diff --git a/www/htdocs/ambassadors/dockercoins-1.png b/www/htdocs/ambassadors/dockercoins-1.png new file mode 100644 index 00000000..30b844a1 Binary files /dev/null and b/www/htdocs/ambassadors/dockercoins-1.png differ diff --git a/www/htdocs/ambassadors/dockercoins-2.png b/www/htdocs/ambassadors/dockercoins-2.png new file mode 100644 index 00000000..6bbaf291 Binary files /dev/null and b/www/htdocs/ambassadors/dockercoins-2.png differ diff --git a/www/htdocs/ambassadors/dockercoins-3.png b/www/htdocs/ambassadors/dockercoins-3.png new file mode 100644 index 00000000..5adf0ea3 Binary files /dev/null and b/www/htdocs/ambassadors/dockercoins-3.png differ diff --git a/www/htdocs/ambassadors/dockercoins-4.png b/www/htdocs/ambassadors/dockercoins-4.png new file mode 100644 index 00000000..9cd26c09 Binary files /dev/null and b/www/htdocs/ambassadors/dockercoins-4.png differ diff --git a/www/htdocs/ambassadors/dockercoins-5.png b/www/htdocs/ambassadors/dockercoins-5.png new file mode 100644 index 00000000..6b82cbb5 Binary files /dev/null and b/www/htdocs/ambassadors/dockercoins-5.png differ diff --git a/www/htdocs/ambassadors/dockercoins-6.png b/www/htdocs/ambassadors/dockercoins-6.png new file mode 100644 index 00000000..78940242 Binary files /dev/null and b/www/htdocs/ambassadors/dockercoins-6.png differ diff --git a/www/htdocs/ambassadors/dockercoins-7.png b/www/htdocs/ambassadors/dockercoins-7.png new file mode 100644 index 00000000..45d2ee67 Binary files /dev/null and b/www/htdocs/ambassadors/dockercoins-7.png differ diff --git a/www/htdocs/ambassadors/principle-1.png b/www/htdocs/ambassadors/principle-1.png new file mode 100644 index 00000000..e61d9185 Binary files /dev/null and b/www/htdocs/ambassadors/principle-1.png differ diff --git a/www/htdocs/ambassadors/principle-2.png b/www/htdocs/ambassadors/principle-2.png new file mode 100644 index 00000000..3f59389b Binary files /dev/null and b/www/htdocs/ambassadors/principle-2.png differ diff --git a/www/htdocs/ambassadors/scaling-1.png b/www/htdocs/ambassadors/scaling-1.png new file mode 100644 index 00000000..5ed79200 Binary files /dev/null and b/www/htdocs/ambassadors/scaling-1.png differ diff --git a/www/htdocs/ambassadors/scaling-2.png b/www/htdocs/ambassadors/scaling-2.png new file mode 100644 index 00000000..e87309e2 Binary files /dev/null and b/www/htdocs/ambassadors/scaling-2.png differ diff --git a/www/htdocs/ambassadors/scaling-3.png b/www/htdocs/ambassadors/scaling-3.png new file mode 100644 index 00000000..b4cb7206 Binary files /dev/null and b/www/htdocs/ambassadors/scaling-3.png differ diff --git a/www/htdocs/ambassadors/scaling-4.png b/www/htdocs/ambassadors/scaling-4.png new file mode 100644 index 00000000..ead74211 Binary files /dev/null and b/www/htdocs/ambassadors/scaling-4.png differ diff --git a/www/htdocs/ambassadors/simple-1.png b/www/htdocs/ambassadors/simple-1.png new file mode 100644 index 00000000..c2f5e9b0 Binary files /dev/null and b/www/htdocs/ambassadors/simple-1.png differ diff --git a/www/htdocs/ambassadors/simple-2.png b/www/htdocs/ambassadors/simple-2.png new file mode 100644 index 00000000..24ccde1e Binary files /dev/null and b/www/htdocs/ambassadors/simple-2.png differ diff --git a/www/htdocs/ambassadors/simple-3.png b/www/htdocs/ambassadors/simple-3.png new file mode 100644 index 00000000..df013f78 Binary files /dev/null and b/www/htdocs/ambassadors/simple-3.png differ diff --git a/www/htdocs/ambassadors/simple-4.png b/www/htdocs/ambassadors/simple-4.png new file mode 100644 index 00000000..febfd5e3 Binary files /dev/null and b/www/htdocs/ambassadors/simple-4.png differ diff --git a/www/htdocs/ambassadors/simple-5.png b/www/htdocs/ambassadors/simple-5.png new file mode 100644 index 00000000..8cdec534 Binary files /dev/null and b/www/htdocs/ambassadors/simple-5.png differ diff --git a/www/htdocs/ambassadors/simple-6.png b/www/htdocs/ambassadors/simple-6.png new file mode 100644 index 00000000..3bd5cbf3 Binary files /dev/null and b/www/htdocs/ambassadors/simple-6.png