVersion: v1 kind: ConfigMap metadata: name: nginx_config data: default.conf: |- upstream backend { server localhost:8085; } server { listen 81; ... }
- 71. Secrets apiVersion: v1 kind: Secrets metadata: name: nginx_secret data: password: cGFzcwo=
- 72. As Volume kind: Pod ... volumeMounts: - name: certs mountPath: /etc/secrets ... volumes: - name: certs secret: secretName: certificates-secret
- 73. As Env Vars kind: Pod ... env: -name: POSTMASTER_USER valueFrom: secretKeyRef: name: credentials-secret key: user_name
- 74. Volumes
- 75. Volumes ● Standart docker volumes ● Azure plugin ● Flocker plugin ● GCE plugin
- 76. Volumes $ docker service create --mount type=bind,src=<HOST-PATH>,dst=<CONTAINER-PATH> --name myservice <IMAGE> $ docker service create --mount type=volume,src=<HOST-PATH>,dst=<CONTAINER-PATH> --name myservice <IMAGE>
- 78. Volumes ● emptyDir ● hostPath ● gcePersistentDisk ● awsElasticBlockStore ● nfs ● flocker ● glusterfs ● cephfs ● gitRepo ● persistentVolumeClaim ● AzureFileVolume ● AzureDiskVolume
- 79. Volumes kind: Pod ... volumeMounts: - name: html-volume mountPath: "/usr/share/nginx/html" volumes: - name: html-volume awsElasticBlockStore: # Enter the volume ID below volumeID: volume_ID fsType: ext4
- 80. Deployment
- 81. Deployment $ docker stack deploy -c docker-compose.yaml <STACK_NAME>
- 82. Volumes apiVersion: extensions/v1beta1 kind: Deployment metadata: name: App labels: chart: "App" spec: {REPLICA CONTROLLER TEMPLATE}
- 83. Addons ● Dashboard UI ● Main metics ● Logs collect ● Scheduled jobs ● Authentication ● Federation
- 85. Package manager
- 86. Geodesic ● Github based access management ● VPN ● Monitoring and alerts ● Slack integration ● SSL for all with let’s encrypt ● Bunch of helm packages
- 87. Resources ● https://docs.docker.com/engine/swarm/ ● https://kubernetes.io/docs/getting-started-guides ● https://github.com/kubernetes/kops ● https://github.com/kubernetes/helm ● https://github.com/kubernetes/charts ● https://github.com/cloudposse/geodesic