In this example, there are 3 servers with Docker installed on it. If docker is not installed, you can see the installation here.
There will be one manager and two workers:
Master – manager (IP: 1.1.1.1)
Slave_1 – worker (IP: 1.1.2.1)
Slave_2 – worker (IP: 1.1.2.2)
Required ports for Docker Swarm to work: 2376 and 2377 (TCP). Make sure that the swarm participants are allowed to interact.
Creating Docker Swarm
On the Master server, do the following:
docker swarm init --advertise-addr 1.1.1.1
We get a message like:
Swarm initialized: current node (ssmj2qyqxejd72p6sa9jinnza) is now a manager. To add a worker to this swarm, run the following command: docker swarm join \ --token SWMTKN-1-3qg9vovt2mxyfu1dfj2nocmkzd3i351z1z0aapd9jxxu7mafff-93r77xv8mrqsgfkf9nei902zk \ 1.1.1.1:2377 To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
Swarm is created and there is one manager in it. Information on the swarm can be viewed with the command:
docker info
Add workers to the swarm, for this we will execute the command that we received earlier when creating the swarm on the Master server on the Slave_1 and Slave_2 servers:
docker swarm join \ --token SWMTKN-1-3qg9vovt2mxyfu1dfj2nocmkzd3i351z1z0aapd9jxxu7mafff-93r77xv8mrqsgfkf9nei902zk \ 1.1.1.1:2377
If everything is ok, it will display the following message:
This node joined a swarm as a worker.
On the swarm manager (Master server), you can see a list of all the nodes in the swarm:
docker node ls
That’s it, Docker Swarm is up, now it remains to add the certificates.
Certificate generation
We return to the Master server.
Create a folder for storing certificates and generate a private CA key:
openssl genrsa -aes256 -out ca-key.pem 4096
Enter pass phrase, this is a required parameter.
Now generate the public CA key:
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
Here we need to enter the FQDN of the Master server
Create a private key for the server:
openssl genrsa -out server-key.pem 4096
We create a request for signing an SSL certificate:
openssl req -subj "/CN=SERVER_MASTER_FQDN" -sha256 -new -key server-key.pem -out server.csr
Where SERVER_MASTER_FQDN is the FQDN of the Master server
For access not only through the domain name, IP addresses can be listed as follows:
echo subjectAltName = DNS:SERVER_MASTER_FQDN,IP:1.1.1.1,IP:127.0.0.1 >> extfile.cnf
Create a signed key for the server:
openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem \ -CAcreateserial -out server-cert.pem -extfile extfile.cnf
Create a client key to access the docker:
openssl genrsa -out key.pem 4096
We will create a request for signature and additionally indicate the type of key use – for authorization:
openssl req -subj '/CN=client' -new -key key.pem -out client.csr echo extendedKeyUsage = clientAuth >> extfile.cnf
Get the signed client key:
openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile.cnf
Delete request files:
rm -v client.csr server.csr
We set the necessary rights to files:
chmod -v 0400 ca-key.pem key.pem server-key.pem chmod -v 0444 ca.pem server-cert.pem cert.pem
Verify startup with TLS. If the docker service is running, then it should be stopped:
dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem \ -H=0.0.0.0:2376
If everything is successful, then you can specify the TLS options in the docker configuration file, as shown here.
Setting workers
Create a directory for certificates:
mkdir /etc/docker/certs
Copy files from the Master server to this directory:
ca.pem cert.pem key.pem
Also, change the docker daemon, following the example of the server, just note that cert and key are different for client and server. “server-cert.pem” and “cert.pem“, “server-key.pem” and “key.pem”
After restarting the docker daemon, you can run it on the worker:
docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=1.1.1.1:2376 version
If everything is correct, the version of the worker docker and the version of the server docker will be displayed.
That’s it, now we have Docker Swarm, which interacts with each other using TLS. Correctly, for each node in the swarm, you need to write out your keys and certificates.