Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Develop and deploy Kubernetes applications with Docker - IBM Index 2018


Published on

Docker Desktop and Enterprise Edition now both include Kubernetes as an optional orchestration component. This talk will explain how to use Docker Desktop (Mac or Windows) to develop and debug a cloud native application, then how Docker Enterprise Edition helps you deploy it to Kubernetes in production.

Published in: Software
  • Be the first to comment

Develop and deploy Kubernetes applications with Docker - IBM Index 2018

  1. 1. Patrick Chanezon, @chanezon February 2018 Develop and deploy Kubernetes applications with Docker
  2. 2. French Polyglot Platforms Software Plumber San Francisco Developer Relations @chanezon
  3. 3. Agenda 1. Intro: the Docker Platform 2. Modernizing Traditional Applications 3. Kubernetes in Docker 4. Demo: Kubernetes in Docker Desktop 5. General CE/EE Architectures 6. Demo: Kubernetes in Docker EE 2.0 7. EE: Topics on mixed workloads 8. Q&A
  4. 4. Introduction The Docker Platform
  5. 5. Traditional Micro services ISV / COTS IoT Big Data ML AI ...Serverless Cloud VM Bare Metal Edge Device Docker Platform
  6. 6. Docker Momentum Docker Hosts 21.0M Growth in Docker job listings 77K% Container downloads 24B Industry Standards
  7. 7. Enterprise Momentum Portability Agility Security 50% total cost savings
  8. 8. The Docker Container Platform Enabling the Software Supply Chain • Diverse Applications • Disparate Infrastructure • Lifecycle Management • Orchestrate Complex Systems • Secure by Default • Edge / IoT • Serverless Anywhere
  9. 9. DEVELOPERS OPERATORS Applications Infrastructure The Docker Platform in a nutshell
  10. 10. INDEPENDENCE OPENNESS SIMPLICITY Core Principles of the Docker Platform
  11. 11. Docker Enterprise Edition Docker Community Edition containerd 1 2 3 4 The best container development workflow The best enterprise container security and management Native Kubernetes integration provides full ecosystem compatibility Industry-standard container runtime Docker with Swarm and Kubernetes
  12. 12. Docker Community Edition Developers EnterpriseContainer Ecosystem The Docker Innovation Model Docker Enterprise Edition 9,149 Open Source Contributors 8800 PRs/Year
  13. 13. runc Notary Registry LibNetworkVPNKit DataKit HyperKitCompose
  14. 14. Modernizing Traditional Applications
  15. 15. The Innovation Challenge Average IT Spend By Type INNOVATION MAINTENANCE 20% 80% 20% 40% 60% 80% 100% 0% 1% Windows Server 2008 Windows Server 2012 Windows Server 2000 Windows Server 2003 Red Hat, Other Linux, Other OS Server OS Market Share Sources: Bank of America, Spiceworks, SolarWinds 18% 45% 24% 12%
  16. 16. Source: RightScale 2017 State of the Cloud Report Top Priority for Enterprise IT 2016 2017 39% 50% 27% 29% 23% 9% 10% 10% Leverage Hybrid Cloud Use Public Cloud Build Private Cloud Use Hosted Cloud Enterprise Priority: Portability
  17. 17. 50+% 79% Major Release Frequency 0 Weekly Monthly Quarterly Annually 5% 10% 15% 20% 25% More than 2 years Enterprise Priority: Agility Source: Plutora, CIO Insight Release 6x or less per year Set increasing release velocity as top IT priority
  18. 18. Enterprise Priority: Security 60% Source: Forbes 2017 State Of Cloud Adoption And Security Report security concerns slowing cloud adoption
  19. 19. The Docker Modernize Traditional Apps POC Program Partner Consulting Services Partner Infrastructure Docker Enterprise Edition Portable Agile Secure Efficient < 5 days + + No Code Changes App Existing Application Convert to a Docker EE container Modern Infrastructure
  20. 20. Reducing total costs by 50% MTA POC Impact Hybrid Cloud-Ready Portability Agility 2x Faster Security Isolation & Integrity
  21. 21. The Modernization Journey App Existing Application Modern Methodologies Convert to a Docker EE Container Modern Infrastructure Ongoing Innovation
  22. 22. 22 KEY CHALLENGES • Accumulated thousands of apps, 400+ systems of record and 5 infrastructures over 150 years • Difficult to innovate with majority of budget spent on maintenance SOLUTION • Leverage Docker MTA program to modernize the email opt- out app with Docker EE to drive down total costs Docker EE and MTA create self funding model for container adoption -70% VMs -67% Cores 10x Average CPU utilization + + -66% Total Cost of Ownership 593 Applications RESULTS • Modernization of single app completed in 1 day • Applying model to other apps built with same technology • Business case forecasts a 66% cost reduction
  23. 23. 23 KEY CHALLENGES • Maintenance costs of managing traditional apps on prem • Code quality was increasingly difficult with outsource software house • App delivery process was too slow for the pace of the business SOLUTION • Leverage Docker MTA program jointly with their trusted partner Accenture App Visibility and Consistency at 50% the Cost RESULTS • 50% savings across all applications • Unified architecture for the first time • New visibility into their outsourced applications
  24. 24. Kubernetes in Docker
  25. 25. What is a container orchestrator? Management of containers running in one or more container runtimes
  26. 26. Docker Enterprise Edition Docker Community Edition containerd The best container development workflow The best enterprise container security and management Docker: Now Powered by Swarm and Kubernetes Native Kubernetes integration provides full ecosystem compatibility Industry-standard container runtime
