It Takes a Village to Raise a Kubernetes

Editor’s note: this post is part of a series of in-depth articles on what’s new in Kubernetes 1.8, written by Jaice Singer DuMars from Microsoft.Each time we release a new version of Kubernetes, it’s enthralling to see how the community responds to all of the hard work that went into it. Blogs on new or enhanced capabilities crop up all over the web like wildflowers in the spring. Talks, videos, webinars, and demos are not far behind. As soon as the community seems to take this all in, we turn around and add more to the mix. It’s a thrilling time to be a part of this project, and even more so, the movement. It’s not just software anymore.When circumstances opened the door for me to lead the 1.8 release, I signed on despite a minor case of the butterflies. In a private conversation with another community member, they assured me that “being organized, following up, and knowing when to ask for help” were the keys to being a successful lead. That’s when I knew I could do it — and so I did.From that point forward, I was wrapped in a patchwork quilt of community that magically appeared at just the right moments. The community’s commitment and earnest passion for quality, consistency, and accountability formed a bedrock from which the release itself was chiseled.The 1.8 release team proved incredibly cohesive despite a late start. We approached even the most difficult situations with humor, diligence, and sincere curiosity. My experience leading large teams served me well, and underscored another difference about this release: it was more valuable for me to focus on leadership than diving into the technical weeds to solve every problem.Also, the uplifting power of emoji in Slack cannot be overestimated.An important inflection point is underway in the Kubernetes project. If you’ve taken a ride on a “startup rollercoaster,” this is a familiar story. You come up with an idea so crazy that it might work. You build it, get traction, and slowly clickity-clack up that first big hill. The view from the top is dizzying, as you’ve poured countless hours of life into something completely unknown. Once you go over the top of that hill, everything changes. Breakneck acceleration defines or destroys what has been built.In my experience, that zero gravity point is where everyone in the company (or in this case, project) has to get serious about not only building something, but also maintaining it. Without a commitment to maintenance, things go awry really quickly. From codebases that resemble the Winchester Mystery House to epidemics of crashing production implementations, a fiery descent into chaos can happen quickly despite the outward appearance of success. Thankfully, the Kubernetes community seems to be riding our growth rollercoaster with increasing success at each release.As software startups mature, there is a natural evolution reflected in the increasing distribution of labor. Explosive adoption means that full-time security, operations, quality, documentation, and project management staff become necessary to deliver stability, reliability, and extensibility. Also, you know things are getting serious when intentional architecture becomes necessary to ensure consistency over time.Kubernetes has followed a similar path. In the absence of company departments or skill-specific teams, Special Interest Groups (SIGs) have organically formed around core project needs like storage, networking, API machinery, applications, and the operational lifecycle. As SIGs have proliferated, the Kubernetes governance model has crystallized around them, providing a framework for code ownership and shared responsibility. SIGs also help ensure the community is sustainable because success is often more about people than code.At the Kubernetes leadership summit in June, a proposed SIG architecture was ratified with a unanimous vote, underscoring a stability theme that seemed to permeate every conversation in one way or another. The days of filling in major functionality gaps appear to be over, and a new era of feature depth has emerged in its place.Another change is the move away from project-level release “feature themes” to SIG-level initiatives delivered in increments over the course of several releases. That’s an important shift: SIGs have a mission, and everything they deliver should ultimately serve that. As a community, we need to provide facilitation and support so SIGs are empowered to do their best work with minimal overhead and maximum transparency.Wisely, the community also spotted the opportunity to provide safe mechanisms for innovation that are increasingly less dependent on the code in kubernetes/kubernetes. This in turn creates a flourishing habitat for experimentation without hampering overall velocity. The project can also address technical debt created during the initial ride up the rollercoaster. However, new mechanisms for innovation present an architectural challenge in defining what is and is not Kubernetes. SIG Architecture addresses the challenge of defining Kubernetes’ boundaries. It’s a work in progress that trends toward continuous improvement.This can be a little overwhelming at the individual level. In reality, it’s not that much different from any other successful startup, save for the fact that authority does not come from a traditional org chart. It comes from SIGs, community technical leaders, the newly-formed steering committee, and ultimately you.The Kubernetes release process provides a special opportunity to see everything that makes this project tick. I’ll tell you what I saw: people, working together, to do the best they can, in service to everyone who sets out on the cloud native journey.
Quelle: kubernetes

Finnish Railways and Accenture Partner to Modernize Key Transportation Apps  

VR Group is the state-owned company that runs Finnish Railways, and provides 82 million passenger train rides and transports 36 million tons of goods per year. The 150+ year old transportation business is broken into separate divisions, each with their own technology departments. Finnish Railways does not have an in-house development team, so each division leverages external vendors and partners for their application development needs.
On Day 2 of DockerCon Europe, Markus Niskanen, Integration Manager at VR Group, and Oscar Renalias, Solutions Architect at Accenture presented their story on how they worked together to modernize critical business applications for Finnish Railways, including the reservation and commuter applications.

