{"id":1077,"date":"2017-09-28T14:04:11","date_gmt":"2017-09-28T14:04:11","guid":{"rendered":"https:\/\/www.bsetec.com\/blog\/?p=1077"},"modified":"2017-10-31T11:18:49","modified_gmt":"2017-10-31T11:18:49","slug":"secrets-of-docker-swarm","status":"publish","type":"post","link":"https:\/\/www.bsetec.com\/blog\/secrets-of-docker-swarm\/","title":{"rendered":"Secrets of Docker Swarm"},"content":{"rendered":"

\"docker-swarm\"<\/a><\/p>\n

 <\/p>\n

Docker changed how development, testing and running software are done, and that\u2019s why software engineers and companies should develop new habits and follow best practices. On the other hand, orchestration technologies like Docker Swarm, K8S or Mesos are also changing depending on the industry demands. Security management, including secret management in Docker Swarm, is one of the things that have evolved as a reaction to these changes.<\/span><\/p>\n

When working with Docker and orchestration tools, following security best practices is important. Software is becoming more distributed and with the rise of new development models, e.g. Micro-services Architecture, communication between software components is adopting new patterns like message-based communication.<\/span><\/p>\n

In a production environment, containers running different services may exchange some critical information. When deploying a software to different environments, it is evident that storing critical information like production passwords in the development environment is not a good practice. There are multiple scenarios where we can notice the need of a standardized interface for accessing secrets.<\/span><\/p>\n

Datacenter Operating System, Kubernetes and other orchestration technologies have their own integrated secrets management solutions. \u00a0we are going to discover Docker native secret management.<\/span><\/p>\n

How Docker Swarm Work ?<\/b><\/p>\n

Docker users can use Docker Secrets in a Swarm cluster. Managers in Docker Swarm act as an authoritative delegation to coordinate secrets management.<\/span><\/p>\n

Secrets could be passwords, keys, certificates, sensitive environment data or any other custom data that a developer wants to protect e.g a database name, the administrator username, etc.<\/span><\/p>\n

Docker Secrets is only available in the Swarm mode, so standalone containers can not use this feature. Swarm Mode allows you to centrally manage sensitive data and messages by encrypting and transmitting them in a secure way and only to containers that need to access to it.<\/span><\/p>\n

When a user adds a new secret to a Swarm cluster, this secret is sent to a manager using a TLS connection.<\/span><\/p>\n

TLS is a cryptographic protocol that provides communications security over a network by providing communication encryption, privacy and data integrity.<\/span><\/p>\n

In order to make all managers up to date with a new secret, when one manager node receives the secret, it saves it to a Raft store with a 256-bit key.<\/span><\/p>\n

Docker Swarm, it\u2019s undeniable that Swarm is one of the most successfully clustering solutions for containers and of course Docker.<\/span><\/p>\n

Swarm is now rock-solid both in terms of feature and quality. Combined with the power of <\/span>libnetwork<\/span><\/i>, Swarm delivers a Software-Defined Network Docker clustering system that is easy to setup and use. It\u2019s the only clustering system that allows us to control a pool of Linux and Windows container engines <\/span>at the same time<\/span><\/i>. Enterprise adoption of Swarm is, IMHO, far easier than other clustering solutions. It\u2019s simple and it just works.<\/span><\/p>\n

What\u2019s container orchestration?<\/b><\/p>\n

Containers basically packages services into one unit which you can deploy anywhere you like\u200a\u2014\u200alocal machine, test environment or production systems. In a production environment, you cannot pile up containers on one machine, because it\u2019ll run out of capacity. You need multiple machines to be running in a cluster and deploy these containers to them. Now the question is, If I have multiple nodes \/ machines running in my cluster. Where do I deploy my container to? You would tell the orchestration software to deploy a container and it takes care of the rest.<\/span><\/p>\n

Orchestration software generally takes care of :<\/span><\/p>\n