Forem: erozedguy

Install & Manage Amazon EKS Add-ons with Terraform

erozedguy — Sun, 30 Jan 2022 22:47:09 +0000

What is an Add-on in Amazon EKS ?

An add-on is software that provides supporting operational capabilities to Kubernetes applications, but is not specific to the application.
This includes software like observability agents or Kubernetes drivers that allow the cluster to interact with underlying AWS resources for networking, compute, and storage.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html

Amazon EKS Add-ons

Amazon VPC CNI
The Amazon VPC CNI add-on for Kubernetes is the networking plugin for pod networking in Amazon EKS clusters. The plugin is responsible for allocating VPC IP addresses to Kubernetes nodes and configuring the necessary networking for pods on each node.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html

CoreDNS
CoreDNS is a flexible, extensible DNS server that can serve as the Kubernetes cluster DNS. When you launch an Amazon EKS cluster with at least one node, two replicas of the CoreDNS image are deployed by default, regardless of the number of nodes deployed in your cluster. The CoreDNS pods provide name resolution for all pods in the cluster.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html

kube-proxy
Kube-proxy maintains network rules on each Amazon EC2 node. It enables network communication to your pods.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/managing-kube-proxy.html

Amazon EBS CSI
The Amazon Elastic Block Store (Amazon EBS) Container Storage Interface (CSI) driver allows Amazon Elastic Kubernetes Service (Amazon EKS) clusters to manage the lifecycle of Amazon EBS volumes for persistent volumes.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.html
https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html

Amazon EKS automatically installs self-managed add-ons such as the Amazon VPC CNI, kube-proxy, and CoreDNS for every cluster, but you can change the default configuration of the add-ons and update them when desired.

Amazon EBS CSI Driver is now available as an Add-on. This Add-on is in preview version with some limitations and inconsistencies. For this reason, its use in Production is not recommended.

This post will show the step by step how to install the Add-ons with terraform

Prerequisites

Amazon EKS cluster running Kubernetes version 1.18 and later

To create an EKS cluster you can check this post https://dev.to/aws-builders/creating-an-eks-cluster-and-node-group-with-terraform-1lf6

AWS CLI installed

https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html

An IAM role with the AmazonEKS_CNI_Policy attached to it

STEPS

Step 01 - Get the version of each Add-on

To know the all version of each Add-on we can use AWS CLI to describe all information about the Add-ons



aws eks describe-addon-versions > addons.json

This command allows to describe all add-on versions and for more confort we can save the output in a JSON file

The resulting JSON file will be like this



{
    "addons": [
        {
            "addonName": "kube-proxy",
            "type": "networking",
            "addonVersions": [
                {
                    "addonVersion": "v1.21.2-eksbuild.2",
                    "architecture": [
                        "amd64",
                        "arm64"
                    ],
                    "compatibilities": [
                        {
                            "clusterVersion": "1.21",
                            "platformVersions": [
                                "*"
                            ],
                            "defaultVersion": true
                        }
                    ]
                },
...

This JSON file contains all information about the EKS cluster Add-ons, like name, type, compatibilities, etc.

Take a note of each add-on version to specify them in the terraform code, according to the cluster version

Step 02 - Create the terraform code

First, We can create a variable of the type list(object()) to specify all names and versions of each Add-ons, based on the information that we get from the JSON file obtained in the last step



variable "addons" {
  type = list(object({
    name    = string
    version = string
  }))

  default = [
    {
      name    = "kube-proxy"
      version = "v1.21.2-eksbuild.2"
    },
    {
      name    = "vpc-cni"
      version = "v1.10.1-eksbuild.1"
    },
    {
      name    = "coredns"
      version = "v1.8.4-eksbuild.1"
    },
    {
      name    = "aws-ebs-csi-driver"
      version = "v1.4.0-eksbuild.preview"
    }
  ]
}

The AWS Provider for Terraform has a specific resource to install and manage the Add-ons.

Using a for_each statement we can iterate all information in the addons variable



resource "aws_eks_addon" "addons" {
  for_each          = { for addon in var.addons : addon.name => addon }
  cluster_name      = aws_eks_cluster.eks-cluster.id
  addon_name        = each.value.name
  addon_version     = each.value.version
  resolve_conflicts = "OVERWRITE"
}

Step 03 - Apply the terraform code

To apply the new resource we can use



terraform apply -auto-approve

Once the installation is finished, we can check the add-ons using the UI

The installation was successful so we can see the Status of each Add-on is Active

Another way to check that everything is can be using kubectl



kubectl get po -n kube-system

With this command we can check if the pods of each Add-on are running

Creating an EKS Cluster and Node Group with Terraform

erozedguy — Sat, 15 Jan 2022 16:41:23 +0000

DESCRIPTION

In this post I'm gonna explain how to deploy an EKS Cluster and EC2 node group using Terraform for the purpose
The Architecture consists of a VPC with 2 public subnets and 2 private subnets in different Availability Zones. Each public subnet contains a nat gateway that allows private subnets to access the Internet.
The EKS nodes will be create in the private subnets. The nodes are EC2 t3-micro instances managed by EKS