Partnership Drives Faster Results
Finnish Railways began working with Accenture, a long-time partner, to design a new common application platform based on Docker Enterprise Edition (EE). Leveraging Accenture’s Container Migration Factory, Finnish Railways had access to hundreds of Docker-trained Accenture architects which meant that this project could be delivered more efficiently. For example, Accenture has customized Terraform scripts that set up a Docker EE environment in AWS in about 25 minutes.
They started with the old reservation system which was running on mainframe and a legacy commuter service application. They rewrote these applications with microservices and also moved from proprietary software platforms to include more open source components.
Expanding App Modernization Across the Organization
The implementation of Docker EE began about a year ago and as the first applications were getting rewritten, the team also saw the opportunity to simply migrate some existing applications to the Docker platform. Docker EE has now become the single platform for all types of applications – from non-production development workloads to greenfield microservices apps to brownfield legacy applications.
The commuter services app went live in June, and the new reservation system went live in August of this year. Finnish Railways has already seen some impressive results:

Average cost savings of 50%
Better visibility into all of the apps with centralized logging and monitoring
Standardization on a common platform and architecture that can be leveraged across all applications and by all of Finnish Railways’ vendors
A consistent app delivery pipeline that works the same for everyone. This makes it easy to bring new contractors and vendors into the same environment and processes.

Finnish Railways has accomplished a lot this year with their Docker EE platform. These early successes have made it possible for Markus to now bring the platform to even more teams within the company and they are actively expanding their footprint with the goal of getting everything over to Docker EE.
To learn more about Finnish Railway’s Docker EE deployment and the services provided by Accenture, also watch their breakout session:

To learn more about Docker Enterprise Edition:

Learn more about Docker EE
Try Docker EE for free and view subscription plans 
Sign up for upcoming webinars

 

Finnish Railways @VRpalvelu and @Accenture Partner to Modernize Key Transportation Apps w/ #docker…Click To Tweet

The post Finnish Railways and Accenture Partner to Modernize Key Transportation Apps   appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

