Forem: leotoras

AWS EKS - Let's play with it

leotoras — Wed, 14 Jun 2023 21:03:08 +0000

Lets start talking about AWS EKS service, what it is, what it does and so on.

For this article, lets assume that you already have a basic knowledge about containers, basic knowledge about Kubernetes and how they work.

So, EKS states for Elastic Kubernetes Service and it is a managed service, that means you don't need to worry about infrastructure, where you can deploy your Kubernetes environment and without needing to install anything to have your control plane and nodes up and running. The only thing you need is a few clicks with the proper configuration.

The AWS EKS service is fully integrated with other AWS services like ECR that makes things easier to deploy your container images, load balancer to distribute the traffic to your pods, IAM to secure the environment among others.

We will not go deeper in theory about Kubernetes, so lets start having our hands dirty to better understand this service !

To interact with Kubernetes and our EKS service, we will need 2 tools that will help us. They are the eksctl (command line tool to interact with EKS service and use CloudFormation behind the scenes to create your cluster) and kubectl (to interact with Kubernetes services).

I'm using an EC2 instance with Amazon Linux 2023 as my environment, but you can choose any environment you feel comfortable.

You can install eksctl issue the following commands:

ARCH=amd64
PLATFORM=$(uname -s)_$ARCH
curl -sLO "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$PLATFORM.tar.gz"
tar -xzf eksctl_$PLATFORM.tar.gz -C /tmp && rm eksctl_$PLATFORM.tar.gz
sudo mv /tmp/eksctl /usr/local/bin

To make sure eksctl is installed successfully, issue the following command:

eksctl version

You should receive an output with the eksctl version like that:

Now, lets install kubectl. To do that, just issue the following commands:

curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/1.27.1/2023-04-19/bin/linux/amd64/kubectl
chmod +x ./kubectl
mkdir -p $HOME/bin && cp ./kubectl $HOME/bin/kubectl && export PATH=$HOME/bin:$PATH

You can verify if the installation is fine with the following command:

kubectl version --short --client

It should return the kubectl version info like that:

"Don't worry about the message saying that the flag --short has been deprecated."

Great, now we have everything we need to start working with our EKS service. The very first thing we need to start working is a cluster. When we create a cluster, we 2 node types that we can work with, they are:

Fargate: this type of compute capacity is also know as serverless because you dont have EC2 instances to manage. You simply put your pods to run and nothing else.
EC2 instances: this type uses EC2 instances to have your pods running, so you need to choose the instance family, instance size, number of instances and so on. In this case, the instances are customized for EKS service.

So, let's create our cluster. To make things simple, lets use Fargate compute mode and default options. We can do that using the eksctl, issue the following command:

eksctl create cluster --name devto-article-eks-cluster \
--region us-east-1 \
--fargate

It will take a few minutes and when it finishes, you will see an output like that:

Now that our cluster is live, we can try some kubectl commands to interact with. Lets try a command to list the nodes, so just type:

kubectl get nodes -o wide

The output will list the nodes like that:

When you create a Kubernetes cluster, it created some internal pods that are used by Kubernetes to work properly. What about to see what are those services ? To do that, issue the following command:

kubectl get pods -A -o wide

The output should like following:

Those are coredns pods, that act as a DNS server for Kuberntes pods. We will not go deeper in Kubernetes sctructure, so that information is enought for now. Lets keep focusing on EKS service.

Great, now we can create our Kubernetes deployment that will pull our container image from a repository. We can run our pod with the following command:

kubectl run devto-article-pod --image <your_account_id>.dkr.ecr.us-east-1.amazonaws.com/my-eks-container-repo:latest

"Remember to replace the subnet ids by your subnets".

Lets check if out pod is running as expected. Type the following command:

kubectl get po

The output shows our container running in a pod as expected:

Now, the final part, make sure our pod has a container doing what is expected, show the welcome message ! Lets check that, we just need to login into the container which is running our app and execute a curl to check the message. Go ahead and execute the following commands:

kubectl exec -it devto-article-pod -- /bin/bash

Amaaaaazing news !!! Our pod is running the container as expected:

After some commands, we are finally done with our mission to have a pod application running on a EKS cluster as required.