About EKS: https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html

ARCHITECTURE

CODE

GITHUB repository: https://github.com/erozedguy/Terraform-EKS-Cluster-with-Node-Group

DEVELOPMENT

STEP 01 - Provide Networking part

I'm using my own terraform module to create the vpc, subnets, internet gateway, nat gateways etc

AWS_VPC module: https://github.com/erozedguy/AWS-VPC-terraform-module

Module's usage



module "aws_vpc" {
  source          = "github.com/erozedguy/AWS-VPC-terraform-module.git"
  networking      = var.networking
  security_groups = var.security_groups
}

Variables for the module



variable "networking" {
  type = object({
   cidr_block       = string
   vpc_name         = string
   azs              = list(string)
   public_subnets   = list(string)
   private_subnets  = list(string)
   nat_gateways     = bool
  })
  default = {
   cidr_block       = "10.0.0.0/16"
   vpc_name         = "terraform-vpc"
   azs              = ["us-east-1a", "us-east-1b"]
   public_subnets   = ["10.0.1.0/24", "10.0.2.0/24"]
   private_subnets  = ["10.0.3.0/24", "10.0.4.0/24"]
   nat_gateways     = true
  }
}

variable "security_groups" {
  type = list(object({
    name        = string
    description = string
    ingress = object({
      description      = string
      protocol         = string
      from_port        = number
      to_port          = number
      cidr_blocks      = list(string)
      ipv6_cidr_blocks = list(string)
    })
  }))

  default = [{
    name        = "ssh"
    description = "Port 22"
    ingress = {
      description      = "Allow SSH access"
      protocol         = "tcp"
      from_port        = 22
      to_port          = 22
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = null
    }
  }]
}

STEP 03 - IAM ROLES

EKS Cluster Role

Kubernetes clusters managed by Amazon EKS make calls to other AWS services on your behalf to manage the resources that you use with the service. That's why I create this role

References: https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html



resource "aws_iam_role" "EKSClusterRole" {
  name = "EKSClusterRole"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "eks.amazonaws.com"
        }
      },
    ]
  })
}

NODE GROUP ROLE

The Amazon EKS node kubelet daemon makes calls to AWS APIs on your behalf. Nodes receive permissions for these API calls through an IAM instance profile and associated policies. Before you can launch nodes and register them into a cluster, you must create an IAM role for those nodes to use when they are launched.

References: https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html



resource "aws_iam_role" "NodeGroupRole" {
  name = "EKSNodeGroupRole"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      },
    ]
  })
}

ATTACH MANAGED IAM POLICIES TO IAM ROLES

This policy provides Kubernetes the permissions it requires to manage resources on your behalf. Kubernetes requires Ec2:CreateTags permissions to place identifying information on EC2 resources including but not limited to Instances, Security Groups, and Elastic Network Interfaces.



resource "aws_iam_role_policy_attachment" "AmazonEKSClusterPolicy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.EKSClusterRole.name
}

This policy allows Amazon EKS worker nodes to connect to Amazon EKS Clusters.



resource "aws_iam_role_policy_attachment" "AmazonEKSWorkerNodePolicy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
  role       = aws_iam_role.NodeGroupRole.name
}

Provides read-only access to Amazon EC2 Container Registry repositories.



resource "aws_iam_role_policy_attachment" "AmazonEC2ContainerRegistryReadOnly" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
  role       = aws_iam_role.NodeGroupRole.name
}

This policy provides the Amazon VPC CNI Plugin (amazon-vpc-cni-k8s) the permissions it requires to modify the IP address configuration on your EKS worker nodes. This permission set allows the CNI to list, describe, and modify Elastic Network Interfaces on your behalf



resource "aws_iam_role_policy_attachment" "AmazonEKS_CNI_Policy" {

  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"

  role       = aws_iam_role.NodeGroupRole.name

}

STEP 04 - Create EKS Cluster

You must to set up the arn of the IAM cluster role, kubernetes version and vpc configuration



resource "aws_eks_cluster" "eks-cluster" {

  name     = "eks-cluster"

  role_arn = aws_iam_role.EKSClusterRole.arn

  version  = "1.21"

vpc_config {

    subnet_ids          = flatten([ module.aws_vpc.public_subnets_id, module.aws_vpc.private_subnets_id ])

    security_group_ids  = flatten(module.aws_vpc.security_groups_id)

  }

depends_on = [

    aws_iam_role_policy_attachment.AmazonEKSClusterPolicy

  ]

