时间戳

首页 > 解决方案 > 无法创建具有自动缩放功能的 Ec2 实例并将其注册到 ECS 集群

amazon-web-services - 无法创建具有自动缩放功能的 Ec2 实例并将其注册到 ECS 集群

问题描述

您好我正在尝试创建一个包含服务和任务的集群。我在 Ecr 中有一个连接到 redis 容器的 python 应用程序。问题是我无法使用自动缩放创建 ec2 实例。Myservice在集群和自动缩放中不会构建。

簇：

---
AWSTemplateFormatVersion: 2010-09-09 
Parameters:
    Alb:
      Type: String
    DefaultTargetGroup:
      Type: String
    ECSServiceRole:
      Type: String
    Task:
      Type: String
Resources:
    MyCluster:
        Type: AWS::ECS::Cluster
        Properties: 
            ClusterName: Flask-redis
    Myservice:
        Type: AWS::ECS::Service
        Properties: 
            Cluster: !Ref MyCluster        
            DeploymentController:   
                Type: ECS
            DesiredCount: 2
            LaunchType: EC2
            LoadBalancers: 
                - ContainerName: python
                  ContainerPort: 5000
                  TargetGroupArn: !Ref DefaultTargetGroup
            Role: !Ref ECSServiceRole
            SchedulingStrategy: REPLICA
            ServiceName: Python-service
            TaskDefinition: !Ref Task

自动缩放：

---
AWSTemplateFormatVersion: 2010-09-09
Parameters:
  SubnetA:
    Type: String
  SubnetB:
    Type: String
  VpcID:
    Type: String
  Albsg:
    Type: String
  Alb:
    Type: String
  ECSServiceRole:
    Type: String

Resources:
  wahajwebserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: wahaj-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref Albsg
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VpcID
  ec2instance:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
    #   UserData:
    #     Fn::Base64: !Sub |
    #     #!/bin/bash -xe
    #     echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
    #     yum install -y aws-cfn-bootstrap
    #     /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region}
        BlockDeviceMappings:
          - DeviceName: /dev/xvda
            Ebs:
                DeleteOnTermination: "true"
                VolumeSize: "8"
                VolumeType: gp2
        ImageId: ami-0bdcc6c05dec346bf
        InstanceType: t2.small
        IamInstanceProfile: !Ref ECSServiceRole
        KeyName: wahaj(webserver)
        SecurityGroups:
            - Ref: wahajwebserver
  myASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
        AvailabilityZones:
            - "us-east-2a"
            - "us-east-2b"
        AutoScalingGroupName: myASG
        LoadBalancerNames:
            - Ref: Alb
        MinSize: "2"
        MaxSize: "2"
        DesiredCapacity: "2"
        HealthCheckGracePeriod: 300
        LaunchConfigurationName:
            Ref: ec2instance
        VPCZoneIdentifier:
            - Ref: "SubnetA"
            - Ref: "SubnetB"

任务：

---
AWSTemplateFormatVersion: 2010-09-09 
Parameters:
    ExRole:
        Type: String
Resources:
    Task:
        Type: AWS::ECS::TaskDefinition
        Properties:
            Family: redis-python 
            Cpu: 1 vCPU
            ExecutionRoleArn: !Ref ExRole
            Memory: 1 GB
            NetworkMode: bridge
            RequiresCompatibilities:
                - EC2
            TaskRoleArn: !Ref ExRole
            ContainerDefinitions: 
              - Essential: true
                Image: redis:latest
                Name: redis 
              - Essential: true
                Image: 021146125185.dkr.ecr.us-east-2.amazonaws.com/python-app:latest
                Name: python
                PortMappings:  
                  - ContainerPort: 5000
                    HostPort: 0
                    Protocol: tcp
                DependsOn:
                   - Condition: START  
                     ContainerName: redis
                Links: 
                   - redis            
Outputs:
  Task:
    Description: Contains all the task specifications
    Value: !Ref Task
    Export:
      Name: "Task"