You did a great job. Thank you so much for follow me in this article and see you in the next.

sources:

https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html
https://eksctl.io/usage/creating-and-managing-clusters/
https://docs.aws.amazon.com/eks/latest/userguide/sample-deployment.html
https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html

AWS ECS - Let's play with it

leotoras — Wed, 14 Jun 2023 17:57:00 +0000

Lets start talking about AWS ECS service, what it is, what it does and so on.

For this article, lets assume that you already have a basic knowledge about containers and how they work (if not, please take a look at ).

So, ECS states for Elastic Container Service and it is a container orchestration service where you can launch your container applications in an easily manner. It makes activities like deploy, manage and scale the applications much more easier.
As it is a service, you really don't need to worry or concern about hardware infrastructure, which is totally managed by AWS (as said, it is a fully managed service). In other words, if you want to run your containerized application on AWS without worry about infrastructure management, ECS is the right option.

To make things easier than before ECS is also fully integrated with AWS ECR (Elastic Container Registry), which is another AWS fully managed AWS service to push your container images. If you are used with Docker Hub, don't worry, it works as well !

We are ready to start, so first things first. Now it is time to visit the AWS ECR service :-)

When you work with ECS, you have 3 options for computing capacity. They are EC2 instances, Fargate and ECS Anywhere (using on premise resources). Lets explain a little bit about each one:

EC2 instances: this type uses EC2 instances to have your services and tasks running, so you need to choose the instance family, instance size, number of instances and so on. In thi case, the instances are customized for ECS service and have the ecs-agent running on top of them.
Fargate: this type of compute capacity is also know as serverless because you don't have EC2 instances to manage. You simply put your services and tasks to run and nothing else.
ECS Anywhere: this type of compute is the ability to register on premise servers to your ECS cluster (we will not touch on this inn this article !).

If you are in doubt on what type of compute capacity you use, you can take a look at this document: .

To make things simple, lets work with Fargate compute mode to run our containers. To start with that, first of all we need an ECS cluster, so lets create one. We have a lot of option to create our cluster, using AWS console, using CLI, using AWS SDK and other IaC tools like CloudFormation and Terraform for example. In our case, lets make it simple and use CLI.
Simply issue this command:

aws ecs create-cluster --cluster-name devto-ecs-cluster --capacity-providers FARGATE

You should have an output like that:

To make sure the cluster is there, you can list it:

aws ecs list-clusters

You are able to see out cluster:

Now, our cluster is up and running, cool ! The next step is to create a task definition for our containers, but what is that ? Let me explain.

Task Definition is a text file in JSON format that describes the containers and their parameters that will be part of the application. The parameters include CPU, memory, image name, IAM role, logging information and much more. You can visit this to take a deeper look on task definitions.

That said, lets create out task definition. You can use any text editor, in my case I use vi to create a JSON file called devto-task-definition, like following:

{
    "containerDefinitions": [
        {
            "name": "devto-article-container",
            "image": "<your_account_id>.dkr.ecr.us-east-1.amazonaws.com/my-ecs-container-repo",
            "cpu": 0,
            "portMappings": [
                {
                    "name": "devto-article-container-80-tcp",
                    "containerPort": 80,
                    "hostPort": 80,
                    "protocol": "tcp",
                    "appProtocol": "http"
                }
            ],
            "essential": true,
            "environment": [],
            "environmentFiles": [],
            "mountPoints": [],
            "volumesFrom": [],
            "ulimits": [],
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-create-group": "true",
                    "awslogs-group": "/ecs/devto-task-definition",
                    "awslogs-region": "us-east-1",
                    "awslogs-stream-prefix": "ecs"
                }
            }
        }
    ],
    "family": "devto-task-definition",
    "taskRoleArn": "arn:aws:iam::<your_account_id>:role/EcsTaskRole",
    "executionRoleArn": "arn:aws:iam::<your_account_id>:role/ecsTaskExecutionRole",
    "networkMode": "awsvpc",
    "volumes": [],
    "placementConstraints": [],
    "requiresCompatibilities": [
        "FARGATE"
    ],
    "cpu": "256",
    "memory": "512",
    "runtimePlatform": {
        "cpuArchitecture": "X86_64",
        "operatingSystemFamily": "LINUX"
    }
}

"Pay attention that I replaced my account id by the string . In your case, it should be your own account id."

