Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a2c4e69

Browse files
joaofnfernandesjoaofnfernandes
authored
Merge pull request docker#855 from joaofnfernandes/792-where-run-commands
Make clear where to run DDC commands
2 parents 204051f + 0ffee96 commit a2c4e69

File tree

14 files changed

+154
-150
lines changed

14 files changed

+154
-150
lines changed

‎datacenter/dtr/2.1/guides/high-availability/backups-and-disaster-recovery.md‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,7 @@ backup command to learn about all the available flags.
5656

5757
As an example, to create a backup of a DTR node, you can use:
5858

59-
```bash
60-
# Create the backup
59+
```none
6160
$ docker run -i --rm docker/dtr backup \
6261
--ucp-url <ucp-url> \
6362
--ucp-insecure-tls \
@@ -76,7 +75,7 @@ Where:
7675
To validate that the backup was correctly performed, you can print the contents
7776
of the tar file created:
7877

79-
```bash
78+
```none
8079
$ tar -tf /tmp/backup.tar
8180
```
8281

@@ -105,7 +104,7 @@ backup command to learn about all the available flags.
105104
As an example, to install DTR on the host and restore its
106105
state from an existing backup:
107106

108-
```bash
107+
```none
109108
# Install and restore configurations from an existing backup
110109
$ docker run -i --rm \
111110
docker/dtr restore \

‎datacenter/dtr/2.1/guides/install/scale-your-deployment.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ you're going to install these replicas also need to be managed by UCP.
2020

2121
To add replicas to an existing DTR deployment:
2222

23-
1. Load your UCP user bundle.
23+
1. Use ssh to log into a node that is already part of UCP.
2424

25-
2. Run the join command.
25+
2. Run the DTR join command:
2626

2727
```none
2828
docker run -it --rm \
@@ -39,7 +39,10 @@ To add replicas to an existing DTR deployment:
3939
4040
## Remove existing replicas
4141
42-
To remove a DTR replica from a deployment, run:
42+
To remove a DTR replica from your deployment:
43+
44+
1. Use ssh to log into a node that is already part of UCP.
45+
2. Run the DTR remove command:
4346
4447
```none
4548
docker run -it --rm \

‎datacenter/install/linux.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Also make sure the hosts are running one of these operating systems:
3333
Install the commercially supported Docker Engine on all hosts you want to manage
3434
with Docker Datacenter.
3535

36-
Log in into each node using ssh, and install CS Docker Engine:
36+
Log in into each host using ssh, and install CS Docker Engine:
3737

3838
```bash
3939
curl -SLf https://packages.docker.com/1.12/install.sh | sh
@@ -59,6 +59,8 @@ docker run --rm -it --name ucp \
5959
This runs the install command in interactive mode, so that you're prompted
6060
for any necessary configuration values.
6161

62+
[Learn more about the UCP installation](../ucp/2.9/guides/installation/index.md)
63+
6264
### Step 4: License your installation
6365

6466
Now that UCP is installed, you need to license it. In your browser, navigate
@@ -110,7 +112,5 @@ by UCP.
110112

111113
## Where to go next
112114

113-
* [Create and manage users](../ucp/2.0/guides/user-management/create-and-manage-users.md)
114115
* [Deploy an application](../ucp/2.0/guides/applications/index.md)
115-
* [Push an image to DTR](../dtr/2.1/guides/repos-and-images/push-an-image.md)
116-
* [Considerations for a High Availability Deployment](../ucp/2.0/guides/high-availability/index.md)
116+
* [Considerations for high availability](../ucp/2.0/guides/high-availability/index.md)

‎datacenter/ucp/2.0/guides/access-ucp/cli-based-access.md‎

Lines changed: 22 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ For this reason, when running docker commands on a UCP node, you need to
1111
authenticate your request using client certificates. When trying to run docker
1212
commands without a valid certificate, you get an authentication error:
1313

14-
```markdown
14+
```none
1515
$ docker ps
1616
17-
An error occurred trying to connect: Get https://ucp:443/v1.22/containers/json: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" when trying to verify candidate authority certificate "UCP Client Root CA")
17+
x509: certificate signed by unknown authority
1818
```
1919

2020
There are two different types of client certificates:
@@ -26,8 +26,8 @@ controller node.
2626

2727
## Download client certificates
2828

29-
To download a client certificate bundle, **log into UCP**, and navigate to your
30-
**profile page**.
29+
To download a client certificate bundle, log into the **UCP web UI**, and
30+
navigate to your user **profile page**.
3131

3232
![](../images/cli-based-access-1.png)
3333

@@ -36,66 +36,52 @@ Click the **Create a Client Bundle** button, to download the certificate bundle.
3636

3737
## Use client certificates
3838

39-
Once you've downloaded a client certificate bundle, you can use it to
40-
authenticate your requests.
39+
Once you've downloaded a client certificate bundle to your local computer, you
40+
can use it to authenticate your requests.
4141

42-
Navigate to the directory where you downloaded the bundle, and unzip it. Then
43-
run the `env.sh` script to start using the client certificates.
42+
Navigate to the directory where you downloaded the user bundle, and unzip it.
43+
Then source the `env.sh` script.
4444

45-
```bash
45+
```none
4646
$ unzip ucp-bundle-dave.lauper.zip
4747
$ cd ucp-bundle-dave.lauper
4848
$ eval $(<env.sh)
4949
```
5050

