mirror of https://github.com/docker/docs.git
161 lines
6.7 KiB
Markdown
161 lines
6.7 KiB
Markdown
---
|
|
description: Load Balancer
|
|
keywords: IBM Cloud load balancer
|
|
title: Load balance Docker EE for IBM Cloud clusters
|
|
---
|
|
|
|
Docker Enterprise Edition (EE) for IBM Cloud deploys three load balancers to each cluster so that you can:
|
|
|
|
* [Access Docker EE Universal Control Plan (UCP) and cluster manager node](#manager-load-balancer).
|
|
* [Access Docker Trusted Registry (DTR)](#dtr-load-balancer).
|
|
* [Expose services created in the cluster](#service-load-balancer).
|
|
|
|
The load balancers are preconfigured for you. Do not change the configurations.
|
|
|
|
## Manager load balancer
|
|
|
|
The manager load balancer is preconfigured to connect your local Docker client, your cluster, `bx d4ic` commands, and Docker EE UCP.
|
|
|
|
Ports:
|
|
|
|
* UCP is listening on load balancer port 443.
|
|
* Agent traffic on the manager nodes is on port 56443.
|
|
|
|
Use the manager load balancer URL to access Docker EE [UCP](/datacenter/ucp/2.2/guides/).
|
|
|
|
1. Get your cluster's load balancer URL for UCP:
|
|
|
|
```bash
|
|
$ bx d4ic list --sl-user user.name.1234567 --sl-api-key api_key
|
|
```
|
|
|
|
2. In your browser, navigate to the URL and log in.
|
|
|
|
**Tip**: Your user name is `admin` or the user name that your admin created for you. You got the password when you [created the cluster](administering-swarms.md#create-swarms) or when your admin created your credentials.
|
|
|
|
|
|
## DTR load balancer
|
|
|
|
The DTR load balancer is used to access DTR and run registry commands such as `docker push` or `docker pull`.
|
|
|
|
The DTR load balancer exposes the following ports:
|
|
|
|
* 443 for HTTPS
|
|
* 80 for HTTP
|
|
|
|
Use the load balancer to access [DTR](/datacenter/dtr/2.4/guides/).
|
|
|
|
1. Get the name of the cluster for which you want to access DTR:
|
|
|
|
```bash
|
|
$ bx d4ic list --sl-user user.name.1234567 --sl-api-key api_key
|
|
```
|
|
|
|
2. Get the DTR URL for the cluster:
|
|
|
|
```bash
|
|
$ bx d4ic show --swarm-name my_swarm --sl-user user.name.1234567 --sl-api-key api_key
|
|
```
|
|
|
|
3. In your browser, navigate to the URL and log in. UCP and DTR share the same login.
|
|
|
|
**Tip**: Your user name is `admin` or the user name that your admin created for you. You got the password when you [created the cluster](administering-swarms.md#create-swarms) or when your admin created your credentials.
|
|
|
|
## Service load balancer
|
|
When you create a service, any ports that are opened with `-p` are automatically exposed through the load balancer. For example:
|
|
|
|
```bash
|
|
$ docker service create --name nginx -p 80:80 nginx
|
|
```
|
|
|
|
This opens up port 80 on the load balancer, and directs any traffic
|
|
on that port to your service.
|
|
|
|
> Note: 10 ports on the service load balancer
|
|
>
|
|
> Each cluster's service load balancer can have 10 ports opened. If you create new services or update a service to publish it on a port but already used 10 ports, new ports are not added and the service cannot be accessed through the load balancer.
|
|
> If you need more than 10 ports, you can explore alternative solutions such as [UCP domain names](https://docs.docker.com/datacenter/ucp/2.2/guides/admin/configure/use-domain-names-to-access-services/) or [Træfik](https://github.com/containous/traefik). You can also [create another cluster](administering-swarms.md#create-swarms).
