Orchestration in Docker Swarm mode, Docker services and declarative - - PowerPoint PPT Presentation

▶

Apr 24, 2023 201 likes •603 views

Orchestration in Docker Swarm mode, Docker services and declarative application deployment Mike Goelzer & Victor Vieux Docker Orchestration Overview Mike Goelzer / mgoelzer@docker.com / gh: mgoelzer Orchestration in Docker Orchestration

SLIDE 1

Orchestration in Docker

Swarm mode, Docker services and declarative application deployment

Mike Goelzer & Victor Vieux Docker

SLIDE 2

Mike Goelzer / mgoelzer@docker.com / gh: mgoelzer

Orchestration Overview

SLIDE 3

Orchestration in Docker

Orchestration

○ Swarm Mode ○ Docker Services ○ Security ○ Routing mesh

Container Healthcheck

SLIDE 4

Engine

Swarm Mode

$ docker swarm init

SLIDE 5

Engine

Swarm Mode

$ docker swarm init $ docker swarm join <IP of manager>:2377

Engine

SLIDE 6

Engine Engine Engine Engine Engine Engine

Swarm Mode

$ docker swarm init $ docker swarm join <IP of manager>:2377

SLIDE 7

Engine Engine Engine Engine Engine Engine

Services

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp frontend_image:latest

mynet

SLIDE 8

Engine Engine Engine Engine Engine Engine

Services

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp frontend_image:latest

$ docker service create --name redis --network mynet redis:latest

mynet

SLIDE 9

Engine Engine Engine Engine Engine Engine

Node Failure

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp frontend_image:latest

$ docker service create --name redis --network mynet redis:latest

mynet

SLIDE 10

Engine Engine Engine Engine Engine Engine

Node Failure

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp frontend_image:latest

$ docker service create --name redis --network mynet redis:latest

mynet

SLIDE 11

Engine Engine Engine Engine Engine

Desired State ≠ Actual State

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp frontend_image:latest

$ docker service create --name redis --network mynet redis:latest

mynet

SLIDE 12

Engine Engine Engine Engine Engine

Converge Back to Desired State

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp frontend_image:latest

$ docker service create --name redis --network mynet redis:latest

mynet

SLIDE 13

Engine Engine Engine Engine Engine

Scaling

$ docker service scale frontend=6

mynet

SLIDE 14

Engine Engine Engine Engine Engine

Scaling

$ docker service scale frontend=10

mynet

SLIDE 15

Engine Engine Engine Engine Engine

Global Services

$ docker service create --mode=global --name prometheus prom/prometheus

mynet

SLIDE 16

Engine Engine Engine Engine Engine

Constraints

Engine

docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"

SLIDE 17

Engine Engine Engine Engine Engine

Constraints

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp --constraint

engline.labels.com.example.storage==ssd frontend_image:latest

Engine

docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"

SLIDE 18

Engine Engine Engine Engine Engine

Constraints

$ docker service create --replicas 3 --name frontend --network mynet

-publish 80:80/tcp --constraint

engline.labels.com.example.storage==ssd frontend_image:latest $ docker service scale frontend=10

Engine

docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"

SLIDE 19

Services

SLIDE 20

Services are grouped into stacks

SLIDE 21

Swarm mode orchestration is optional

You don’t have to use it
1.12 is fully backwards compatible
Will not break existing deployments and scripts

SLIDE 22

Routing Mesh

Operator reserves a

swarm-wide ingress port (8080) for myapp

Every node listens on 8080
Container-aware routing mesh

can transparently reroute traffic from Worker3 to a node that is running container

Built in load balancing into the

Engine

DNS-based service discovery

Worker 1

:8080

Manager

User accesses myapp.com:8080

:8080

Worker 2

:8080

Worker 3

:8080

frontend frontend

$ docker service create --replicas 3 --name frontend --network mynet

p 8080:80 frontend_image:latest

frontend

SLIDE 23

Routing Mesh: Published Ports

Operator reserves a

swarm-wide ingress port (8080) for myapp

Every node listens on 8080
Container-aware routing mesh

can transparently reroute traffic from Worker3 to a node that is running container

Built in load balancing into the

Engine

DNS-based service discovery

Worker 1

:8080

Manager

User accesses myapp.com:8080

:8080

Worker 2

:8080

Worker 3

:8080

frontend frontend

$ docker service create --replicas 3 --name frontend --network mynet

p 8080:80 frontend_image:latest

frontend

SLIDE 24

Security out of the box

Cryptographic Node Identity

○ Workload segregation (think PCI)

There is no “insecure mode”:

○ TLS mutual auth ○ TLS encryption ○ Certificate rotation

SLIDE 25

HEALTHCHECK --interval=5m --timeout=3s

-retries 3

CMD curl -f http://localhost/ || exit 1 Checks every 5 minutes that web server can return index page within 3 seconds. Three consecutive failures puts container in an unhealthy state.

Container Health Check in Dockerfile

SLIDE 26

Victor Vieux / vieux@docker.com / gh: vieux

Orchestration Deep Dive

+ demo at the end

SLIDE 27

Node Node Node Node Node Node

Swarm Topology

Node Node Node Node Node Node

SLIDE 28

Node Node Node Node Node Node

Swarm Topology

Node Node Node Node Node Node

Manager Worker

SLIDE 29

Node Node Node Node Node Node

Swarm Topology

Node Node Node Node Node Node

Manager Worker

Each Node has a role
Roles are dynamic
Programmable Topology

SLIDE 30

Manager Manager Manager

Worker Worker Worker Worker Worker Worker Worker Internal Distributed State Store

Raft consensus group

Docker swarm mode communication internals

Gossip network gRPC

SLIDE 31

Manager Manager Manager

Internal Distributed State Store

Raft consensus group

Quorum Layer

Strongly consistent: Holds desired state
Simple to operate
Blazing fast (in-memory reads, domain specific indexing, ...)
Secure

SLIDE 32

Worker Worker Worker Worker Worker Worker Worker

Worker-to-Worker Gossip

Gossip network

Eventually consistent: Routing mesh, load balancing rules, ...
High volume, p2p network between workers
Secure: Symmetric encryption with key rotation in Raft

SLIDE 33

API Allocator Orchestrator Scheduler Dispatcher R A F T Manager Node Worker Executor Worker Node Accepts command from client and creates service object Reconciliation loop for service objects and creates tasks Allocates IP addresses to tasks Assigns nodes to tasks Checks in on workers docker service create Connects to dispatcher to check on assigned tasks

Node Breakdown

Executes the tasks assigned to worker node

SLIDE 34

Internal Load Balancer

SLIDE 35

Ingress Load Balancer

SLIDE 36

Secure by default with end-to-end encryption

Cryptographic node

identity

Automatic encryption

and mutual auth (TLS)

Automatic cert rotation
External CA

integration

Manager Node

Certificate Authority TLS

Manager Node

Certificate Authority TLS

Manager Node

Certificate Authority TLS

Worker

TLS

Worker

TLS

Worker

TLS

SLIDE 37

DEMO

SLIDE 38

Questions?

Victor Vieux vieux@docker.com / @vieux Mike Goelzer mgoelzer@docker.com / @mgoelzer

SLIDE 39

Victor Vieux vieux@docker.com / @vieux Mike Goelzer mgoelzer@docker.com / @mgoelzer