amazon-elb - ECS 和应用程序负载均衡器未使用 Terraform 注册临时端口

Question

我正在 ECS 上使用 Docker 创建应用程序。我有以下 Terraform 文件(为了便于阅读而连接):

resource "aws_ecs_cluster" "my-cluster" {
  name = "my-cluster"
}

resource "aws_launch_configuration" "ecs" {
  name = "ECS Cluster"
  image_id = "ami-1c002379"
  instance_type = "m4.xlarge"
  security_groups = ["sg-4218de2a"]
  iam_instance_profile = "${aws_iam_instance_profile.ecs.name}"
  # TODO: is there a good way to make the key configurable sanely?
  key_name = "my-key"
  associate_public_ip_address = true
  user_data = "#!/bin/bash\necho ECS_CLUSTER='${aws_ecs_cluster.my-cluster.name}' > /etc/ecs/ecs.config"
}

resource "aws_iam_role" "ecs_host_role" {
  name = "ecs_host_role"
  assume_role_policy = "${file("policies/ecs-role.json")}"
}

resource "aws_iam_role_policy" "ecs_instance_role_policy" {
  name = "ecs_instance_role_policy"
  policy = "${file("policies/ecs-instance-role-policy.json")}"
  role = "${aws_iam_role.ecs_host_role.id}"
}

resource "aws_iam_policy_attachment" "ecs_for_ec2" {
  name = "ecs-for-ec2"
  roles = ["${aws_iam_role.ecs_host_role.id}"]
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
}

resource "aws_iam_role" "ecs_service_role" {
  name = "ecs_service_role"
  assume_role_policy = "${file("policies/ecs-role.json")}"
}

resource "aws_iam_role_policy" "ecs_service_role_policy" {
  name = "ecs_service_role_policy"
  policy = "${file("policies/ecs-service-role-policy.json")}"
  role = "${aws_iam_role.ecs_service_role.id}"
}

resource "aws_iam_instance_profile" "ecs" {
  name = "ecs-instance-profile"
  path = "/"
  role = "${aws_iam_role.ecs_host_role.name}"
}

resource "aws_autoscaling_group" "ecs-cluster" {
  availability_zones = ["us-east-2a", "us-east-2b"]
  name = "ECS ${aws_ecs_cluster.my-cluster.name}"
  min_size = "1"
  max_size = "2"
  desired_capacity = "1"
  health_check_type = "EC2"
  launch_configuration = "${aws_launch_configuration.ecs.name}"
  vpc_zone_identifier = ["subnet-8e9abce7"]
}

resource "aws_alb" "front-end" {
  name            = "alb"
  internal        = false
  security_groups = ["sg-4218de2a"]
  subnets         = ["subnet-8e9abce7", "subnet-e11d779a"]

  enable_deletion_protection = true
}

resource "aws_alb_listener" "front_end" {
  load_balancer_arn = "${aws_alb.front-end.arn}"
  port              = "80"
  protocol          = "HTTP"

  default_action {
    target_group_arn = "${aws_alb_target_group.fe-tg.arn}"
    type             = "forward"
  }
}

resource "aws_alb_target_group" "fe-tg" {
  name     = "fe-tg"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = "vpc-22eeb84b"
  health_check {
    path  = "/poc/healthy.html"
  }
}


resource "aws_autoscaling_attachment" "asg_attachment_bar" {
  autoscaling_group_name = "${aws_autoscaling_group.ecs-cluster.name}"
  alb_target_group_arn   = "${aws_alb_target_group.fe-tg.arn}"
}

resource "template_file" "task_container_definition" {
  template = "${file("container-defintion.json.tpl")}"

  vars {
    aws_region = "${var.region}"
    aws_account = "${var.account}"
    image = "${var.image}"
    tag = "${var.tag}"
  }
}


resource "aws_ecs_task_definition" "my-td" {
  family = "my-task"
  container_definitions = "${template_file.task_container_definition.rendered}"
}

resource "aws_ecs_service" "poc" {
  name            = "poc-v4"
  cluster         = "${aws_ecs_cluster.my-cluster.name}"
  task_definition = "${aws_ecs_task_definition.my-td.arn}"
  desired_count   = 3
  iam_role        = "${aws_iam_role.ecs_service_role.arn}"

  depends_on = ["aws_iam_role_policy.ecs_service_role_policy", "aws_alb_listener.front_end"]

  deployment_maximum_percent = 200
  deployment_minimum_healthy_percent = 51

  load_balancer {
    target_group_arn = "${aws_alb_target_group.fe-tg.id}"
    container_name = "greeter"
    container_port = 0
  }

  placement_constraints {
    type       = "memberOf"
    expression = "attribute:ecs.availability-zone in [us-east-2a, us-east-2b]"
  }

  placement_strategy {
    type  = "binpack"
    field = "cpu"
  }
}

任务定义模板:

[{
  "environment": [],
"name": "greeter",
"mountPoints": [],
"image": "${aws_account}.dkr.ecr.${aws_region}.amazonaws.com/${image}:${tag}",
"cpu": 0,
"portMappings": [
{
"containerPort": 8080, "hostPort": 0
}
],
"memory": 2048,
        "memoryReservation": 1024,
"essential": true,
"volumesFrom": []
}]

我要求 ECS 在我的服务中启动至少 3 个任务。但是，由于某种原因，我的应用程序负载均衡器没有将临时端口纳入运行状况检查。它放置的是实际的 tomcat 端口(8080)。

当我手动创建服务时，它工作得很好，但使用 Terraform 时却不行。有什么突出的吗？

Answer 1

是的，我看到了这个设置。资源aws_alb_listener仅用于定义默认规则(最后一个、最低优先级规则)

请添加资源aws_alb_listener_rule，示例代码:

resource "aws_alb_listener_rule" "static" {
  listener_arn = "${aws_alb_listener.front_end.arn}"
  priority     = 100

  action {
    type             = "forward"
    target_group_arn = "${aws_alb_target_group.fe-tg.arn}"
  }

  condition {
    field  = "path-pattern"
    values = ["/static/*"]
  }
}

您可以添加更多具有不同优先级(100、101、102...)的资源aws_alb_listener_rule。

有了它，您应该可以正确获取动态端口。