I had a great time speaking at Microsoft’s Ignite conference last week! It was fun talking a bit about our startup journey at Hyperfish and some of the decisions we made along the way about running and supporting our service.
This was a totally new topic for me and something a bit outside my normal speaking topics … but I really enjoy sharing our journey with others!
You can check out the session recording here:
Sometimes hosted build agents in VSTS dont cut the mustard and you want full control over your build environment. That’s where self hosted build agents come in. The problem is … do you don’t want to run VMs ideally and if you are getting into Kubernetes then your dev cluster is probably sitting there idle 90%+ of the time with all those CPU cycles being wasted.
We decided to do something with that extra capacity and run a set of VSTS linux build agents (good for Nodejs and .net Core builds etc…) in our dev AKS cluster! We can scale them up for more concurrent builds really easily.
What you will need:
Lets go …
Helm is a tool that helps you install apps in your kubernetes environment. Helm charts are templates for your application. They define what your app needs and what containers should be deployed etc… Fortunately Microsoft make their linux build agent available as a Docker image that we can use in a helm chart to get it deployed. https://hub.docker.com/r/microsoft/vsts-agent/
This means all we need to do is deploy it (or many of them) to Kubernetes … and helm charts can help with that! We wrote a basic one to get things going.
First you will need to get our helm chart.
git clone [email protected]:Hyperfish/vsts-build.git
Next open up the values.yaml file and update the following properties:
Note: for more information about these see the vsts agent docker image documentation.
Once you have updated the values.yaml file you are ready to deploy!
Ensure you are in the /vsts-agent folder and have kubectl connected to the kubernetes cluster you want to deploy the application to. (tip: run “kubectl cluster-info” to check you are connected)
Deploy the chart:
helm install .
Once complete the agent will be started in your kubernetes cluster.
helm ls
This will show you the apps you ahve deployed and you should see the vets-agent chart deployed.
Check your VSTS build pool that you specified in the values.yaml file. You should see your new agents listed.
Troubleshooting:
If you don’t see them listed then its likely that the values you set are incorrect. You can check the logs of your agents using:
kubectl logs <pod name>
You might see something like “error: missing VSTS_ACCOUNT environment variable”
Kubernetes is a great way to deploy multiple vsts build agents! Deploying with a Helm chart is even nicer! It gives you are simple way to deploy and manage your agents in kubernetes.
Enjoy!
-CJ
We recently moved our production service to the new Azure Kubernetes Service (AKS) from Microsoft. AKS is a managed Kubernetes (K8s) offering from Microsoft, which in this case, means Microsoft manage part of the cluster for you. With AKS you pay for your worker nodes, not your master nodes (and thus control plane) which is nice.
Don’t know what Kubernetes is?
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. — https://kubernetes.io/
The short story is that we were forced to evaluate our options as the current orchestration software we were using to run our service was shutting down. Docker Cloud was a sass offering that offered capabilities around orchestration/management or our docker container based service. This meant we used it for deployment of new containers, rolling out updates, scheduling those containers on various nodes (VMs) and keeping an eye on it all. It was a very innovative offering 2 years ago when we started using it, was cloud based, easy to use and price competitive. Anyway, Docker with their new focus on making money the Enterprise decided to retire the product and we were forced to look elsewhere.
Kubernetes was the obvious choice. It’s momentum in the industry means there are a plethora of tools, guidance, community and offerings around it. Our service was already being run in Docker containers and so didn’t require significant changes to run in Kubernetes. Our service is comprised of ~20 or so “services” e.g. frontend, API. Kubernetes helps you run these services. It offers things like scheduling those containers to run, managing spinning up new ones if they stop etc.
Every major cloud provider has a Kubernetes offering now. Googles GKE has been around since as early as Nov 2014 & Amazon’s AWS recently released their EKS (on June 2018).
We are not a big team and we couldn’t afford to have a dedicated team to run our orchestration and management platform. We needed an offering that was run by Kubernetes experts who know the nitty gritty of running K8s. The team building AKS at Microsoft are those people. Lead by the co-founder of the Kubernetes project Brendan Burns the MS team know their stuff. It was compelling that they were looking at new approaches in the managed K8s space like not charging for the control plan/master nodes in a cluster and were set on having it just be vanilla K8s and not a weird fork with proprietary peculiarities.
Summary of reasons (in no particular order):
AKS is relatively new and at the time we started considering our options for the move AKS was not a generally available service. We didn’t know when it would GA either. This pained me to say the least, but we had a hunch it was coming soon. To mitigate this we investigated acs-engine which is a tool that AKS uses behind the scenes to generate ARM templates for Azure to stand up a K8s cluster. Our backup plan was to run our own K8s cluster for a while until AKS went GA. Fortunately we didn’t need to do this 🙂
We were in the fortunate position that our service was already running in a set of Docker containers. Tweaking these to run with Kubernetes only required minor changes. Those were all focused on supplying configuration to the containers. We used a naming convention for environment variables that wasn’t Kubernetes friendly, so we needed to tweak the way we read that configuration in our containers.
