DCEU 18: Docker Container Networking
•
2 likes•825 views
This document discusses Docker container networking and publishing applications securely with Docker Enterprise. It provides an overview of key Kubernetes networking concepts like pods, services, ingress and network policies. It then details how Docker Enterprise integrates with Calico for container networking and policy-driven security. The integration provides connectivity between pods and services out of the box. It also allows enforcing network policies and zero-trust security through Calico's policy engine. The document concludes with demos of publishing sample applications using Docker Swarm services and Kubernetes ingress resources.
Report
Share
More Related Content
What's hot
What's hot (20)
Similar to DCEU 18: Docker Container Networking
Similar to DCEU 18: Docker Container Networking (20)
More from Docker, Inc.
More from Docker, Inc. (20)
Recently uploaded
Recently uploaded (20)
DCEU 18: Docker Container Networking
- 1. Docker Container Networking How to Publish and Secure applications in the Docker Enterprise Platform
- 2. Senior Consultant, Hopla Software @frjaraur Javier Ramirez Solution Engineer, Docker @GuillaumeMorini Guillaume Morini
- 3. Goal of this Session ● Basics of K8S Networking ● Docker Enterprise + Calico Integration Overview ● Application Publishing with Docker Enterprise ● Takeaways ● Q&A
- 4. Let’s Start with K8S Connectivity Basics
- 5. Kubernetes Connectivity Concepts Pod Networking (CNI) Ingress Services (Kube-proxy) Network Policy Kube-DNS
- 6. Node UCP Manager Manager Nodes Load Balancer (ucp.example.com) Node Node Node UCP worker Worker Nodes Node UCP worker Node UCP worker Node DTR worker DTR Nodes Load Balancer (dtr.example.com) Node DTR worker Node DTR worker DTR Storage (Azure Storage, NFS, etc.) Logging Monitoring Image storage External CALDAP/AD Add-ons UCP Manager UCP Manager Docker Enterprise Overview Load Balancer (app.example.com)
- 7. Secure networking for the cloud-native era Open source, maintained by Tigera with hundreds of third party contributors Batteries-included Container networking for Docker Enterprise Kubernetes > Scalable, distributed control plane > Policy-driven network security > No overlay required > Integrated with all major cloud platforms > Widely deployed, proven at scale TIGERA CALICO: WHY IT’S AWESOME
- 8. ➔ No Underlay Dependency = No Lock-In ➔ Simple Zero-Touch Provisioning ➔ Any Infrastructure, Any Cloud ◆ On-Prem ( VM, Bare) ◆ Cloud ( AWS, Azure, GCP) ◆ Hybrid Heterogeneous Infrastructure
- 9. Connectivity Concept Out-of-the-Box Solution with Docker Enterprise 2.1 Pod - Pod Calico CNI Services ClusterIP NodePort LoadBalancer Ingress NGINX Ingress Controller DNS kube-dns K8s Network Policy Calico Diverse Application Portfolio * Tigera CNX builds on Calico with enterprise security features: Hierarchical Policies, Policy RBAC, DevSecOps tools (Audit, Alerting, Compliance), etc.
- 10. Zero-Trust Security •Declarative policy-driven isolation •Fine-grained access control •Dynamic, in lock step with Kubernetes ComplianceStage/tier separation Tenant/namespace isolation Micro- segmentation
- 11. UCP Manager/ K8s Master Manager Nodes Worker Nodes Docker Enterprise 2.1 Calico Integration kubelet k8s-apiserver calico-node Appl Pod A kubelet UCP / k8s Worker A kube-proxy kube-dns k8s-scheduler calico-node kube-proxy calico-node App Pod B kubelet kube-proxy UCP / k8s Worker B Pod IP Connectivity Peering Native Host Routing calico-kube-controller k8s-controller eth0 eth0
- 12. Let’s dig inside each component
- 13. Worker Nodes UCP Manager/ K8s Master Manager Nodes Pod Creation: Kubelet Node apiserver scheduler controller- manager Etcd kubelet Node Pod Node
- 14. Worker Nodes UCP Manager/ K8s Master Manager Nodes Pod Network: Calico/CNI apiserver scheduler controller- manager Etcd kubelet Calico/CNI Calico/IPAM
- 15. Worker Nodes UCP Manager/ K8s Master Manager Nodes Pod Network: Calico/Node apiserver scheduler controller- manager Etcd kubelet Calico/CNI Calico/IPAM Calico/Node Calico/Node Calico/CNI Calico/IPAM kubelet
