Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Docker Compose利用者から見た Kubernetes 開発環境構築入門 / introduction to kubernetes for docker compose user

Kou
September 15, 2018

Docker Compose利用者から見た Kubernetes 開発環境構築入門 / introduction to kubernetes for docker compose user

Kou

September 15, 2018
Tweet

More Decks by Kou

Other Decks in Programming

Transcript

  1. Docker ComposeͷΈͷӡ༻ʹΑΔ ओͳ໰୊఺ ϗετΛ৑௕Խ͢Δʹ͋ͨͬͯ͸ͦ͜ ·Ͱ೉͘͠͸ͳ͍͕ɺϗετ͝ͱʹΞ ϓϦέʔγϣϯΛσϓϩΠͨ͠Γɺσ ϓϩΠ࣌ʹϩʔυόϥϯαʔ͔Βͷ੾ Γ཭͠Λߦ͏ͳͲΛࣗ࡞͢Δඞཁ͕ग़ ͯ͘Δɻ 1.

    ϗετͷ৑௕Խ ྫ͑͹σϓϩΠʹࣦഊͯ͠ଈ੾Γ໭͠ Λ͍ͨ͠ͱ͍ͬͨέʔεʹ͓͍ͯ͸ɺ Docker Compose୯ମͰಛผͳػೳ͕ ఏڙ͞Ε͍ͯΔΘ͚Ͱ͸ͳ͍ͷͰࣗ෼ Ͱͦͷ࢓૊Λ࡞Δඞཁ͕͋Δɻ
 (Ϗϧυͨ͠Πϝʔδͷλά؅ཧɺλά Λࢦఆͯ͠ͷσϓϩΠͳͲ) 2. ίϯςφͷόʔδϣϯ؅ཧ ίϯςφͷࢮ׆؂ࢹ΍ো֐࣌ͷ෮چʹ ͍ͭͯ͸खಈͩͬͨΓࣗ࡞͢Δ෦෼͕ ଟ͍ɻ 3. ࢮ׆؂ࢹ΍ো֐͔Βͷ෮چ
  2. 1. ਤͷΑ͏ͳNginxͷઃఆϑΝΠϧΛ഑ஔ ͨ͠σΟϨΫτϦΛ༻ҙ͓ͯ͘͠ 2. nginxσΟϨΫτϦͷ1্ͭʹҠಈͯ͠Ҏ ԼͷίϚϯυͰConfigMapΛ࡞੒͢Δ kubectl create configmap nginx-config-common

    -—from-file=nginx/etc/common ConfigMapͷ࡞੒ྫ 3. ͜ΕΛඞཁͳ෼͚ͩߦ͏ɻ※αϒσΟϨΫτϦ·Ͱ͸ ݟͯ͘Εͳ͍ͷͰσΟϨΫτϦߏ੒ʹ͸஫ҙ
  3. ࡞੒ͨ͠ConfigMapͷ಺༰ΛkubectlͰ֬ೝ͢ΔͱҎԼͷΑ͏ʹͳ͍ͬͯΔ $ kubectl get configmap nginx-config-common -o yaml ——————————————————————— apiVersion:

    v1 data: nginx.conf: | user daemon daemon; daemon off; error_log /var/opt/nginx/log/error.log; pid /var/run/nginx.pid; worker_processes auto; worker_rlimit_nofile 100000; events { worker_connections 4000; use epoll; multi_accept on; } ɾɾɾɾ(௕͍ͷͰলུ) kind: ConfigMap metadata: creationTimestamp: 2018-09-12T12:47:51Z name: nginx-config-common namespace: default resourceVersion: "121247" selfLink: /api/v1/namespaces/default/configmaps/nginx-config-common uid: 0fae62dd-b68a-11e8-bbb2-025000000001
  4. ࡞੒ͨ͠ConfigMapͷ಺༰ΛಡΈࠐΜͰ͍ΔDeploymentઃఆྫ apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment spec: replicas:

    2 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: library/nginx:latest ports: - containerPort: 8080 - containerPort: 8443 volumeMounts: - name: v-nginx-config mountPath: /etc/nginx volumes: - name: v-nginx-config-common configMap: name: nginx-config-common volumesʹ࡞੒ͨ͠ConfigMap໊Λࢦఆͯ͠ɺ ίϯςφͷvolumeMounts ͷઃఆͰ Ϛ΢ϯτ͍ͨ͠ύεΛهड़͢Δ
  5. Deploymentͷ࡞੒ ྫͱͯ͠ɺ࡞੒ͨ͠DeploymentͷઃఆΛ nginx-django- deployment.yaml ͱ͍͏ϑΝΠϧ໊Ͱอଘ͠·͢ɻ ͦͷޙɺҎԼͷίϚϯυͰ Deployment ͷ࡞੒Λߦ͍·͢ɻ kubectl apply

