CNI Applications Aren't Allocated ServicePort

[ozdanborne]

In order to map a marathon task to a service entry in Marathon-LB, it must be allocated a servicePort by Marathon. I have noticed that Marathon is only allocating servicePorts to Docker Containerizer tasks. It is not allocating servicePorts to Unified Containerizer tasks.

As a base case, the the following sample app.json launches a docker containerizer task, which is correctly given a servicePort:

{
  "id": "docker-task",
  "container": {
    "type": "DOCKER",
    "docker": {
      "image": "nginx",
      "network": "USER",
      "portMappings": [{"containerPort": 80}]
    }
  },
  "ipAddress": {
      "networkName": "dcos"
  }
}

I see the task's assigned servicePort in its marathon information:

[vagrant@a1 ~]$ curl m1.dcos:8080/v2/apps/docker-task
{"app":{"id":"/docker-task","cmd":null,"args":null,"user":null,"env":{},"instances":1,"cpus":1,"mem":128,"disk":0,"gpus":0,"executor":"","constraints":[],"uris":[],"fetch":[],"storeUrls":[],"backoffSeconds":1,"backoffFactor":1.15,"maxLaunchDelaySeconds":3600,"container":{"type":"DOCKER","volumes":[],"docker":{"image":"nginx","network":"USER","portMappings":[{"containerPort":80,"servicePort":10101,"protocol":"tcp","labels":{}}],"privileged":false,"parameters":[],"forcePullImage":false}},"healthChecks":[],"readinessChecks":[],"dependencies":[],"upgradeStrategy":{"minimumHealthCapacity":1,"maximumOverCapacity":1},"labels":{},"acceptedResourceRoles":null,"ipAddress":{"groups":[],"labels":{},"discovery":{"ports":[]},"networkName":"dcos"},"version":"2016-10-04T21:10:23.736Z","residency":null,"secrets":{},"taskKillGracePeriodSeconds":null,"versionInfo":{"lastScalingAt":"2016-10-04T21:10:23.736Z","lastConfigChangeAt":"2016-10-04T21:10:23.736Z"},"tasksStaged":0,"tasksRunning":1,"tasksHealthy":0,"tasksUnhealthy":0,"deployments":[],"tasks":[{"id":"docker-task.f74113c8-8a76-11e6-8a4d-70b3d5800001","slaveId":"f4a920f7-29dd-411c-8181-d77d7d92fb0f-S3","host":"192.168.65.111","state":"TASK_RUNNING","startedAt":"2016-10-04T21:10:25.181Z","stagedAt":"2016-10-04T21:10:24.041Z","ports":[],"version":"2016-10-04T21:10:23.736Z","ipAddresses":[{"ipAddress":"9.0.1.130","protocol":"IPv4"}],"appId":"/docker-task"}]}}

When the above application is launched with the necessary HAPROXY_* labels, it works as expected with Marathon-LB.

However, the following similar Unified Containerizer task is not assigned a servicePort:

{
  "id": "unified-task",
  "container": {
    "type": "MESOS",
    "docker": {
      "image": "nginx",
      "portMappings": [{"containerPort": 80}]
    }
  },
  "ipAddress": {
      "networkName": "dcos"
  }
}

No servicePort is assigned:

[vagrant@a1 ~]$ curl m1.dcos:8080/v2/apps/unified-task
{"app":{"id":"/unified-task","cmd":null,"args":null,"user":null,"env":{},"instances":1,"cpus":1,"mem":128,"disk":0,"gpus":0,"executor":"","constraints":[],"uris":[],"fetch":[],"storeUrls":[],"backoffSeconds":1,"backoffFactor":1.15,"maxLaunchDelaySeconds":3600,"container":{"type":"MESOS","volumes":[],"docker":{"image":"nginx","credential":null,"forcePullImage":false}},"healthChecks":[],"readinessChecks":[],"dependencies":[],"upgradeStrategy":{"minimumHealthCapacity":1,"maximumOverCapacity":1},"labels":{},"acceptedResourceRoles":null,"ipAddress":{"groups":[],"labels":{},"discovery":{"ports":[]},"networkName":"dcos"},"version":"2016-10-04T21:13:48.557Z","residency":null,"secrets":{},"taskKillGracePeriodSeconds":null,"versionInfo":{"lastScalingAt":"2016-10-04T21:13:48.557Z","lastConfigChangeAt":"2016-10-04T21:13:48.557Z"},"tasksStaged":0,"tasksRunning":1,"tasksHealthy":0,"tasksUnhealthy":0,"deployments":[],"tasks":[{"id":"unified-task.714cab29-8a77-11e6-8a4d-70b3d5800001","slaveId":"f4a920f7-29dd-411c-8181-d77d7d92fb0f-S3","host":"192.168.65.111","state":"TASK_RUNNING","startedAt":"2016-10-04T21:13:51.107Z","stagedAt":"2016-10-04T21:13:48.806Z","ports":[],"version":"2016-10-04T21:13:48.557Z","ipAddresses":[{"ipAddress":"9.0.1.2","protocol":"IPv4"}],"appId":"/unified-task"}]}}

When the above application is launched with the necessary HAPROXY_* labels, it is not mapped to a service in Marathon-LB (since it does not have a servicePort to assign it to.)

cc: @jdef

[nfnt]

The current Unified Containerizer support in Marathon does not support port mappings. Only host networking is possible at the moment.

[akamalov]

@jdef, do we have an ETA when this problem will be solved ? What Marathon ver will the bug fix go under ?

Thanks again.

[akamalov]

@jdef, docker containerizer

[jdef]

bumping the milestone on this. should land in master sooner than later, but won't make the cutoff for marathon 1.4 :(

[marcomonaco]

#4972

[meichstedt]

Note: This issue has been migrated to https://jira.mesosphere.com/browse/MARATHON-1687. For more information see https://groups.google.com/forum/#!topic/marathon-framework/khtvf-ifnp8.