kubeadm v1.8 Released: Introducing Easy Upgrades for Kubernetes Clusters

Editor’s note: this post is part of a series of in-depth articles on what’s new in Kubernetes 1.8Since its debut in September 2016, the Cluster Lifecycle Special Interest Group (SIG) has established kubeadm as the easiest Kubernetes bootstrap method. Now, we’re releasing kubeadm v1.8.0 in tandem with the release of Kubernetes v1.8.0. In this blog post, I’ll walk you through the changes we’ve made to kubeadm since the last update, the scope of kubeadm, and how you can contribute to this effort.Security first: kubeadm v1.6 & v1.7Previously, we discussed planned updates for kubeadm v1.6. Our primary focus for v1.6 was security. We started enforcing role based access control (RBAC) as it graduated to beta, gave unique identities and locked-down privileges for different system components in the cluster, disabled the insecure `localhost:8080` API server port, started authorizing all API calls to the kubelets, and improved the token discovery method used formerly in v1.5. Token discovery (aka Bootstrap Tokens) graduated to beta in v1.8.In number of features, kubeadm v1.7.0 was a much smaller release compared to v1.6.0 and v1.8.0. The main additions were enforcing the Node Authorizer, which significantly reduces the attack surface for a Kubernetes cluster, and initial, limited upgrading support from v1.6 clusters.Easier upgrades, extensibility, and stabilization in v1.8We had eight weeks between Kubernetes v1.7.0 and our stabilization period (code freeze) to implement new features and to stabilize the upcoming v1.8.0 release. Our goal for kubeadm v1.8.0 was to make it more extensible. We wanted to add a lot of new features and improvements in this cycle, and we succeeded.Upgrades along with better introspectability. The most important update in kubeadm v1.8.0 (and my favorite new feature) is one-command upgrades of the control plane. While v1.7.0 had the ability to upgrade clusters, the user experience was far from optimal, and the process was risky.Now, you can easily check to see if your system can handle an upgrade by entering:$ kubeadm upgrade planThis gives you information about which versions you can upgrade to, as well as the health of your cluster.You can examine the effects an upgrade will have on your system by specifying the –dry-run flag. In previous versions of kubeadm, upgrades were essentially blind in that you could only make assumptions about how an upgrade would impact your cluster. With the new dry run feature, there is no more mystery. You can see exactly what applying an upgrade would do before applying it.After checking to see how an upgrade will affect your cluster, you can apply the upgrade by typing:$ kubeadm upgrade apply v1.8.0This is a much cleaner and safer way of performing an upgrade than the previous version. As with any type of upgrade or downgrade, it’s a good idea to backup your cluster first using your preferred solution.Self-hostingSelf-hosting in this context refers to a specific way of setting up the control plane. The self-hosting concept was initially developed by CoreOS in their bootkube project. The long-term goal is to move this functionality (currently in an alpha stage) to the generic kubeadm toolbox. Self-hosting means that the control plane components, the API Server, Controller Manager and Scheduler are workloads themselves in the cluster they run. This means the control plane components can be managed using Kubernetes primitives, which has numerous advantages. For instance, leader-elected components like the scheduler and controller-manager will automatically be run on all masters when HA is implemented if they are run in a DaemonSet. Rolling upgrades in Kubernetes can be used for upgrades of the control plane components, and next to no extra code has to be written for that to work; it’s one of Kubernetes’ built-in primitives!Self-hosting won’t be the default until v1.9.0, but users can easily test the feature in experimental clusters. If you test this feature, we’d love your feedback!You can test out self-hosting by enabling its feature gate:$ kubeadm init –feature-gates=SelfHosting=trueExtensibilityWe’ve added some new extensibility features. You can delegate some tasks, like generating certificates or writing control plane arguments to kubeadm, but still drive the control plane bootstrap process yourself. Basically, you can let kubeadm do some parts and fill in yourself where you need customizations. Previously, you could only use kubeadm init to perform “the full meal deal.” The inclusion of the kubeadm alpha phase command supports our aim to make kubeadm more modular, letting you invoke atomic sub-steps of the bootstrap process.In v1.8.0, kubeadm alpha phase is just that: an alpha preview. We hope that we can graduate the command to beta as kubeadm phase in v1.9.0. We can’t wait for feedback from the community on how to better improve this feature!ImprovementsAlong with our new kubeadm features, we’ve also made improvements to existing ones. The Bootstrap Token feature that makes `kubeadm join` so short and sweet has graduated from alpha to beta and gained even more security features.If you made customizations to your system in v1.6 or v1.7, you had to remember what those customizations were when you upgraded your cluster. No longer: beginning with v1.8.0, kubeadm uploads your configuration to a ConfigMap inside of the cluster, and later reads that configuration when upgrading for a seamless user experience.The first certificate rotation feature has graduated to beta in v1.8, which is great to see. Thanks to the Auth Special Interest Group, the Kubernetes node component kubelet can now rotate its client certificate automatically. We expect this area to improve continuously, and will continue to be a part of this cross-SIG effort to easily rotate all certificates in any cluster.Last but not least, kubeadm is more resilient now. kubeadm init will detect even more faulty environments earlier, and time out instead of waiting forever for the expected condition.The scope of kubeadmAs there are so many different end-to-end installers for Kubernetes, there is some fragmentation in the ecosystem. With each new release of Kubernetes, these installers naturally become more divergent. This can create problems down the line if users rely on installer-specific variations and hooks that aren’t standardized in any way. Our goal from the beginning has been to make kubeadm a building block for deploying Kubernetes clusters and to provide kubeadm init and kubeadm join as best-practice “fast paths” for new Kubernetes users. Ideally, using kubeadm as the basis of all deployments will make it easier to create conformant clusters.kubeadm performs the actions necessary to get a minimum viable cluster up and running. It only cares about bootstrapping, not about provisioning machines, by design. Likewise, installing various nice-to-have addons by default like the Kubernetes Dashboard, some monitoring solution, cloud provider-specific addons, etc. is not in scope. Instead, we expect higher-level and more tailored tooling to be built on top of kubeadm, that installs the software the end user needs.v1.9.0 and beyondWhat’s in store for the future of kubeadm?Planned featuresWe plan to address high availability (replicated etcd and multiple, redundant API servers and other control plane components) as an alpha feature in v1.9.0. This has been a regular request from our user base.Also, we want to make self-hosting the default way to deploy your control plane: Kubernetes becomes much easier to manage if we can rely on Kubernetes’ own tools to manage the cluster components.Promoting kubeadm adoption and getting involvedThe kubeadm adoption working group is an ongoing effort between SIG Cluster Lifecycle and other parties in the Kubernetes ecosystem. This working group focuses on making kubeadm more extensible in order to promote adoption of it for other end-to-end installers in the community. Everyone is welcome to join. So far, we’re glad to announce that kubespray started using kubeadm under the hood, and gained new features at the same time! We’re excited to see others follow and make the ecosystem stronger.kubeadm is a great way to learn about Kubernetes: it binds all of Kubernetes’ components together in a single package. To learn more about what kubeadm really does under the hood, this document describes kubeadm functions in v1.8.0.If you want to get involved in these efforts, join SIG Cluster Lifecycle. We meet on Zoom once a week on Tuesdays at 16:00 UTC. For more information about what we talk about in our weekly meetings, check out our meeting notes. Meetings are a great educational opportunity, even if you don’t want to jump in and present your own ideas right away. You can also sign up for our mailing list, join our Slack channel, or check out the video archive of our past meetings. Even if you’re only interested in watching the video calls initially, we’re excited to welcome you as a new member to SIG Cluster Lifecycle!If you want to know what a kubeadm developer does at a given time in the Kubernetes release cycle, check out this doc. Finally, don’t hesitate to join if any of our upcoming projects are of interest to you!Thank you,Lucas KäldströmKubernetes maintainer & SIG Cluster Lifecycle co-leadWeaveworks contractor
Quelle: kubernetes