- 16. Worker Nodes UCP Manager/ K8s Master Manager Nodes Kubernetes Services: Kube-proxy apiserver scheduler controller- manager Etcd kubelet Calico/CNI Calico/IPAM Calico/Node Calico/Node kube-proxy kube-proxy Calico/CNI Calico/IPAM kubelet > Cluster IP > Node Port > Load Balancer
- 17. Worker Nodes UCP Manager/ K8s Master Manager Nodes Network Policy apiserver scheduler controller- manager Etcd kubelet Calico/CNI Calico/IPAM Calico/Node Calico/Node kube-proxy kube-proxy Calico/CNI Calico/IPAM kubelet
- 18. Let’s demo
- 19. UCP Manager/ K8s Master Manager Nodes Load Balancer (ucp.example.com) Node UCP/K8S worker Worker Nodes Node UCP/K8S worker Node UCP/K8S worker UCP Manager/ K8s Master UCP Manager/ K8s Master Calico Node Calico Node Calico Node Calico Node Calico NodeCalico Node App Pods App Pods App Pods Demo 1: Docker Enterprise + Calico Overview Thanks @ahmetb
- 20. Demo 1: Network policy Thanks @ahmetb Web Pods Search Pods API Pods Other Pods Db Pod Bookstore app
- 21. UCP Manager/ K8s Master Manager Nodes Kubernetes Services: Ingress apiserver scheduler controller- manager Etcd Worker NodesIngress Nodes pod svc A service-a.example.com
- 22. Kubernetes Services: Ingress Components ● Ingress Controller ● Ingress Resource ● Default Backend
- 23. Kubernetes Services: Ingress Smart Loadbalancers ● Kubernetes Nginx * ● Nginx/Nginx Plus ● Traëfik Loadbalancers Controllers ● Cluster External Ingress Elements Interaction: ○ Big IP F5 Ingress ○ Octavia Ingress Controller ○ GLBC (GCE L7 lbctl) ○ Netscaler ○ AVI Networks Vantage ● Cluster Internal API Gateways: ○ Kong Framework Specific ● Docker Enterprise Interlock * ● Openshift Router * Tested on Docker Enterprise
- 24. Kubernetes Services: Ingress Ingress Resource apiVersion: extensions/v1beta1 kind: Ingress metadata: name: colors-ingress annotations: nginx.com/sticky-cookie-services: "serviceName=red-svc red_svc_id expires=60s path=/;" nginx.com/health-checks: "true" nginx.org/rewrites: "serviceName=red-svc rewrite=/;" spec: rules: - host: blue.example.com http: paths: - path: /red/ backend: serviceName: red-svc servicePort: 80 - backend: serviceName: blue-svc servicePort: 80 - host: red.example.com http: paths: - backend: serviceName: red-svc servicePort: 80
- 25. Swarm Services: Interlock UCP Manager/ K8s Master Manager Nodes apiserver scheduler controller- manager Etcd interlock-extension interlock-proxy Worker Nodes Worker Nodes with Interlock Proxy tasks service A a.example.com interlock-proxy interlock BYOLB
- 26. Swarm Services: Interlock Interlock Service Publishing version: "3.3" services: red: image: codegazers/colors:1.12 environment: - COLOR=red deploy: replicas: 3 labels: com.docker.lb.hosts: red.example.com com.docker.lb.network: colors com.docker.lb.port: 3000 networks: - colors blue: image: codegazers/colors:1.12 environment: - COLOR=blue deploy: replicas: 2 labels: com.docker.lb.hosts: blue.example.com com.docker.lb.network: colors com.docker.lb.port: 3000 networks: - colors networks: colors: driver: overlay
- 27. Let’s demo
- 28. UCP Manager/ K8s Master Manager Nodes Load Balancer (ucp.example.com) Node UCP/K8S worker Worker Nodes Node UCP/K8S worker Node UCP/K8S worker UCP Manager/ K8s Master UCP Manager/ K8s Master Calico Node Calico Node Calico Node Calico Node Calico NodeCalico Node Red Pod Blue Pod Node UCP/K8S worker Node UCP/K8S worker Calico Node Calico Node NGINXKong Demo 2: Let’s Deploy a Sample Application Ingress Nodes Red Service Blue Service Red Pod Blue Pod Red Pod Black Service Black Pod
- 29. Takeaway Docker Enterprise allows you to: • Easily publish your applications using Docker Swarm or Kubernetes • Integrate with various solutions to support your choices of using any infrastructure • Enforce a dynamic policy-based microsegmentation
- 30. Try Docker Enterprise + Calico: trial.docker.com community.docker.com slack.projectcalico.org @docker @projectcalico @tigeraio @thekonginc @nginx Thank you! Questions?
- 31. Take A Breakout Survey Access your session and/or workshop surveys for the conference at any time by tapping the Sessions link on the navigation menu or block on the home screen. Find the session/workshop you attended and tap on it to view the session details. On this page, you will find a link to the survey.
- 32. Come Join Us In San Francisco April 29-May 2 2019