将FargateService部署到生活在不同堆栈中的ECS (序言)

Question

1-我有一个项目core-infra，它包含所有的核心下相关组件(VPCs、子网、ECS Cluster...etc)。

2-我有一些微型服务项目，每个项目都有独立的堆栈用于部署。

• 我想将微服务项目堆栈FargateService从A部署到已经存在的居住在核心-infra堆栈中的ECS。

受影响地区/特征

• 普鲁米服务
• ECS
• 部署微服务
• FargateService

普利米github发行链接

Answer 1

Pulumi引用是这里的答案：https://www.pulumi.com/docs/intro/concepts/stack/#stackreferences

您的核心下堆栈将输出ECS集群ID，然后堆栈B使用该输出，例如，它可以将ECS服务部署到给定的集群(https://www.pulumi.com/registry/packages/aws/api-docs/ecs/service/)。

Answer 2

我能够使用aws classic进行部署。PS:与awsx相比，设置要复杂得多，文档和资源并非详尽无遗。

现在我没有什么问题：

• 负载平衡器无法到达，并且一直在加载
• 我在CloudWatch LogGoup中没有任何日志
• 不确定如何在ECS服务中使用LB Listner /不确定端口映射

这是完整的代码，供参考(那些正在忙碌的人)，如果你能建议任何改进/答案，我将不胜感激。

// Capture the EnvVars
const appName = process.env.APP_NAME;
const namespace = process.env.NAMESPACE;
const environment = process.env.ENVIRONMENT;

// Load the Deployment Environment config.
const configMapLoader = new ConfigMapLoader(namespace, environment);

const env = pulumi.getStack();
const infra = new pulumi.StackReference(`org/core-datainfra/${env}`);

// Fetch ECS Fargate cluster ID.
const ecsClusterId = infra.getOutput('ecsClusterId');

// Fetch DeVpc ID.
const deVpcId = infra.getOutput('deVpcId');

// Fetch DeVpc subnets IDS.
const subnets = ['subnet-aaaaaaaaaa', 'subnet-bbbbbbbbb'];

// Fetch DeVpc Security Group ID.
const securityGroupId = infra.getOutput('deSecurityGroupId');

// Define the Networking for our service.
const serviceLb = new aws.lb.LoadBalancer(`${appName}-lb`, {
    internal: false,
    loadBalancerType: 'application',
    securityGroups: [securityGroupId],
    subnets,
    enableDeletionProtection: false,
    tags: {
        Environment: environment
    }
});
const serviceTargetGroup = new aws.lb.TargetGroup(`${appName}-t-g`, {
    port: configMapLoader.configMap.service.http.externalPort,
    protocol: configMapLoader.configMap.service.http.protocol,
    vpcId: deVpcId,
    targetType: 'ip'
});
const http = new aws.lb.Listener(`${appName}-listener`, {
    loadBalancerArn: serviceLb.arn,
    port: configMapLoader.configMap.service.http.externalPort,
    protocol: configMapLoader.configMap.service.http.protocol,
    defaultActions: [
        {
            type: 'forward',
            targetGroupArn: serviceTargetGroup.arn
        }
    ]
});

// Create AmazonECSTaskExecutionRolePolicy
const taskExecutionPolicy = new aws.iam.Policy(
    `${appName}-task-execution-policy`,
    {
        policy: JSON.stringify({
            Version: '2012-10-17',
            Statement: [
                {
                    Effect: 'Allow',
                    Action: [
                        'ecr:GetAuthorizationToken',
                        'ecr:BatchCheckLayerAvailability',
                        'ecr:GetDownloadUrlForLayer',
                        'ecr:BatchGetImage',
                        'logs:CreateLogStream',
                        'logs:PutLogEvents',
                        'ec2:AuthorizeSecurityGroupIngress',
                        'ec2:Describe*',
                        'elasticloadbalancing:DeregisterInstancesFromLoadBalancer',
                        'elasticloadbalancing:DeregisterTargets',
                        'elasticloadbalancing:Describe*',
                        'elasticloadbalancing:RegisterInstancesWithLoadBalancer',
                        'elasticloadbalancing:RegisterTargets'
                    ],
                    Resource: '*'
                }
            ]
        })
    }
);

//  IAM role that allows Amazon ECS to make calls to the load balancer
const taskExecutionRole = new aws.iam.Role(`${appName}-task-execution-role`, {
    assumeRolePolicy: JSON.stringify({
        Version: '2012-10-17',
        Statement: [
            {
                Effect: 'Allow',
                Principal: {
                    Service: ['ecs-tasks.amazonaws.com']
                },
                Action: 'sts:AssumeRole'
            },
            {
                Action: 'sts:AssumeRole',
                Principal: {
                    Service: 'ecs.amazonaws.com'
                },
                Effect: 'Allow',
                Sid: ''
            },
            {
                Action: 'sts:AssumeRole',
                Principal: {
                    Service: 'ec2.amazonaws.com'
                },
                Effect: 'Allow',
                Sid: ''
            }
        ]
    }),
    tags: {
        name: `${appName}-iam-role`
    }
});

new aws.iam.RolePolicyAttachment(`${appName}-role-policy`, {
    role: taskExecutionRole.name,
    policyArn: taskExecutionPolicy.arn
});

// New image to be pulled
const image = `${configMapLoader.configMap.service.image.repository}:${process.env.IMAGE_TAG}`;

// Set up Log Group
const awsLogGroup = new aws.cloudwatch.LogGroup(`${appName}-awslogs-group`, {
    name: `${appName}-awslogs-group`,
    tags: {
        Application: `${appName}`,
        Environment: 'production'
    }
});

const serviceTaskDefinition = new aws.ecs.TaskDefinition(
    `${appName}-task-definition`,
    {
        family: `${appName}-task-definition`,
        networkMode: 'awsvpc',
        executionRoleArn: taskExecutionRole.arn,
        requiresCompatibilities: ['FARGATE'],
        cpu: configMapLoader.configMap.service.resources.limits.cpu,
        memory: configMapLoader.configMap.service.resources.limits.memory,
        containerDefinitions: JSON.stringify([
            {
                name: `${appName}-fargate`,
                image,
                cpu: parseInt(
                    configMapLoader.configMap.service.resources.limits.cpu
                ),
                memory: parseInt(
                    configMapLoader.configMap.service.resources.limits.memory
                ),
                essential: true,
                portMappings: [
                    {
                        containerPort: 80,
                        hostPort: 80
                    }
                ],
                environment: configMapLoader.getConfigAsEnvironment(),
                logConfiguration: {
                    logDriver: 'awslogs',
                    options: {
                        'awslogs-group': `${appName}-awslogs-group`,
                        'awslogs-region': 'us-east-2',
                        'awslogs-stream-prefix': `${appName}`
                    }
                }
            }
        ])
    }
);

// Create a Fargate service task that can scale out.
const fargateService = new aws.ecs.Service(`${appName}-fargate`, {
    name: `${appName}-fargate`,
    cluster: ecsClusterId,
    taskDefinition: serviceTaskDefinition.arn,
    desiredCount: 5,
    loadBalancers: [
        {
            targetGroupArn: serviceTargetGroup.arn,
            containerName: `${appName}-fargate`,
            containerPort: configMapLoader.configMap.service.http.internalPort
        }
    ],
    networkConfiguration: {
        subnets
    }
});

// Export the Fargate Service Info.
export const fargateServiceName = fargateService.name;
export const fargateServiceUrl = serviceLb.dnsName;
export const fargateServiceId = fargateService.id;
export const fargateServiceImage = image;

​

​