Since last DockerCon, Kubernetes has been integrated into both the Desktop and Enterprise editions of the Docker Platform. In this deep dive session, we’ll showcase live demos and explore where Kubernetes fits in the architecture of both the Desktop and the Enterprise editions and which community tools make this integration possible. We’ll be covering topics ranging from hypervisor control, storage and networking all the way to the integration of a custom RBAC system, native Compose file support and providing a rich user interface for Kubernetes.

1. Wayne Song
Software Engineer, Docker Inc.
Kubernetes in the
Docker platform
Guillaume Tardif
Software Engineer, Docker Inc.

2. Kubernetes
● First introduced in Docker for Mac 17.12 and Docker for
Windows 18.02 with one-click cluster install
● Introduced in Docker EE 2.0
● Passes all Kubernetes Conformance tests

3. Docker Desktop Mac & Windows
● Most efficient way to use Docker on Mac & Windows
● Runs in a Linux VM; No VirtualBox, VMware Fusion, etc.
● Takes care of network & disk shares for you
● Auto-update, you get the latest Docker available
● Two distribution channels: Edge / Stable
● Download from https://store.docker.com/

4. Docker for Mac and Windows
LinuxKit VM
Docker CLI
Docker Engine
Network sharingFilesystem sharing Hypervisor
containerd

5. ● One-click button to enable
Kubernetes
● Show or hide all kube-system
containers in docker ps
Starting a Kubernetes cluster

6. Kubernetes in Docker for Desktop
LinuxKit VM
Kubernetes CLI
kubelet
Swarm mode
Docker CLI
Docker Engine
Network sharingFilesystem sharing Hypervisor
containerd
Kubernetes services

7. Boot Sequence
Host VM
1. Install kubectl 2. Run kubeadm init
3. Start kubelet
4. Wait for kubeadm init to finish
5. Run kubeadm upgrade if necessary
6. Update ~/kube/config
7. Open API server port
8. Start custom controllers :
PVC, Load balanced services, etc.

8. Persistent Volumes
● hostPath Volume can mount a volume in the host or in the VM
● Support of inotify: file change events are propagated to the VM
● NFS, Git, Ceph and RBD volumes can be also mounted

9. Persistent Volume Claims
● Persistent Volume Claim controller is included
Automatically create a hostPath volume in ~/.docker/Volumes
● StatefulSets, workload API object used to manage stateful applications,
work as expected

10. Exposed Ports
● Network setup with simple CNI bridge
● LoadBalancer and NodePort services automatically exposed on the host
with a VPNKit controller

11. v
Kubernetes in Docker for Mac
Demo

12. So you can use kubectl, helm, deploy Kubernetes apps…
… but could we deploy to Kubernetes with
docker stack deploy -c myComposeFile … ?
Compose for Kubernetes

13. ● Use API aggregation
● Provide a new type: Stack
● Can be use either with Docker and Kubernetes CLI.
○ kubectl get stacks
○ docker stack ls
● Automatically :
○ Create PV for Compose volumes
○ Expose ports with LoadBalancer services
Compose for Kubernetes

14. v
Try it out at trial.docker.com
Kubernetes in Docker EE

15. v
Kubernetes in Docker EE 2.0
Demo

16. Kubernetes API Request Lifecycle
Kubernetes API Server
Authentication Authorization
Admission
Control
etcd

17. ● X509 Client Certificates
○ Used for authentication of kubectl and the docker CLI via
the “client bundle” feature
● OpenID Connect Identity Provider
Authentication

18. ● Requests authorized via the Authorization Webhook plugin
● Custom RBAC system shared between Swarm and
Kubernetes:
○ Users, Teams, Organizations, Service Accounts
○ Custom Roles
● No support for the rbac.authorization.k8s.io API,
future plans for API translation
Authorization

19. Authorization

20. ● Allows plugins to inspect, mutate or reject API requests
after authorization
● Used for:
○ Node RBAC
○ Orchestrator Selection
○ Image Signing policy enforcement
Admission Control

21. ● Administrators can toggle between kubernetes or swarm orchestrator for any
node
● When toggling orchestrators, workloads of the previous orchestrator will be
evicted
● An admission controller ensures that kubernetes workloads can only be
scheduled on nodes labelled as “kubernetes” nodes.
● Workloads of multiple orchestrators on the same node can lead to resource
contention
Orchestrator Selection

22. ● Enforces that all workloads deployed in the cluster have a
fully qualified image reference
● Resolves image references to always include a digest
● Contacts the registry to ensure that the referenced image
has been signed by an authorized user.
Image Policy Signing Enforcement

23. ● Docker Desktop and EE now include a
conformant Kubernetes distribution
● Integration with UCP authentication,
RBAC, and image signing for unified
experience between Kubernetes and
Swarm
● Try it out at docker.com/get-docker and
trial.docker.com
In Summary