Docker & OpenShift 3 락플레이스미들웨어기술본부양희선
Contents 1. Docker Container 개요 2. 이미지다운로드및관리 3. S2i 이미지및커스텀이미지생성 4. JBoss EAP 이미지설명 5. 이미지를이용한어플리케이션생성 ( 빌드 ) 6. 배포및롤백 7. 서비스확장 ( 오토스케일링 )
1. Docker Container 개요 Docker Image 란? Image & Container VM & Container Image 생성및활용 Docker & Kubernetes of Openshift
Docker & LXC Linux LXC LibContainer Container
Docker Image 실행에필요한모든것을포함하여 Docker Format 의파일로생성 code, runtime, system tools, system libraries Image Container Container Container
Docker Image vs Container Image Container An instance of an image is called container
VM vs Docker Container
Docker Hub https://hub.docker.com/explore/
Docker Hub https://hub.docker.com/explore/
Dockerfile Hello Openshift https://hub.docker.com/r/openshift/hello-openshift/ [root@master ~]# cat Dockerfile 베이스이미지만든사람넣을파일사용할포트실행할파일 FROM scratch MAINTAINER Jessica Forrester jforrest@redhat.com ADD bin/hello-openshift /hello-openshift EXPOSE 8080 8888 ENTRYPOINT ["/hello-openshift"]
Dockerfile Hello Openshift 이미지생성 # 이미지생성 [root@hsyangpc hello-openshift]# docker build -t my-hello-openshift. Sending build context to Docker daemon 6.594 MB Step 0 : FROM scratch Step 1 : MAINTAINER Jessica Forrester <jforrest@redhat.com> Step 4 : ENTRYPOINT /hello-openshift Successfully built ec2eb0e5676f # 생성된이미지조회 [root@hsyangpc hello-openshift]# docker images REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE my-hello-openshift latest ec2eb0e5676f 40 seconds ago 6.517 MB
Dockerfile Hello Openshift 실행결과 [root@hsyangpc hello-openshift]# docker run -d my-hello-openshift c2c82f8f8dc6b37e52eb517dd3e294d149443e04860ef0356c186cdd55e7df3f # 현재실행중인 Container 조회 [root@hsyangpc hello-openshift]# docker ps c2c82f8f8dc6 my-hello-openshift 3 minutes ago Up 3 minutes 8080/tcp, 8888/tcp my-hello-openshift # 컨테이너 IP 정보조회 [root@hsyangpc hello-openshift]# docker inspect my-hello-openshift... "IPAddress": "172.17.0.4",... "8080/tcp": null, "8888/tcp": null [root@hsyangpc hello-openshift]# curl -v 172.17.0.4:8080 Hello OpenShift!
Hello-world [root@hsyangpc hello-world]# docker run my-hello-world Hello from Docker. This message shows that your installation appears to be working correctly. To generate this message, Docker took the following steps: 1. The Docker client contacted the Docker daemon.... For more examples and ideas, visit: https://docs.docker.com/engine/userguide/ [root@hsyangpc hello-world]#
Dockerfile Apache Webserver [root@master ~]# cat Dockerfile Apache Image 생성 FROM docker.io/centos USER root RUN yum -y install tar unzip vi vim telnet COPY files/jboss-ews-httpd-2.1.0.zip /tmp/ RUN cd /opt; unzip /tmp/jboss-ews-httpd-2.1.0.zip Apache Container 실행 Port Forwarding WORKDIR /opt/jboss-ews-2.1/httpd RUN./.postinstall EXPOSE 80 CMD ["/opt/jboss-ews-2.1/httpd/sbin/apachectl","-k","start","-d","foreground"]
Docker Build [root@master ~]# docker build -t ews21. [root@master ~]# docker images REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE ews21 latest 47bd98336d1d 3 days ago 443.1 MB docker.io/centos 6.6 12c9d795d85a 6 months ago 202.6 MB # Container 실행및 Port Forwarding [root@master ~]# docker run -d --privileged -p 80:80 -h web1 ews21
Apache Webserver 컨테이너접속 # 실행중인컨테이너조회 [root@master ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES d1e70a6efdac ews21 "/opt/jboss-ews l" 16 minutes ago Up 16 minutes 80/tcp tender_albattani # 컨테이너내부로접속 [root@master ~]# docker exec -ti d1e70a6efdac /bin/bash [root@tender_albattani~]#
