Taming unruly apps with open source networking

Editor's Notes

• #7: Monoliths couple change cycles together such that independent business capabilities have to be deployed on the same schedule. Something that is moving faster will have to wait for the slower services Services embedded in monoliths cannot be scaled independently, so load is far more difficult to account for efficiently. So what do you do? You size for peak Developers new to the organization must acclimate to a new team, learn a business domain, become familiar with an enormous code base all at once. So ramping up takes several months before you can get real developer productivity Can’t throw more people onto the problem. It just causes overcrowding, too many cooks in the kitchen syndrome, expensive coordination and communication overhead Technical Stacks are committed for the long haul. Introducing new techologies is considered a threat and can adversely affect the monolith
• #8: Strong modularization – each deployable service/app is tracked as one codebase tracked in version control. There can be many deployed instances across multiple environments The service explicity declares and isolates dependencies via appropriate tooling rather than depending on implicitly dependences in its deployment environment Configurations can differ between deployment envrionements (dev/stage/prod) and is injected via OS level environment variables. Backing services database or message brokers are treated as attached resources and consumed identically across all envrironment Build, release, run
• #14: Containers as a standalone is not enough – it requires automation -applications like Mesos, Kubernetes, OpenShift – help with scheduling automation
• #16: None, nothing in its networking namespace, just the loop back device.
• #17: NAT Bridge is the default networking docker option. It provides namespace isolation, communication between containers in the same host and leverage iptables, it allows ports in the address space of the host. Start the docker deamon, set ups network isolation, masquerading, each container would have its own networking address, Access the application from the outside, Port X goes to port Y Containers can talk to each other. Containers can discover each other. To make it cross-host, you have to expose all the services needed. There’s no concept like advanced networking like security group where a container can belong to a group and see the services that the group has allowed it to see.
• #18: Container equals host. In this networking setting, the containers are spawned in the same networking namespace in which the docker daemon is running. This allows the containers to see the same networking as the host. You should trust the container that runs, it is capable of negatively impacting your networking configurations. For network plumbing, Host networking would be useful, as one could make an image of a daemon that has dependences and it becomes the base network namespace.
• #19: Multiple containers can communicate with each other through the loopback device, share the name networking namespace Looks very similar to the pod concept in Kubernetes, second container uses the same IP as the first container (or full container between containers)
• #21: A flat network is a network that does not provide any segmentation options. A traditional L2 ethernet network is a "flat" network. Any servers attached to this network are able to see the same broadcast traffic and can contact each other without requiring a router. flat networks are often used to attach Nova servers to an existing L2 network (this is called a "provider network"). If 2 tenants are sharing the same cluster, tenant 1 can see the traffic from tenant 2. This is not desirable for a cloud because you want to offer tenant isolation. A vlan network is one that uses VLANs for segmentation. When you create a new network in Neutron, it will be assigned a VLAN ID from the range you have configured in your Neutron configuration. Using vlan networks requires that any switches in your environment are configured to trunk the corresponding VLANs. However, VLANS are difficult to set up and configure and creates a unique tunnel ID, but there’s a limitation of 4096 segmentation IDs GRE segmentation and VXLANs works by encapsulating network traffic and provides tenant isolation. It allows for overlapping subnets and IP ranges. Just like VLANS, it also creates a unique tunnel Id, but there’s headroom with 6 million. Unlike VLAN networks, overlay networks does not require you to synchronize our OpenStack configuration with your L2 swtich configuration. In VLAn, any switch in your environment are configured to trunk the corresponding VLANS, which can be troublesome if your
• #26: Fully virtualized Layer 2 to 4 Networking MidoNet helps create switches, routers, DHCP, NAT, load balancers and firewalls among other network services. Open Source Distributed containerizable “controller” Logical Switching Distributed virtual switching, Layer 2 over Layer 3, decoupled from the physical network without limitations of convention VLANs Interconnect with VLAN/VxLAN networks (physical and virtual) via software L2 Gateway Logical Routing Routing between virtual networks without exiting the software container Logical Firewall Distributed Firewall that is integrated with the Linux kernel Enforces security policies at ingress (to keep bad traffic from the private cloud) – Native security groups Layer 4 Load balancing with health monitor Distributed Stateful NAT Bring traffic from an external network to a floating IP address for a tenant router Perform network address translation from the external network's public IP address to a private IP address and in the reverse direction.
• #27: How it works Cross-host networking for containers Advanced networking opportunities Solves these problems that the traditional networking could not address
• #28: Cross-host networking for containers Advanced networking opportunities Today MidoNet uses docker event interface to gather container information Planned integration with Docker libnetwork. MidoNet plugin to Docker to provide advanced networking for cross-host containers (e.g. tunneling, load balancing and more)
• #30: What happens when you launch an instance,
• #31: Source: Google analytics, midonet.org (Nov 2014 to August 31, 2015)