Introduction to Container Management on AWS

© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Travis Williams, Enterprise Solutions Architect
December 2nd, 2016
Introduction to Container
Management on AWS

Containers on AWS
Hypervisor Containers

Server

Guest
OS

Bins/Libs

Bins/
Libs

App2
App1

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

Server

Guest
OS

“Okay, let’s run our containers on AWS.”

“Okay, let’s run our containers on AWS.”
Choose your own adventure!Start!
You ==
Wizard?
Legacy
Apps?
Big Data?
Cluster >
10000?
Love
Docker
CLI?
Cluster >
1000?
Cluster >
200?
Huge IT
team?
No
Yes
No
Yes
Inspiration: http://
adrianotto.com/wp-content/
uploads/2016/02/choose-
adventure-1024x574.png
No Yes
Yes
YesNoYesNoYes
Yes

AWS Container Ecosystem
•  Foundation
•  Monitoring
•  CI/CD
•  Security
•  PaaS

AWS Container Ecosystem Shout-Outs: Cloudbees

AWS Container Ecosystem Shout-Outs: Cloudbees
ü  Bring your own License (BYOL)
Model
ü  Free trial available
ü  Seamlessly provision VMs of Jenkins
masters and Operations centers
ü  Interact directly with AWS services
including: Amazon EC2, Amazon S3,
AWS Route53, AWS Lambda

AWS Container Ecosystem Shout-Outs: Convox
Racks ⟷ ASG, CF, Dynamo, EC2, ECS, IAM, VPC!
Apps ⟷ CF, ECS, ELB!
Scale ⟷ ASG, CF, ECS!
Environments ⟷ KMS, S3!
Builds ⟷ ECR!
Logs ⟷ Cloudwatch, Lambda!
Metrics ⟷ CloudWatch!
Notifications ⟷ SNS!
Convox Platform API ⟷ AWS Services

AWS Container Ecosystem Shout-Outs: Convox
┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐ !
web: !
│ build: . │ !
labels: !
│ - convox.port.443.protocol=tls │ !
- convox.port.443.proxy=true !
│ links: │ !
- db ┌───────────────────┐ !
│ - redis │ │ TLS Load Balancer │ !
ports: ┌┤https + websockets ├┐ ┌─────────┐ ┌─────────┐!
│ - 80:4000 │ │└────────┬─┬────────┘│ │┌───────┐│ │┌───────┐│!
- 443:4001 │ ┌─────┐ │ │ ┌─────┐ │ ││ rake ││ ││ rake ││!
│ │ ┌ ─ ─ ─ ─ ─ ─ ─ ─ │ │nginx│ │ │ │nginx│ │ ││resque ││ ││resque ││!
worker: Rails Image │ │ └─────┘ │ │ └─────┘ │ │└───────┘│ │└───────┘│!
│ build: . │ │ │ ┌─────┐ │ │ ┌─────┐ │ │ worker │ │ worker │!
command: rake resque work ──────▶ Ubuntu 16.04 OS │──────▶│ │ruby │ │ │ │ruby │ │ │Container│ │Container│!
│ │ │ pg, redis gems │ │puma │ │ │ │puma │ │ └─────────┘ └─────────┘!
db: + code │ │ └─────┘ │ │ └─────┘ │ ┌─────────┐ ┌─────────┐!
│ image: convox/postgres │ └ ─ ─ ─ ─ ─ ─ ─ ─ │ web │ │ web │ │┌───────┐│ │┌───────┐│!
labels: │Container│ │Container│ ││ rake ││ ││ rake ││!
│ - convox.health.timeout=60 │ └─────────┘ └─────────┘ ││resque ││ ││resque ││!
ports: ┌─────────┐ ┌─────────┐ │└───────┘│ │└───────┘│!
│ - 5432 │ │Postgres │ │ Redis │ │ worker │ │ worker │!
volumes: │Database │ │Database │ │Container│ │Container│!
│ - /var/lib/postgresql/data │ └─────────┘ └─────────┘ └─────────┘ └─────────┘!
!
│redis: │ !
image: convox/redis !
│ ports: │ !
- 6433 !
└ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┘ !
Docker config in codebase → Docker Config in ECR → Containers on ECS

