|
| 1 | +# Telepresence with Docker Golden Path |
| 2 | + |
| 3 | +## Why? |
| 4 | + |
| 5 | +It can be tedious to adopt Telepresence across your organization, since in its handiest form, it requires admin access, and needs to get along with any exotic |
| 6 | +networking setup that your company may have. |
| 7 | + |
| 8 | +If Docker is already approved in your organization, this Golden path should be considered. |
| 9 | + |
| 10 | +## How? |
| 11 | + |
| 12 | +When using Telepresence in Docker mode, users can eliminate the need for admin access on their machines, address several networking challenges, and forego the need for third-party applications to enable volume mounts. |
| 13 | + |
| 14 | +You can simply add the docker flag to any Telepresence command, and it will start your daemon in a container. |
| 15 | +Thus removing the need for root access, making it easier to adopt as an organization |
| 16 | + |
| 17 | +Let's illustrate with a quick demo, assuming a default Kubernetes context named default, and a simple HTTP service: |
| 18 | + |
| 19 | +```cli |
| 20 | +$ telepresence connect --docker |
| 21 | +Connected to context default (https://default.cluster.bakerstreet.io) |
| 22 | +
|
| 23 | +$ docker ps |
| 24 | +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES |
| 25 | +7a0e01cab325 datawire/telepresence:2.12.1 "telepresence connec…" 18 seconds ago Up 16 seconds 127.0.0.1:58802->58802/tcp tp-default |
| 26 | +``` |
| 27 | + |
| 28 | +This method limits the scope of the potential networking issues since everything stays inside Docker. The Telepresence daemon can be found under the name `tp-<your-context>` when listing your containers. |
| 29 | + |
| 30 | +Start an intercept and a corresponding intercept-handler: |
| 31 | + |
| 32 | +```cli |
| 33 | +$ telepresence intercept echo-easy --port 8080:80 --docker-run -- jmalloc/echo-server |
| 34 | +Using Deployment echo-easy |
| 35 | + Intercept name : echo-easy |
| 36 | + State : ACTIVE |
| 37 | + Workload kind : Deployment |
| 38 | + Destination : 127.0.0.1:8080 |
| 39 | + Service Port Identifier: proxied |
| 40 | + Intercepting : all TCP requests |
| 41 | +Echo server listening on port 8080. |
| 42 | +``` |
| 43 | + |
| 44 | +Using `--docker-run` starts the local container that acts as the intercept handler so that it uses the same network as the container that runs the telepresence daemon. It will also |
| 45 | +have the remote volumes mounted in the same way as the remote container that it intercepts. |
| 46 | + |
| 47 | +If you want to curl your remote service, you'll need to do that from a container that shares the daemon container's network. You can find the network using `telepresence status`: |
| 48 | +```cli |
| 49 | +$ telepresence status | grep 'Container network' |
| 50 | + Container network : container:tp-default-default-cn |
| 51 | +``` |
| 52 | + |
| 53 | +Now curl with a `docker run` that uses that network: |
| 54 | +```cli |
| 55 | +$ docker run --network container:tp-default-default-cn --rm curlimages/curl echo-easy |
| 56 | + % Total % Received % Xferd Average Speed Time Time Time Current |
| 57 | + Dload Upload Total Spent Left Speed |
| 58 | +100 99 100 99 0 0 21104 0 --:--:-- --:--:-- -Request served by 4b225bc8d6f1 |
| 59 | +
|
| 60 | +GET / HTTP/1.1 |
| 61 | +
|
| 62 | +Host: echo-easy |
| 63 | +Accept: */* |
| 64 | +User-Agent: curl/8.6.0 |
| 65 | +-:--:-- 24750 |
| 66 | +``` |
| 67 | + |
| 68 | +Similarly, if you want to start your intercept handler manually using `docker run`, you must ensure that it shares the daemon container's network: |
| 69 | + |
| 70 | +```cli |
| 71 | +$ docker run \ |
| 72 | + --network=container:tp-default \ |
| 73 | + -e PORT=8080 jmalloc/echo-server |
| 74 | +Echo server listening on port 8080. |
| 75 | +``` |
| 76 | + |
| 77 | +### Tip. Use named connections |
| 78 | +You can use the `--name` flag to name the connection and get a shorter network name: |
| 79 | + |
| 80 | +``` |
| 81 | +$ telepresence quit |
| 82 | +$ telepresence connect --docker --name a |
| 83 | +``` |
| 84 | +Now, the network name will be `tp-a` instead of `tp-default-default-cn`. |
| 85 | + |
| 86 | +Naming is also very useful when you want to connect to several namespaces simultaneously, e.g. |
| 87 | + |
| 88 | +``` |
| 89 | +$ telepresence connect --docker --name alpha --namespace alpha |
| 90 | +$ telepresence connect --docker --name beta --namespace beta |
| 91 | +``` |
| 92 | + |
| 93 | +Now, with two connections active, you must pass the flag `--use <name pattern>` to other commands, e.g. |
| 94 | +``` |
| 95 | +$ telepresence intercept echo-easy --use alpha --port 8080:80 --docker-run -- jmalloc/echo-server |
| 96 | +``` |
| 97 | + |
| 98 | +## Key learnings |
| 99 | + |
| 100 | +* Using the Docker mode of telepresence **does not require root access**, and makes it **easier** to adopt it across your organization. |
| 101 | +* It **limits the potential networking issues** you can encounter. |
| 102 | +* It **limits the potential mount issues** you can encounter. |
| 103 | +* It **enables simultaneous intercepts in multiple namespaces**. |
| 104 | +* It leverages **Docker** for your interceptor. |
0 commit comments