Web Hosting with OpenShift Brice Copy – BE-ICS BASICS presentation – 04 Feb 2017

Overview A quick introduction to OpenShift Why OpenShift OpenShift concepts Limitations Docker usage remarks BE-ICS 09 Feb 2016

Why OpenShift ? Migrating thousands of AFS / DFS websites Supporting multiple web technologies easily (PHP, Node, Python, PERL, Java) Reducing maintenance complexity for the IT department Supporting modern architectures : Clustering Load balancing and high availability BE-ICS 04 February 2017

OpenShift concepts Project Pod PVC Service Route BE-ICS 04 February 2017

Route Service 1 Pod Service 2 PVC OpenShift Project BE-ICS 04 February 2017

Project An Openshift project is where you deploy applications and supporting components. A Project is composed of : A private network, with non-routable IP addresses A domain name, for which IT Dept will generate SSL certificates automatically (Optional) a CERN SSO domain registration (! Only one for the entire project) BE-ICS 04 February 2017

Pod A pod is essentially a container / a computer : It has a hostname, an IP address, a transient file system It can be attached to Persistent Storage (if it needs a persistent file system) It can be initialized from a build process, or from a Docker image. Pods can be replicated manually or automatically to cope with load (depending on their CPU usage, I/O activity) BE-ICS 04 February 2017

Persistent Volume Claim (PVC) By default, Pod only have a transient file system Upon restart, all files are lost. A PVC indicates the requirement for a Pod to store persistent files Indicate how much storage is required Indicate what kind of access (shared, replicated, read-only etc…)  OpenShift will procure the matching storage BE-ICS 04 February 2017

Services Defines a group of containers that serve the same function (typically, work over the same ports, host the same code) Example : Databases Application Server Services can be exposed to other Services, or to the outside world through Routes BE-ICS 04 February 2017

Route A Route is your project’s window to the world : It exposes a Service on a well-known URL path and maps internal ports to port 443. Routes are high-availability URLs, they are guaranteed to work, but it’s up to you to ensure your underlying Service is properly sized. HA Proxy (the underlying Router) supports : HTTPS WebSockets TLS over SNI You can access your project without a route, through SSH Tunneling – but no high-availability is guaranteed. BE-ICS 04 February 2017

Limitations Routes are quite constraining, unless your code is HTTPS or WebSocket friendly. Most Docker images cannot at the moment be used without some minor changes (USER directives, file system access rights). BE-ICS 04 February 2017

Demo BE-ICS 04 February 2017

A few words about Docker usage Ensure that your image uses the USER clause (with a non-root user) Ensure that your image does not expect non-root access rights to the transient file system – OpenShift randomly generates UIDs – you can pin a UID and hard-code it in your image… or use NSSWRAPPER (either way, it’s fun!) Beware of Docker image hashes – if your container is not redeploying, it’s mostly because of them. Consider using S2I capabilities (but be prepared to rely on OpenShift build idiosyncrasies). BE-ICS 04 February 2017

04 February 2017 BE-ICS