With the task definition file created, we need to register this task definition so ECS is able to reference when creating a service or task. To do that, just issue the following command:

aws ecs register-task-definition --cli-input-json file://devto-task-definition.json

To make sure the task definition has been successfully created, you can issue the command to confirm:

aws ecs list-task-definitions

With the task definition registered, we are finally able to run our task in our ECS cluster (Uhuuuuulll !!!). To do that, lets create a service to run our task and test it from a browser on the internet. To do that, take note about the subnet-id you will deploy the service, the security group for that service (as this is an example, lets use a security group allowing access from internet on port 80) and lets assign a public IP to that, so we will be able to test it from anywhere. With all required information, lets simply issue the following command:

aws ecs create-service --cluster devto-ecs-cluster \
--service-name devto-article-service \
--task-definition devto-task-definition \
--desired-count 1 \
--launch-type "FARGATE" \
--network-configuration "awsvpcConfiguration={subnets=[subnet-014d9c5f9d0bb9b90],securityGroups=[sg-03eb793e06078aabe],assignPublicIp=ENABLED}"

To make sure the service has been created, lets list the services running in our ECS cluster with the following command:

aws ecs list-services --cluster devto-ecs-cluster

Yes, our service is right there:

Now our container app is running in a service on top of the ECS cluster, that is great !!! So, time to test it. As we deployed in a public subnet to make it available to test in the internet, we need to find the public IP address that was assigned to out task in the service. To grab this information, lets run some commands !

First, lets list our task to get the arn. Issue the following command:

aws ecs list-tasks --cluster devto-ecs-cluster --service devto-article-service

It will output the task arn:

Now, lets describe this task using the arn, so we will be able to check which network interface it is using and with that information, check the public IP assigned to the task. Just issue the following command:

aws ecs describe-tasks \
--cluster devto-ecs-cluster \
--tasks arn:aws:ecs:us-east-1:<your_account_id>:task/devto-ecs-cluster/defc81a93bda4df6ad73957ef718876e

"Pay attention that I replaced my account id by the string . In your case, it should be your own account id."

Look for the "networkInterfaceId" value as shown bellow:

With the network interface id, we can easily discover the IP address with a describe command. Just issue the following command:

aws ec2 describe-network-interfaces \
--network-interface-id eni-0765281dfd52d2b06

The output will be as shown bellow:

What amaaaaazing news !!! Now we can test our application from a browser and make sure it is running as expected. So what are we waiting for ? Lets try it right now !!! Lets put the public IP in a browser and have our fingers crossed:

Uaaaaauuuu !!! After some commands, we are finally done with our mission to have a container application running on a ECS cluster as required.

You did a great job. Thank you so much for follow me in this article and see you in the next.

sources:
https://aws.amazon.com/getting-started/hands-on/deploy-docker-containers/
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-container-image.html
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_AWSCLI_Fargate.html#ECS_AWSCLI_Fargate_register_task_definition

AWS ECR - Let's play with it

leotoras — Wed, 14 Jun 2023 17:56:32 +0000

Lets start talking about AWS ECR service, what it is, what it does and so on.

ECR is a fully managed AWS container image registry service where you can create your public or private repositories, and have it secure, scalable and reliable, where you can push, pull and manage your container images.

Instead of going so deeper in theory, lets have out hands dirty and perform some tasks to have a real idea about what we are talking about.

For that, it's nice to have a container image to use as an example, so lets create one !

I'm going to use an EC2 instance with Amazon Linux 2023 operating systems as my working place, you can choose anyone that fits your needs.

Lets start updating our instance packages before installing Docker binaries, with the following command:

sudo yum update -y

Now, lets install Docker with the following command:

sudo yum install docker -y

Now, we need to start the Docker service, so you can issue the following command:

sudo service docker start

And to confirm Docker service is up and running:

sudo service docker status

To remove the need to add "sudo" in front of any docker command, lets make our user part of the Docker group, simply issuing the following command:

sudo usermod -a -G docker ec2-user

To check if everything is working, just check the docker info to retrieve some information:

docker info

If you receive a "permission denied" error trying the command above, don't panic, the only think you need is logout and login again.

