Kategorie: Kubernetes

More DockerCon Speakers Announced

Today, we are announcing the next group of awesome DockerCon speakers and we can’t wait for the lessons, stories, tips, tricks and insights they will share.

Need tips on how to create effective images, even when you have to include a bunch of image processing libraries?
What about learning how other organizations are taking Docker into production and adopting DevOps?
Want to deep dive into the Docker internals from Docker’s technical staff?

Join us at the largest container conference in the world to hear these stories and many more DockerCon speakers from the community. 
Docker Security Deep Dive

Journey to Docker Production: Evolving Your Infrastructure and Processes

Creating Effective Docker Images

Plug-ins: Building, Shipping, Storing and Running

Docker for Ops

Docker Networking

 
 
 
 
 
 
 

Modern Storage Platform for Containerized Environments

Do you really want to attend sessions from these DockerCon speakers, but are having a hard time convincing your manager on pulling the trigger to send you? Have you already explained that sessions, training and hands-on exercises are definitely worth the financial investment and time away from your desk?
Well, fear not! We’ve put together a few more resources and reasons to help convince your manager that DockerCon 2017 on April 17-20, is an invaluable experience you need to attend.
More information about DockerCon 2017:

Register for the conference
Choose what workshop to attend
Book your Hotel room
Become a sponsor

Register for DockerCon 
 

Thrilled to announced the 2nd batch of @DockerCon speakers! Stay tuned for the full agenda next weekClick To Tweet

The post More DockerCon Speakers Announced appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Running MongoDB on Kubernetes with StatefulSets

