Advanced Access Control with Docker EE
•
1 like•311 views
The sharing of computing resources among applications and users solves many challenges and presents opportunities for enterprise IT. It leads to better infrastructure efficiency and the specialization of responsibilities in the IT stack. Shared resources across diverse organizations and applications also introduce new hurdles. Tenants need to access their resources securely and with complete privacy from other tenants. This requires secure segmentation, access control, and more. Container multi-tenancy is much more than cgroups and namespaces. This talk focuses on the advanced Access Control features in Docker Enterprise Edition that provide the fine-grained control to segment cluster resources. This includes how to design fine-grained roles, the architecture and grouping of resources, and how to apply these as Access Control policy. Walk through practical examples from current production designs and understand how they can be applied to your organization.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Advanced Access Control with Docker EE
Similar to Advanced Access Control with Docker EE (20)
More from Docker, Inc.
More from Docker, Inc. (20)
Recently uploaded
Recently uploaded (20)
Advanced Access Control with Docker EE
- 1. Docker Enterprise Edition Advanced Access Control Mark Church Solutions Architect, Docker Inc. @churchofmark October, 2017
- 2. app container platform physical infrastructure app appapp Team Mobile Team Payments Company Acquisition sharing is caring
- 3. container 1 app container 2 app host CPU memory I/O storage secrets images networks volumes services virtual resources physical resources host host users
- 4. • Payments team can view their containers and logs only • Mobile team can view their containers and logs only • Admins - Full capabilities, full stack • Ops team Full capabilities against application nodes Access Control at OrcaBank
- 7. Payments Team/production/payments Dev Role Collection Subject Role grants GRANT
- 8. • Admins - Full capabilities, full stack • Ops team Full capabilities against application nodes • Payments team can view their containers only • Mobile team can view their containers only Access Control at OrcaBank
- 10. / ├── Shared │ ├── app nodes │ ├── mobile │ └── payments └── System └── infra nodes OrcaBank collection architecture
- 11. UsersTeamsGrantsCollections grant mobile payments ops admins Roles Full Control Dev grant / DevelopersDevelopersInfra Admins DevelopersDevelopersDevelopers DevelopersDevelopersDevelopers DevelopersDevelopersSREs / Ops /Shared/mobile grant/Shared/payments grant/Shared Ops grant composition
- 12. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller Worker Nodes /mobile volume app network /payments app db network app app network volume secret config
- 13. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller UCP Workers /mobile volume app network /payments app db network app app network volume secret config Payments Team ● View containers ● View services ● View logs ● Container Inspect No Access
- 14. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller UCP Workers /mobile volume app network /payments app db network app app network volume secret config Mobile Team ● View containers ● View services ● View logs ● Container Inspect No Access No Access
- 15. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller UCP Workers /mobile volume app network /payments app db network app app network volume secret config Ops Team ● All Resources ○ Deploy ○ View ○ Update ○ Destroy No Access
- 16. OrcaBank “DevOps” Cluster New Requirements • Mobile Team - Full capabilities to deploy in “mobile” collection • Payments Team - Full capabilities to deploy in “payments” collection • DB Team - Full capabilities to deploy in “db” collection • Each team will also have dedicated nodes
- 17. UCP Controller UCP Controller UCP Controller System UCP Controller UCP Controller Docker Trusted Registry mobile paymentsdb UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes collection architecture
- 18. / ├── Shared │ ├── app nodes │ ├── mobile │ └── payments └── System └── infra nodes / ├── Shared ├── System │ └── infra nodes ├── db │ └── app nodes ├── mobile │ └── app nodes └── payments └── app nodes diff
- 19. / ├── Shared ├── System │ └── infra nodes ├── db │ └── app nodes │ ├── payments │ └── mobile ├── mobile │ └── app nodes └── payments └── app nodes consumer/provider relationships
- 20. UCP Controller UCP Controller UCP Controller /System UCP Controller UCP Controller Docker Trusted Registry /mobile /payments app app network volume config app app network /db /mobile /payments volume network db secret volume network db secret UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes collection architecture
- 21. AD/LDAP Users AD/LDAP GroupsTeamsGrantsCollections AD_db AD_pay AD_admin db payments admins DevelopersDevelopersInfra Admins DevelopersDevelopersDB Ops DevelopersDevelopersDevOps grant/db grant/ grant grant /payments /db/payments AD_mobmobile DevelopersDevelopersDevOps grant grant /mobile /db/mobile Roles Admin View & Use Networks + Secrets Ops
- 22. UCP Controller UCP Controller UCP Controller /System UCP Controller UCP Controller Docker Trusted Registry /mobile /payments app app network volume config app app network /db /mobile /payments volume network db secret volume network db secret Collection Architecture UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers DB Team ● All Resources ○ Create ○ Update ○ View ○ Destroy ○ Schedule No Access No Access
- 23. UCP Controller UCP Controller UCP Controller /System UCP Controller UCP Controller Docker Trusted Registry /mobile /payments app app network volume config app app network /db /mobile /payments volume network db secret volume network db secret Collection Architecture UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers Mobile Team ● All Resources ○ Create ○ Update ○ View ○ Destroy ○ Schedule No Access Mobile Team Networks & Secrets ○ View ○ Use No Access
- 24. Docker EE Hosted Demo ● Free 4 Hour Demo ● No Servers Required ● Full Docker EE Cluster Access And hands on labs! docker.com/trial