  27. 27. Lifecycle of a Kubernetes API Request Kubernetes API Server Authentication Authorization Admission Control etcd
  28. 28. Orchestrator: Docker Engine with Swarm-Mode Enabled ● ● Declarative State through the “Service” construct ● Built-in Routing Mesh & Overlay networking ● In-memory Raft Store for all state (persisted to disk) ● Built-in CA, per-node cryptographic node identity, mTLS between all endpoints
  29. 29. Orchestrator: Kubernetes ● ● Scheduling Unit: Pods ● Declarative State through “Controllers”: Deployment, ReplicaSet, DaemonSet … ● Load balancing via Services and Ingresses ● Flat Networking model delegated to plugins
  30. 30. Docker EE 2.0: A conformant kubernetes distribution
  31. 31. Test locally on Swarm and Kubernetes Develop with Docker Community Edition on your workstation Deploy to production in Swarm Deploy to production in Kubernetes Docker Community Edition All in one development for Swarm and Kubernetes
  32. 32. Demo: Kubernetes in Docker Desktop
  33. 33. Kubernetes in Docker Desktop
  34. 34. General CE/EE Architecture
  35. 35. Linuxkit VM Kubernetes CLI Swarm Mode Kubernetes etcd Docker CLI kubeadm Kubernetes in Docker CE (Windows and Mac) Compose CRD Single Docker Engine vpnkitHost fs mounts hyperkit / hyperv
  36. 36. Docker EE now includes Kubernetes Docker Enterprise Edition Production Ready Windows and IBM P/Z Support Pods, batch jobs, blue-green deployments, horizontal pod auto-scaling Docker Swarm Swarm-Mode Kubernetes Private Image Registry Secure Access and User Management App and Cluster Management Image Security Scanning Content Trust and Verification Policy Management
  37. 37. GUI Universal Control Plane Trusted Registry Kubernetes CLI Docker Engine Swarm-Mode Docker Swarm Kubernetes etcd CA OIDC Provider Docker CLI Node Agent Reconciler Kubernetes in Docker EE
  38. 38. Docker EE Architectural Highlights ● Conformant Kubernetes components ran as Docker containers ● Swarm Managers are Kubernetes Masters ● Swarmkit node inventory is source of truth ● Cryptographic Node Identity and mTLS used throughout
  39. 39. - Easy High Availability provisioning - Cryptographic node identity Features Swarm Support - Registry - Content Trust - Secure Scanning - Clean upstream integration - Full ecosystem compatibility - Role Based Access Control - Authorization, Authentication - Node Segmentation Secure Cluster Lifecycle Secure Supply Chain 100% Interoperability Secure Multi-tenancy Management Dashboard Supported and Certified on Windows Server and Major Linux Distributions Kubernetes Support Docker Enterprise Edition Management for Swarm and Kubernetes
  40. 40. Demo: Kubernetes in Docker EE 2.0
  41. 41. Uses of Kubernetes Plugin Interfaces
  42. 42. Authentication ● X509 Client Certificates ○ Used for authentication of kubectl and the docker CLI via the “client bundle” feature ● OpenID Connect Identity Provider ○ GUI sessions use a custom identity provider and a token exchange service to authenticate with the OIDC authentication plugin
  43. 43. Authorization ● All requests authorized via the Authorization Webhook plugin ● Custom RBAC system shared between Swarm and Kubernetes: ○ Users, Teams, Organizations, Service Accounts ○ Custom Roles ○ Hierarchical “Grants” ● No support for the API, future plans for API translation
  44. 44. Admission Control ● Allows plugins to inspect, mutate or reject API requests after authorization ● Used for: ○ Orchestrator Selection ○ Linking nodes to namespaces ○ User Impersonation for Stacks ○ Image Signing policy enforcement
  45. 45. Orchestrator Selection ● Each node is running both kubernetes and swarm system components ● Administrators can toggle between (kubernetes, swarm or mixed) for any given node ● When toggling orchestrators, workloads of the previous orchestrator will be evicted ● An admission controller ensures that kubernetes workloads can only be scheduled on nodes labelled as “kubernetes” nodes. ● Workloads of multiple orchestrators on the same node can lead to resource contention Manager Node (K8s, Swarm) Worker Node (Swarm) Worker Node (Kubernetes) Worker Node (Kubernetes) Kubelet Swarm Agents Kubelet Kubelet Kubelet Swarm Agents Swarm Agents Swarm Agents
  46. 46. Linking Nodes to Namespaces ● Allows users to uniquely assign nodes to namespaces. ● Variation of the PodNodeSelector admission controller integrated with UCP’s RBAC system
  47. 47. Image Signing Policy Enforcement ● Enforces that all workloads deployed in the cluster have a fully qualified image reference ● Resolves image references to always include a digest ● Contacts the registry to ensure that the referenced image has been signed by an authorized user.
  48. 48. The Tao of Docker
  49. 49. 之道 Tao, The Way
  50. 50. 之道 Tao
  51. 51. 无为 Wu-wei, Effortless action
  52. 52. 无为 Wu-wei, Effortless action
  53. 53. 自然 Ziran, Naturalness
  54. 54. 自然 Ziran, Naturalness container based No state No couplingbounded context
  55. 55. 无为 Modernize traditional applications without coding The Docker 之道 自然 Create microservice applications with the container platform that started the container revolution
  56. 56. Beta signup is open! GENERALLY AVAILABLE Q1 2018 Docker: Now powered by Swarm and Kubernetes
  57. 57. Thank You! chanezon @chanezon