Editor’s note: Today’s post is by Sandeep Dinesh, Developer Advocate, Google Cloud Platform, showing how to run a database in a container.Conventional wisdom says you can’t run a database in a container. “Containers are stateless!” they say, and “databases are pointless without state!” Of course, this is not true at all. At Google, everything runs in a container, including databases. You just need the right tools. Kubernetes 1.5 includes the new StatefulSet API object (in previous versions, StatefulSet was known as PetSet). With StatefulSets, Kubernetes makes it much easier to run stateful workloads such as databases.If you’ve followed my previous posts, you know how to create a MEAN Stack app with Docker, then migrate it to Kubernetes to provide easier management and reliability, and create a MongoDB replica set to provide redundancy and high availability.While the replica set in my previous blog post worked, there were some annoying steps that you needed to follow. You had to manually create a disk, a ReplicationController, and a service for each replica. Scaling the set up and down meant managing all of these resources manually, which is an opportunity for error, and would put your stateful application at risk In the previous example, we created a Makefile to ease the management of of these resources, but it would have been great if Kubernetes could just take care of all of this for us.With StatefulSets, these headaches finally go away. You can create and manage your MongoDB replica set natively in Kubernetes, without the need for scripts and Makefiles. Let’s take a look how.Note: StatefulSets are currently a beta resource. The sidecar container used for auto-configuration is also unsupported.Prerequisites and SetupBefore we get started, you’ll need a Kubernetes 1.5+ and the Kubernetes command line tool. If you want to follow along with this tutorial and use Google Cloud Platform, you also need the Google Cloud SDK.Once you have a Google Cloud project created and have your Google Cloud SDK setup (hint: gcloud init), we can create our cluster.To create a Kubernetes 1.5 cluster, run the following command:gcloud container clusters create “test-cluster”This will make a three node Kubernetes cluster. Feel free to customize the command as you see fit.Then, authenticate into the cluster:gcloud container clusters get-credentials test-clusterSetting up the MongoDB replica setTo set up the MongoDB replica set, you need three things: A StorageClass, a Headless Service, and a StatefulSet.I’ve created the configuration files for these already, and you can clone the example from GitHub:git clone https://github.com/thesandlord/mongo-k8s-sidecar.gitcd example/StatefulSet/To create the MongoDB replica set, run these two commands:kubectl apply -f googlecloud_ssd.yamlkubectl apply -f mongo-statefulset.yamlThat’s it! With these two commands, you have launched all the components required to run an highly available and redundant MongoDB replica set. At an high level, it looks something like this:Let’s examine each piece in more detail.StorageClassThe storage class tells Kubernetes what kind of storage to use for the database nodes. You can set up many different types of StorageClasses in a ton of different environments. For example, if you run Kubernetes in your own datacenter, you can use GlusterFS. On GCP, your storage choices are SSDs and hard disks. There are currently drivers for AWS, Azure, Google Cloud, GlusterFS, OpenStack Cinder, vSphere, Ceph RBD, and Quobyte.The configuration for the StorageClass looks like this:kind: StorageClassapiVersion: storage.k8s.io/v1beta1metadata:  name: fastprovisioner: kubernetes.io/gce-pdparameters:  type: pd-ssdThis configuration creates a new StorageClass called “fast” that is backed by SSD volumes. The StatefulSet can now request a volume, and the StorageClass will automatically create it!Deploy this StorageClass:kubectl apply -f googlecloud_ssd.yamlHeadless ServiceNow you have created the Storage Class, you need to make a Headless Service. These are just like normal Kubernetes Services, except they don’t do any load balancing for you. When combined with StatefulSets, they can give you unique DNS addresses that let you directly access the pods! This is perfect for creating MongoDB replica sets, because our app needs to connect to all of the MongoDB nodes individually.The configuration for the Headless Service looks like this:apiVersion: v1kind: Servicemetadata:  name: mongo  labels:    name: mongospec:  ports:  – port: 27017    targetPort: 27017  clusterIP: None  selector:    role: mongoYou can tell this is a Headless Service because the clusterIP is set to “None.” Other