differ diff --git a/www/htdocs/index.html b/www/htdocs/index.html index ec41aba9..3f7e3e51 100644 --- a/www/htdocs/index.html +++ b/www/htdocs/index.html @@ -1503,6 +1503,18 @@ Note: of course, if we wanted, we could run on all five nodes. --- +class: pic + +![Ambassador principle](ambassadors/principle-1.png) + +--- + +class: pic + +![Ambassador principle](ambassadors/principle-2.png) + +--- + ## Start redis - Start a standalone Redis container @@ -3322,12 +3334,24 @@ If we wanted to use DTR, we would: ## Using open source registry -- All we need to do is to run a `registry:2` container +- We need to run a `registry:2` container
(make sure you specify tag `:2` to run the new version!) - It will store images and layers to the local filesystem
(but you can add a config file to use S3, Swift, etc.) +- Docker *requires* TLS when communicating with the registry, + unless for registries on `localhost` or with the Engine + flag `--insecure-registry` + +- We will run an ambassador on each node + of the cluster, redirecting `localhost:5000` to + the registry + +--- + +## Deploying our open source registry + .exercise[ - Start your registry on your Swarm cluster: @@ -3336,9 +3360,53 @@ If we wanted to use DTR, we would: docker run -dP --name registry registry:2 ``` +- Start five ambassadors (one per node): + ``` + for N in $(seq 1 5); do + docker run -d -p 5000:5000 jpetazzo/hamba \ + 5000 $(docker port registry 5000) + done + ``` + +] + +--- + +## Testing our local registry + +- We can retag a small image, and push it to the registry + +.exercise[ + +- Make sure we have the busybox image: + ``` + docker pull busybox + ``` + +- Retag the busybox image: + ``` + docker tag busybox localhost:5000/busybox + ``` + +- Push it: + ``` + docker push localhost:5000/busybox + ``` + +] + +--- + +## Using our local registry + +- The `build-tag-push.py` script uses the `DOCKER_REGISTRY` + environment variable + +.exercise[ + - Set the `DOCKER_REGISTRY` variable: ``` - export DOCKER_REGISTRY=$(docker port registry 5000) + export DOCKER_REGISTRY=localhost:5000 ``` ] @@ -3598,6 +3666,50 @@ This is our plan: --- +## Pictures worth 1000 words + +- In the following diagrams, we are connecting a + `www` service to a `redis` service through + an ambassador. + +--- + +class: pic + +![](ambassadors/simple-1.png) + +--- + +class: pic + +![](ambassadors/simple-2.png) + +--- + +class: pic + +![](ambassadors/simple-3.png) + +--- + +class: pic + +![](ambassadors/simple-4.png) + +--- + +class: pic + +![](ambassadors/simple-5.png) + +--- + +class: pic + +![](ambassadors/simple-6.png) + +--- + ## Our tools - `link-to-ambassadors.py` @@ -3626,34 +3738,20 @@ This is our plan: .exercise[ - Run the first script to create a new YAML file: -
`../link-to-ambassadors.py $COMPOSE_FILE new.yml` - -- Look how the file was modified: -
`diff $COMPOSE_FILE new.yml` +
`../bin/link-to-ambassadors.py` ] +In the Compose file, all links have been replaced +by `extra_hosts` sections. + --- -## Change `$COMPOSE_FILE` in place +class: pic -The script can take zero, one, or two file name arguments: +## Current state -- two arguments indicate input and output files to use; -- with one argument, the file will be modified in place; -- with zero agument, it will act on `$COMPOSE_FILE`. - -For convenience, let's avoid having a bazillion files around. - -.exercise[ - -- Remove the temporary Compose file we just created: -
`rm -f new.yml` - -- Update `$COMPOSE_FILE` in place: -
`../link-to-ambassadors.py` - -] +![Two empty hosts](ambassadors/dockercoins-1.png) --- @@ -3666,9 +3764,6 @@ The application can now be started and scaled. - Start the application:
`docker-compose up -d` -- Scale the application: -
`docker-compose scale worker=5 rng=10` - ] Note: you can scale everything as you like, *except Redis*, @@ -3676,6 +3771,14 @@ because it is stateful. --- +class: pic + +## Current state + +![Containers are running, but disconnected](ambassadors/dockercoins-2.png) + +--- + ## Create the ambassadors This has to be executed each time you create new services @@ -3691,12 +3794,20 @@ It will create missing ambassadors. .exercise[ - Run the script! -