}

NODE GROUP

To create and run PODS we need a infrastructure. We can select between EC2 instances (worker nodes) or FARGATE.
For this implementation I'm gonna provide EC2 "t3-micro" instances as worker nodes to run the PODS
For an isolated infrastructure and more security, the best practice is to create your worker nodes in private subnets.
We must provide the required information about the AMI, intance type, capacity type, disk size to create the worker nodes and also scaling configuration to specify the desired, max and min size of worker nodes



resource "aws_eks_node_group" "node-ec2" {

  cluster_name    = aws_eks_cluster.eks-cluster.name

  node_group_name = "t3_micro-node_group"

  node_role_arn   = aws_iam_role.NodeGroupRole.arn

  subnet_ids      = flatten( module.aws_vpc.private_subnets_id )

scaling_config {

    desired_size = 2

    max_size     = 3

    min_size     = 1

  }

ami_type       = "AL2_x86_64"

  instance_types = ["t3.micro"]

  capacity_type  = "ON_DEMAND"

  disk_size      = 20

depends_on = [

    aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy,

    aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly,

    aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy

  ]

}

USAGE



terraform init

terraform validate

terraform plan

terraform apply -auto-approve

STEP 05 - Check Cluster & Node Group Creation

Check if the node gruoup was created using AWS Console

Create or update the kubeconfig for Amazon EKS
For this purpose use this command:

aws eks update-kubeconfig --region <region-code> --name <cluster-name>

Replace <region-code> with you respective region, example us-east-1
and <cluster-name with your cluster's name

Check node using kubectl

Documentation: https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html

Getting Started with Amazon EKS: Basics and guide to create your first POD

erozedguy — Tue, 17 Aug 2021 16:55:25 +0000

1. What is Amazon EKS?

Is a managed service to run Kubernetes on AWS without needing to install, operate and maintain the insfrastructure.

References:

https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html

https://kubernetes.io/es/docs/home/

2. Important Concepts

2.1 EKS Control Plane

Consists of control plane nodes that run the Kubernetes Software, such as etcd and the kubernetes API server.
Control Plane infrastructure is not shared across cluster or AWS accounts
The control plane exposes a public endpoint so that clients and nodes can communicate with the cluster.

References:

https://docs.aws.amazon.com/eks/latest/userguide/clusters.html

https://www.eksworkshop.com/010_introduction/architecture/architecture_control/

2.2 Worker Nodes & Node Groups

Workers nodes are EC2 intances
- Run the applications workloads
Node Groups are groups of EC2 intances that are provisioned as part of an EC2 autoscaling group
Connect to the control plane via API server endpoint

Considerations:

All EC2 instances must be the same type
Be running the same AMI
Use the same EKS worker node IAM role

Reference: https://docs.aws.amazon.com/eks/latest/userguide/eks-compute.html

2.3 VPC

Control plane components cannot view or receive communications from other cluster or another AWS accounts, except as authorized with Kubernetes RBAC policies
VPCs and subnets must be tagged appropriately, so that Kubernetes knows that it can use them for deploying resources, such as load balancers
Amazon EKS creates and manages network interfaces in your account
Fargate PODS are deployed to private subnets only

Reference: https://docs.aws.amazon.com/eks/latest/userguide/eks-networking.html

2.4 Fargate Profiles

The Fargate profile allows an administrator to declare which pods run on Fargate
Each POD running on Fargate is isolated of the other resources and does not share the underlying kernel, CPU resources, memory or elastic network interface with another POD
AWS built fargate controller that recognizes the PODS that belong to fargate and schedules the on FARGATE PROFILES

Reference: https://docs.aws.amazon.com/eks/latest/userguide/fargate-profile.html

3. Creating an EKS cluster

PREREQUISITES

Install and configure AWS CLI

References:

https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html

Install eksctl

Reference: https://docs.aws.amazon.com/eks/latest/userguide/eksctl.html

Install kubectl

Reference: https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html

3.1 Create EKS Cluster with `eksctl`

eksctl create cluster --name <my-cluster> \
              --version <1.21> \
              --region <region> \
              -- zones <az1,az2...>\
              --without-nodegroup

Check the cluster in our AWS account

eksctl get cluster

3.2 Create and associate IAM OIDC Provider for EKS Cluster

With this feature, you can manage user access to your cluster by leveraging existing identity management life cycle through your OIDC identity provider.

eksctl utils associate-iam-oidc-provider --region <region-code> \
                                         --cluster <cluter-name> \
                                         --approve

3.3 Create a EC2 key pair with `AWS Management Console`

For this step you must use the AWS Management Console in your web browser

NOTE: When we use eksctl to create an EKS cluster, automatically are created public and private subnets, NAT Gateways, Cluster service Role, security group and more resources required for our eks cluster are automatically created

