This document discusses Docker container networking and publishing applications securely with Docker Enterprise. It provides an overview of key Kubernetes networking concepts like pods, services, ingress and network policies. It then details how Docker Enterprise integrates with Calico for container networking and policy-driven security. The integration provides connectivity between pods and services out of the box. It also allows enforcing network policies and zero-trust security through Calico's policy engine. The document concludes with demos of publishing sample applications using Docker Swarm services and Kubernetes ingress resources.

1. Docker Container Networking
How to Publish and Secure applications
in the Docker Enterprise Platform

2. Senior Consultant, Hopla Software
@frjaraur
Javier Ramirez
Solution Engineer, Docker
@GuillaumeMorini
Guillaume Morini

3. Goal of this Session
● Basics of K8S Networking
● Docker Enterprise + Calico Integration
Overview
● Application Publishing with Docker
Enterprise
● Takeaways
● Q&A

4. Let’s Start with K8S
Connectivity Basics

5. Kubernetes Connectivity Concepts
Pod Networking
(CNI)
Ingress
Services
(Kube-proxy)
Network
Policy
Kube-DNS

6. Node
UCP Manager
Manager Nodes
Load Balancer (ucp.example.com)
Node Node
Node
UCP
worker
Worker Nodes
Node
UCP
worker
Node
UCP
worker
Node
DTR worker
DTR Nodes
Load Balancer (dtr.example.com)
Node
DTR worker
Node
DTR worker
DTR Storage (Azure Storage, NFS, etc.)
Logging Monitoring
Image storage
External CALDAP/AD
Add-ons
UCP Manager UCP Manager
Docker Enterprise Overview
Load Balancer (app.example.com)

7. Secure networking for the cloud-native era
Open source, maintained by Tigera with hundreds of
third party contributors
Batteries-included Container networking for Docker
Enterprise Kubernetes
> Scalable, distributed control plane
> Policy-driven network security
> No overlay required
> Integrated with all major cloud platforms
> Widely deployed, proven at scale
TIGERA CALICO: WHY IT’S AWESOME

8. ➔ No Underlay Dependency = No Lock-In
➔ Simple Zero-Touch Provisioning
➔ Any Infrastructure, Any Cloud
◆ On-Prem ( VM, Bare)
◆ Cloud ( AWS, Azure, GCP)
◆ Hybrid
Heterogeneous Infrastructure

9. Connectivity Concept Out-of-the-Box Solution with Docker Enterprise 2.1
Pod - Pod Calico CNI
Services ClusterIP
NodePort
LoadBalancer
Ingress NGINX Ingress Controller
DNS kube-dns
K8s Network Policy Calico
Diverse Application Portfolio
* Tigera CNX builds on Calico with enterprise security features: Hierarchical Policies, Policy RBAC, DevSecOps tools (Audit, Alerting, Compliance), etc.

10. Zero-Trust Security
•Declarative policy-driven isolation
•Fine-grained access control
•Dynamic, in lock step with Kubernetes
ComplianceStage/tier
separation
Tenant/namespace
isolation
Micro-
segmentation

11. UCP Manager/ K8s Master
Manager Nodes
Worker Nodes
Docker Enterprise 2.1 Calico Integration
kubelet
k8s-apiserver
calico-node
Appl Pod A
kubelet
UCP / k8s Worker A
kube-proxy
kube-dns
k8s-scheduler
calico-node
kube-proxy
calico-node
App Pod B
kubelet kube-proxy
UCP / k8s Worker B
Pod IP Connectivity
Peering
Native Host Routing
calico-kube-controller
k8s-controller
eth0 eth0

12. Let’s dig inside each
component

13. Worker Nodes
UCP Manager/ K8s Master
Manager Nodes
Pod Creation: Kubelet
Node
apiserver scheduler
controller-
manager
Etcd
kubelet
Node
Pod
Node

14. Worker Nodes
UCP Manager/ K8s Master
Manager Nodes
Pod Network: Calico/CNI
apiserver scheduler
controller-
manager
Etcd
kubelet
Calico/CNI
Calico/IPAM

15. Worker Nodes
UCP Manager/ K8s Master
Manager Nodes
Pod Network: Calico/Node
apiserver scheduler
controller-
manager
Etcd
kubelet
Calico/CNI
Calico/IPAM
Calico/Node Calico/Node
Calico/CNI
Calico/IPAM
kubelet

16. Worker Nodes
UCP Manager/ K8s Master
Manager Nodes
Kubernetes Services: Kube-proxy
apiserver scheduler
controller-
manager
Etcd
kubelet
Calico/CNI
Calico/IPAM
Calico/Node Calico/Node
kube-proxy kube-proxy
Calico/CNI
Calico/IPAM
kubelet
> Cluster IP
> Node Port
> Load Balancer