|
|
|
|
### Accessing a service with the service load balancer
|
|
|
|
1. Connect to your Docker EE for IBM Cloud swarm. Navigate to the directory where you [downloaded the UCP credentials](administering-swarms.md#download-client-certificates) and run the script. For example:
|
|
|
|
```bash
|
|
$ cd filepath/to/certificate/repo && source env.sh
|
|
```
|
|
|
|
2. Create the service specifying the port on which you want the service exposed. For example:
|
|
|
|
```bash
|
|
$ docker service create --name go-demo \
|
|
-e DB=go-demo-db \
|
|
--network go-demo \
|
|
--publish 8080:8080 \
|
|
vfarcic/go-demo
|
|
```
|
|
|
|
3. Get the name of the cluster, and then use it to get the service load balancer URL:
|
|
|
|
```bash
|
|
$ bx d4ic list --sl-user user.name.1234567 --sl-api-key api_key
|
|
$ bx d4ic show --swarm-name my_swarm --sl-user user.name.1234567 --sl-api-key api_key
|
|
```
|
|
|
|
4. To access a service that you have previously exposed on a port, use the `service-lb-url` that you retrieved. For example:
|
|
|
|
```bash
|
|
$ curl https://service-lb-url:8080/demo/hello
|
|
```
|
|
|
|
### Services with SSL certificates
|
|
Use [IBM Cloud infrastructure SSL Certificates](https://knowledgelayer.softlayer.com/topic/ssl-certificates) to authenticate and encrypt online transactions that are transmitted through your cluster's load balancer.
|
|
|
|
When you create a certificate for your domain, specify the **Common Name**. When you create the Docker service, include the certificate common name to use the certificate for SSL termination for your service.
|
|
|
|
Before you begin:
|
|
|
|
1. Log in to [IBM Cloud infrastructure](https://control.softlayer.com/).
|
|
|
|
2. [Add or an import an SSL certificate](https://knowledgelayer.softlayer.com/topic/ssl-certificates) to use. In your infrastructure account, you can access the page from **Security** > **SSL** > **Certificates**.
|
|
|
|
3. Note the certificate **Common Name**.
|
|
|
|
**Start a service that uses SSL termination**: Start a service that listens on ports `80` and `443`. The service load balancer provides SSL termination on port `443` that uses your SSL certificate's common name, `com.ibm.d4ic.lb.cert=certificate-common-name`, when you create the service.
|
|
|
|
In the label, append `@HTTPS:port` to list the ports you want to expose.
|
|
|
|
For example:
|
|
|
|
```bash
|
|
$ docker service create --name name \
|
|
...
|
|
--label com.ibm.d4ic.lb.cert=certificate-common-name@HTTPS:443
|
|
...
|
|
```
|
|
|
|
To specify other or multiple ports, append them as follows:
|
|
|
|
* Links HTTPS to port 444: `--label com.ibm.d4ic.lb.cert=certificate-common-name@HTTPS:444`
|
|
* Links HTTPS to ports 444 and 8080: `--label com.ibm.d4ic.lb.cert=certificate-common-name@HTTPS:444,HTTPS:8080`
|
|
|
|
**Set a health check path**: By default, the service load balancer sets a health check path to `/`. If the service cannot respond with a 200 message to a `GET` request on the `/` path, then include a health monitor path label when you create the service. For example:
|
|
|
|
```bash
|
|
--label com.ibm.d4ic.healthcheck.path=/demo/hello@443
|
|
```
|
|
|
|
When the route is published, the health check is set to the path that you specify in the label. Choose a path that can respond with a 200 message to a `GET` request.
|
|
|
|
**Example command**: The following `docker service create` command expands on the example from the [previous section](#access-a-service-with-the-service-load-balancer) to create a demo service that is exposed on a different port than the default and includes a health check path. It is based on the `vfarcic/go-demo` image.
|
|
|
|
```bash
|
|
$ docker service create --name go-demo \
|
|
-e DB=go-demo-db \
|
|
--network go-demo \
|
|
--publish 8080:8080 \
|
|
--replicas 3 \
|
|
--label com.ibm.d4ic.lb.cert=certificate-common-name@HTTPS:8080 \
|
|
--label com.ibm.d4ic.healthcheck.path=/demo/hello@8080 \
|
|
vfarcic/go-demo
|
|
```
|