DockerCon EU 2017: All the videos are now live!

In case you missed it last week, here are the highlights from DockerCon Europe 2017 including recordings of the keynotes. We’re excited to announce that most of the breakout videos are now available online! A big thanks to all our awesome speakers for working hard on the content of their sessions. All the videos are published on the Docker Website, the slides available from the Docker Slideshare account and photos soon uploaded to a DockerCon EU 2017 album on facebook.

Here are the links to the playlists of each track:  
Using Docker
Using Docker sessions are introductory sessions for Docker users, dev and ops alike. Filled with practical advice, learnings and insight, these sessions will help you get started with Docker or better implement Docker into your workflow.
Docker Best Practices
Docker Best Practices sessions provide a deeper dive into Docker tooling, implementation and real world production use recommendations. If you are ready to get to the next level with your Docker usage, join this track for best practices from the Docker team.
Use Case
Use case sessions highlight how companies are using Docker to modernize their infrastructure and build, ship and run distributed applications. These sessions are heavy on business value, ROI and production implementation advice and learnings.
Black Belt
One way to achieve a deep understanding of a complex system is to isolate the various components of that system, as well as those that interact with it, and examine all of them relentlessly. This is what we do in the Black Belt track! It features deeply technical talks covering not only container technology but also related projects.
Edge [NEW!]
The Edge Track shows how containers are redefining our technology toolbox, from solving old problems in a new way to pushing the boundaries of what we can accomplish with software. Sessions in this track provide a glimpse into the new container frontier.
Transform [NEW!]
The transform track focuses on the impact of change – both for organizations and ourselves as individuals and communities. Filled with inspiration, insights and new perspectives, these stories will leave you energized and equipped to drive innovation.
Community Theater
Located in the main conference hall, the Community Theater will feature lightning talks and cool hacks from the Docker community and ecosystem.
Note that the videos from the ecosystem tracks are not posted directly on the Docker website but directly shared with DockerCon sponsors for them to share with their communities. The Moby Summit videos will be available later this week on the Moby Project website.
Learn more about Docker:

Check out the Play with Docker Classroom
Try Docker EE for free
Sign up for upcoming webinars
Save the date for DockerCon 2018

 

All the @dockercon EU 2017 videos and slides are now live! #dockercon #docker #learndocker Click To Tweet

The post DockerCon EU 2017: All the videos are now live! appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Five Days of Kubernetes 1.8