`../create-ambassadors.py` +
`../bin/create-ambassadors.py` ] --- +class: pic + +## Current state + +![Ambassadors are started, but unconfigured](ambassadors/dockercoins-3.png) + +--- + ## Configure the ambassadors All ambassadors are created but they still need configuration. @@ -3713,12 +3824,20 @@ Then it configures all ambassadors with all found backends. .exercise[ - Run it! -
`../configure-ambassadors.py` +
`../bin/configure-ambassadors.py` ] --- +class: pic + +## Current state + +![Ambassadors are configured](ambassadors/dockercoins-4.png) + +--- + ## Check what we did .exercise[ @@ -3733,25 +3852,121 @@ Then it configures all ambassadors with all found backends. --- +## Scale + +- We will now add more containers. + +.exercise[ + +- Scale worker and rng: + ``` + docker-compose scale worker=5 rng=10 + ``` + +] + +The performance graph stays at the same level. + +If we look at the logs of the added workers, we will +see screenfuls of "connection refused" exceptions. + +--- + +class: pic + +## Current state + +![New containers are there, but not ambassadors](ambassadors/dockercoins-5.png) + +--- + +## Add ambassadors + +- The new containers don't have ambassadors at this point. + +.exercise[ + +- Create the missing ambassadors with the script: + ``` + ../bin/create-ambassadors.py + ``` + +] + +The performance graph stays at the same level. + +If we look at the logs of the added workers, we will +now see timeout errors instead of "connection refused." + +--- + +class: pic + +## Current state + +![Now ambassadors are here, but unconfigured](ambassadors/dockercoins-6.png) + +--- + +## Configure ambassadors + +- The last step is to inject the updated configuration. + +.exercise[ + +- Run the last script one more time: + ``` + ../bin/configure-ambassadors.py + ``` + +] + +Now the performance graph climbs up, and the worker +logs show normal operation. + +--- + +class: pic + +## Current state + +![All ambassadors are here and configured](ambassadors/dockercoins-7.png) + +--- + ## Clean up - Before moving on, stop and remove all containers .exercise[ -- Terminate all containers: +- Terminate and remove all containers: ``` - docker-compose kill + docker-compose down ``` -- Remove them: +- Remove ambassadors: ``` - docker-compose rm -f + ../bin/delete-ambassadors.sh ``` ] -Note: we also need to remove the ambassadors. +--- + +## A few words about those ambassadors + +- There is "a lot" of added complexity here +
(5 scripts of almost 50 lines each!) + +- Snark aside, those scripts tap into those concepts: + + - network namespaces + - dynamic load balancer reconfiguration + - sidekick containers that are *mandatory* + - ... and have to be managed manually + +- We are going to see an easier way to manage this! --- @@ -4038,29 +4253,21 @@ Note: good guy ~~Stevedore~~ Docker will start without K/V .exercise[ -``` -docker network create --driver overlay jedi -docker network create --driver overlay darkside -docker network ls -``` +- Create two networks, *blue* and *green*: + ``` + docker network create --driver overlay blue + docker network create --driver overlay green + docker network ls + ``` -] - --- - -(Don't worry, there won't be any spoiler here, I have -been so busy preparing this workshop that I haven't -seen the new movie yet!) - --- - -.exercise[ - -``` -docker run -d --name luke --net jedi -m 3G redis -docker run -d --name vador --net jedi -m 3G redis -docker run -d --name palpatine --net darkside -m 3G redis -``` +- Create containers with names of blue and green + things, on their respective networks: + ``` + docker run -d --name sky --net blue -m 3G redis + docker run -d --name navy --net blue -m 3G redis + docker run -d --name grass --net green -m 3G redis + docker run -d --name forest --net green -m 3G redis + ``` ] @@ -4079,40 +4286,75 @@ docker run -d --name palpatine --net darkside -m 3G redis - This will work: ``` - docker exec -ti vador ping luke + docker exec -ti sky ping navy ``` - This will not: ``` - docker exec -ti vador ping palpatine + docker exec -ti navy ping grass ``` ] --- -## Dynamically connect containers +## Containers connected to multiple networks + +- Some colors aren't *quite* blue *nor* green .exercise[ -- ~~Connect `vador` to the `darkside`:~~ -- To the `darkside`, connect `vador` we must: - +- Create a container that we want to be on both networks: ``` - docker network connect darkside vador + docker run -d --net blue --name turquoise nginx ``` -- Now this will work: - +- Check connectivity: ``` - docker exec -ti vador ping palpatine + docker exec -ti turquoise ping -c1 navy + docker exec -ti turquiose ping -c1 grass + ``` + (First works; second doesn't) + +] + +--- + +## Dynamically connecting containers + +- This is achieved with the command: +
`docker network connect NETNAME CONTAINER` + +.exercise[ + +- Dynamically connect to the green network: + ``` + docker network connect green turquoise ``` -- Take a peek inside `vador`: - +- Check connectivity: ``` - docker exec -ti vador ip addr ls + docker exec -ti turquoise ping -c1 navy + docker exec -ti turquiose ping -c1 grass + ``` + (Both commands work now) + +] + +--- + +## Under the hood + +- Each network has an interface in the container + +- There is also an interface for the default gateway + +.exercise[ + +- View interfaces in our `turquoise` container: + ``` + docker exec -ti turquoise ip addr ls ``` ] @@ -4121,25 +4363,22 @@ docker run -d --name palpatine --net darkside -m 3G redis ## Dynamically disconnecting containers +- There is a mirror command to `docker network connect` + .exercise[ -- This works, right: - +- Disconnect the *turquoise* container from *blue* + (its original network): ``` - docker exec -ti vador ping luke + docker network disconnect blue turquoise ``` -- Let's disconnect `vador` from the `jedi` ~~order~~ network: - +- Check connectivity: ``` - docker network disconnect jedi vador - ``` - -- And now: - - ``` - docker exec -ti vador ping luke + docker exec -ti turquoise ping -c1 navy + docker exec -ti turquiose ping -c1 grass ``` + (First command fails, second one works) ] @@ -4152,18 +4391,25 @@ docker run -d --name palpatine --net darkside -m 3G redis - Destroy containers: ``` - docker rm -f luke vador palpatine + docker rm -f sky navy grass forest turquoise ``` - Destroy networks: ``` - docker network rm jedi - docker network rm darkside + docker network rm blue + docker network rm green ``` ] +You cannot remove a network if +it still has containers. + +There is no `"rm -f"` for network. +
+There is a `"disconnect -f"` if needed. + --- # Using overlay networks with Compose @@ -4180,6 +4426,29 @@ docker run -d --name palpatine --net darkside -m 3G redis --- +## Our first "Compose v2" app + +- To deploy DockerCoins, we still need a local registry + +- Let's deploy a local registry using a Compose File v2! + +.exercise[ + +- Go to the `registry` directory in the repository: + ``` + cd ~/orchestration-workshop/registry + ``` + +] + +Let's examine the `docker-compose.yml` file. + +--- + +FIXME + +--- + ## Converting from Compose file v1 to v2 - Services are no longer at the top level, @@ -4229,26 +4498,23 @@ services: ``` ] -Note: `build-tag-push.py` doesn't support v2 format yet. - - +
(or you can `cp docker-compose.yml-v2 docker-compose.yml`) --- -## Manually edit out Compose file +## Update our Compose file - If we try to start the app like that, containers will only run on nodes with the appropriate images - We need to replace each `build:` section with an `image:` section +- We can re-use the `build-tag-push.py` script for that + .exercise[ -- Merge `docker-compose.yml-v2` and `docker-compose.yml-12345678` - that was generated earlier +XXX - Start the application @@ -4256,8 +4522,6 @@ Copy-paste this into `docker-compose.yml` ] -Alternate solution: live code a patch for `build-tag-push.py`. - --- ## Going further