Now we are ready to start working with Docker images and ECR and ECS service !!!

First thing we need is a file called Dockerfile, where we will describe the base image for our container all the things we need to install to run our app.
You can use any file editor, create the Docker file with the following example:

FROM ubuntu:22.04

# Update container image and install dependencies
RUN apt-get update && \
 apt-get -y install apache2

# Install apache and write a message in the index.html file
RUN echo 'Welcome to my DEV.TO article about container on AWS ECS !!!' > /var/www/html/index.html

# Configure apache
RUN echo '. /etc/apache2/envvars' > /root/run_apache.sh && \
 echo 'mkdir -p /var/run/apache2' >> /root/run_apache.sh && \
 echo 'mkdir -p /var/lock/apache2' >> /root/run_apache.sh && \ 
 echo '/usr/sbin/apache2 -D FOREGROUND' >> /root/run_apache.sh && \ 
 chmod 755 /root/run_apache.sh

EXPOSE 80

CMD /root/run_apache.sh

Now it is time to use this Dockerfile and build our image giving it a tag (basically a name for our image). Lets tag it my-ecs-container, so issue the following command (make sure that you are in the directory where the Dockerfile resides):

docker build -t my-ecs-container .

As soon as the command completes successfuly, you will see a message like this:

To make sure the image is ready, we can check with the following command:

docker image ls

You should be able to see ou image my-ecs-container as follows:

Lets recapture what we have done so far:

installed Docker service in our environment
created a Dockerfile
built the docker image and tagged it
have the image ready locally

It is a good point to test our image, right ?
So, lets run this image and see if that works as expected. Just issue the following command:

docker container run -dt -p 80:80 my-ecs-container

The output should be the container id that is currently running:

To make sure everything is working properly, lets open a browser, paste the public IP from our environment and see if the Welcome message is displayed:

Great ! Our container image was successfully built and our container is running as expected !

Now it is time to visit the AWS ECR service :-)

We currently have our image locally with us, so we need to push it to a repository where it can be safely pushed and pulled whenever we need it.
Here, ECR comes into picture. We are ready to push our built image to an ECR repo.

To have this task done, we first need to create an ECR repo, so lets do that. For that, you can use the AWS console to do that visually or you can create using CLI with the following command:

aws ecr create-repository --repository-name my-ecs-container-repo --region us-east-1

You will receive an output like that:

Now that we have our ECR repository available, we need to push our container image to that repo. To do that, the image needs to follow a standard name, basically specifying account id, region and repository name, like that:

<aws_account_id>.dkr.ecr.region.amazonaws.com/<repository-name>

So, before pushing the image to the ECR, lets give that a proper name tagging it using the docker tag command:

docker tag my-ecs-container <aws_account_id>.dkr.ecr.us-east-1.amazonaws.com/my-ecs-container-repo

To verify the new image is tagged with the standard name, just issue the following command:

docker image ls

Next step ! We need to login to our ECR repository to push the image. To do that, we issue the following command:

docker login -u AWS -p $(aws ecr get-login-password --region REGION) aws_account_id.dkr.ecr.REGION.amazonaws.com

Make sure to replace the values REGION and aws_account_id for the proper values. You should have the following output:

Finally we are able to push our image to the ECR repo and make it secure and ready to be used for example by AWS ECS service (we wil talk about that service in another article). Lets do that, just issue the following command:

docker push aws_account_id.dkr.ecr.region.amazonaws.com/my-ecs-container-repo

Make sure to replace with the proper values for the image name. You should have the following output:

If you want to validate our job, you can run your container pulling the image from the ECR repo. Lets give a try, open a browser, paste the public IP from our environment and see if the Welcome message is displayed:

we are finally done with our mission to have a container image pushed to and pulled from an ECR repository !!!

In the next article, let's play with AWS ECS service.

You did a great job. Thank you so much for follow me in this article and see you in the next.

sources:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-container-image.html
https://docs.aws.amazon.com/AmazonECR/latest/userguide/what-is-ecr.html