    -f nginx-django-deployment.yaml kubectl create Ͱ΋࡞੒͸ՄೳͰ͕͢ɺapply͸࡞੒͓Αͼߋ৽ͷ྆ ํʹରԠ͍ͯ͠·͢ɻ(create͸طʹ࡞੒͞Ε͍ͯΔͱΤϥʔʹͳΔ) ͦͷͨΊɺσϓϩΠ࣌ͷมߋ൓өͰ͸͜ͷίϚϯυΛར༻͢Δέʔ ε͕ଟ͍Ͱ͢ɻ
  6. Serviceͷઃఆྫ kind: Service apiVersion: v1 metadata: name: nginx-service spec: type:

    NodePort selector: app: nginx ports: - name: http protocol: TCP port: 8080 targetPort: 8080 - name: https protocol: TCP port: 8443 targetPort: 8443 selectorʹର৅Podͷϥϕϧʹఆٛͨ͠஋Λࢦ ఆͯ͠Serviceͱඥ෇͚Δ
  7. IngressͷઃఆͱΠϯετʔϧ IngressΛ࢖͑͹AWSͰ͋Ε͹ALBΛׂΓ౰ͯΔ͜ͱ΋ՄೳͳͷͰ͢ ͕ɺएׯઃఆ͕໘౗ͳͷͰࠓճ͸ Nginx Ingress Controller Λར༻͠· ͢ɻ(ALBͷׂΓ౰ͯʹ͍ͭͯ΋ؾʹͳΔํ͸ alb-ingress-controller, kube-aws-ingress-controller

    ͋ͨΓΛௐ΂ͯΈ͍ͯͩ͘͞) Nginx Ingress Controllerʹ͍ͭͯ͸ helm ͱ͍͏Kubernetesͷύοέ ʔδϚωʔδϟʔΛ࢖ͬͯҎԼͷΑ͏ʹΠϯετʔϧ͠·͢ɻ helm install stable/nginx-ingress
  8. Ingress (Nginx Ingress Controller)ͷઃఆྫ apiVersion: extensions/v1beta1 kind: Ingress metadata: annotations:

    kubernetes.io/ingress.class: nginx name: example-lb spec: rules: - host: www.example.com http: paths: - backend: serviceName: nginx-service servicePort: 8080 path: / tls: - hosts: - www.example.com secretName: example-tls selectorʹର৅Podͷϥϕϧʹఆٛͨ͠஋Λࢦ ఆͯ͠Serviceͱඥ෇͚ΔɻservicePortʹ͸ serviceͰࢦఆ͞Εͨ port ·ͨ͸ targetPort Λ ࢦఆ͢ΔɻHTTPSͷઃఆΛߦ͏৔߹͸ tls ͱ͍ ͏߲໨ʹূ໌ॻͷઃఆ͕ඞཁʹͳΓɺSecret ʹূ໌ॻΛొ࿥ͯͦ͠ΕΛࢦఆ͢Δඞཁ͕͋Δɻ
  9. Jobͷઃఆྫ apiVersion: batch/v1 kind: Job metadata: name: db-migrate spec: backoffLimit:

    1 parallelism: 1 completions: 1 template: spec: containers: - name: job-sleep image: debian:stretch-slim command: ["migrate", "up"] restartPolicy: Never backoffLimitͷ਺Λมߋ͢Δ͜ͱͰࣦഊ࣌ͷ࠶ ࢼߦճ਺ͳͲ΋ఆٛ͢Δ͜ͱ΋Ͱ͖Δɻ restartPolicy͕Neverʹઃఆ͞Εͨδϣϒ͕Ұ౓ ਖ਼ৗ׬ྃ͢Δͱɺdelete͞ΕΔ·Ͱ࠶࣮ߦ͞Ε Δ͜ͱ͸ͳ͘ͳΔɻ
  10. CronJobͷઃఆྫ apiVersion: batch/v1beta1 kind: CronJob metadata: name: cron-job spec: schedule:

