Running containers in AWS
- 1. Running Containers in AWS ECS, EKS, FARGATE, ELASTIC BEANSTALK ETC.
- 2. About me Andrew May Cloud Solutions Lead and Senior Solutions Architect at Leading EDJE AWS Academy instructor at Columbus State Community College
- 3. Docker Service Elastic Container Service (ECS) EC2 Fargate EKS Elastic Beanstalk Single Multi Discovery CloudMap AppMesh Transient AWS Batch CodeBuild
- 4. This is not an “Intro to Docker”
- 5. …but you may find this useful: Best Practices and Tips for Building Images Columbus Docker User Group ◦Wednesday March 27th - 6pm ◦Here at Leading EDJE office
- 8. ECR “Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images.”
- 9. Elastic Container Registry (ECR) ECR is a Docker registry hosted within AWS in each region ◦ Images are stored close to where your containers will run Images are secured using AWS IAM Policies, the service running the containers, or an AWS IAM User must be granted access The Elastic Container Registry contains a Repository for each image, a Repository can store many versions of that image Lifecycle Policies can be used to clean up old versions of images (you pay for the amount of storage you use in ECR, and images are often >100 MB) Login using AWS CLI (`aws ecr get-login --no-include-email –profile … --region us-east-1`), use standard Docker commands to pull and push Image names are prefixed by ECR Repository URL (<account>.dkr.ecr.<region>.amazonaws.com)
- 10. Repository storing multiple versions
- 11. Orchestration When running a production service, it’s no longer sufficient to manually start Docker containers. Orchestration is the management of the container lifecycles.
- 12. Orchestration provides: ➢Configuration ➢Scheduling ➢Deployment ➢Scaling ➢Storage (Volume) mapping ➢Secret management ➢High Availability ➢Load balancing integration
- 13. Managed Orchestration options (AWS)
- 14. ECS “Amazon Elastic Container Service is a highly scalable, high-performance container orchestration service that supports Docker containers and allows you to easily run and scale containerized applications on AWS”
- 15. Elastic Container Service (ECS) Original AWS Service for running containers ◦ Before it was made a public service, was the basis for Lambda functions launched a year earlier ECS Service is free, you only pay for the resources (EC2/Fargate) that are used with ECS Strong integration with other AWS Services, in particular: ◦ IAM permissions at container (task) level ◦ Load balancers (ELB/ALB/NLB) AutoScaling of containers (similar to EC2 AutoScaling)
- 16. • ECS can use either EC2 instances or Fargate to run Docker containers • Container Instances = ECS Instances = EC2 Instances • Tasks have 1 or more running Containers • Tasks are defined by Task Definitions
- 17. Task Definition and Tasks ❖ The Task Definition is a Template for a Task, that will run one or more Container ❖ The Task Definition will reference the Container Image that will be pulled from ECR (or Dockerhub) ❖ The ECS Agent pulls this image to start the containers for the Task ❖ Also specifies Port mappings, CPU/Memory requirements, Volumes etc. ❖ Specifies whether it runs on EC2 or Fargate ❖ Task Definitions are versioned
- 18. Application Load Balancer Integration with ECS Services ❖ ECS Services are long running Tasks (e.g. Webservers) ❖ Docker Containers have a container port (e.g. 80) and a host port ❖ Host ports can be predefined or if zero is specified in Task Definition it will use an ephemeral port ❖ ALB Target Group registered with Service will automatically be updated with correct port on EC2 instance when new container starts
- 19. Other ECS Benefits ECS Infrastructure can be created using CloudFormation Updating a Service to use a new Task Definition will perform a Blue-Green deployment ◦ New Tasks are started and must be healthy (e.g. via ALB healthcheck) before old Tasks are stopped Task Placement can distribute across AZs or binpack ◦ Can also have non homogeneous clusters with different instance types and control where tasks run DAEMON Services can be used for running agents (e.g. XRay) on each EC2 instance in cluster, rather than including in each Task Definition as a “sidecar” Metrics collected in CloudWatch, and logs can go to CloudWatch Logs or other destinations
- 20. Fargate “AWS Fargate is a compute engine for Amazon ECS that allows you to run containers without having to manage servers”
- 21. Fargate “Serverless” option for running containers in an ECS Cluster ◦ Configure desired CPU/Memory and this will be guaranteed for that container ◦ Compare to using EC2 where you may be over/under provisioned Configuration uses Task Definitions, with only minor changes from running on EC2 Networking is always awsvpc – i.e. it will use an ENI per instance (one of your subnet IPs) Because there is no shared server, can no longer run DAEMON tasks ◦ Can still run “sidecar” containers that are defined in the shared task definition Scaling at a task level is similar to when using EC2 instances, but without the complexity of scaling the underlying EC2 AutoScaling group(s)
- 22. Fargate Pricing Fargate was expensive when launched, but the Firecracker VM technology has allowed AWS to reduce costs ◦ vCPU $0.04048/hour Memory $0.004445/GB hour ◦ Still expensive compared to well utilized EC2, especially if using reserved instances Tech10 (https://www.trek10.com/blog/fargate-pricing-vs-ec2/) produced a pricing comparison that compares EC2 and Fargate pricing for ECS ◦ With recent price reductions, Fargate is comparable in price to on-demand EC2 instances with ~70% utilization ◦ EC2 reserved instances are considerably cheaper, but will typically only be used for baseline load
- 23. EKS “Amazon Elastic Container Service for Kubernetes (Amazon EKS) makes it easy to deploy, manage, and scale containerized applications using Kubernetes on AWS.”