17. Worker Nodes
UCP Manager/ K8s Master
Manager Nodes
Network Policy
apiserver scheduler
controller-
manager
Etcd
kubelet
Calico/CNI
Calico/IPAM
Calico/Node Calico/Node
kube-proxy kube-proxy
Calico/CNI
Calico/IPAM
kubelet

18. Let’s demo

19. UCP Manager/
K8s Master
Manager Nodes
Load Balancer (ucp.example.com)
Node
UCP/K8S
worker
Worker Nodes
Node
UCP/K8S
worker
Node
UCP/K8S
worker
UCP Manager/
K8s Master
UCP Manager/
K8s Master
Calico Node Calico Node Calico Node
Calico Node Calico NodeCalico Node
App Pods App Pods App Pods
Demo 1: Docker Enterprise + Calico Overview
Thanks @ahmetb

20. Demo 1: Network policy
Thanks @ahmetb
Web
Pods
Search
Pods
API
Pods
Other
Pods
Db
Pod
Bookstore app

21. UCP Manager/ K8s Master
Manager Nodes
Kubernetes Services: Ingress
apiserver scheduler
controller-
manager
Etcd
Worker NodesIngress Nodes
pod
svc
A
service-a.example.com

22. Kubernetes Services: Ingress
Components
● Ingress Controller
● Ingress Resource
● Default Backend

23. Kubernetes Services: Ingress
Smart Loadbalancers
● Kubernetes Nginx *
● Nginx/Nginx Plus
● Traëfik
Loadbalancers Controllers
● Cluster External Ingress Elements Interaction:
○ Big IP F5 Ingress
○ Octavia Ingress Controller
○ GLBC (GCE L7 lbctl)
○ Netscaler
○ AVI Networks Vantage
● Cluster Internal API Gateways:
○ Kong
Framework Specific
● Docker Enterprise Interlock *
● Openshift Router
* Tested on Docker Enterprise

24. Kubernetes Services: Ingress
Ingress Resource
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: colors-ingress
annotations:
nginx.com/sticky-cookie-services: "serviceName=red-svc red_svc_id expires=60s path=/;"
nginx.com/health-checks: "true"
nginx.org/rewrites: "serviceName=red-svc rewrite=/;"
spec:
rules:
- host: blue.example.com
http:
paths:
- path: /red/
backend:
serviceName: red-svc
servicePort: 80
- backend:
serviceName: blue-svc
servicePort: 80
- host: red.example.com
http:
paths:
- backend:
serviceName: red-svc
servicePort: 80

25. Swarm Services: Interlock
UCP Manager/ K8s Master
Manager Nodes
apiserver scheduler
controller-
manager
Etcd
interlock-extension
interlock-proxy
Worker Nodes
Worker Nodes with
Interlock Proxy
tasks
service
A
a.example.com
interlock-proxy
interlock
BYOLB

26. Swarm Services: Interlock
Interlock Service Publishing
version: "3.3"
services:
red:
image: codegazers/colors:1.12
environment:
- COLOR=red
deploy:
replicas: 3
labels:
com.docker.lb.hosts: red.example.com
com.docker.lb.network: colors
com.docker.lb.port: 3000
networks:
- colors
blue:
image: codegazers/colors:1.12
environment:
- COLOR=blue
deploy:
replicas: 2
labels:
com.docker.lb.hosts: blue.example.com
com.docker.lb.network: colors
com.docker.lb.port: 3000
networks:
- colors
networks:
colors:
driver: overlay

27. Let’s demo

28. UCP Manager/
K8s Master
Manager Nodes
Load Balancer (ucp.example.com)
Node
UCP/K8S
worker
Worker Nodes
Node
UCP/K8S
worker
Node
UCP/K8S
worker
UCP Manager/
K8s Master
UCP Manager/
K8s Master
Calico Node Calico Node Calico Node
Calico Node Calico NodeCalico Node
Red
Pod
Blue
Pod
Node
UCP/K8S
worker
Node
UCP/K8S
worker
Calico Node Calico Node
NGINXKong
Demo 2: Let’s Deploy a Sample Application
Ingress Nodes
Red
Service
Blue
Service
Red
Pod
Blue
Pod
Red
Pod
Black
Service
Black
Pod

29. Takeaway
Docker Enterprise allows you to:
• Easily publish your applications using Docker Swarm or
Kubernetes
• Integrate with various solutions to support your choices of
using any infrastructure
• Enforce a dynamic policy-based microsegmentation

30. Try Docker Enterprise + Calico: trial.docker.com
community.docker.com
slack.projectcalico.org
@docker @projectcalico @tigeraio @thekonginc @nginx
Thank you! Questions?

31. Take A Breakout Survey
Access your session and/or workshop surveys for the conference at any time by tapping the
Sessions link on the navigation menu or block on the home screen.
Find the session/workshop you attended and tap on it to view the session details. On this page, you
will find a link to the survey.

32. Come Join Us In San Francisco
April 29-May 2
2019