Upgrade to Pro — share decks privately, control downloads, hide ads and more …

OpenShift Windows Containers

OpenShift Windows Containers

Windows containers were launched as a Developer Preview feature in Red Hat OpenShift 4.4. The architecture involves letting Windows run Windows Server containers and Red Hat Enterprise Linux run Red Hat Enterprise Linux containers, with OpenShift orchestrating them as building blocks to compose your next-generation applications.


Red Hat Livestreaming

July 06, 2020

More Decks by Red Hat Livestreaming

Other Decks in Technology


  1. The Road to Production OpenShift Windows Containers Subodh Bhargava @

    Microsoft, Senior Program Manager in Windows Server Group Mike Barrett @ Red Hat, Senior Director in Cloud Platforms Anand Chandramohan @ Red Hat, Senior Principal Product Manager in Cloud Platforms
  2. ASP.NET and .NET continue to be top framework choices Source:

    Stackoverflow Developer Survey, 2019 2019 Stackoverflow Developer Survey, Most Popular Technologies 3
  3. Why containerize traditional Windows apps? • PORTABILITY, SECURITY AND COST

    REDUCTION ◦ Accelerate your public and hybrid cloud strategy ◦ Gain applications portability, agility, and control ◦ Reduce infrastructure and management costs for Windows 2003, 2008, and 2012 Windows applications Custom Licensing and Support Hardware Resources Inefficiencies Application Maintenance and Management COSTS FOR MANAGING TRADITIONAL APPLICATIONS 65% Traditional Application Maintenance 59% Inertia of Traditional App Infrastructure Top Development Challenges for Development Teams State of App development Survey: Q1 2016, Cornell University case study.
  4. On-Premises ✔ No re-architect or new code ✔ Increased density

    & lower deployment cost ✔ Improved productivity and DevOps agility ✔ Portability of apps and dependencies Lift and Shift Scenarios 5
  5. Trusted enterprise Kubernetes Empowering developers to innovate Cloud-like experience everywhere

    Open source innovation Why Customers Choose Red Hat OpenShift
  6. Developer Productivity Cluster Services Automated Ops ⠇Over-The-Air Updates ⠇Monitoring ⠇Registry

    ⠇Networking ⠇Router ⠇KubeVirt ⠇OLM ⠇Helm 11 Red Hat Enterprise Linux & RHEL CoreOS Kubernetes Developer CLI ⠇VS Code extensions ⠇IDE Plugins Code Ready Workspaces CodeReady Containers Service Mesh ⠇Serverless Builds ⠇CI/CD Pipelines Full Stack Logging Chargeback Databases ⠇Languages Runtimes ⠇Integration Business Automation 100+ ISV Services Platform Services Application Services Developer Services Larger Scope Physical Virtual Private cloud Public cloud Build Cloud-Native Apps Manage Workloads Multi-cluster Management Discovery ⠇Policy ⠇Compliance ⠇Configuration ⠇Workloads Managed cloud (Azure, AWS, IBM, Red Hat) Windows Server Nodes

    | ANALYTICS AI | ML MULTI-CLOUD IOT More Than 1,700 Red Hat OpenShift Customers 13
  8. For Windows Containers 14 • Choose: Learn straight Kubernetes or

    stay in the Windows App • Commercial on premise ISV container eco-system for Kubernetes • Leverage out of the box OVN networking or replace it with Tigera solutions • Windows Kubernetes Lifecycling • Automated Windows node joins to cluster • Logging and Monitoring • Only place you can run .NET in a KubeVirt Windows VM, RHEL .NET Core Container, and a Windows Server Container: Complete Windows coverage

    Services STORAGE Kubernetes services Monitoring | Logging | Tuned SDN | DNS | Kubelet Infrastructure services etcd NETWORK COMPUTE Registry Prometheus | Grafana Alertmanager Kibana | Elasticsearch Router Developers Admins WORKER Monitoring | Logging | Tuned SDN | DNS | Kubelet Registry Prometheus | Grafana Alertmanager Kibana | Elasticsearch Router This is Still Normal OpenShift
  10. OSS Windows Inbox OpenShift On Prem architecture Physical Network –