than that, it looks exactly the same as any normal Kubernetes Service.StatefulSetThe pièce de résistance. The StatefulSet actually runs MongoDB and orchestrates everything together. StatefulSets differ from Kubernetes ReplicaSets (not to be confused with MongoDB replica sets!) in certain ways that makes them more suited for stateful applications. Unlike Kubernetes ReplicaSets, pods created under a StatefulSet have a few unique attributes. The name of the pod is not random, instead each pod gets an ordinal name. Combined with the Headless Service, this allows pods to have stable identification. In addition, pods are created one at a time instead of all at once, which can help when bootstrapping a stateful system. You can read more about StatefulSets in the documentation.Just like before, this “sidecar” container will configure the MongoDB replica set automatically. A “sidecar” is a helper container which helps the main container do its work.The configuration for the StatefulSet looks like this:apiVersion: apps/v1beta1kind: StatefulSetmetadata:  name: mongospec:  serviceName: “mongo”  replicas: 3  template:    metadata:      labels:        role: mongo        environment: test    spec:      terminationGracePeriodSeconds: 10      containers:        – name: mongo          image: mongo          command:            – mongod            – “–replSet”            – rs0            – “–smallfiles”            – “–noprealloc”          ports:            – containerPort: 27017          volumeMounts:            – name: mongo-persistent-storage              mountPath: /data/db        – name: mongo-sidecar          image: cvallance/mongo-k8s-sidecar          env:            – name: MONGO_SIDECAR_POD_LABELS              value: “role=mongo,environment=test”  volumeClaimTemplates:  – metadata:      name: mongo-persistent-storage      annotations:        volume.beta.kubernetes.io/storage-class: “fast”    spec:      accessModes: [ “ReadWriteOnce” ]      resources:        requests:          storage: 100GiIt’s a little long, but fairly straightforward.The first second describes the StatefulSet object. Then, we move into the Metadata section, where you can specify labels and the number of replicas. Next comes the pod spec. The terminationGracePeriodSeconds is used to gracefully shutdown the pod when you scale down the number of replicas, which is important for databases! Then the configurations for the two containers is shown. The first one runs MongoDB with command line flags that configure the replica set name. It also mounts the persistent storage volume to /data/db, the location where MongoDB saves its data. The second container runs the sidecar.Finally, there is the volumeClaimTemplates. This is what talks to the StorageClass we created before to provision the volume. It will provision a 100 GB disk for each MongoDB replica.Using the MongoDB replica setAt this point, you should have three pods created in your cluster. These correspond to the three nodes in your MongoDB replica set. You can see them with this command:kubectl get podsNAME        READY     STATUS    RESTARTS   AGEmongo-0      2/2       Running   0          3mmongo-1      2/2       Running   0          3mmongo-2      2/2       Running   0          3mEach pod in a StatefulSet backed by a Headless Service will have a stable DNS name. The template follows this format: <pod-name>.<service-name>This means the DNS names for the MongoDB replica set are:mongo-0.mongomongo-1.mongomongo-2.mongoYou can use these names directly in the connection string URI of your app.In this case, the connection string URI would be:“mongodb://mongo-0.mongo,mongo-1.mongo,mongo-2.mongo:27017/dbname_?”That’s it!Scaling the MongoDB replica setA huge advantage of StatefulSets is that you can scale them just like Kubernetes ReplicaSets. If you want 5 MongoDB Nodes instead of 3, just run the scale command:kubectl scale –replicas=5 statefulset mongoThe sidecar container will automatically configure the new MongoDB nodes to join the replica set.Include the two new nodes (mongo-3.mongo & mongo-4.mongo) in your connection string URI and you are good to go. Too easy!Cleaning UpTo clean up the deployed resources, delete the StatefulSet, Headless Service, and the provisioned volumes.Delete the StatefulSet:kubectl delete statefulset mongoDelete the Service:kubectl delete svc mongoDelete the Volumes:kubectl delete pvc -l role=mongoFinally, you can delete the test cluster:gcloud container clusters delete “test-cluster”Happy Hacking!For more cool Kubernetes and Container blog posts, follow me on Twitter and Medium. –Sandeep Dinesh, Developer Advocate, Google Cloud Platform.
Quelle: kubernetes