4. Creating a NODE GROUP

4.1 Create Node Group with additional Add-Ons in Public Subnets

eksctl create nodegroup --cluster <CLUSTER_NAME> \
                        --region <REGION> \
                        --name <NAME_NODE_GROUP> \
                        -node-type <TYPE_EC2_INSTANCE> \
                        --nodes <#_EC2_INSTANCES> \
                        --nodes-min <MIN_NODES> \
                        --nodes-max <MAX_NODES> \
                        --node-volume-size <GB>\
                        --ssh-access \
                        --ssh-public-key <PUB_KEY> \
                        --managed \
                        --asg-access \
                        --external-dns-access \
                        --full-ecr-access \
                        --appmesh-access \
                        --alb-ingress-access

4.2 Check the nodes

4.3 Use `kubectl` to managed the EKS cluster

Check nodes

kubectl get nodes

Check Services

kubectl get services

5. Creating the first POD

Write a .yaml manifest to create a POD
Execute the .yaml file to create the POD

kubectl apply -f <manifest_name>.yaml

Check the PODS in our EKS cluster with kubectl

kubectl get po

View the POD into a node through the aws management console

6. DELETE THE EKS CLUSTER

Delete the NODE GROUP

eksctl delete nodegroup --cluster <clusterName> \
                        --name <nodegroupName>

Delete the EKS Cluster

eksctl delete cluster <clusterName>

RESOURCES: https://github.com/stacksimplify/aws-eks-kubernetes-masterclass

CI/CD Pipeline for Amazon ECS/FARGATE with Terraform

erozedguy — Sun, 08 Aug 2021 01:02:24 +0000

DESCRIPTION

In this post I am going to explain how to build the infrastructure on AWS with Terraform to implement a CI / CD pipeline for ECS / Fargate.
The Architecture consists of a VPC with 2 public subnets in different Availability Zones. The desired tasks are 2 and each task is deployed on each public subnet with Fargate and each task belongs to the same ECS service.
An Application Load Balancer is used to balance the load between the two tasks.
In this case, the main goal is to implement a docker container that contains a simple HTTP server built with GOLANG. This HTTP server allows you to obtain the private IP of each task.
If I push new changes to the CodeCommit repository, CodePipeline detects those changes, triggers the pipeline and creates a new docker image and then deploys it to the ECS service to update the tasks.

ARCHITECTURE

RESOURCES

https://github.com/erozedguy/CICD-Pipeline-for-Amazon-ECS-Fargate

STEPS

STEP 01 - Create a IAM Role and CodeCommit Credentials

Create a Service Role for Elastic Container Service Task (
Allows ECS tasks to call AWS services on your behalf.)
Attach AWSCodeCommitPowerUser Policy to my USER
Generate HTTPS Git credentials for AWS CodeCommit to clone, push, pull to the CodeCommit Repository

STEP 02: Terraform scripts to build the infrastructure

`PROVIDERS`



terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.51"
    }
  }
}
provider "aws" {
  profile = "default"
  region  = "us-east-1"
}

`VPC`

The vpc script has VPC, SUBNETS and INTERNET GATEWAY resources.



resource "aws_vpc" "ecs-vpc" {
  cidr_block = "${var.cidr}"

  tags = {
    Name = "ecs-vpc"
  }
}

# PUBLIC SUBNETS
resource "aws_subnet" "pub-subnets" {
  count                   = length(var.azs)
  vpc_id                  = "${aws_vpc.ecs-vpc.id}"
  availability_zone       = "${var.azs[count.index]}"
  cidr_block              = "${var.subnets-ip[count.index]}"
  map_public_ip_on_launch = true

  tags = {
    Name = "pub-subnets"
  }
}

# INTERNET GATEWAY
resource "aws_internet_gateway" "i-gateway" {
  vpc_id = "${aws_vpc.ecs-vpc.id}"

  tags = {
    Name = "ecs-igtw"
  }
}

`VARIABLES TO VPC`



variable "cidr" {
  type    = string
  default = "145.0.0.0/16"
}

variable "azs" {
  type = list(string)
  default = [
    "us-east-1a",
    "us-east-1b"
  ]
}

variable "subnets-ip" {
  type = list(string)
  default = [
    "145.0.1.0/24",
    "145.0.2.0/24"
  ]

}

`IAM ROLES & POLICIES`

For the CodeBuild is necessary to create a IAM Role&Policy to allow access to ECR to push and pull the Docker images in the ECR repository. Also, is necessary a permission to access a S3 bucket to store the artifacts.



resource "aws_iam_role" "codebuild-role" {
  name = "codebuild-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "codebuild.amazonaws.com"
        }
      },
    ]
  })
}

resource "aws_iam_role_policy" "codebuild-policy" {
  role = "${aws_iam_role.codebuild-role.name}"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action   = ["codecommit:GitPull"]
        Effect   = "Allow"
        Resource = "*"
      },
      {
        Action = [
          "ecr:BatchCheckLayerAvailability",
          "ecr:GetDownloadUrlForLayer",
          "ecr:BatchGetImage",
          "ecr:CompleteLayerUpload",
          "ecr:GetAuthorizationToken",
          "ecr:InitiateLayerUpload",
          "ecr:PutImage",
        "ecr:UploadLayerPart"]
        Effect   = "Allow"
        Resource = "*"
      },
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
        "logs:PutLogEvents"]
        Effect   = "Allow"
        Resource = "*"
      },
      {
        Action = [
          "s3:PutObject",
          "s3:GetObject",
          "s3:GetObjectVersion",
          "s3:GetBucketAcl",
        "s3:GetBucketLocation"]
        Effect   = "Allow"
        Resource = "*"
      }
    ]