应用负载均衡器：

---
AWSTemplateFormatVersion: 2010-09-09
Parameters:
    SubnetA:
      Type: String
    SubnetB:
      Type: String
    VpcID:
      Type: String
Resources:
    Albsg:
        Type: AWS::EC2::SecurityGroup
        Properties:
            GroupName: alb-sg
            VpcId: !Ref VpcID
            SecurityGroupIngress:
                - IpProtocol: tcp
                  FromPort: 22
                  ToPort: 22
                  CidrIp: 0.0.0.0/0
                  Description: For traffic from Internet
                - IpProtocol: tcp
                  FromPort: 80
                  ToPort: 80
                  CidrIp: 0.0.0.0/0
                  Description: For traffic from Internet
            GroupDescription: Security Group for demo server
    Alb:
        Type: AWS::ElasticLoadBalancingV2::LoadBalancer
        Properties: 
            IpAddressType: ipv4
            Name: Alb
            Scheme: internet-facing
            SecurityGroups: 
                - !Ref Albsg
            Subnets:
                - Ref: "SubnetA"
                - Ref: "SubnetB"
            Type: application
    DefaultTargetGroup:
        Type: AWS::ElasticLoadBalancingV2::TargetGroup
        DependsOn: Alb
        Properties:
            Name: alb-tg
            VpcId: !Ref VpcID
            Port: 80
            Protocol: HTTP
    LoadBalancerListener:
        Type: AWS::ElasticLoadBalancingV2::Listener
        Properties:
            LoadBalancerArn: !Ref Alb
            Port: 80
            Protocol: HTTP
            DefaultActions:
                - Type: forward
                  TargetGroupArn: !Ref DefaultTargetGroup
Outputs:
  Albsg:
    Description: security group for application load balancer
    Value: !Ref Albsg
    Export:
        Name: "Albsg"
  Alb:
    Description: application load balancer
    Value: !Ref Alb
    Export:
      Name: "Alb"
  DefaultTargetGroup:
    Description: Default Target Group
    Value: !Ref DefaultTargetGroup
    Export:
      Name: "DefaultTargetGroup"

角色：

---
AWSTemplateFormatVersion: 2010-09-09 
Resources:
    ECSServiceRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Effect: Allow
              Principal:
                Service: [ecs.amazonaws.com]
              Action: ['sts:AssumeRole']
          Path: /
          Policies:
          - PolicyName: ecs-service
            PolicyDocument:
              Statement:
              - Effect: Allow
                Action: ['elasticloadbalancing:DeregisterInstancesFromLoadBalancer', 'elasticloadbalancing:DeregisterTargets',
                  'elasticloadbalancing:Describe*', 'elasticloadbalancing:RegisterInstancesWithLoadBalancer',
                  'elasticloadbalancing:RegisterTargets', 'ec2:Describe*', 'ec2:AuthorizeSecurityGroupIngress']
                Resource: '*'
    ExRole:
        Type: 'AWS::IAM::Role'
        Properties:
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - ecs-tasks.amazonaws.com
                Action:
                  - 'sts:AssumeRole'
          Path: /
          ManagedPolicyArns:
            - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
          Policies: 
            - PolicyName: AccessECR
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Action: 
                      - ecr:BatchGetImage
                      - ecr:GetAuthorizationToken
                      - ecr:GetDownloadUrlForLayer 
                    Resource: '*'
Outputs:
  ExRole:
    Description: Task excution role
    Value: !Ref ExRole
    Export:
        Name: "ExRole"
  ECSServiceRole:
    Description: application load balancer
    Value: !Ref ECSServiceRole
    Export:
      Name: "ECSServiceRole"

我无法使用自动缩放创建 Ec2 实例并将它们注册到 ECS 集群。任何帮助，将不胜感激。

标签： amazon-web-servicesamazon-ec2amazon-ecsautoscalingaws-application-load-balancer