Fission: Serverless Functions as a Service for Kubernetes

Editor’s note: Today’s post is by Soam Vasani, Software Engineer at Platform9 Systems, talking about a new open source Serverless Function (FaaS) framework for Kubernetes. Fission is a Functions as a Service (FaaS) / Serverless function framework built on Kubernetes.Fission allows you to easily create HTTP services on Kubernetes from functions. It works at the source level and abstracts away container images (in most cases). It also simplifies the Kubernetes learning curve, by enabling you to make useful services without knowing much about Kubernetes.To use Fission, you simply create functions and add them with a CLI. You can associate functions with HTTP routes, Kubernetes events, or other triggers. Fission supports NodeJS and Python today.Functions are invoked when their trigger fires, and they only consume CPU and memory when they’re running. Idle functions don’t consume any resources except storage.Why make a FaaS framework on Kubernetes?We think there’s a need for a FaaS framework that can be run on diverse infrastructure, both in public clouds and on-premise infrastructure. Next, we had to decide whether to build it from scratch, or on top of an existing orchestration system. It was quickly clear that we shouldn’t build it from scratch — we would just end up having to re-invent cluster management, scheduling, network management, and lots more.Kubernetes offered a powerful and flexible orchestration system with a comprehensive API backed by a strong and growing community. Building on it meant Fission could leave container orchestration functionality to Kubernetes, and focus on FaaS features.The other reason we don’t want a separate FaaS cluster is that FaaS works best in combination with other infrastructure. For example, it may be the right fit for a small REST API, but it needs to work with other services to store state. FaaS also works great as a mechanism for event handlers to handle notifications from storage, databases, and from Kubernetes itself. Kubernetes is a great platform for all these services to interoperate on top of.Deploying and Using FissionFission can be installed with a `kubectl create` command: see the project README for instructions.Here’s how you’d write a “hello world” HTTP service:$ cat > hello.pydef main(context):    print “Hello, world!”$ fission function create –name hello –env python –code hello.py –route /hello$ curl http://<fission router>/helloHello, world!Fission takes care of loading the function into a container, routing the request to it, and so on. We go into more details in the next section. How Fission Is Implemented on KubernetesAt its core, a FaaS framework must (1) turn functions into services and (2) manage the lifecycle of these services.There are a number of ways to achieve these goals, and each comes with different tradeoffs. Should the framework operate at the source-level, or at the level of Docker images (or something in-between, like “buildpacks”)? What’s an acceptable amount of overhead the first time a function runs? Choices made here affect platform flexibility, ease of use, resource usage and costs, and of course, performance. Packaging, source code, and imagesOne of our goals is to make Fission very easy to use for new users. We chose to operateat the source level, so that users can avoid having to deal with container image building, pushing images to registries, managing registry credentials, image versioning, and so on.However, container images are the most flexible way to package apps. A purely source-level interface wouldn’t allow users to package binary dependencies, for example.So, Fission goes with a hybrid approach — container images that contain a dynamic loader for functions. This approach allows most users to use Fission purely at the source level, but enables them to customize the container image when needed.These images, called “environment images” in Fission, contain the runtime for the language (such as NodeJS or Python), a set of commonly used dependencies and a dynamic loader for functions. If these dependencies are sufficient for the function the user is writing, no image rebuilding is needed. Otherwise, the list of dependencies can be modified, and the image rebuilt.These environment images are the only language-specific parts of Fission. They present a uniform interface to the rest of the framework. This design allows Fission to be easily extended to more languages.Cold start performanceOne of the goals of the serverless functions is that functions use CPU/memory resources only when running. This optimizes the resource cost of functions, but it comes at the cost of some performance overhead