    VMWARE, CISCO, or any SDN K8s Master Node (Linux) Linux OS OVS Openshift CNI CRI Storage Plugins (SMB, iSCSI) CNI CSI or FlexVolume Fluentd Plugin Prometheus Exporter Container Runtime (CRIO) Kubelet K8s Worker Node (Windows) Windows OS Host Compute Service (HCS) Host Network Service (HNS) Container Runtime (Docker / ContainerD) CRI Fluentd Plugin Prometheus Exporter OSS + Windows Contributed VSWITCH Openshift Kubernetes Cluster New Code (co-owned by RHT and MSFT) VXLAN Tunnel Kubernetes Annotations (etcd) Running on Linux master node Kubelet Network policy daemon Storage Plugins (SMB, iSCSI) CNI CSI or FlexVolume Win-overlay CNI Kube-proxy Hybdrid-Ove rlay service Hybdrid-Overlay daemon Kubernetes Annotations (etcd)
  11. Dev Preview Architecture Pulls Down: • WMCB • OpenShift node

    ignition config • Upstream Kubelet • Hybrid-Overlay • Kube-Proxy • CNI plugin taint = windows hosts inventory file WMCB: • Configures the kubelet.conf • Handles the CSR handshake • Set taint for windows • Loads CNI plugin • Loads hybrid-overlay • Starts Kubelet as Windows Service Network Rules for Traffic In/Out Or Bare Metal
  12. 2019 2020 2021 March Dec First Half Second Half 3/25/2019

    Kubernetes 1.14: Production-level support for Windows Nodes OpenShift 4.3 OpenShift 4.5 OVN GA OpenShift 4.7 OpenShift 4.4 Magic 8 Ball OpenShift 4.3 = Kubernetes 1.16 OpenShift 4.4 = Kubernetes 1.17 OpenShift 4.5 = Kubernetes 1.18 OpenShift 4.6 = Kubernetes 1.19 OpenShift 4.7 = Kubernetes 1.20 Kubernetes 1.18 runAsUser gMSA CSI Proxy Kubernetes 1.17 Kubernetes 1.19 OpenShift 4.6 Kubernetes 1.20 RuntimeClass Dates are Subject to Change Without Notice THE GA ZONE Dev Preview Drop 6 Tech Preview First Half Second
  13. 24 LifeCycle • Be able to target a set of

    Windows servers • Automate the deployment of the software on Windows • Configure the software on the Windows node specific to OpenShift • Keep the Window’s node Kube software in sync with the OpenShift cluster version
  14. Logging & Monitoring TLS TLS OpenShift Infra Nodes Prometheus node_exporter

    TLS TLS LogMonitor Fluentd Node_Exporter Open source projects driving this work:
  15. 28 Resource Management & Security Resource Management • CPU based

    on Percentage instead of Shares targeting Kubernetes 1.20 • RuntimeClass for HyperV container isolation targeting Kubernetes 1.20 ◦ Will also require CRI based containerd targeting Kubernetes 1.21 • Pod evictions due to memory pressure targeting Kubernetes 1.21 Security • Windows Group Managed Service Account (gMSA) and runAsUserName stable in Kubernetes 1.18
  16. Scope for First Release (GA) • Join a Windows Server

    node to a OpenShift cluster • Life Cycle required software on the Windows Server node • Be able to hold a tenant boundary • Be able to deploy a container to the Windows Server • Be able to route traffic between pods (east/west) and to application users (north/south) • Prometheus/Grafana Dashboards • ElasticSearch Logging (EFK) • 3rd party eco-system for PV Support Out of Scope for First Release • S2I Build or Knative Automations • Service Mesh Integration • Pipeline Integration • Deeper UI changes • Equal Resource Management Policies in Kubernetes
  17. Archive of SIG Windows Meetings Latest Windows Container Forum Topics

    SIG Live Meeting Tues@12:30pmET • Windows Kubernetes Code • OpenShift Windows Container Operator • Windows Kubernetes Downloads DEV PREVIEW Email Microsoft and Red Hat Development Questions or Obtain Access to the Dev Preview Join Kubernetes on Slack! #sig-windows Get Involved or Just Stay Informed! Call To Action