解决方案

由于您没有提供任何错误消息，因此最初查看Autoscaling模板会显示几个问题。

负载均衡器名称

        LoadBalancerNames:
            - Ref: Alb

这仅适用于 CLB，但您正在使用 ALB。对于 ALB，您应该使用TargetGroupARNs参数。

用户数据

你注释掉了UserData. 不知道为什么？它应该在那里，因为您应该向集群注册实例。我猜是因为错误？见下文。

cfn信号

在 UserData 中，您正在使用--resource ECSAutoScalingGroup. 但应该是--resource myASG

ASG 和创作政策

cfn-signal没有效果，因为您的 ASG 缺少CreationPolicy。

ECSC集群

再次在UserData:ECSCluster中没有定义对的引用。

图像标识

只是看看ami-0bdcc6c05dec346bf我不确定这是否是 ECS 优化的 AMI。这必须检查。

ECS服务角色

它的形式没有显示。可能不正确，甚至完全缺失。

更新和固定模板

经过进一步检查，发现了更多问题。仅举几例：

  • 缺少实例配置文件
  • 缺少/错误的容器实例角色
  • 不正确的安全组
  • 不使用ImportValue
  • 缺少一些输出出口

固定和修改的模板在us-east-1默认 VPC 中进行了测试。除非调整 AMI，否则它不会在任何其他地区工作。此外，由于缺少您的 ECR 映像，我不得不使用自己的端口创建自己的映像，因此我还必须对其进行修改以尝试验证。

角色

---
AWSTemplateFormatVersion: 2010-09-09 
Resources:

  ExRole:
      Type: 'AWS::IAM::Role'
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - ecs-tasks.amazonaws.com
              Action:
                - 'sts:AssumeRole'
        Path: /
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
        Policies: 
          - PolicyName: AccessECR
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: 
                    - ecr:BatchGetImage
                    - ecr:GetAuthorizationToken
                    - ecr:GetDownloadUrlForLayer 
                  Resource: '*'

  ContainerInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'               
        Statement:
          - Effect: Allow
            Principal: {'Service': ['ec2.amazonaws.com']}
            Action: ['sts:AssumeRole']
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
      Path: '/'

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: 
      Roles: 
        - !Ref ContainerInstanceRole      

Outputs:
  
  ExRole:
    Description: Task excution role
    Value: !Ref ExRole
    Export:
        Name: "ExRole"


  InstanceProfile:
    Description: profile for container instances
    Value: !Ref InstanceProfile
    Export:
        Name: "InstanceProfile"

alb

---
AWSTemplateFormatVersion: 2010-09-09
Parameters:
    SubnetA:
      Type: AWS::EC2::Subnet::Id
    SubnetB:
      Type: AWS::EC2::Subnet::Id
    VpcID:
      Type: AWS::EC2::VPC::Id
Resources:
    Albsg:
        Type: AWS::EC2::SecurityGroup
        Properties:
            GroupName: alb-sg
            VpcId: !Ref VpcID
            SecurityGroupIngress:
                - IpProtocol: tcp
                  FromPort: 80
                  ToPort: 80
                  CidrIp: 0.0.0.0/0
                  Description: For traffic from Internet
            GroupDescription: Security Group for demo server
    Alb:
        Type: AWS::ElasticLoadBalancingV2::LoadBalancer
        Properties: 
            IpAddressType: ipv4
            Name: Alb
            Scheme: internet-facing
            SecurityGroups: 
                - !Ref Albsg
            Subnets:
                - Ref: "SubnetA"
                - Ref: "SubnetB"
            Type: application
    DefaultTargetGroup:
        Type: AWS::ElasticLoadBalancingV2::TargetGroup
        DependsOn: Alb
        Properties:
            Name: alb-tg
            VpcId: !Ref VpcID
            Port: 8080
            Protocol: HTTP
    LoadBalancerListener:
        Type: AWS::ElasticLoadBalancingV2::Listener
        Properties:
            LoadBalancerArn: !Ref Alb
            Port: 80
            Protocol: HTTP
            DefaultActions:
                - Type: forward
                  TargetGroupArn: !Ref DefaultTargetGroup
Outputs:
  Albsg:
    Description: security group for application load balancer
    Value: !Ref Albsg
    Export:
        Name: "Albsg"
  Alb:
    Description: application load balancer
    Value: !Ref Alb
    Export:
      Name: "Alb"
  DefaultTargetGroup:
    Description: Default Target Group
    Value: !Ref DefaultTargetGroup
    Export:
      Name: "DefaultTargetGroup"