Kubernetes 1.8 is live, made possible by hundreds of contributors pushing thousands of commits in this latest releases.The community has tallied more than 66,000 commits in the main repo and continues rapid growth outside of the main repo, which signals growing maturity and stability for the project. The community has logged more than 120,000 commits across all repos and 17,839 commits across all repos for v1.7.0 to v1.8.0 alone.With the help of our growing community of 1,400 plus contributors, we issued more than 3,000 PRs and pushed more than 5,000 commits to deliver Kubernetes 1.8 with significant security and workload support updates. This all points to increased stability, a result of our project-wide focus on maturing process, formalizing architecture, and strengthening Kubernetes’ governance model.While many improvements have been contributed, we highlight key features in this series of in-depth posts listed below. Follow along and see what’s new and improved with storage, security and more.Day 1: 5 Days of Kubernetes 1.8Day 2: kubeadm v1.8 Introduces Easy Upgrades for Kubernetes ClustersDay 3: Kuberentes v.1.8 Retrospective: It Takes a Village to Raise a KubernetesDay 4: Using RBAC, Generally Available in Kubernetes v1.8Day 5: Enforcing Network Policies in KubernetesConnectPost questions (or answer questions) on Stack Overflow Join the community portal for advocates on K8sPort Follow us on Twitter @Kubernetesio for latest updates Connect with the community on Slack Get involved with the Kubernetes project on GitHub
Quelle: kubernetes

What is Notary and why is it important to CNCF?

As you may have heard, the Notary project has been invited to join the Cloud Native Computing Foundation (CNCF). Much like its real world namesake, Notary is a platform for establishing trust over pieces of content.
In life, certain important events such as buying a house are facilitated by a trusted third party called a “notary.” When buying a house, this person is typically employed by the lender to verify your identity and serve as a witness to your signatures on the mortgage agreement. The notary carries a special stamp and will also sign the documents as an affirmation that a notary was present and verified all the required information relating to the borrowers.
In a similar manner, the Notary project, initially sponsored by Docker, is designed to provide high levels of trust  over digital content using strong cryptographic signatures. In addition to ensuring the provenance of the software, it also provides guarantees that the content is not modified without approval of the author anywhere in the supply chain.  This then allows higher level systems like Docker Enterprise Edition (EE)  with Docker Content Trust (which uses Notary) to establish clear policy on the usage of content.  For instance, a policy can be set that only signed content can be used at runtime and deployed by the orchestrators in the Docker platform. Overall Notary is a core piece of plumbing in Docker’s  approach to the secure supply chain whereby security is seamlessly and uniformly embedded into a workflow from development all the way through to operations.
Notary is an implementation of The Update Framework (TUF) written in Go. TUF was developed at the NYU Tandon School of Engineering. TUF was submitted to join CNCF in partnership with Notary. The combined nature of these two projects makes for a particularly compelling donation– both the specification and most widely deployed implementation are coming in together under the auspices of the CNCF.
With technologies such as containerd and Kubernetes already members of CNCF, Notary and TUF are the first security-related projects to be added to the CNFC. This year has seen a significant uptick in data security compromises and we believe the CNCF is positioning itself ahead of the curve by inviting Notary and TUF to join. We hope that more security-focused projects are added to the CNCF over time.
Notary is already used in production environments beyond container distribution with Cloudflare integrating it into their PAL tool for container identity bootstrapping and Kolide using it to secure their autoupdater for the osquery tool. If current trends continue, there will be many more users in search of tools to secure their software distribution channels in the near future and Notary, TUF, and the CNCF will be well positioned to meet that need.
 

What is #Notary and why is it important to @CloudNativeFdn ? @moby #securityClick To Tweet

The post What is Notary and why is it important to CNCF? appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Introducing Software Certification for Kubernetes