when starting from idle (the “cold start” overhead).Cold start overhead is important in many use cases. In particular, with functions used in an interactive use case — like a web or mobile app, where a user is waiting for the action to complete — several-second cold start latencies would be unacceptable.To optimize cold start overheads, Fission keeps a running pool of containers for each environment. When a request for a function comes in, Fission doesn’t have to deploy a new container — it just chooses one that’s already running, copies the function into the container, loads it dynamically, and routes the request to that instance. The overhead of this process takes on the order of 100msec for NodeJS and Python functions.How Fission works on KubernetesFission is designed as a set of microservices. A Controller keeps track of functions, HTTProutes, event triggers, and environment images. A Pool Manager manages pools of idle environment containers, the loading of functions into these containers, and the killing of function instances when they’re idle. A Router receives HTTP requests and routes them to function instances, requesting an instance from the Pool Manager if necessary.The controller serves the fission API. All the other components watch the controller for updates. The router is exposed as a Kubernetes Service of the LoadBalancer or NodePort type, depending on where the Kubernetes cluster is hosted.When the router gets a request, it looks up a cache to see if this request already has a service it should be routed to. If not, it looks up the function to map the request to, and requests the poolmgr for an instance. The poolmgr has a pool of idle pods; it picks one, loads the function into it (by sending a request into a sidecar container in the pod), and returns the address of the pod to the router. The router  proxies over the request to this pod. The pod is cached for subsequent requests, and if it’s been idle for a few minutes, it is killed.(For now, Fission maps one function to one container; autoscaling to multiple instances is planned for a later release. Re-using function pods to host multiple functions is also planned, for cases where isolation isn’t a requirement.)Use Cases for FissionBots, Webhooks, REST APIs Fission is a good framework to make small REST APIs, implement webhooks, and write chatbots for Slack or other services.As an example of a simple REST API, we’ve made a small guestbook app that uses functions for reading and writing to guestbook, and works with a redis instance to keep track of state. You can find the app in the Fission GitHub repo.The app contains two end points — the GET endpoint lists out guestbook entries from redis and renders them into HTML. The POST endpoint adds a new entry to the guestbook list in redis. That’s all there is — there’s no Dockerfile to manage, and updating the app is as simple as calling fission function update. Handling Kubernetes EventsFission also supports triggering functions based on Kubernetes watches. For example, you can setup a function to watch for all pods in a certain namespace matching a certain label. The function gets the serialized object and the watch event type (added/removed/updated) in its context.These event handler functions could be used for simple monitoring — for example, you could send a slack message whenever a new service is added to the cluster. There are also more complex use cases, such as writing a custom controller by watching Kubernetes’ Third Party Resources.Status and RoadmapFission is in early alpha for now (Jan 2017). It’s not ready for production use just yet. We’re looking for early adopters and feedback.What’s ahead for Fission? We’re working on making FaaS on Kubernetes more convenient, easy to use and easier to integrate with. In the coming months we’re working on adding support for unit testing, integration with Git, function monitoring and log aggregation. We’re also working on integration with other sources of events.Creating more language environments is also in the works. NodeJS and Python are supported today. Preliminary support for C# .NET has been contributed by Klavs Madsen.You can find our current roadmap on our GitHub issues and projects.Get InvolvedFission is open source and developed in the open by Platform9 Systems. Check us out on GitHub, and join our slack channel if you’d like to chat with us. We’re also on twitter at @fissionio.Download KubernetesGet involved with the Kubernetes project on GitHub Post questions (or answer questions) on Stack Overflow Connect with the community on SlackFollow us on Twitter @Kubernetesio for latest updates–Soam Vasani, Software Engineer, Platform9 Systems
Quelle: kubernetes