Docker and Kubernetes of Openshift Docker 만사용하여컨테이너서비스 Kubernetes 를사용하여컨테이너서비스 Port Forwarding Route ews21.test.rockplace.co.kr Image 로부터컨테이너생성 Service (LB) 172.30.35.131 Image Container Container / Pod Container / Pod 10.1.2.10:80, 10.1.3.13:80
Docker Working flow Clients portal.rp.com Host 52.78.245.72:80 Docker Build Port Forwarding Docker Image Apache Container: 172.30.35.131:80
Docker and Kubernetes of Openshift 내부 DNS portal.rp.com Clients HAProxy 52.78.245.72:80 Openshift Route ( 내부 Service 위치확인 ) Openshift Node HAProxy Container/Pod: 172.30.35.131:80 Service (Load Balancing) Image Registry Apache Container/Pod: 10.0.10.11:80 Pod (Container)
Container Management by Openshift Route: ews21 외부로부터의진입점 ews21.test.rockplace.co.kr service: ews21 172.30.176.102 Cluster IP (VIP) 를통한 Loadbalancing Docker Image Pod Kubernetes 는 Container 를 Pod 에담아서관리 ReplicationController 지정된개수의 Pod 가잘돌고있는지 DeploymentConfig 몇개의 Pod 를만들지 어떻게 Pod 를배포할지
2. 이미지다운로드및관리 Image Registry Image Download & Push Openshift Image Stream Image Import
Image Registry Docker Image 는 Image Registry 에저장된다. Docker 명령을이용하여 Image Registry 로부터이미지를받을수있다. 폐쇄망에서는내부에 Private Image Registry 를구성할수있다. Openshift Pull Image Redhat Redhat Image Registry new-app Dockerhub Image Registry Images Private Image Registry ( 폐쇄망환경 )
Image Push & Download Admin 이외부 Registry 로부터받거나자체제작한이미지를 Image Registry 에올린다. 내부의 Openshift 에서 Image Registry 로부터이미지를받아갈수있다. Admin Jboss-eap7 Image Push Private Image Registry ( 폐쇄망환경 ) Openshift Jboss-eap7 Image Download
Openshift Image Stream Openshift 에서는 ImageStream 형태로이미지를관리한다. 하나의 ImageStream 에는 Tag 가다른여러개의이미지가있고각각 ImageStreamTag 와 Image Metadata 로구별될다. ImageStream Jboss-eap7-openshift ImageStreamMapping ImageStreamTag 1.4 1.5 jboss-eap@sha256:474.. jboss-eap@sha256:312.. Image Metadata.. Image Metadata... 이미지다운로드위치및상세정보 이미지 Tag ( 버전정보 ) ImageStreamImage 이미지 ID
Image Import ImageStream 에정의되어있는이미지를다운로드받아 Openshift 내부에저장한다. ImageStream 은최초에이미지가들어있지않으므로 import-image 를통해이미지를저장한다. 이미이미지를다운로드받은후에도 import-image 를통해업데이트할수있다. oc import-image jboss-eap70-openshift:1.4 -n openshift 1.4 1.5 Jboss-eap70-openshift jboss-eap@sha256:474.. Image Metadata.. jboss-eap@sha256:312.. Image Metadata... Private Image Registry ( 폐쇄망환경 ) "from": { "kind": "DockerImage", "name": "registry.access.redhat.com/jboss-eap-7/eap70-openshift:1.4" },
Image Import import-image 를수행한이후에 Node 에수행중인어플리케이션은바로변경되지않는다. Build 를수행하면새로운이미지를이용하여어플리케이션을생성한다. Openshift Master oc import-image ImageStream Jboss-eap7:1.4 Private Image Registry ( 폐쇄망환경 ) Build Jboss-eap7:1.4 Node1 ImageStream Jboss-eap7:1.4 Node1 ImageStream Jboss-eap7:1.4
3. S2I Builder 이미지및커스텀이미지생성 S2I Builder 이미지란? S2I Builder 이미지작동방식 기존이미지를변경하여커스텀이미지생성
S2I Builder 일반적으로 Java WAS 이미지는 OS Libs, JDK, WAS Engine, Application 으로이루어진다. 이미지에서변경이지속적으로일어나는부분은 Application 이다. Builder Image 에는 Application 을다운받아 Build 할수있는 Builder 가들어있다. 일반 Image Builder Image Source Download & Build Application WAS Engine JDK OS Libs Builder WAS Engine JDK OS Libs
S2I Builder 이미지를컨테이너로실행하면 Builder 가작동하여 Application 을다운로드받아새로운이미지를만든다. Builder Image Builder 새로운이미지생성 Application Image Builder Application Git WAS Engine JDK OS Libs WAS Engine JDK OS Libs
S2I Builder Builder Image 는 Git 서버로부터 Application 을받아새로운 Application Image 를생성한다. 새로운 Application Image 는 Openshift 내부에 Openshift Container Registry 에저장된다. 각 Node 로 Application Image 를배포한다. Openshift Infra Node1 Builder Image Application Image Openshift Container Registry Build Application Image 배포 Node2 Application Image