AWS Customers Have Options
Today we’ll cover:
•  Amazon ECS
•  CoreOS Tectonic (Kubernetes)
•  Mesosphere DC/OS (Mesos)
•  Docker Datacenter

Container Orchestration
Instance Instance Instance
OS OS OS
Container Runtime Container Runtime Container Runtime
App Service App App Service Service

myJob:
{

Cpu:
10

Mem:
256

}

Orchestrator
Schedule
Run
“myJob”

Instance/OS Instance/OS Instance/OS
Service Management
Scheduling
Resource Management
OrchestrationService Management
§ Availability
§ Lifecycle
§ Discovery

Service Management
Scheduling
Resource Management
Orchestration
Scheduling
§ Placement
§ Scaling
§ Upgrades
§ Rollbacks

Service Management
Scheduling
Resource Management
Orchestration
Resource
Management
§ Memory
§ CPU
§ Ports

Schedulers
Cluster

Machines

Cluster
State

Information

Monolothic
Two-‐Level
Shared
State

No
Concurrency
Pessimistic

Concurrency

(offers)

Optimistic

Concurrency

(transactions)

Scheduling
Logic

Kubernetes
Replication

Controller

API
Server

Kubernetes
Master

Kubelet
KubeProxy
Docker

Container
Container

Pod
Pod

Kubelet
KubeProxy
Docker

Container
Container

Pod
Pod

Kubernetes
Cluster

etcd

Kubernetes
Container orchestration or the OS for distributed compute
Upstream Kubernetes
●  Container orchestration
●  Horizontal scale
●  High availability
●  Service discovery & load
balancing
●  Basic command line
operations
kubelet
default addons
(DNS)
controller manager
proxy
api server
scheduler
etcd
system kubelet
OS
Docker
Rkt
flannel
Kubernetes
Storage & Compute
apps/container/microservices
OS

Tectonic Extends
Upstream Kubernetes
●  Installer
●  Management console
●  Painless updates
●  Cluster scaling
●  Disaster recovery
●  Alerts and logging
●  Security (integrated)
●  Integration across
environments
Extending Kubernetes for the Enterprise
Security Mgmt
Kubernetes
CoreOS Linux
Cloud Integration
Update
Container Registry
Storage & Compute

Tectonic
Kubernetes Management
●  Single console across
environments
●  AWS Auto Scaling
●  Monitoring and logging
●  Audit log
●  Alert configuration
●  View compute usage over
time and isolate by
namespace/cluster
Security Mgmt
Kubernetes
CoreOS Linux
Cloud Integration
Update
Container Registry
Storage & Compute

Tectonic
Operating System
●  Packaged with CoreOS
Linux, tested against
Docker and rkt
●  Rolling upgrades of OS
Security Mgmt
Kubernetes
CoreOS Linux
Cloud Integration
Update
Container Registry
Storage & Compute

Highlighted AWS Features
•  Production-ready installs: Built from our learnings from kube-aws,
the Tectonic AWS installer installs a highly available self-hosted
Kubernetes cluster in your environment
•  Managed upgrades on AWS: CoreOS applies CoreUpdate
functionality to Kubernetes.
•  Disaster recovery: Managed backups and restore of Kubernetes
clusters via etcd to s3

Kube-AWS
•  github.com/coreos/kube-aws
•  kube-aws is a templating engine for AWS Cloudformation templates
•  All assets (CloudFormation, userdata for instances) are declarative
templates that can be checked into git and version controlled
•  Uses Amazon KMS to encrypt all secrets before putting them into assets
files. Secrets are unlocked once the machines boot into their IAM roles
•  Spreading of workers and control plane nodes across AZs

Customer Use Case
Planet Labs launches and manages a fleet
of earth-imageing sattelites
Manages 100 million images and supports
tens of terabytes of data every day
Building a whole-earth dataset

Before:
•  Operational overhead from
30 million jobs and 15,000
instances
•  Challenges with
inconsistent packaging
and deployments across
teams
After:
•  Kubernetes + CoreOS on
AWS
•  Containers allowed
consistent app packaging
•  Less rigid dependencies
•  Less focus on infrastructure
Customer Use Case