Editor’s Note: Today’s post is by William Denniss, Product Manager, Google Cloud on the new Kubernetes Software Conformance Certification program.Over the last three years, Kubernetes® has seen wide-scale adoption by a vibrant and diverse community of providers. In fact, there are now more than 60 known Kubernetes platforms and distributions. From the start, one goal of Kubernetes has been consistency and portability.In order to better serve this goal, today the Kubernetes community and the Cloud Native Computing Foundation® (CNCF®) announce the availability of the beta Kubernetes Software Conformance Certification program. The Kubernetes conformance certification program gives users the confidence that when they use a Certified Kubernetes™ product, they can rely on a high level of common functionality. Certification provides Independent Software Vendors (ISVs) confidence that if their customer is using a Certified Kubernetes product, their software will behave as expected.CNCF and the Kubernetes Community invites all vendors to run the conformance test suite, and submit conformance testing results for review and certification by the CNCF. When the program graduates to GA (generally available) later this year, all vendors receiving certification during the beta period will be listed in the launch announcement.Just like Kubernetes itself, conformance certification is an evolving program managed by contributors in our community. Certification is versioned alongside Kubernetes, and certification requirements receive updates with each version of Kubernetes as features are added and the architecture changes. The Kubernetes community, through SIG Architecture, controls changes and overseers what it means to be Certified Kubernetes. The Testing SIG works on the mechanics of conformance tests, while the Conformance Working Group develops process and policy for the certification program.Once the program moves to GA, certified products can proudly display the new Certified Kubernetes logo mark with stylized version information on their marketing materials. Certified products can also take advantage of a new combination trademark rule the CNCF adopted for Certified Kubernetes providers that keep their certification up to date.Products must complete a recertification each year for the current or previous version of Kubernetes to remain certified. This ensures that when you see the Certified Kubernetes™ mark on a product, you’re not only getting something that’s proven conformant, but also contains the latest features and improvements from the community.Visit https://github.com/cncf/k8s-conformance for more information about Kubernetes Software Compliance Certification, and learn how you can include your product in a growing list of Certified Kubernetes providers.“Cloud Native Computing Foundation”, “CNCF” and “Kubernetes” are registered trademarks of The Linux Foundation in the United States and other countries. “Certified Kubernetes” and the Certified Kubernetes design are trademarks of The Linux Foundation in the United States and other countries.
Quelle: kubernetes

DockerCon Europe 2017 Highlights

DockerCon Europe 2017 is coming to an end and we’d like to thank all of the speakers, sponsors and attendees for contributing to the success of these amazing 3 days in Copenhagen. All the slides will soon be published on our slideshare account and all the breakout session videos recordings will soon be available on the docker website.
DockerCon Day 1 Highlights
On Tuesday, we announced that Docker will be delivering seamless integration of Kubernetes into the Docker platform. Adding Kubernetes support as an orchestration option (alongside Swarm) in both Docker Enterprise Edition, and in Docker for Mac and Windows will help simplify and advance the management of Kubernetes for enterprise IT and deliver the advanced capabilities of the Docker platform to a broader set of applications.

To try the latest version of Docker Enterprise Edition, Docker for Mac and Windows with built-in Kubernetes and sign up for the upcoming Beta. Also, Check out the detailed blog posts to learn how we’re bringing Kubernetes to:

Docker Enterprise Edition
Docker Community Edition on the desktop with Docker for Mac and Windows
The Moby Project

You can also watch the video recording and slides of the day 1 keynote here:

 
DockerCon Day 2 Highlights
Yesterday, we announced an expanded partnership with IBM to address the growing demand for the Modernize Traditional Applications (MTA) program. The Docker MTA program enables IT organizations to modernize legacy applications using Docker Enterprise Edition (EE) for application management in addition to one of Docker’s MTA partners for  for hybrid cloud infrastructure and professional services. Customers who have participated in the MTA program have realized the portability, agility and security benefits of the platform and a savings of more than 50 percent of their total cost of ownership (TCO). Through this expanded partnership, Docker and IBM will be able to take a broader range of enterprise customers through the modernization journey with a fast and efficient process for transforming their legacy applications on a modern cloud architecture.

You can also watch the video recording & slides of the day 2 keynote here below:

Learn more about the Modernize Traditional Application (MTA) program:

Download the MTA kit
Watch an introduction to the MTA program video

Could not make it to DockerCon this year? Save the date for DockerCon 2018 June 12-14, 2018 – Moscone Center, San Francisco, California

#DockerCon Europe 2017 Highlights, video and slides from the keynotes @kubernetesClick To Tweet

The post DockerCon Europe 2017 Highlights appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Extending Docker Enterprise Edition to Support Kubernetes

At DockerCon Europe, we announced that Docker will be delivering seamless integration of Kubernetes into the Docker platform. Bringing Kubernetes to Docker Enterprise Edition (EE) will simplify and advance the management of Kubernetes for enterprise IT and deliver the advanced capabilities of Docker EE to a broader set of applications.
Swarm and Kubernetes Side-by-Side
Docker EE is an enterprise-grade container platform that includes a private image registry, advanced security features and centralized management for the entire container lifecycle. By including Kubernetes for container orchestration, customers will have the ability to run both Swarm and Kubernetes in the same Docker EE cluster while still leveraging the same secure software supply chain for building and deploying applications.