    "*/1 * * * *" jobTemplate: spec: template: spec: containers: - name: job-sleep image: debian:stretch-slim imagePullPolicy: Always command: ["echo", "test"] restartPolicy: Never scheduleʹcronܗࣜͰ࣮ߦ࣌ؒΛࢦఆ͢Δ͜ͱ ͕ग़དྷΔ
  11. Kubernetesʹ͓͚ΔΩϟογϡ ͱDBͷѻ͍ ϩʔΧϧ΍։ൃ؀ڥͰ͸Redis/MySQLίϯςφΛಈ͔ͯ͠΋Α͍ͷͰ ͕͢ɺAWSΛར༻͍ͯ͠Δέʔεͩͱຊ൪؀ڥͰ͸ElastiCache΍ RDSΛ࢖͍ͨ͘ͳΔ͔ͱࢥ͍·͢ɻ͜ͷ৔߹ɺKubernetes୯ମ (kubectl)Ͱ͸؆୯ʹ੍ޚ͕Ͱ͖ͳ͍ͨΊɺଞͷϓϩϏδϣχϯάπʔ ϧͰ͋Δ kops ΍ Terraform

    Λ૊Έ߹Θͤͯߏங͢Δ͜ͱʹͳΓ· ͢ɻ·ͨɺKubernetes on AWSͱͯ͠͸ EKS ͱ͍͏Ϛωʔδυαʔ Ϗε΋͋Γɺ2018೥9݄ݱࡏ͸౦ژϦʔδϣϯͰ͸·ͩ࢖͑·ͤΜ ͕ɺ౦ژϦʔδϣϯʹରԠͨ͠ࠒʹ͸ͪ͜ΒΛར༻͢Δͷ΋ྑ͍͔ͱ ࢥ͍·͢ɻ
  12. kompose ࣮ߦྫ 1. HomebrewͰΠϯετʔϧ brew install kompose 2. ݩͱͳΔ docker-compose.yaml

    Λࢦఆ͢Δ kompose convert -f docker-compose.yaml -o (ग़ྗઌσΟϨΫτϦ) volumeʹ͍ͭͯ͸σϑΥϧτͩͱPersistentVolumeClaim΁ม׵͞Ε·͕͢ɺ ͜Εʹ͍ͭͯ͸ --volumes Φϓγϣϯʹͯ hostPath ͱͯ͠ίϯόʔτ͢Δ͜ͱ΋Մ ೳͰ͢ɻDocker ComposeͰ͸ϗετྖҬΛϚ΢ϯτͯ͠ར༻͍ͯ͠Δέʔε͕ଟ͍ ͱࢥ͏ͷͰɺ࠷ॳ͸ hostPath ࢦఆͰίϯόʔτ͢Δํ͕ྑ͍͔΋஌Ε·ͤΜɻ (΋ͪΖΜޙ͔Βॻ͖௚͢લఏʹ͸ͳΓ·͢)
  13. 1. ൿಗ৘ใΛϦϙδτϦʹͦͷ··ίϛοτ͠ਏ͍ KubernetesͰ͸SecretϦιʔεΛ࢖͏͜ͱͰൿಗ৘ใΛѻ͍΍͘͢ͳΓ·͕͢ɺઃ ఆϑΝΠϧ্͸஋ΛBase64Τϯίʔυͯ͠ه࿥͍ͯ͠Δ͚ͩʹա͗ͳ͍ͨΊɺ؆୯ ʹσίʔυͰ͖·͢ɻͦͷͨΊɺ͜ΕΛͦͷ·· git ϦϙδτϦ΁ίϛοτ͢Δͷ͸ ጨΒΕͯ͠·͍·͢ɻྫ͑ΔͳΒ Rails 5.2ͷCredentialsʹ૬౰͢Δػೳ͕ݸਓతʹ

    ͸͋Ε͹͍͍ͳͱࢥ͍ͬͯ·͕͢ɺͦͷΑ͏ͳػೳ͸ඪ४Ͱ͸ଘࡏ͠ͳ͍໛༷Ͱ ͢ɻͰ͕͢ɺ͜Εʹ͍ͭͯ͸ bitnami-labs/sealed-secrets ΛΠϯετʔϧͯ͠ SealedSecretϦιʔεΛ௥Ճ͢Δ͜ͱͰ࣮ݱՄೳͷΑ͏Ͱ͢ɻ ʻࢀߟαΠτʼ
 https://engineering.bitnami.com/articles/sealed-secrets.html