diff --git a/certs.png b/certs.png deleted file mode 100644 index 665a51f1bd..0000000000 Binary files a/certs.png and /dev/null differ diff --git a/certs.svg b/certs.svg deleted file mode 100644 index df0ad82b3d..0000000000 --- a/certs.svg +++ /dev/null @@ -1,428 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - image/svg+xml - - - - - - - - - - Orca Root CA - - - - Orca intermediate CA - - - - Orca servercert - - - - Orca normalUser Cert - - - - Swarm intermediate CA - - - - swarm serverCert - - - - Orca adminUser Cert - - - - - - - - Swarm Trusted CAs - - diff --git a/install_upgrade_spec.md b/install_upgrade_spec.md index e59c0157dc..7dbc359a7e 100644 --- a/install_upgrade_spec.md +++ b/install_upgrade_spec.md @@ -3,17 +3,13 @@ ![Components](orca_components.png) +## Known gaps + +* Swarm must talk to consul with TLS enabled - https://github.com/docker/swarm/issues/404 - slated for 1.9 + ## Open Questions -* Can Swarm talk to consul with TLS enabled? -* ~~Can we use a single root CA and intermediate CA certs for orca/swarm?~~ - Yes! -* ~~Should the bootstrapper container contain the other images within?~~ - no, too bloated -* ~~Should we link all our containers, or wire them up based on the punched through IP/ports?~~ - It's not ready yet -* ~~DB Clustering/HA?~~ - Not for v1 -* ~~What KV store (swarm discovery backend) should we use?~~ - Use single node consul for v1 -* ~~How far away is core orca from supporting multiple swarms?~~ not for v1 -* ~~Does it make sense to append the Orca CA certificates to the local system's trusted certs?~~ Give fingerprint instead - +* Can we get admin user certs signed by the swarm CA to work? If not, admins will have to deal with dual certs for swarm+orca access. ## Assumptions @@ -21,19 +17,18 @@ * We wont use data volume containers, but instead host volume mounts * Our goal is to get as close to a full end-to-end deployment as possible (from bare-metal up to orca) * Advanced customers may be able to cherry-pick, but that's not the focus in v1 + * We'll deploy an internal consul instance for swarm (not HA) * Bare-metal ISO based installer not (yet) covered in this document * Swarm requires a common single CA "on both sides" (incoming client communication and outgoing engine communication) * Swarm Managers must have visibility to all the engines (or proxies) and be secured with TLS. All Engines/Proxies must trust the CA who signed the swarm cert * Swarm manager and docker proxy may fold into one component, but this shouldn't fundamentally change the flow -* We'll "own" an internal root CA with intermediaries for orca/swarm to provide access control - * Admin users certs will be signed by the root so they have swarm access, regular users by the orca intermediate so they do not have swarm access +* We'll "own" two internal root CAs for orca/swarm to provide access control * Set up so that certs can be replaced post v1 * We'll store the certs in a host volume mount * The volume could be swapped out for a keywhiz volume mount in the future (unclear if we can write to it though...) * Laying the groundwork of a central CA for our managed swarm will enable keywhiz for secret management post v1 * Installation logic should be idempotent, and not clobber any pertinent state unless the user asks us to -![Certs](certs.png) ## User Entrypoint @@ -100,9 +95,8 @@ docker run --rm -t \ 7. Stop any existing orca containers already running on the host 8. (conditional) clobber existing state if requested 9. Generate Root CA and certs if not present in host volume path: /etc/docker/ssl/orca - * root Orca CA cert - * Intermediat Orca CA cert - * Intermediat Swarm CA cert + * Orca CA cert + * Swarm CA cert 10. Generate cert for proxy/swarm manager signed by Swarm CA 11. Deploy proxy with random exposed port 12. Verify we can see the proxy we just deployed using the engines external IP diff --git a/orca_components.png b/orca_components.png index c406880054..75cf37ce04 100644 Binary files a/orca_components.png and b/orca_components.png differ diff --git a/orca_components.svg b/orca_components.svg index dd55a5085f..6c4765350d 100644 --- a/orca_components.svg +++ b/orca_components.svg @@ -198,6 +198,21 @@ style="fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:1pt;stroke-opacity:1" transform="scale(0.6,0.6)" /> + + + @@ -237,17 +252,18 @@ . . . + id="g8785" + transform="translate(49.857143,0)"> - - - - DockerProxy - + style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:2;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#SemiCircleIn-6)" /> + id="g7530"> SwarmManager - + y="444.94174" + x="-609.47736" + sodipodi:role="line">Join + id="g7447"> + style="opacity:0.8;fill:#80d8ff;fill-opacity:1;fill-rule:evenodd;stroke:#0c73b1;stroke-width:1.760337;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1" /> Engine 1 @@ -530,21 +497,21 @@ ExternallyExternallyVisiblePorts @@ -582,90 +549,205 @@ style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:2;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#SemiCircleIn-69-65-6)" /> + id="g7563"> + style="opacity:0.8;fill:#80d8ff;fill-opacity:1;fill-rule:evenodd;stroke:#0c73b1;stroke-width:2.79217744;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1" /> Engine 0 + transform="translate(-201,128)" + id="g9942-0"> + SwarmCA(cfssl) + + + + Orca CA(cfssl) + + + + DockerProxy + + + + SwarmJoin + + + Engine 1 + + + SwarmManager - - - - - Engine N + y="444.94174" + x="-609.47736" + sodipodi:role="line">Join