  })

}

`ROUTE TABLES`

A single Route Table for both Public Subnets



# TABLE FOR PUBLIC SUBNETS
resource "aws_route_table" "pub-table" {
  vpc_id = "${aws_vpc.ecs-vpc.id}"
}

resource "aws_route" "pub-route" {
  route_table_id         = "${aws_route_table.pub-table.id}"
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = "${aws_internet_gateway.i-gateway.id}"
}

resource "aws_route_table_association" "as-pub" {
  count          = length(var.azs)
  route_table_id = "${aws_route_table.pub-table.id}"
  subnet_id      = "${aws_subnet.pub-subnets[count.index].id}"
}

`SECURITY GROUPS`

The first Sec-Group is for the ECS Service



resource "aws_security_group" "sg1" {
  name        = "golang-server"
  description = "Port 5000"
  vpc_id      = aws_vpc.ecs-vpc.id

  ingress {
    description      = "Allow Port 5000"
    from_port        = 5000
    to_port          = 5000
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    description = "Allow all ip and ports outboun"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

The second Sec-Group is for the Application Load Balancer



resource "aws_security_group" "sg2" {
  name        = "golang-server-alb"
  description = "Port 80"
  vpc_id      = aws_vpc.ecs-vpc.id

  ingress {
    description      = "Allow Port 80"
    from_port        = 80
    to_port          = 80
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    description = "Allow all ip and ports outboun"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

`APPLICATION LOAD BALANCER`



resource "aws_lb" "app-lb" {
  name               = "app-lb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.sg2.id]
  subnets            = ["${aws_subnet.pub-subnets[0].id}", "${aws_subnet.pub-subnets[1].id}"]

}

Port #5000 is used in the Target Group because that port is used for the container



resource "aws_lb_target_group" "tg-group" {
  name        = "tg-group"
  port        = "5000"
  protocol    = "HTTP"
  vpc_id      = "${aws_vpc.ecs-vpc.id}"
  target_type = "ip"

}

Port #80 is used for the Listener



resource "aws_lb_listener" "lb-listener" {

  load_balancer_arn = "${aws_lb.app-lb.arn}"

  port              = "80"

  protocol          = "HTTP"

default_action {

    type             = "forward"

    target_group_arn = "${aws_lb_target_group.tg-group.arn}"

  }

}

`ECS & ECR`

ECR repository



resource "aws_ecr_repository" "ecr-repo" {

  name = "ecr-repo"

}

ECS Cluster



resource "aws_ecs_cluster" "ecs-cluster" {

  name = "clusterDev"

}

Task Definition

In this part is important to specify the containerPort
Create a ENV VAR: export TF_VAR_uri_repo = <ID_ACCOUNT>.dkr.ecr.<REGION>.amazonaws.com/<ECR_REPOSITORY_NAME>



resource "aws_ecs_task_definition" "task" {

  family                   = "HTTPserver"

  network_mode             = "awsvpc"

  requires_compatibilities = ["FARGATE"]

  cpu                      = 256

  memory                   = 512

  execution_role_arn       = data.aws_iam_role.ecs-task.arn

container_definitions = jsonencode([

    {

      name   = "golang-container"

      image  = "${var.uri_repo}:latest" #URI

      cpu    = 256

      memory = 512

      portMappings = [

        {

          containerPort = 5000

        }

      ]

    }

  ])

}

ECS Service

Specify the load balancer block



resource "aws_ecs_service" "svc" {

  name            = "golang-Service"

  cluster         = "${aws_ecs_cluster.ecs-cluster.id}"

  task_definition = "${aws_ecs_task_definition.task.id}"

  desired_count   = 2

  launch_type     = "FARGATE"

network_configuration {

    subnets          = ["${aws_subnet.pub-subnets[0].id}", "${aws_subnet.pub-subnets[1].id}"]

    security_groups  = ["${aws_security_group.sg1.id}"]

    assign_public_ip = true

  }

load_balancer {

    target_group_arn = "${aws_lb_target_group.tg-group.arn}"

    container_name   = "golang-container"

    container_port   = "5000"

  }

}

`CI/CD PIPELINE`

CodeCommit Repository



resource "aws_codecommit_repository" "repo" {

  repository_name = var.repo_name

}

CodeBuild Project



resource "aws_codebuild_project" "repo-project" {

  name         = "${var.build_project}"

  service_role = "${aws_iam_role.codebuild-role.arn}"

artifacts {

    type = "NO_ARTIFACTS"