The major work required was in defining the “structure” of our application in Kubernetes configuration files. These files define the components in your application, the configuration of them, how they can be communicated with & resources they need. These files are just YAML files however manually building them can be tedious when you have quite a few to do. Also there can be repetition between them and keeping them in sync can be painful.
This is where Helm comes in.
Helm is the “package manager for Kubernetes” … but I prefer to think of it as a tool that helps you build templates (“charts”) of your application.
In Azure speak they are like ARM templates for your application definition.
The great part about Helm is that it separates the definition of your application and the environmental specifics. For example, you build a chart for your application that might contain a definition for your frontend app and an API, what resources they need and the configuration they get e.g. DB connection string. But you don’t have to bake the connection string into your chart. That is supplied in an environment specific values file. This lets you define your application and then create environment specific values files for each environment you will deploy your application to e.g. test, stage, production etc. You can manage your chart in source control etc. and manage your environment specific values files (with secrets etc.) outside of source control in a safe location.
This means we can deploy our service on a developer laptop, AKS cluster in Azure for test or into Production using the exact same definition, but with different environment specific configuration.
Chart + Environment config == Full definition.
We already had a Docker Compose definition of our service that our engineers used to run the stack locally during development. We took this and translated it into a Helm chart. This took a bit of work as we were learning along the way, but the result is excellent. One definition of our service in a declarative, modular and configurable way that we use across development, test environments and production.
Helm charts are already available for loads of different applications too. This means if you want to run apps like redis, postgres or zookeeper you don’t have to build your own helm charts.
The best way I can demonstrate in a blog post the value all this brings is to show you how simple it is to deploy our application.
Here are the CLI steps for deploying a brand new, fully functional 4 node environment in Azure with AKS + Helm for our application
az aks create –resource-group myCluster –name myCluster –admin-username cjadmin –dns-name-prefix appName –node-count 4
helm upgrade myApp . -f values.yaml -f values.dev.yaml –install
Two commands to a fully functional environment, running on a 4 node K8s cluster in Azure. Not bad at all!! It takes us about 10 mins to spin up depending on how fast Azure is at provisioning nodes.
Of course there were things that didn’t go perfectly along with all this too. Not specifically AKS related, but Azure related. One in particular that really pissed me off 🙂 During the production move we needed to move some static IP addresses around in our production environment. We started the move and it seemingly failed part the way through the move. This left our resource group in Azure locked for ~4 hours!! During this time we couldn’t update, edit or add anything to our resource group. We logged a Severity A support ticket with MS which is supposed to have a 1 hour response time … over 3 hours later we were still waiting. We couldn’t wait and needed to take mitigation steps which included spinning up a totally new and separate environment (easy with AKS!) and doing some hacky things with VMs and HAProxy to get traffic proxied correctly to it. Some of our customers whitelist our static IP addresses in their firewalls so we don’t have the luxury of a simple DNS change to point at a new environment. It was disappointing to say the least that we pay for a support contract from MS but Azure failed and more importantly our support with MS failed and left us high and dry for 4 hours. PS: they still don’t know what happened, but are investigating it.
Docker closing it’s Docker Cloud offering was the motivation we needed to evaluate Kubernetes and other services. It left me with a bad taste in my mouth with Docker as a company and I will find it hard to recommend or trust taking a dependency on a product offering from them. Deprecating a SaaS product with 2 months notice is not the right way to operate a business if you are interested in keeping customers IMHO. But nevertheless a good thing for us ultimately!
Our experience moving to AKS has been nothing short of excellent. We are very glad the timing of AKS worked in our favor and that Microsoft have a great offering that meets our needs. It’s still early days with AKS and time will be the ultimate proof, however as of today we are very happy with the move.
If you are new to container based applications and are from a Microsoft development background I recommend checking out a short tutorial on ASP.Net + Docker. I have thoroughly enjoyed building a SaaS service that serves millions of users in a container based model and think many of the benefits it offers are worth considering for new projects.
If you want to learn Kubernetes in Azure I recommend their getting started tutorial. It’s will give you a basic understanding of K8s and how AKS works.
Try out the tutorial on AKS + Helm for deploying applications to get started on your journey to loving Helm.
Finally … I interviewed Gabe Monroy from the AKS team when I was at Build 2018 for the Microsoft Cloud show if you are interested in hearing more about AKS, the team behind it and Microsoft’s motivations for building it!
-CJ
Anyone who has listen to me rant on about how interesting Docker is on the Microsoft Cloud Show may have caught me talking about Tutum.
The short story on Tutum is that it provides an easy to use management application over Virtual Machines that you want to run your apps on with Docker. It is (sort of) cloud provider agnostic in that it supports Amazon Web Services, Microsoft Azure and Digital Ocean among others.
It was bought by Docker late last year and recently was recently re-released as Docker Cloud.