- 24. Kubernetes Predominant Docker Orchestration service Managed Kubernetes available in: ◦ Google Cloud Platform (Google Kubernetes Engine) ◦ Microsoft Azure (Azure Kubernetes Service – AKS) ◦ Amazon Web Services (EKS) The GCP offering is the most mature, AKS and EKS were both launched in 2018 Support for running Kubernetes clusters on EC2 and integrating with other services (e.g. ELB) has existed for longer than EKS has been available
- 25. What does EKS manage? EKS manages three Kubernetes master instances across AZs to provide high availability
- 26. Using EKS Cluster creation can be automated with CloudFormation, and AWS provides sample templates Cluster requires: ◦ VPC with public/private subnets to run in, and security group used for control plane ◦ EKS Service IAM role (allows cluster to create load balancers etc.) ◦ EKS Cluster (the master instances managed by AWS) ◦ Node instances – use EKS AMI that runs a bootstrap to register with cluster Once Cluster created, configure kubectl with access to cluster and use normal Kubernetes tools and templates to manage and deploy to the cluster EKS Cluster cost $0.20/hour (about $140/month)
- 27. Integration with other AWS Services Kubernetes (not specifically EKS) supports Classic ELBs and NLBs, but not ALBs ◦ Can use Nginx Ingress (with ELB) or aws-alb-ingress-controller Integrating with IAM to provide “pod” level permissions requires installing kube2Iam Registering created load balancers with Route 53 requires installing external-dns Making logs accessible requires Fluentd or another service to be installed Metrics collections requires additional services to be installed You may need to install Helm to install some of these other services All of these extra service that need to be run, consume memory/CPU on worker nodes
- 28. Cloud Portability One of the promises of Kubernetes is the ability to run applications in the same way across different Cloud platforms There significant variations between what is supported across AWS, GCP and Azure, and what services are preinstalled as part of managed clusters Running the same service across multiple Cloud platforms requires using platform specific annotations However, most of those differences are hidden from the running applications that can operate the same way across platforms
- 29. Elastic Beanstalk “AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS.”
- 30. Elastic Beanstalk Elastic Beanstalk is a Platform-as-a-Service (PaaS) for a variety of languages and services Aims to make it easy to migrate applications to AWS Manages underlying infrastructure, high availability, deployments, logging etc. ◦ Can also create databases and other related services
- 31. Elastic Beanstalk Docker support Single Container (version 1) Launched in 2014 (before ECS) Runs single container per EC2 instance Uses Nginx as proxy to container Upload source code including Dockerfile and it will build and deploy container OR Upload configuration file referencing image stored in Docker registry Multiple Container (version 2) Launched in 2015 Runs containers on ECS Can only reference prebuilt images stored in a Docker registry Can upload files that are mounted as container volumes as part of the deployment bundle
- 32. AWS CloudMap “AWS Cloud Map is a cloud resource discovery service. With Cloud Map, you can define custom names for your application resources, and it maintains the updated location of these dynamically changing resources.”
- 33. CloudMap AWS CloudMap superceeds Service Discovery for ECS ◦ Launched in May 2018, Service Discovery for ECS registered running tasks in a Route 53 namespace (hosted zone), creating A (IP) and SRV (IP and Port) records ◦ Query DNS for available services ◦ ECS Tasks must use awsvpc networking, either using Fargate or the limited number of ENIs available per EC2 instance AWS CloudMap builds the previous service to add an API based system that still supports DNS, but is no longer reliant upon it, allowing it to be used for resources where DNS does not apply ◦ Supports a variety of services including ECS, EKS, S3, SQS, Lambda, Load Balancers ◦ ECS Tasks with Service discovery enabled automatically enrolled in CloudMap ◦ EKS support via External DNS Similar to the Service Discovery portions of Hashicorp Consul
- 34. CloudMap
- 35. CloudMap
- 36. AWS AppMesh (BETA) “AWS App Mesh makes it easy to monitor and control microservices running on AWS. App Mesh standardizes how your microservices communicate, giving you end-to-end visibility and helping to ensure high-availability for your applications.”
- 37. AppMesh Available in public Beta, but still in very early stages Service Mesh implementation for AWS, using the Open Source Envoy proxy, but a custom Control Plane Manage connectivity between microservices, including traffic shaping functionality like: ◦ Routing: Canary and A/B Testing ◦ Load Balancing and Service Discovery ◦ Handling Failures (Retry, Circuit Breaker) Integration with CloudMap for Service Discovery Logging and Tracing (CloudWatch, X-Ray)
- 38. AppMesh
- 39. AWS Batch “AWS Batch enables developers, scientists, and engineers to easily and efficiently run hundreds of thousands of batch computing jobs on AWS.”
- 40. AWS Batch Batch service that automatically provisions computing resources to run Jobs Job = Unit of work: shell script, Linux executable or Docker container image Job Definition = How jobs are run: IAM Role, CPU/Memory requirements ◦ Similar to ECS Task Definition Job Queue = Queue of jobs to run, can have multiple queues (e.g. different priorities) Jobs are run using Docker containers utilizing ECS technology ◦ EC2 instances for running containers are automatically managed ◦ Can use EC2 spot instances to reduce costs
- 41. AWS CodeBuild “AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy.”
- 42. AWS CodeBuild Docker based build/test environment ◦ All steps run in docker containers, either provided codebuild containers for common build tools, or custom images from ECR/Dockerhub ◦ Support for Windows (e.g. .NET Framework) builds using Windows containers on Windows Server Commonly integrated with CodePipeline Scales automatically rather than provisioning agents Pay for build minutes ◦ First 100 build minutes (smallest instance type) per month free
- 43. Questions?