51-
The env.sh script updates the `DOCKER_HOST` and `DOCKER_CERT_PATH`
52-
environment variables to use the certificates you downloaded.
51+
The `env.sh` script updates the `DOCKER_HOST` environment variable to make your
52+
local Docker CLI communicate with UCP. It also updates the `DOCKER_CERT_PATH`
53+
environment variables to use the client certificates that are included in the
54+
client bundle you downloaded.
5355

5456
From now on, when you use the Docker CLI client, it includes your client
55-
certificates as part of the request to the Docker Engine. You can now use the
56-
`docker info` command to see if the certificates are being sent to the Docker
57-
Engine.
58-
59-
```markdown
60-
$ docker info
61-
62-
Containers: 11
63-
Nodes: 2
64-
ucp: 192.168.99.100:12376
65-
└ Status: Healthy
66-
ucp-node: 192.168.99.101:12376
67-
└ Status: Healthy
68-
Cluster Managers: 1
69-
192.168.99.104: Healthy
70-
└ Orca Controller: https://192.168.99.100:443
71-
└ Swarm Manager: tcp://192.168.99.100:3376
72-
└ KV: etcd://192.168.99.100:12379
73-
```
74-
57+
certificates as part of the request to the Docker Engine.
58+
You can now use the Docker CLI to create services, networks, volumes and other
59+
resources on a swarm managed by UCP.
7560

7661
## Download client certificates using the REST API
7762

78-
You can also download client certificate bundles using the UCP REST API. In
63+
You can also download client bundles using the UCP REST API. In
7964
this example we'll be using `curl` for making the web requests to the API, and
8065
`jq` to parse the responses.
8166

82-
To install these tools on an Ubuntu distribution, you can run:
67+
To install these tools on a Ubuntu distribution, you can run:
8368

84-
```bash
69+
```none
8570
$ sudo apt-get update && apt-get install curl jq
8671
```
8772

8873
Then you get an authentication token from UCP, and use it to download the
8974
client certificates.
9075

91-
```bash
76+
```none
9277
# Create an environment variable with the user security token
9378
$ AUTHTOKEN=$(curl -sk -d '{"username":"<username>","password":"<password>"}' https://<ucp-ip>/auth/login | jq -r .auth_token)
79+
9480
# Download the client certificate bundle
9581
$ curl -k -H "Authorization: Bearer $AUTHTOKEN" https://<ucp-ip>/api/clientbundle -o bundle.zip
9682
```
9783

9884
## Where to go next
9985

100-
* [Deploy an app from the UI](../applications/index.md)
86+
* [Access the UCP web UI](index.md)
10187
* [Deploy an app from the CLI](../applications/deploy-app-cli.md)

‎datacenter/ucp/2.0/guides/access-ucp/index.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,7 @@ browser, Administrators can:
2121

2222
Non-admin users can only see and change the images, networks, volumes, and
2323
containers, they are granted access.
24+
25+
# Where to go next
26+
27+
* [Access UCP from the CLI](cli-based-access.md)

‎datacenter/ucp/2.0/guides/applications/deploy-app-cli.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ application.
1313

1414
Docker UCP secures your Docker swarm with role-based access control, so that only
1515
authorized users can deploy applications. To be able to run
16-
Docker commands on a swarm managed by UCP, you need to authenticate your
17-
requests using client certificates.
16+
Docker commands on a swarm managed by UCP, you need to configure your Docker CLI
17+
client to authenticate to UCP using client certificates.
1818

1919
[Learn how to set your CLI to use client certificates](../access-ucp/cli-based-access.md).
2020

@@ -25,7 +25,7 @@ The WordPress application we're going to deploy is composed of two services:
2525
* wordpress: The service that runs Apache, PHP, and WordPress.
2626
* db: A MariaDB database used for data persistence.
2727

28-
After setting up your terminal to authenticate using client certificates,
28+
After setting up your Docker CLI client to authenticate using client certificates,
2929
create a file named `docker-compose.yml` with the following service definition:
3030

