1. Web Hosting with OpenShift
Brice Copy – BE-ICS BASICS presentation – 04 Feb 2017

2. Overview A quick introduction to OpenShift Why OpenShift
OpenShift concepts
Limitations
Docker usage remarks
BE-ICS
09 Feb 2016

3. Why OpenShift ? Migrating thousands of AFS / DFS websites
Supporting multiple web technologies easily (PHP, Node, Python, PERL, Java)
Reducing maintenance complexity for the IT department
Supporting modern architectures :
Clustering
Load balancing and high availability
BE-ICS
04 February 2017

4. OpenShift concepts Project Pod PVC Service Route BE-ICS
04 February 2017

5. Route Service 1 Pod Service 2 PVC OpenShift Project BE-ICS
04 February 2017

6. Project
An Openshift project is where you deploy applications and supporting components.
A Project is composed of :
A private network, with non-routable IP addresses
A domain name, for which IT Dept will generate SSL certificates automatically
(Optional) a CERN SSO domain registration (! Only one for the entire project)
BE-ICS
04 February 2017

7. Pod A pod is essentially a container / a computer :
It has a hostname, an IP address, a transient file system
It can be attached to Persistent Storage (if it needs a persistent file system)
It can be initialized from a build process, or from a Docker image.
Pods can be replicated manually or automatically to cope with load (depending on their CPU usage, I/O activity)
BE-ICS
04 February 2017

8. Persistent Volume Claim (PVC)
By default, Pod only have a transient file system
Upon restart, all files are lost.
A PVC indicates the requirement for a Pod to store persistent files
Indicate how much storage is required
Indicate what kind of access (shared, replicated, read-only etc…)
 OpenShift will procure the matching storage
BE-ICS
04 February 2017

9. Services
Defines a group of containers that serve the same function (typically, work over the same ports, host the same code)
Example :
Databases
Application Server
Services can be exposed to other Services, or to the outside world through Routes
BE-ICS
04 February 2017

10. Route A Route is your project’s window to the world :
It exposes a Service on a well-known URL path and maps internal ports to port 443.
Routes are high-availability URLs, they are guaranteed to work, but it’s up to you to ensure your underlying Service is properly sized.
HA Proxy (the underlying Router) supports :
HTTPS
WebSockets
TLS over SNI
You can access your project without a route, through SSH Tunneling – but no high-availability is guaranteed.
BE-ICS
04 February 2017

11. Limitations
Routes are quite constraining, unless your code is HTTPS or WebSocket friendly.
Most Docker images cannot at the moment be used without some minor changes (USER directives, file system access rights).
BE-ICS
04 February 2017

12. Demo
BE-ICS
04 February 2017

13. A few words about Docker usage
Ensure that your image uses the USER clause (with a non-root user)
Ensure that your image does not expect non-root access rights to the transient file system – OpenShift randomly generates UIDs – you can pin a UID and hard-code it in your image… or use NSSWRAPPER (either way, it’s fun!)
Beware of Docker image hashes – if your container is not redeploying, it’s mostly because of them.
Consider using S2I capabilities (but be prepared to rely on OpenShift build idiosyncrasies).
BE-ICS
04 February 2017

14. 04 February 2017
BE-ICS