Advanced Access Control with Docker EE
1 like317 views
The document outlines the advanced access control implemented in Docker Enterprise Edition, detailing the permissions and roles assigned to different teams at Orcabank, including payments, mobile, operations, and admin roles. Each team is granted specific capabilities regarding container viewing, managing secrets, and utilizing resources tailored to their functions. Additionally, it mentions the introduction of dedicated nodes for different teams and discusses the cluster architecture used for operations.
Advanced Access Control with Docker EE
- 1. Docker Enterprise Edition Advanced Access Control Mark Church Solutions Architect, Docker Inc. @churchofmark October, 2017
- 2. app container platform physical infrastructure app appapp Team Mobile Team Payments Company Acquisition sharing is caring
- 3. container 1 app container 2 app host CPU memory I/O storage secrets images networks volumes services virtual resources physical resources host host users
- 4. • Payments team can view their containers and logs only • Mobile team can view their containers and logs only • Admins - Full capabilities, full stack • Ops team Full capabilities against application nodes Access Control at OrcaBank
- 7. Payments Team/production/payments Dev Role Collection Subject Role grants GRANT
- 8. • Admins - Full capabilities, full stack • Ops team Full capabilities against application nodes • Payments team can view their containers only • Mobile team can view their containers only Access Control at OrcaBank
- 10. / ├── Shared │ ├── app nodes │ ├── mobile │ └── payments └── System └── infra nodes OrcaBank collection architecture
- 11. UsersTeamsGrantsCollections grant mobile payments ops admins Roles Full Control Dev grant / DevelopersDevelopersInfra Admins DevelopersDevelopersDevelopers DevelopersDevelopersDevelopers DevelopersDevelopersSREs / Ops /Shared/mobile grant/Shared/payments grant/Shared Ops grant composition
- 12. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller Worker Nodes /mobile volume app network /payments app db network app app network volume secret config
- 13. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller UCP Workers /mobile volume app network /payments app db network app app network volume secret config Payments Team ● View containers ● View services ● View logs ● Container Inspect No Access
- 14. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller UCP Workers /mobile volume app network /payments app db network app app network volume secret config Mobile Team ● View containers ● View services ● View logs ● Container Inspect No Access No Access
- 15. UCP Controller UCP Controller UCP Controller /System /Shared secret app db UCP Controller UCP Controller Docker Trusted Registry UCP Controller UCP Controller UCP Workers /mobile volume app network /payments app db network app app network volume secret config Ops Team ● All Resources ○ Deploy ○ View ○ Update ○ Destroy No Access
- 16. OrcaBank “DevOps” Cluster New Requirements • Mobile Team - Full capabilities to deploy in “mobile” collection • Payments Team - Full capabilities to deploy in “payments” collection • DB Team - Full capabilities to deploy in “db” collection • Each team will also have dedicated nodes
- 17. UCP Controller UCP Controller UCP Controller System UCP Controller UCP Controller Docker Trusted Registry mobile paymentsdb UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes collection architecture
- 18. / ├── Shared │ ├── app nodes │ ├── mobile │ └── payments └── System └── infra nodes / ├── Shared ├── System │ └── infra nodes ├── db │ └── app nodes ├── mobile │ └── app nodes └── payments └── app nodes diff
- 19. / ├── Shared ├── System │ └── infra nodes ├── db │ └── app nodes │ ├── payments │ └── mobile ├── mobile │ └── app nodes └── payments └── app nodes consumer/provider relationships
- 20. UCP Controller UCP Controller UCP Controller /System UCP Controller UCP Controller Docker Trusted Registry /mobile /payments app app network volume config app app network /db /mobile /payments volume network db secret volume network db secret UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes UCP Controller UCP Controller Worker Nodes collection architecture
- 21. AD/LDAP Users AD/LDAP GroupsTeamsGrantsCollections AD_db AD_pay AD_admin db payments admins DevelopersDevelopersInfra Admins DevelopersDevelopersDB Ops DevelopersDevelopersDevOps grant/db grant/ grant grant /payments /db/payments AD_mobmobile DevelopersDevelopersDevOps grant grant /mobile /db/mobile Roles Admin View & Use Networks + Secrets Ops
- 22. UCP Controller UCP Controller UCP Controller /System UCP Controller UCP Controller Docker Trusted Registry /mobile /payments app app network volume config app app network /db /mobile /payments volume network db secret volume network db secret Collection Architecture UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers DB Team ● All Resources ○ Create ○ Update ○ View ○ Destroy ○ Schedule No Access No Access
- 23. UCP Controller UCP Controller UCP Controller /System UCP Controller UCP Controller Docker Trusted Registry /mobile /payments app app network volume config app app network /db /mobile /payments volume network db secret volume network db secret Collection Architecture UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers UCP Controller UCP Controller UCP Workers Mobile Team ● All Resources ○ Create ○ Update ○ View ○ Destroy ○ Schedule No Access Mobile Team Networks & Secrets ○ View ○ Use No Access
- 24. Docker EE Hosted Demo ● Free 4 Hour Demo ● No Servers Required ● Full Docker EE Cluster Access And hands on labs! docker.com/trial