3131
```none
@@ -58,14 +58,14 @@ volumes:
5858
```
5959

6060
In your command line, navigate to the place where you've created the
61-
`docker-compose.yml` file and run:
61+
`docker-compose.yml` file and deploy the application to UCP by running:
6262

6363
```bash
6464
$ docker-compose --project-name wordpress up -d
6565
```
6666

67-
Test that the WordPress service is up and running, and find where you can
68-
reach it.
67+
Test that the WordPress service is up and running, and find on which node it
68+
was deployed.
6969

7070
```bash
7171
$ docker-compose --project-name wordpress ps
@@ -76,7 +76,7 @@ wordpress_db_1 docker-entrypoint.sh mysqld Up 3306/tcp
7676
wordpress_wordpress_1 docker-entrypoint.sh apach ... Up 172.31.18.153:8000->80/tcp
7777
```
7878

79-
In this example, WordPress can be accessed at 172.31.18.153:8000. Navigate to
79+
In this example, WordPress was deployed to 172.31.18.153:8000. Navigate to
8080
this address in your browser, to start using the WordPress app you just
8181
deployed.
8282

‎datacenter/ucp/2.0/guides/applications/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ WordPress application.
1111

1212
## Deploy WordPress
1313

14-
On your browser, **log in** to UCP, and navigate to the **Applications** page.
14+
In your browser, **log in** to UCP, and navigate to the **Applications** page.
1515
There, click the **Deploy compose.yml** button, to deploy a new application.
1616

1717
![](../images/deploy-app-ui-1.png)

‎datacenter/ucp/2.0/guides/configuration/index.md‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,39 +5,49 @@ keywords: Universal Control Plane, UCP, certificate, authentiation, tls
55
title: Use externally-signed certificates
66
---
77

8-
By default the UCP web UI is exposed using HTTPS, to ensure all
9-
communications between clients and UCP are encrypted. Since UCP
10-
controllers use self-signed certificates for this, when a client accesses
11-
UCP their browsers won't trust this certificate, so the browser displays a
12-
warning message.
8+
All UCP services are exposed using HTTPS, to ensure all communications between
9+
clients and UCP are encrypted. By default this is done using self-signed TLS
10+
certificates that are not trusted by client tools like web browsers. So when
11+
you try to access UCP, your browser will warn that it doesn't trust UCP or that
12+
UCP has an invalid certificate.
1313

14-
You can configure UCP to use your own certificates, so that it is automatically
15-
trusted by your users' browser and client tools.
14+
![invalid certificate](../images/use-externally-signed-certs-1.png)
15+
16+
The same happens with other client tools.
17+
18+
```none
19+
$ curl https://ucp.example.org
20+
21+
SSL certificate problem: Invalid certificate chain
22+
```
23+
24+
You can configure UCP to use your own TLS certificates, so that it is
25+
automatically trusted by your browser and client tools.
1626

1727
To ensure minimal impact to your business, you should plan for this change to
18-
happen outside business peak hours. Your applications will continue
19-
running normally, but UCP will be unresponsive while the controller containers
20-
are restarted.
28+
happen outside business peak hours. Your applications will continue running
29+
normally, but existing UCP client certificates will become invalid, so users
30+
will have to download new ones to [access UCP from the CLI](../access-ucp/cli-based-access.md).
2131

22-
## Replace the server certificates
32+
## Customize the UCP TLS certificates
2333

24-
To configure UCP to use your own certificates and keys, go to the
34+
To configure UCP to use your own TLS certificates and keys, go to the
2535
**UCP web UI**, navigate to the **Admin Settings** page,
2636
and click **Certificates**.
2737

28-
![](../images/use-externally-signed-certs-1.png)
38+
![](../images/use-externally-signed-certs-2.png)
2939

3040
Upload your certificates and keys:
3141

3242
* A ca.pem file with the root CA public certificate.
33-
* A cert.pem file with the server certificate and any intermediate CA public
43+
* A cert.pem file with the TLS certificate and any intermediate CA public
3444
certificates. This certificate should also have SANs for all addresses used to
35-
reach the UCP controller, including load balancers.
36-
* A key.pem file with server private key.
45+
access UCP, including load balancers.
46+
* A key.pem file with TLS private key.
3747

3848
Finally, click **Update** for the changes to take effect.
3949

40-
After replacing the certificates your users won't be able to authenticate
50+
After replacing the TLS certificates your users won't be able to authenticate
4151
with their old client certificate bundles. Ask your users to go to the UCP
4252
web UI and [get new client certificate bundles](../access-ucp/cli-based-access.md).
4353

0 commit comments

Comments
 (0)