Figure 1. Docker EE Architecture with Multiple Orchestrators
This is possible because Docker EE has a modular architecture that is designed to support multiple orchestrators. The Linux nodes are both Swarm and Kubernetes-ready and application teams can decide which orchestrator to use at app deployment time.
When creating a new Stack in Docker EE, you are given the choice of deploying it as Swarm Services or as Kubernetes Workloads:

Figure 2. Selectable modes at app deployment time
Upon deployment, the Docker EE dashboard has a “Shared Resources” area which allows you to view and manage the entire EE environment, including both Swarm Services and Kubernetes Workloads.

Figure 3. New dashboard with shared resources view of both Swarm and Kubernetes
Get Docker EE Capabilities for Kubernetes
Bringing Kubernetes into Docker EE means making Kubernetes work as easily and powerfully as Docker EE. That includes enabling all of the advanced EE features for Kubernetes workloads.  
Easy Production Install
By leveraging Swarm for cluster management, creating a highly available and fault tolerant Kubernetes environment is much easier and much more secure.
For admins, they can get a cluster up and running with Kubernetes by simply installing Docker EE with a one-line command. Once the cluster is running, Kubernetes is installed as part of Docker EE. This includes built-in security to enable mutually authenticated TLS, with certificate rotation.  

Figure 4. Docker EE cluster where the same nodes are both Docker and Kubernetes-ready
NOTE: This view shows Kubernetes v1.7 although the Beta will be leveraging v1.8.
Secure and Unified Supply Chain
Docker EE delivers end-to-end security across the supply chain from the developer’s laptop to production deployment. With this integration, teams leverage the same supply chain capabilities for both Swarm and Kubernetes deployments. That includes:

Secure Image Management: With image scanning and Docker Content Trust, Docker EE provides a way to validate and verify images before being deployed and manage them in a privately hosted image registry.
Secure Automation: With policy-based image promotion, organizations remove bottlenecks in the supply chain while enforcing policies such as scanning for vulnerabilities.

Secure Multi-Tenancy
With flexible and granular role-based access controls (RBAC) down to the API-level, admins can integrate AD/LDAP once and support different teams bringing different apps (Windows, Linux, or mainframe) of different app types (microservices, ISV, or traditional), leveraging different orchestrators (Swarm or Kubernetes) all into the same Docker EE environment with secure isolation between them. That allows development teams to bring their own tools and processes into the same environment.

Figure 5. Docker EE access controls with resource collections
For users deploying applications to the EE cluster, they get the choice of API in Kubernetes or Swarm, across a common set of nodes and using a common set of container images secured by the Trusted Registry.
Deploy Apps to Kubernetes
A new capability with this upcoming release allows organizations to use existing Docker Compose files and deploy to a Kubernetes environment. The same Docker Compose file can be deployed with either orchestrator by mapping Docker service definitions to native Kubernetes resource types.

Figure 6. Docker Compose YAML file being deployed as a Kubernetes workload
Centralized Management
With Docker EE, all of these different applications can be monitored and managed in a single environment that is integrated with centralized logging and monitoring capabilities. IT can manage and secure all applications in a unified operating model that aligns with their current responsibilities.

Figure 7: Container view in the Docker EE dashboard that includes containers deployed in Swarm and in Kubernetes from the same Docker Compose YAML file
Infrastructure Independence
Docker EE delivers a consistent experience across certified infrastructure platforms including multiple Linux distributions (RHEL, SLES, CentOS, Ubuntu, Oracle Linux) and Windows as well as cloud platforms including AWS and Azure. This means organizations are not locked into an underlying platform and get greater cloud portability.

Sign up for the Beta
Docker will be integrating the latest stable release of Kubernetes and contributing back to the Kubernetes project. As part of this announcement, Docker will also be adding Kubernetes support in Docker for Mac and Docker for Windows.
If you’re interested in getting an easy-to-manage and secure deployment of Kubernetes with advanced lifecycle management capabilities, visit https://www.docker.com/kubernetes and sign up for the upcoming Beta.
To learn more about Docker Enterprise Edition:

Register here to live stream the Day 2 keynote
Visit www.docker.com/enterprise
Test drive Docker EE without installing anything at www.docker.com/trial

Extending @Docker Enterprise Edition to Support @Kubernetesio #dockerconClick To Tweet

The post Extending Docker Enterprise Edition to Support Kubernetes appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Docker Platform and Moby Project add Kubernetes

