More tips and tricks for running containers like a pro - Rancher Online MEetup - February 2017

© 2017 Rancher Labs, Inc.© 2017 Rancher Labs, Inc .

More Tips and Tricks for Running Containers like a ProFebruary 28, 2017

#ranchermeetup

© 2017 Rancher Labs, Inc.2 © 2017 Rancher Labs, Inc .

Shannon WilliamsCo-Founder/VP Sales @smw355

Darren ShepherdCo-Founder/Chief Architect @ibuildthecloudFreenode: darren0

#ranchermeetup


Rajashree MandaoganeSoftware EngineerRancher Labs @rajashree_28

#ranchermeetup

Bill MaxwellSr. Devops LeadRancher Labs @cloudnautique


Sidhartha ManiSoftware EngineerRancher Labs @utter_babbage

#ranchermeetup

Raul SanchezSr. Field EngineerRancher Labs @rawmindNet


First things first…

This is a not a !

#ranchermeetup


There are rules for a meetup!• We won’t be done on time• Questions are always welcome• Demo, then demo some more• Things will break, be patient

#ranchermeetup

© 2017 Rancher Labs, Inc.© 2017 Rancher Labs, Inc .7

Join the conversation on Twitter #ranchermeetup


Agenda• Integrated Secrets Management – Bill • Autoscaling with Rancher webhooks – Rajashree • Hand-on with Traefik – Raul • Using the Kubernetes Dashboard and Helm – Sidhartha• Latest Releases – Darren

#ranchermeetup


Rancher Labs

#ranchermeetup

An open-source software platform for managing containers

A minimalist OS built explicitly to run Docker

© 2017 Rancher Labs, Inc.10

A complete container management platform that makes it easy to…

INNOVATE WITH CONTAINERSwithout compromising flexibility by empowering developers with fast access

to the latest tools

MANAGE APPLICATIONSby simplifying day to day application lifecycle management

RUN CONTAINERSwith the most complete set of container and infrastructure management capabilities

Production ready✔ 20 million+ downloads

✔ Open platform for innovating

✔ Easy to use interface

✔ Multi-tenant

✔ Role based access

✔ 24X7 support

✔ And more….

© 2017 Rancher Labs, Inc.11

Complete Container Management Platform

Application Catalog

Container Orchestration and SchedulingUser MgmtRBAC

AD/LDAPSAML

Ops MgmtCI/CD

RegistriesMonitoring

Networking

Multi-tenant Environments

Environment 1 Environment N

Infrastructure Services

Storage

……. ..Environment 2

Security DNS/LB


#ranchermeetup

Tips, Tricks and Tools for Running Containers Like a Pro


https://youtu.be/ZovLwCvb2Is

https://youtu.be/ZovLwCvb2Is


Integrated Secrets Management

© 2017 Rancher Labs, Inc.

New Components


Secrets Creation Flow


Secret Container Flow


Lock down the local key at rest. Vault:

Support storing secrets in Vault secrets backend.

Long Term improvements Signing Public Keys Create and deploy Vault tokens.

Road to GA


Docs: http://docs.rancher.com/rancher/v1.4/en/cattle/secrets/

Repos: Github.com/rancher/secrets-api Github.com/rancher/secrets-flexvol

Resources


Demo

#ranchermeetup


Scaling in Rancher with Webhooks

• Scaling of services• Scaling of hosts• Upgrading services

based on Docker Hub webhooks


Autoscaling using webhooks• Create webhooks for scaling up/down a service• Configure an external service to monitor it,

example Prometheus• Prometheus raises alerts and triggers

configured webhooks• Webhook-service handles scaling


Webhooks for service upgrade• Add receiver hook to use as a Docker Hub

webhook for an image• When any tag of the image is pushed, webhook

is triggered• Webhook-service upgrades all services based

on service selectors used while creating receiver hook


Demo

#ranchermeetup


Hands on with Træfik

• Træfik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease


Architecture


Internal Logic


Static config# traefik.tomllogLevel = "INFO"traefikLogsFile = "/opt/traefik/log/traefik.log"accessLogsFile = "/opt/traefik/log/access.log"defaultEntryPoints = ["http", "https"][entryPoints] [entryPoints.http] address = ":8080" [entryPoints.https] address = ":8443" [entryPoints.https.tls] [[entryPoints.https.tls.certificates]] certFile = "/opt/traefik/certs/traefik.crt" keyFile = "/opt/traefik/certs/traefik.key"[web]address = ":8000"[file]filename = "/opt/traefik/etc/rules.toml"watch = true