How we run Kubernetes in Kubernetes aka Kubeception

Editor’s note: Today’s post is by the team at Giant Swarm, showing how they run Kubernetes in Kubernetes.Giant Swarm’s container infrastructure started out with the goal to be an easy way for developers to deploy containerized microservices. Our first generation was extensively using fleet as a base layer for our infrastructure components as well as for scheduling user containers.In order to give our users a more powerful way to manage their containers we introduced Kubernetes into our stack in early 2016. However, as we needed a quick way to flexibly spin up and manage different users’ Kubernetes clusters resiliently we kept the underlying fleet layer.As we insist on running all our underlying infrastructure components in containers, fleet gave us the flexibility of using systemd unit files to define our infrastructure components declaratively. Our self-developed deployment tooling allowed us to deploy and manage the infrastructure without the need for imperative configuration management tools.However, fleet is just a distributed init and not a complete scheduling and orchestration system. Next to a lot of work on our tooling, it required significant improvements in terms of communication between peers, its reconciliation loop, and stability that we had to work on. Also the uptake in Kubernetes usage would ensure that issues are found and fixed faster.As we had made good experience with introducing Kubernetes on the user side and with recent developments like rktnetes and stackanetes it felt like time for us to also move our base layer to Kubernetes.Why Kubernetes in KubernetesNow, you could ask, why would anyone want to run multiple Kubernetes clusters inside of a Kubernetes cluster? Are we crazy? The answer is advanced multi-tenancy use cases as well as operability and automation thereof.Kubernetes comes with its own growing feature set for multi-tenancy use cases. However, we had the goal of offering our users a fully-managed Kubernetes without any limitations to the functionality they would get using any vanilla Kubernetes environment, including privileged access to the nodes. Further, in bigger enterprise scenarios a single Kubernetes cluster with its inbuilt isolation mechanisms is often not sufficient to satisfy compliance and security requirements. More advanced (firewalled) zoning or layered security concepts are tough to reproduce with a single installation. With namespace isolation both privileged access as well as firewalled zones can hardly be implemented without sidestepping security measures.Now you could go and set up multiple completely separate (and federated) installations of Kubernetes. However, automating the deployment and management of these clusters would need additional tooling and complex monitoring setups. Further, we wanted to be able to spin clusters up and down on demand, scale them, update them, keep track of which clusters are available, and be able to assign them to organizations and teams flexibly. In fact this setup can be combined with a federation control plane to federate deployments to the clusters over one API endpoint.And wouldn’t it be nice to have an API and frontend for that?Enter GiantnetesBased on the above requirements we set out to build what we call Giantnetes – or if you’re into movies, Kubeception. At the most basic abstraction it is an outer Kubernetes cluster (the actual Giantnetes), which is used to run and manage multiple completely isolated user Kubernetes clusters.The physical machines are bootstrapped by using our CoreOS bootstrapping tool, Mayu. The Giantnetes components themselves are self-hosted, i.e. a kubelet is in charge of automatically bootstrapping the components that reside in a manifests folder. You could call this the first level of Kubeception.Once the Giantnetes cluster is running we use it to schedule the user Kubernetes clusters as well as our tooling for managing and securing them.We chose Calico as the Giantnetes network plugin to ensure security, isolation, and the right performance for all the applications running on top of Giantnetes.Then, to create the inner Kubernetes clusters, we initiate a few pods, which configure the network bridge, create certificates and tokens, and launch virtual machines for the future cluster. To do so, we use lightweight technologies such as KVM and qemu to provision CoreOS VMs that become the nodes of an inner Kubernetes cluster. You could call this the second level of Kubeception.Currently this means we are starting Pods with Docker containers that in turn start VMs with KVM and qemu. However, we are looking into doing this with rkt qemu-kvm, which would result in using a rktnetes setup for our Giantnetes.The networking solution for the inner Kubernetes clusters has two levels. It on a combination of flannel’s server/client architecture model and Calico BGP. While a flannel client is used to create the network bridge between the VMs of each virtualized inner Kubernetes cluster, Calico is running inside the virtual machines to connect the different Kubernetes nodes and create a single network for the inner Kubernetes. By using Calico, we mimic the Giantnetes networking solution inside of each Kubernetes cluster and provide the primitives to secure and isolate workloads through the Kubernetes network policy API.Regarding security, we aim for separating privileges as much as possible and making things auditable. Currently this means we use certificates to secure access to the clusters and encrypt communication between all the components that form a cluster is (i.e. VM to VM, Kubernetes components to each other, etcd master to Calico workers, etc). For this we create a PKI backend per cluster and then issue certificates per service in Vault on-demand. Every component uses a different certificate, thus, avoiding to expose the whole cluster if any of the components or nodes gets compromised. We further rotate the certificates on a regular basis.For ensuring access to the API and to services of each inner Kubernetes cluster from the outside we run a multi-level HAproxy ingress controller setup in the Giantnetes that connects the Kubernetes VMs to hardware load balancers.Looking into Giantnetes with kubectlLet’s have a look at a minimal sample deployment of Giantnetes.In the above example you see a user Kubernetes cluster `customera` running in VM-containers on top of Giantnetes. We currently use Jobs for the network and certificate setups.Peeking inside the user cluster, you see the DNS pods and a helloworld running.Each one of these user clusters can be scheduled and used independently. They can be spun up and down on-demand.ConclusionTo sum up, we could show how Kubernetes is able to easily not only self-host but also flexibly schedule a multitude of inner Kubernetes clusters while ensuring higher isolation and security aspects. A highlight in this setup is the composability and automation of the installation and the robust coordination between the Kubernetes components. This allows us to easily create, destroy, and reschedule clusters on-demand without affecting users or compromising the security of the infrastructure. It further allows us to spin up clusters with varying sizes and configurations or even versions by just changing some arguments at cluster creation. This setup is still in its early days and our roadmap is planning for improvements in many areas such as transparent upgrades, dynamic reconfiguration and scaling of clusters, performance improvements, and (even more) security. Furthermore, we are looking forward to improve on our setup by making use of the ever advancing state of Kubernetes operations tooling and upcoming features, such as Init Containers, Scheduled Jobs, Pod and Node affinity and anti-affinity, etc.Most importantly, we are working on making the inner Kubernetes clusters a third party resource that can then be managed by a custom controller. The result would be much like the Operator concept by CoreOS. And to ensure that the community at large can benefit from this project we will be open sourcing this in the near future.– Hector Fernandez, Software Engineer & Puja Abbassi, Developer Advocate, Giant Swarm
Quelle: kubernetes