This document discusses containers and container infrastructure. It begins by explaining how containers allow complex systems to be broken into discrete functional parts for modular development and scale. It then contrasts containers with virtual machines, noting that containers share a host kernel and use kernel namespaces for isolation rather than full hardware virtualization. The document goes on to describe how containers use cgroups and namespaces to provide isolation. It stresses that containers are built on and isolated using features of the Linux kernel. It also discusses the need for container orchestration in production for fault tolerance, scaling, resource optimization, service discovery, and rolling updates. Finally, it outlines some benefits of using Cisco Application Centric Infrastructure (ACI) with Kubernetes for container orchestration.

1. © 2018 Cisco and/or its affiliates. All rights reserved.
Building a Container-Ready Infrastructure
PrastowoYuliarso
DCTechnical Solution Architect

2. © 2018 Cisco and/or its affiliates. All rights reserved.
Breaking systems into independently changeable agents
From Monolithic to Microservices Architectures
• Breaking complex enterprise systems
traditionally built as monolith into discrete
functional parts.
• Allows for development and upgrades to
happen modularly.
• Allows for the different parts to be distributed
across multiple machines for scale and
availability.
• Better utilization of physical resources by
executing only the code and processes that
provide an application service as opposed to
an entire operating system.
• Containers are the atomic unit of
Microservices.

3. © 2018 Cisco and/or its affiliates. All rights reserved.
Abstraction of resources at an OS and not a hardware level
Comparing and Contrasting VMs to Containers
Server
Hypervisor
App
A
App
A
App
B
Server
Hypervisor
Container Engine (Linux)
App
A
App
A
App
B
App
B
Guest
OS
Guest
OS
Guest
OS
App
B
VM Container

4. © 2018 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
• Containers share the host kernel
• Containers use the kernel ability to
group processes for resource
control
• Containers ensure isolation through
namespaces
• Containers feel like lightweight VMs
(lower footprint, faster), but are not
Virtual Machines!
Server
Hypervisor
Container Engine (Linux)
App
A
App
A
App
B
App
B
App
BContainer
A more detailed look into Containers

5. © 2018 Cisco and/or its affiliates. All rights reserved.
Containers are Linux
• Containers are isolated processes
• Containers ensure isolation through
namespaces
• Containers do NOT run on Docker.
The Docker daemon uses user space
tools that talk to the kernel to set up
containers
Server
Hypervisor
Container Engine (Linux)
App
A
App
A
App
B
App
B
App
BContainer
BRKACI-1024 6

6. © 2018 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
• Kernel control groups (cgroups)
• Limit, account for, and isolate the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of
processes
• Namespaces
• Provide isolation for different types of resources
How are containers built?
Key features used by containers
Cgroups
cpu cpuset memory device
Namespaces
PID MNT IPC UTC NET

7. © 2018 Cisco and/or its affiliates. All rights reserved.
For development, it may be ok to run containers on a single host to develop and test an application.
However, for production environments the following requirements need to be met:
• Are fault-tolerant
• Can scale, and do this on-demand
• Use resources optimally
• Can discover other applications automatically, and communicate with each other
• Are accessible from the external world
• Can update/rollback without any downtime.
Container Orchestrators are the tools which group hosts together to form a cluster, while meeting the
above requirements.
Container Orchestration

8. © 2018 Cisco and/or its affiliates. All rights reserved.
Container-based architecture
Common elements
Infrastructure
Runtime
Orchestration
Kubernetes
Container
Platforms
Nomad

9. © 2018 Cisco and/or its affiliates. All rights reserved.
ACI + Kubenetes Benefits
Visibility: Live statistics in APIC
per container and health
metrics
Unified networking:
Containers, VMs, and
baremetal
Micro-services
load balancing integrated in
fabric for HA / performance
Secure multi tenancy and
separation of concerns
Seamless integration of
Kubernetes network
policies and ACI policies

10. © 2018 Cisco and/or its affiliates. All rights reserved.
CISCO CONNECT 2018 . IT’S ALL YOU
Solution Highlights: ACI and Kubernetes
1. Flexible mapping of Kubernetes policies to APIC policies
• Simple developer driven workflow
• Network team + developer workflow
2. Fabric load balancing
• Symmetric PBR for north south traffic
• Host datapath distributed internal load balancer
3. APIC GUI integration for Kubernetes
• Stats per pod, deployment, service
• Physical + virtual correlation
Docker Host (Linux)
OVS
Key Capabilities
APIC Kubernetes Plugins
OpFlex Agent
OpFlex Proxy
Kubernetes Master
CNI Plugin

11. © 2018 Cisco and/or its affiliates. All rights reserved.
DEMO

12. © 2018 Cisco and/or its affiliates. All rights reserved.