  SubnetA:
    Value: !Ref SubnetA
    Export:
        Name: "SubnetA"
  SubnetB:
    Value: !Ref SubnetB
    Export:
        Name: "SubnetB"
  VpcID:
    Value: !Ref VpcID
    Export:
        Name: "VpcID"

任务

---
AWSTemplateFormatVersion: 2010-09-09 

Resources:
    Task:
        Type: AWS::ECS::TaskDefinition
        Properties:
            Family: redis-python 
            Cpu: 1 vCPU
            ExecutionRoleArn: !ImportValue ExRole
            Memory: 1 GB
            NetworkMode: bridge
            RequiresCompatibilities:
                - EC2
            TaskRoleArn: !ImportValue ExRole
            ContainerDefinitions: 
              - Essential: true
                Image: redis:latest
                Name: redis 
              - Essential: true
                Image: xxxxxx.dkr.ecr.us-east-1.amazonaws.com/xxxxxx:latest
                Name: python
                PortMappings:  
                  - ContainerPort: 8080
                    #HostPort: 0
                    Protocol: tcp
                DependsOn:
                   - Condition: START  
                     ContainerName: redis
                Links: 
                   - redis            
Outputs:
  Task:
    Description: Contains all the task specifications
    Value: !Ref Task
    Export:
      Name: "Task"

service_and_asg

---
AWSTemplateFormatVersion: 2010-09-09

Parameters:

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Default: wahajwebserver

  DesiredCapacity:
    Type: Number
    Default: 2

  MinSize:
    Type: Number
    Default: 1

  MaxSize:
    Type: Number
    Default: 4  


Resources:

  MyCluster:
      Type: AWS::ECS::Cluster
      Properties: {}

  wahajwebserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      #GroupName: wahaj-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          SourceSecurityGroupId: !ImportValue Albsg
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !ImportValue VpcID

  Myservice:
      Type: AWS::ECS::Service
      Properties: 
          Cluster: !Ref MyCluster        
          DeploymentController:   
              Type: ECS
          DesiredCount: 2
          LaunchType: EC2
          LoadBalancers: 
              - ContainerName: python
                ContainerPort: 8080
                TargetGroupArn: !ImportValue DefaultTargetGroup
          #Role: !Ref ECSServiceRole
          SchedulingStrategy: REPLICA
          #ServiceName: Python-service
          TaskDefinition: !ImportValue Task

  ec2instance:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe

          yum update -y && yum install -y aws-cfn-bootstrap 

          echo ECS_CLUSTER=${MyCluster} >> /etc/ecs/ecs.config
          echo ECS_BACKEND_HOST= >> /etc/ecs/ecs.config           

          /opt/aws/bin/cfn-signal -e $? \
                --stack ${AWS::StackName} \
                --resource myASG \
                --region ${AWS::Region}

      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: 30
            VolumeType: gp2
      ImageId: ami-07a63940735aebd38 # before ami-0bdcc6c05dec346bf
      InstanceType: t2.small
      IamInstanceProfile: !ImportValue InstanceProfile
      KeyName: !Ref KeyName
      SecurityGroups:
          - Ref: wahajwebserver

  myASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    CreationPolicy:
      ResourceSignal:
        Timeout: PT5M
        Count: !Ref DesiredCapacity
    Properties:
      #AutoScalingGroupName: myASG
      MinSize: !Ref MinSize
      MaxSize: !Ref MaxSize
      DesiredCapacity: !Ref DesiredCapacity
      HealthCheckGracePeriod: 300
      LaunchConfigurationName:
        Ref: ec2instance
      VPCZoneIdentifier:
        - !ImportValue SubnetA
        - !ImportValue SubnetB
      TargetGroupARNs:
        - !ImportValue DefaultTargetGroup

ECS 集群有两个任务和两个任务的截图（每个实例上有一个任务）

在此处输入图像描述

推荐阅读