Today we’re announcing that the Docker platform is integrating support for Kubernetes so that Docker customers and developers have the option to use both Kubernetes and Swarm to orchestrate container workloads. Register for beta access and check out the detailed blog posts to learn how we’re bringing Kubernetes to:

Docker Enterprise Edition
Docker Community Edition on the desktop with Docker for Mac and Windows
The Moby Project

Docker is a platform that sits between apps and infrastructure. By building apps on Docker, developers and IT operations get freedom and flexibility. That’s because Docker runs everywhere that enterprises deploy apps: on-prem (including on IBM mainframes, enterprise Linux and Windows) and in the cloud. Once an application is containerized, it’s easy to re-build, re-deploy and move around, or even run in hybrid setups that straddle on-prem and cloud infrastructure.
The Docker platform is composed of many components, assembled in four layers:

The containerd industry-standard container runtime implementing the OCI standards
Swarm orchestration that transforms a group of nodes into a distributed system
Docker Community Edition providing developers a simple workflow to build and ship container applications, with features like application composition, image build and management
Docker Enterprise Edition, to manage an end to end secure software supply chain and run containers in production

These four layers are assembled from upstream components that are part of the open source Moby Project.
Docker’s design philosophy has always been about providing choice and flexibility. This is important for customers that are integrating Docker with existing IT systems, and that’s why Docker is built to work well with already-deployed networking, logging, storage, load balancers and CI/DC systems. For all of these (and more), Docker relies on industry-standard protocols or published and documented interfaces. And for all of these, Docker Enterprise Edition ships with sensible defaults, but those defaults can be swapped for certified third party options for customers that have existing systems or prefer an alternative solution.
In 2016, Docker added orchestration to the platform, powered by the SwarmKit project. In the past year, we’ve received lots of positive feedback on Swarm: it’s easy to set up, is scalable and is secure out-of-the-box.
We’ve also gotten feedback that some users really like the integrated Docker platform with end-to-end container management, but that they want to use other orchestrators, like Kubernetes, for container scheduling. Either because they’ve already designed services to work on Kubernetes or because Kubernetes has particular features they’re looking for. This is why we are adding Kubernetes support as an orchestration option (alongside Swarm) in both Docker Enterprise Edition, and in Docker for Mac and Windows.

We’re also working on innovative components that make it easier for Docker users to deploy Docker apps natively with Kubernetes orchestration. For example, by using Kubernetes extension mechanisms like Custom Resources and the API server aggregation layer, the coming version of Docker with Kubernetes support will allow users to deploy their Docker Compose apps as Kubernetes-native Pods and Services.
With the next version of the Docker platform, developers can build and test apps destined for production directly on Kubernetes, on their workstation. And ops can get all the benefits of Docker Enterprise Edition – secure multi-tenancy, image scanning and role-based access control – while running apps in production orchestrated with either Kubernetes or Swarm.
The Kubernetes version that we’re incorporating into Docker will be the vanilla Kubernetes that everyone is familiar with, direct from the CNCF.  It won’t be a fork, nor an outdated version, nor wrapped or limited in any way.
Through the Moby Project, Docker has been working to adopt and contribute to Kubernetes over the last year. We’ve been working on containerd and cri-containerd for the container runtime, on InfraKit for creating and managing Kubernetes installs, and on libnetwork for overlay networking. See the Moby Project blog post for more examples and details.
Docker and Kubernetes share much lineage, are written using the same programming language and have overlapping components, contributors and ideals. We at Docker are looking forward to incorporating Kubernetes support into our products and into the open source projects we work on. And we can’t wait to work with the Kubernetes community to make containers and container-orchestration ever more powerful and easier to use.
Beta of both Docker Enterprise (for supported infrastructure) and Community Edition (for Mac and Windows) with Kubernetes support will be available later this year. Sign up to get notified when they’re ready.
While we’re adding Kubernetes as an orchestration option in Docker, we remain committed to Swarm and our customers and users that rely on Swarm and Docker for running critical apps at scale in production. To learn more about how Docker is integrating Kubernetes, check out the sessions “What’s New in Docker” and “Gordon’s Secret Session” at DockerCon EU.
Where to go from here?

Sign up for the Kubernetes for Docker beta
Kubernetes for Docker Enterprise Edition
Kubernetes for Docker Community Edition for Mac and Windows
Moby and Kubernetes

#Docker Platform and @Moby Project add @Kubernetesio #dockerconClick To Tweet

The post Docker Platform and Moby Project add Kubernetes appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/