Dynamic config

[backends] [backends.web-test__webtest] [backends.web-test__webtest.circuitbreaker] expression = "NetworkErrorRatio() > 0.5" [backends.web-test__webtest.LoadBalancer] method = "drr" [backends.web-test__webtest.servers.webtest-web-test-1] url = "http://10.42.115.5:8080" weight = 0 [backends.web-test__webtest.servers.webtest-web-test-2] url = "http://10.42.90.235:8080" weight = 0 [backends.web-test__webtest.servers.webtest-web-test-3] url = "http://10.42.251.194:8080" weight = 0[frontends] [frontends.web-test__webtest] backend = "web-test__webtest" passHostHeader = true priority = 5 [frontends.web-test__webtest.routes.service] rule = "Host:webtest.local,test2.local,test3.local;"


Catalog

- Admin ui- http and https ports- Deploy by host label- https and sticky bit support- Letsencrypt (ACME) support- Autoconfig by services labels

TODO- Rancher internal certs and sni- Real time backend update and traefik built in supporthttps://github.com/containous/traefik/pull/1173Will be included in traefik release v1.2.0-rc2


Catalog


Service labels- traefik.enable = <true | stack | false> - true: the service will be published as *service_name.stack_name.traefik_domain* - stack: the service will be published as *stack_name.domain*. WARNING of collisions - false: the service will not be published- traefik.priority = <priority> # Override for frontend priority. 5 by default- traefik.protocol = <http | https> # Override the default http protocol- traefik.sticky = <true | false> # Enable/disable sticky sessions to the backend- traefik.alias = <alias> # Alternate names to route rule. traefik.domain is appended- traefik.alias.fqdn = < alias fqdn > # Alternate names to route rule. traefik.domain is not appended.- traefik.domain = < domain.name > # Domain names to route rules. Multiple domains separated by ","- traefik.domain.regexp = < domain.regexp > # Domain name regexp rule. Multiple domains separated by ","- traefik.port = <port> # port to expose throught traefik- traefik.acme = < true | false > # Enable/disable ACME traefik feature- traefik.path = < path > # Path rule. Multiple values separated by ","- traefik.path.strip = < path > # Path strip rule. Multiple values separated by ","- traefik.path.prefix = < path > # Path prefix rule. Multiple values separated by ","- traefik.path.prefix.strip = < path > # Path prefix strip rule. Multiple values separated by ","

WARNING: Only services with healthy state are added to traefik, so health checks are mandatory.


Demo

#ranchermeetup


Using the Kubernetes Dashboard and Helm


Kubernetes Dashboard• Web based Kubernetes control UI• Deploy applications• Provides overview of various Kubernetes resources• Provides a log viewer for easy debugging

#ranchermeetup


Kubernetes Helm• Package manager for Kubernetes• Supports private repositories• Search for packages• Configure and Install packages• Delete packages

#ranchermeetup


Demo

#ranchermeetup


Latest Release

Rancher 1.4 – February 4, 2017

Key Features:- Kubernetes Dashboard & Helm- Webhooks- Network Policies- Multi-IP Host Scheduling- Secrets Management (Experimental)


Next ReleasesRancher 1.5 – Early March

Key features:- Catalog Enhancements – Ability to add catalogs per environment- Additional Webhooks – Host scaling, service redeploy- Additional Network Policies – Enhances network policies to support services that are linked- API Interceptor – Admins can now configure pre and post filter hooks into Rancher API requests- Metadata Refactoring – Improvements to allow increased environment scaling


Getting StartedRancher and RancherOS are in GitHub – Get Involved!

#ranchermeetup

http://github.com/rancher

http://github.com/rancher


Even better - try.rancher.com…


Then join a free training class…

http://rancher.com/training

http://rancher.com/training


Thank yourancher.com

#ranchermeetup

More tips and tricks for running containers like a pro - Rancher Online MEetup - February 2017

Technology

Transcript of More tips and tricks for running containers like a pro - Rancher Online MEetup - February 2017