What does it provide?
At a high level you still pay for your VMs wherever you host them, but Docker Cloud provides you management of them for 2c an hour (after your first free node) no matter how big or small they are. You write your code, package it in a Docker Image as per usual and then use Docker Cloud to deploy containers based on those docker images to your Docker nodes. You can do this manually or have it triggered when you push your image to somewhere like Docker Hub as part of a continuous integration set up.
Once you have deployed your app (“Services” in Docker Cloud terminology) you can use it to monitor them, scale them, check logs, redeploy a newer version or turn them off etc… They provide an easy to use Web App, REST APIs and a Command Line Interface (CLI).
So how easy is it really?
The first thing you have to do is connect to your cloud provider like Azure. For Azure this means downloading a certificate from Docker Cloud and uploading it into your Azure subscription. This lets Docker Cloud use the Azure APIs to manage things in your subscription for you. (details here)
Once you have done that you can start deploying Virtual Machines, “Nodes” in Docker Cloud terminology. Below I’m creating a 2 node cluster of A2 size in the West US region of Azure.
That’s it. Click “Launch node cluster” wait a few mins (ok quite a few) and you have a functional Docker cluster up and running in Azure.
In Azure you can take a look at what Docker Cloud has created for you. Note that as of the time of writing that Docker Cloud is provisioning “Classic” style VMs in Azure and not using the newer ARM model. They also deploy different VMs into their own cloud services and resource groups which isn’t good for production. That said, Docker Cloud let you Bring Your Own Node (BYON) which lets you provision the VMs however you like, install the Docker Cloud agent on them and then register them in Docker Cloud. Using this you can deploy your VMs using ARM in Azure and configure them however you like.
Now you have a node or two ready you can start deploying your apps to them! Before you do this you obviously need to write your app … or use something simple like a pre-canned demo Docker Image to test things out.
Docker Cloud makes this really simple through “Services”. You create a new service, tell it where it should pull the Docker Image from and a few other configuration options like Ports to map etc… Then Create and your containers will be deployed to your nodes.
Try this once you have your nodes up and running. Click Services in the top nav, then Create Service. Under Jumpstarts & Miscellaneous category you should see the “dockercloud/hello-world” image. Select it and then set it up like this:
There are only a two things I changed from the default setup.
Click “Create and deploy” and you should see your containers starting up. Pretty simple huh!
Note: There is obviously a lot more available via configuration for things like environment variables and volume management for data that you will eventually need to learn about as you develop and deploy apps using Docker.
Once your containers are deployed you will see them move to the running state:
Now you have two hello world containers running on your nodes. If you go back to your list of Nodes you should see 1 container running on each:
I want to see the good man!
You can test your hello world app out by hitting its endpoint. You can find out what that is under the Service you created in the Endpoints information.
Try it out! Open the URL provided in a browser and you should see something like this:
Note that #1 will indicate what container you are hitting.
Want more containers? Go into your Service and move the slider and hit apply.
You will get an error like this:
This is because we mapped port 80 of the Node to the Container and you can only do that mapping once per Node/VM. i.e. two containers cant both be listening on port 80. So unless you use a HAProxy or similar to load balance your containers you will be limited to one container on each node mapped to port 80. I might write up another post about how to do this better using HAProxy.
We are a small company and we want to automate things as much as possible to reduce the manual effort required for mundane tasks. We have opted to use Docker Cloud for helping us deploy containers to Azure as part of our continuous integration and continuous deployment pipeline.
In a nutshell when a developer commits code it goes through the following pipeline and automatically is deployed to our staging environment:
This way a few minutes after a developers commits code the app has been built and deployed seamlessly into Azure for us. We have a Big Dev Ops Flashing Thing hanging on the wall telling us how the build is going.
At Hyperfish we have been using Tutum for a while during its preview period with what I think is great success. Sure, there have been issues during the preview, but on the whole I think it has saved us a TON of time and effort setting up and configuring docker environments. Hell I am a developer kinda guy, not much of a infrastructure one and I managed to get it working easily which I think is really saying something 🙂
Is this how you will run production?
Not 100% sure to be honest. It is certainly a fantastic tool that helps you run your apps easily and quickly. But there is a nagging sensation in the back of my head that it is yet another service dependency that will have its share of downtime and issues and that might complicate things. But I guess you could say that about any additional bit of technology you introduce and take a dependency on. That said, traffic to and from your apps is not going through Docker Cloud, traffic goes direct to your nodes in Azure so if they have brief downtime your app should continue to run just fine.
I have said that for the size we currently are and with the team focusing on building product that we might consider something else only once we can do a better job that it does for us.
We might consider something else only once we can do a better job that it does for us.
All in all I think Docker Cloud has a lot of great things to offer. It will be interesting to compare and contrast these with the likes of Azure’s new service, Azure Container Service (ACS) as it matures and approaches General Availability. It’s definitely something we will look at also.
-CJ