Use Tectonic if:
•  You want a Kubernetes experience tailored for
AWS
•  You want to purchase support for Kubernetes
•  You may want to consider another container
runtime (i.e. rkt)
Kube-aws:

Docker Datacenter (DDC)
Docker Universal Control Plane
Integrated
Security
Docker Engine
Container runtime, orchestration, networking, volumes, plugins
Docker Trusted Registry
Operating
Systems Config Mgt Monitoring LoggingCI/CD ..more..Images Networking Volumes
VirtualizationPublic Cloud Physical

Docker Datacenter
Universal Control Plane:
•  Cluster manager
•  Etcd for state management
•  Swarm for scheduling
•  LDAP integration, service
discovery, load balancing
built in
Docker Trusted Registry
•  Private repository
•  Image Signing
•  LDAP/RBAC support
•  S3 backend support

Docker Datacenter (DDC)
UCP
Manager
UCP
Manager
UCP
Manager
Internal distributed store
DTR
Replica
Worker
Raft consensus group
Image Registry
BYO TCP Load Balancer
UCP
Worker
UCP
Worker
UCP
Worker
UCP
Worker
push / pull
Admin / User
Deploy / manage
LDAP/AD
Monitoring
Logging
External
CA
Image
Storage
DTR
Replica
Worker
DTR
Replica
Worker

•  Swarm Mode (Docker 1.12) Support
•  Point and click UI to manage nodes,
services, containers and networks
•  Highly Available ( 3, 5, or 7 Controllers)
•  Secure access control with LDAP/AD
support and granular RBAC
•  Docker Content Trust : Image Signing
and Runtime Enforcement
UCP
Manager

CS Docker Engine
Swarm Mode Manager Node
Monitoring
Web UI
Log
Aggregator
Access
Control Auth Server
Docker Swarm
Docker Datacenter: UCP

DDC Quickstart – AWS Architecture
Availability
Zone
Availability
Zone

Private
subnet

Public
subnet
Public
subnet

Private
subnet

EC2

instances

EC2

instances

Elastic
Load

Balancing

Elastic
Load

Balancing

Internet

gateway
VPC
NAT

gateway

VPC
NAT

gateway

Internet

gateway

DDC Quickstart – AWS Architecture
Availability
Zone
Availability
Zone

Private
subnet
Private
subnet

Swarm
Nodes
Swarm
Nodes

DTR

Controller

DTR

Controller

DTR

Controller

UCP

Controller

UCP

Controller

UCP

Controller

Docker Datacenter:
Customer Use Case
ADP leverages Docker Datacenter on AWS to deliver Security And Scale For Both Legacy
And Microservices Applications
Challenge
Refactor legacy monolithic applications to microservices
Disparate systems at scale - hundreds of products, hundreds of thousands of clients
Solution
Leverages Docker Datacenter on AWS - UCP, DTR, CS Engine
Benefits
Adopt hybrid strategy – mix of big and small containers for any application creating an
evolutionary path forward to microservices on the Cloud.
Swarm spans across public and private infrastructure and across applications, allowing the
swarm to the abstraction layer between physical compute and the application teams.
Apps running in hardened containers, image signing and multiple DTRs ensure a secure
environment
“Docker’s CaaS approach will enable us to drive transformation across the entire application
lifecycle from development to operations. With Docker, we will be able to ensure application
portability, whether it is between dev and ops or between the datacenter and the cloud.”

Use Docker Datacenter if…
•  The “Docker Native” stack is important to you
•  Your development workflow is built around Compose and the
Docker CLI
•  You want Commercial Support for the Docker Engine
DDC Quickstart:

Mesos

Master

Marathon

ZooKeeper

Mesos + Marathon
Mesos
Slaves

Long
Running

Tasks

Jobs

Coordination
&

Configuration

●  Collection of services to power your apps
●  Service installation and lifecycle management
40
DC/OS Universe
Mesosphere Enterprise DC/OS
Large install base on premise and in the cloud
●  Container & big data operations
●  Security, fault tolerance & high availability
●  Open core & production proven at scale
Container orchestration
Datacenter aggregation
Turnkey lifecycle mgt
User Interface & CLI
Security
Advanced
Networking
Monitoring &
Operations
Compliance
Elastic
●  Supports hybrid deployments
Mesosphere DC/OS