  }

source {

    type     = "CODECOMMIT"

    location = "${aws_codecommit_repository.repo.clone_url_http}"

  }

environment {

    compute_type    = "BUILD_GENERAL1_SMALL"

    image           = "aws/codebuild/standard:5.0"

    type            = "LINUX_CONTAINER"

    privileged_mode = true

  }

}

buildspec.yml

This file is very important to create the Docker Image and Pull it to ECR repository
To update the ECS service is important to specify the containerName and imageUri in a JSON file with the name imagedefinitions.json. This file is an artifact
This file must be in the CodeCommit repository



version: 0.2

phases:

  pre_build:

    commands:

      - echo Logging in to Amazon ECR...

      - echo $AWS_DEFAULT_REGION

      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin 940401905947.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com

      - REPOSITORY_NAME="ecr-repo"


      - REPOSITORY_URI=940401905947.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$REPOSITORY_NAME

      - COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)

      - IMAGE_TAG=${COMMIT_HASH:=latest}

  build:

    commands:

      - echo Building the Docker image...

      - docker build -t $REPOSITORY_NAME:latest .

      - docker tag $REPOSITORY_NAME:latest $REPOSITORY_URI:latest

      - docker tag $REPOSITORY_NAME:latest $REPOSITORY_URI:$IMAGE_TAG

  post_build:

    commands:

      - docker push $REPOSITORY_URI:latest

      - docker push $REPOSITORY_URI:$IMAGE_TAG

      - printf '[{"name":"golang-container","imageUri":"%s"}]' $REPOSITORY_URI:$IMAGE_TAG > imagedefinitions.json

artifacts:

  files: imagedefinitions.json

S3 Bucket to store the `artifacts`



resource "aws_s3_bucket" "bucket-artifact" {

  bucket = "eroz-artifactory-bucket"

  acl    = "private"

}

CodePipeline

Specify Source, Build, Deploy Stages

NOTE: to code the stages check the official documentation
https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html



resource "aws_codepipeline" "pipeline" {

  name     = "pipeline"

  role_arn = "${data.aws_iam_role.pipeline_role.arn}"

artifact_store {

    location = "${aws_s3_bucket.bucket-artifact.bucket}"

    type     = "S3"

  }

  # SOURCE

  stage {

    name = "Source"

    action {

      name             = "Source"

      category         = "Source"

      owner            = "AWS"

      provider         = "CodeCommit"

      version          = "1"

      output_artifacts = ["source_output"]

  <span class="nx">configuration</span> <span class="o">=</span> <span class="p">{</span>
    <span class="nx">RepositoryName</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">${var.repo_name}</span><span class="dl">"</span>
    <span class="nx">BranchName</span>     <span class="o">=</span> <span class="dl">"</span><span class="s2">${var.branch_name}</span><span class="dl">"</span>
  <span class="p">}</span>
<span class="p">}</span>



}

  # BUILD

  stage {

    name = "Build"

    action {

      name             = "Build"

      category         = "Build"

      owner            = "AWS"

      provider         = "CodeBuild"

      version          = "1"

      input_artifacts  = ["source_output"]

      output_artifacts = ["build_output"]

  <span class="nx">configuration</span> <span class="o">=</span> <span class="p">{</span>
    <span class="nx">ProjectName</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">${var.build_project}</span><span class="dl">"</span>
  <span class="p">}</span>
<span class="p">}</span>



}

  # DEPLOY

  stage {

    name = "Deploy"

    action {

      name            = "Deploy"

      category        = "Deploy"

      owner           = "AWS"

      provider        = "ECS"

      version         = "1"

      input_artifacts = ["build_output"]

  <span class="nx">configuration</span> <span class="o">=</span> <span class="p">{</span>
    <span class="nx">ClusterName</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">clusterDev</span><span class="dl">"</span>
    <span class="nx">ServiceName</span> <span class="o">=</span> <span class="dl">"</span><span class="s2">golang-Service</span><span class="dl">"</span>
    <span class="nx">FileName</span>    <span class="o">=</span> <span class="dl">"</span><span class="s2">imagedefinitions.json</span><span class="dl">"</span>
  <span class="p">}</span>
<span class="p">}</span>



}

}

`DATA`

This section is for using created IAM roles



data "aws_iam_role" "pipeline_role" {

  name = "codepipeline-role"

}

data "aws_iam_role" "ecs-task" {

  name = "ecsTaskExecutionRole"

}

`OUTPUTS`

To get the ALB DNS and the CodeCommit Repository URL



output "repo_url" {

  value = aws_codecommit_repository.repo.clone_url_http

}

output "alb_dns" {

  value = aws_lb.app-lb.dns_name

}

`EXTRA VARIABLES`



variable "repo_name" {

  type    = string

  default = "dev-repo"