기존이미지변경 기존이미지를변경하여새로운이미지를만들수있다 Dockerfile FROM jboss-eap-7/eap70-openshift # Scripts for troubleshooting COPY files/bin/launch/add_java_opts_append.sh /opt/eap/bin/launch/... # Install packages and change gclog name USER 0 RUN sed -i "s/en_us/all/" /etc/yum.conf \ && yum y reinstall glibc-common \ && yum clean all # Maven Repo. Direcotry Permission RUN rm -f /opteap/standalone/deployments/activemq-rar.rar \... && chmod -R 775 /home/jboss/scripts Base Image File 복사 root 유저로변경다국어패키지설치불필요파일삭제 # Allow arbitrary USER 185 ENV LANG=ko_KR.utf8 TZ=Asia/Seoul jboss 유저로변경하여실행 OS 문자셋및타임존설정
기존이미지변경 Dockerfile 을이용하여새로운이미지를생성한다. # docker build -t ncis-eap70-openshift:1.0. ncis-eap70-openshift:1.0 Private Image Registry Push
Guideline for Building Image https://docs.openshift.com/container-platform/3.3/creating_images/guidelines.html#openshiftcontainer-platform-specific-guidelines Image 재사용 Image에 Tag를사용하여유지관리 Multiple Processes 회피 Image Build 후임시파일제거 Layer 최소화 Support Arbitrary User IDs
4. JBoss EAP 이미지 Openshift 용 JBoss EAP 이미지의특징 JBoss EAP 이미지작동방식
EAP7 for Openshift 이미지특징 구분운영모드 Admin Console JBOSS_HOME 실행스크립트 OS Version 내용 Standalone 없음 /opt/eap /opt/eap/bin/openshift-launch.sh Red Hat Enterprise Linux Server release 7.3 (Maipo)
JBoss EAP7 이미지작동방식 1. git 서버로부터받은파일을이미지의 /tmp/src 로복사 Openshift Infra OCP Builder Build 2. /tmp/src 의파일을 /$HOME/source 로복사 3. /$HOME/source 아래의디렉토리별로 JBoss 관련위치로복사 Node /$HOME/source 하위디렉토리 configuration deployments modules jboss-eap7-openshift jboss-eap7-openshift
실행순서 순번 스크립트파일 용도 1 /usr/local/s2i/assemble 소스및설정파일을 JBoss 내부로복사 2 /usr/local/s2i/run openshift-launch.sh 실행 3 /opt/eap/bin/openshift-launch.sh EAP 기동
Git vs Container 파일위치 Git 서버의각디렉토리파일들은아래와같이컨테이너디렉토리로복사된다. 구분 Git Directory 파일 Container Directory 소스 / war ear rar jar $JBOSS_HOME/deployments/ /deployments/ war ear rar jar $JBOSS_HOME/deployments/ 설정파일 /configuration/ 모든파일 (standalone-openshift.xml) $JBOSS_HOME/configuration/ Module /modules/ 모든파일 $JBOSS_HOME/modules/
5. 이미지를이용한어플리케이션생성 Openshift Resource Build Git
Openshift User and Project Resources Route Service User Project Pod Deployment Config BuildConfig
Build, Deployment, Pod Pod Route Service 배포내역 User Project Pod Deployment Config Build 내역 BuildConfig
BuildConfig BuildConfig 는설정된내용을기반으로 Build 를실행하는역할을한다. 가져올 Application 정보 사용할 Image / 결과 Image Git Repository URL: http://gitlab.test.rp.co.kr/root/ncis-eap70.git Git Reference: master Context Dir: simple-app Build From : openshift/ncis-eap70-openshift:1.4 Push To: myproject/ncis-eap70-openshift:latest
Git OCP Builder 는원격지의소스를가져오기위한방법으로 Git 서버를사용한다. Branch Reference 는 master, Context 는 / 로설정하면 git clone 시 Git 서버의모든히스토리까지받게되므로소스의용량이커지고오래걸린다. 용량을줄이려면아래와같이 Git Reference 를빈칸으로남겨둬야한다. 소스와전체히스토리복사 Git Repository URL: http://gitlab.test.rp.co.kr/root/ncis-eap70.git Git Reference: master Context Dir: / 소스와최종히스토리만복사 (--depth=1) Git Repository URL: http://gitlab.test.rp.co.kr/root/ncis-eap70.git Git Reference: Context Dir: /
6. 배포및롤백 Deployment Rollback
Deployment Deployment 는 Build 에의해생성된이미지를 Node 로배포하여실행시키는것을말한다. 배포할 Image 배포방법 Image Stream Tag: myproject/ncis:latest Image 가변경되면자동으로배포 : yes 설정이바뀌면자동으로배포 : yes Strategy Type: Rolling Max Num Unavailable Pods: 25% ( ¼ 씩 Rolling 배포 ) Replicas: 4 ( 동시에유지할 Pod 개수 )
Rollback Rollback 은기존에배포됐던특정시점으로어플리케이션을다시배포하는것을말한다. Openshift 는기존 Deployment 이미지를그대로유지하고있으므로쉽게 Rollback 이가능하다. 배포내역
7. 서비스확장 Manual Scale-Out Resource Limits Auto-Scaler
Manual Scale-out 실행될 Pod 의개수를화살표로조정할수있다.
Resource Limit 컨테이너가최대로사용할수있는 CPU 와 Memory 를지정할수있다.
Auto-Scaler 지정된 CPU 사용율에따라 Pod 의개수가자동으로증가또는감소하게설정가능하다.
EAP7 Application
감사합니다 midware@rockplace.co.kr