CODEWITHSUNDEEP
mesosmarathonmesosphere
Peter Becich
Peter Becich

Reputation: 1053

Private networking necessary for Mesos and Marathon?

I am working through this tutorial: http://mesosphere.io/docs/getting-started/cloud-install/

Just learning on an Ubuntu instance on Digital Ocean, I let the master process bind to the public IP, and the Mesos and Marathon web interfaces became publicly accessible. No surprises there.

Do Mesos and Marathon rely on Zookeeper to create private IPs between instances? Could you skip using Zookeeper by manually setting up a private network between instances? Then the proper way to start the master and slave processes is to bind to the secondary, private IPs of each instance?

Digital Ocean can set up private IPs automatically, but this is kind of a learning exercise for me. I am aware of the broad rule that administrator access to a server shouldn't come through a public IP. Another way of phrasing this posting is, does private networking provide the security for Mesos and Marathon?

Only starting with one Ubuntu instance, running both master and slave, for now. Binding to the loopback address would fix this issue for just one machine, I realize.

Upvotes: 3

Views: 1945

Answers (2)

Dimitri Kopriwa
Dimitri Kopriwa

Reputation: 14363

Mesos and marathon doesn't create private IPs between instance. For that, I suggest you use tinc or directly a docker image tinc

Using this, I was able to do the config you want in 5 minutes, it's easier to configure than openvpn, and each host can connect to another, no need to use a vpn server to route all the traffic.

Each node will store a private and public for connecting to each server of the private network.

You should setup a private network for using mesos.

After that, you can add in /etc/hosts all the hosts with the IP of the internal network.

You will be able to bind zookeeper using the private network :

zk://master-1:2181,master-2:2181,master-3:2181

Then the proper way to start the master and slave processes is to bind to the secondary private IPs of each instance.

Upvotes: 0

ssk2
ssk2

Reputation: 188

ZooKeeper is used for a few different things for both Marathon and Mesos:

  1. Leader election
  2. Storing state
  3. Resolving the Mesos masters

At the moment, you can't skip ZooKeeper entirely because of 2 and 3 (although later versions of Mesos have their own registry which keeps track of state). AFAIK, Mesos doesn't rely on ZooKeeper for creation of private IPs - it'll bind to whatever is available (but you can force this via the ip parameter). So, you won't be able to forgo ZooKeeper entirely with a private network.

Private networking will provide some security for Mesos and Marathon - assuming you firewall off their access to the external world.

A good (although not necessarily the best) solution for keeping the instances on a private network is to set up an OpenVPN (or similar) network to one of the masters. Then, launch each instance on its private IP and make you also set the hostname parameter to that IP. Connect to the Mesos/Marathon web consoles via their private IP and the VPN and all should resolve correctly.

Upvotes: 3

Related Questions