}

variable "branch_name" {

  type    = string

  default = "master"

}

variable "build_project" {

  type    = string

  default = "dev-build-repo"

}

variable "uri_repo" {

  type = string

  #The URI_REPO value is in a TF_VAR in my PC

}

STEP 03: HTTP Simple Server with `GOLANG`

This code is useful to get the PRIVATE IP of the ecs tasks



package main

import (

    "fmt"

    "log"

    "net"

    "net/http"

)

func main() {

    log.Print("HTTPserver: Enter main()")

    http.HandleFunc("/", handler)

    log.Fatal(http.ListenAndServe("0.0.0.0:5000", nil))

}

// printing request headers/params

func handler(w http.ResponseWriter, r *http.Request) {

<span class="nx">log</span><span class="p">.</span><span class="nc">Print</span><span class="p">(</span><span class="dl">"</span><span class="s2">request from address: %q</span><span class="se">\n</span><span class="dl">"</span><span class="p">,</span> <span class="nx">r</span><span class="p">.</span><span class="nx">RemoteAddr</span><span class="p">)</span>
<span class="nx">fmt</span><span class="p">.</span><span class="nc">Fprintf</span><span class="p">(</span><span class="nx">w</span><span class="p">,</span> <span class="dl">"</span><span class="s2">%s %s %s</span><span class="se">\n</span><span class="dl">"</span><span class="p">,</span> <span class="nx">r</span><span class="p">.</span><span class="nx">Method</span><span class="p">,</span> <span class="nx">r</span><span class="p">.</span><span class="nx">URL</span><span class="p">,</span> <span class="nx">r</span><span class="p">.</span><span class="nx">Proto</span><span class="p">)</span>

<span class="nx">fmt</span><span class="p">.</span><span class="nc">Fprintf</span><span class="p">(</span><span class="nx">w</span><span class="p">,</span> <span class="dl">"</span><span class="s2">Host = %q</span><span class="se">\n</span><span class="dl">"</span><span class="p">,</span> <span class="nx">r</span><span class="p">.</span><span class="nx">Host</span><span class="p">)</span>
<span class="nx">fmt</span><span class="p">.</span><span class="nc">Fprintf</span><span class="p">(</span><span class="nx">w</span><span class="p">,</span> <span class="dl">"</span><span class="s2">RemoteAddr = %q</span><span class="se">\n</span><span class="dl">"</span><span class="p">,</span> <span class="nx">r</span><span class="p">.</span><span class="nx">RemoteAddr</span><span class="p">)</span>
<span class="k">if</span> <span class="nx">err</span> <span class="p">:</span><span class="o">=</span> <span class="nx">r</span><span class="p">.</span><span class="nc">ParseForm</span><span class="p">();</span> <span class="nx">err</span> <span class="o">!=</span> <span class="nx">nil</span> <span class="p">{</span>
    <span class="nx">log</span><span class="p">.</span><span class="nc">Print</span><span class="p">(</span><span class="nx">err</span><span class="p">)</span>
<span class="p">}</span>
<span class="k">for</span> <span class="nx">k</span><span class="p">,</span> <span class="nx">v</span> <span class="p">:</span><span class="o">=</span> <span class="nx">range</span> <span class="nx">r</span><span class="p">.</span><span class="nx">Form</span> <span class="p">{</span>
    <span class="nx">fmt</span><span class="p">.</span><span class="nc">Fprintf</span><span class="p">(</span><span class="nx">w</span><span class="p">,</span> <span class="dl">"</span><span class="s2">Form[%q] = %q</span><span class="se">\n</span><span class="dl">"</span><span class="p">,</span> <span class="nx">k</span><span class="p">,</span> <span class="nx">v</span><span class="p">)</span>
<span class="p">}</span>
<span class="nx">fmt</span><span class="p">.</span><span class="nc">Fprintf</span><span class="p">(</span><span class="nx">w</span><span class="p">,</span> <span class="dl">"</span><span class="se">\n</span><span class="s2">===&gt; local IP: %q</span><span class="se">\n\n</span><span class="dl">"</span><span class="p">,</span> <span class="nc">GetOutboundIP</span><span class="p">())</span>



}

func GetOutboundIP() net.IP {

    conn, err := net.Dial("udp", "8.8.8.8:80")

    if err != nil {

        log.Fatal(err)

    }

    defer conn.Close()

<span class="nx">localAddr</span> <span class="p">:</span><span class="o">=</span> <span class="nx">conn</span><span class="p">.</span><span class="nc">LocalAddr</span><span class="p">().(</span><span class="o">*</span><span class="nx">net</span><span class="p">.</span><span class="nx">UDPAddr</span><span class="p">)</span>

<span class="k">return</span> <span class="nx">localAddr</span><span class="p">.</span><span class="nx">IP</span>



}

STEP 04: Dockerfile

This Dockerfile create a image with a HTTP Server with GOLANG
This file must be in the CodeCommit repository



FROM golang:alpine AS builder

ENV GO111MODULE=on </span>

    CGO_ENABLED=0 </span>

    GOOS=linux </span>

    GOARCH=amd64

WORKDIR /build

COPY ./HTTPserver.go .