Mesosphere DC/OS
Big Data
Analytics
Stateful
Service
Big Data and Stateful Apps
Mesosphere Enterprise DC/OS
Container
App
Container
App
CaaS PaaS
●  Uses 66% less infrastructure
●  Simplified operations
●  Turnkey install of datacenter-wide services
●  Easier to experiment with new tech (e.g., Spark)

Mesosphere DC/OS:
Customer Use Case
•  Production event handling service
•  Deployed to 3 AWS Regions
•  40 seconds to deploy new builds
•  Infrastructure Density: 66% less instances
•  Cost Reduction: 57% less spend

Use DC/OS If….
•  You prefer technology that has been around than your toddler
•  You want to take advantage of the “DC/OS Universe”
•  You want to also manage big-data applications with your
orchestration tool
DC/OS on AWS:

Docker

Task

Container
Instance

Amazon

ECS

Container

ECS
Agent

ELB

Internet

ELB

User
/

Scheduler

API

Cluster
Management
Engine

Task

Container

Docker

Task

Container
Instance

Container

ECS
Agent

Task

Container

Docker

Task

Container
Instance

Container

ECS
Agent

Task

Container

AZ
1

AZ
2

Key/Value
Store

Agent
Communication
Service

Amazon ECS

Amazon ECS
Container Management
at Any Scale
Flexible Container
Placement
Integration
with the AWS Platform

Components of ECS
Task
Actual containers running on
Instances
Task Definition
Definition of containers and
environment for task
Cluster
Fleet of EC2 instances on
which tasks run
Manager
Manage cluster resource
and state of tasks
Scheduler
Place tasks considering
cluster status
Agent
Coordinate EC2 instances
and Manager

Cluster, Scheduler, Task Scheduler
ManagerCluster
Task Definition
Task
Agent

Expedia
One of the world’s leading travel companies
•  Primer – Internal deployment tool
•  Supports various applications
•  Creates GitHub repository, pipeline,
and monitoring by one click
•  Based on ECS Optimized AMI,
configured by CloudFormation
•  Zero-Downtime Instance
Replacement
http://www.slideshare.net/AmazonWebServices/deep-dive-on-microservices-and-amazon-ecs-64033400
Continuous Delivery to ECS with Primer
ECS Production Clusters – Serving 200 applications
14 instances: 56 apps (+ 19 canaries) 17 instances: 78 apps (+ 25
canaries)
35 instances: 107 apps (+ 23 canaries) 5 instances: 7 apps (+ 4 canaries)
Charts produced with c3vis: github.com/ExpediaDotCom/c3vis

Amazon Personalization
Distributed neural network learning on multiple GPUs
•  From Apache Spark, run CPU
and GPU tasks transparently
•  CPU: Amazon EMR
•  GPU: Amazon ECS
•  Package GPU libraries with
Docker image
•  DSSTNE runs workloads in
parallel across hundreds of
GPUs
https://blogs.aws.amazon.com/bigdata/post/TxGEL8IJ0CAXTK/Generating-Recommendations-at-Amazon-Scale-with-Apache-Spark-and-Amazon-DSSTNE

Use ECS if:
•  You want a managed service that scales with you
•  You want to leverage native AWS integrations: IAM Roles,
ALB, VPC, Cloudwatch Logs, Autoscaling, ECR
•  You want to build around AWS tools: API/CLI/SDK/
CloudFormation
•  You want to leverage the strong ECS partner ecosystem

Conclusion:
•  AWS has a rich ecosystem and supports every
major orchestration framework
•  Whether you choose to use Amazon ECS or an
AWS Partner solution, our goal to provide the best
experience possible
•  Container workloads: Think AWS

Introduction to Container Management on AWS

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie Introduction to Container Management on AWS

Ähnlich wie Introduction to Container Management on AWS (20)

Mehr von Amazon Web Services

Mehr von Amazon Web Services (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (15)

Introduction to Container Management on AWS