# Build the application

RUN go build -o HTTPserver ./HTTPserver.go

WORKDIR /dist

RUN cp /build/HTTPserver .

# Build a small image

FROM scratch

COPY --from=builder /dist/HTTPserver /

EXPOSE 5000

ENTRYPOINT ["/HTTPserver"]

STEP 05: Create TF_VAR

STEP 06: Create the Infrastructure

Commands

terraform init
terraform validate
terraform plan
terraform apply -auto-approve

When the creation is finished we get the OUTPUTS

STEP 07: Upload Dockerfile, Code and buildspect files to the CodeCommit repository

Clone the repository
Copy buildspect.yml, Dockerfile and Golang Code to the cloned repository folder and then do a commit
Git push to the CodeCommit Repository

STEP 08: Check the Pipeline

When the "Build" stage is done, check the docker image in the ECR repository

STEP 09: Check the ECS Service

When the "Deploy" stage is done, check the Tasks in the ECS Service

STEP 10: Check the `Target Group`

STEP 11: Check the operation of the Application Load Balancer

FINAL STEP: Delete the Infrastructure

terraform destroy -auto-approve

Forem: erozedguy

Install & Manage Amazon EKS Add-ons with Terraform

What is an Add-on in Amazon EKS ?

Amazon EKS Add-ons

Prerequisites

STEPS

Step 01 - Get the version of each Add-on

Step 02 - Create the terraform code

Step 03 - Apply the terraform code

Creating an EKS Cluster and Node Group with Terraform

DESCRIPTION

ARCHITECTURE

CODE

DEVELOPMENT

STEP 01 - Provide Networking part

Module's usage

Variables for the module

STEP 03 - IAM ROLES

EKS Cluster Role

NODE GROUP ROLE

ATTACH MANAGED IAM POLICIES TO IAM ROLES

STEP 04 - Create EKS Cluster

NODE GROUP

USAGE

STEP 05 - Check Cluster & Node Group Creation

Getting Started with Amazon EKS: Basics and guide to create your first POD

1. What is Amazon EKS?

2. Important Concepts

2.1 EKS Control Plane

2.2 Worker Nodes & Node Groups

2.3 VPC

2.4 Fargate Profiles

3. Creating an EKS cluster

PREREQUISITES

3.1 Create EKS Cluster with eksctl

3.2 Create and associate IAM OIDC Provider for EKS Cluster

3.3 Create a EC2 key pair with AWS Management Console

4. Creating a NODE GROUP

4.1 Create Node Group with additional Add-Ons in Public Subnets

4.2 Check the nodes

4.3 Use kubectl to managed the EKS cluster

5. Creating the first POD

6. DELETE THE EKS CLUSTER

CI/CD Pipeline for Amazon ECS/FARGATE with Terraform

DESCRIPTION

ARCHITECTURE

RESOURCES

STEPS

STEP 01 - Create a IAM Role and CodeCommit Credentials

STEP 02: Terraform scripts to build the infrastructure

PROVIDERS

VPC

VARIABLES TO VPC

IAM ROLES & POLICIES

ROUTE TABLES

SECURITY GROUPS

APPLICATION LOAD BALANCER

ECS & ECR

ECR repository

ECS Cluster

Task Definition

ECS Service

CI/CD PIPELINE

CodeCommit Repository

CodeBuild Project

buildspec.yml

S3 Bucket to store the artifacts

CodePipeline

DATA

OUTPUTS

EXTRA VARIABLES

STEP 03: HTTP Simple Server with GOLANG

STEP 04: Dockerfile

STEP 05: Create TF_VAR

STEP 06: Create the Infrastructure

STEP 07: Upload Dockerfile, Code and buildspect files to the CodeCommit repository

STEP 08: Check the Pipeline

STEP 09: Check the ECS Service

STEP 10: Check the Target Group

STEP 11: Check the operation of the Application Load Balancer

3.1 Create EKS Cluster with `eksctl`

3.3 Create a EC2 key pair with `AWS Management Console`

4.3 Use `kubectl` to managed the EKS cluster

`PROVIDERS`

`VPC`

`VARIABLES TO VPC`

`IAM ROLES & POLICIES`

`ROUTE TABLES`

`SECURITY GROUPS`

`APPLICATION LOAD BALANCER`

`ECS & ECR`

`CI/CD PIPELINE`

S3 Bucket to store the `artifacts`

`DATA`

`OUTPUTS`

`EXTRA VARIABLES`

STEP 03: HTTP Simple Server with `GOLANG`

STEP 10: Check the `Target Group`