现在 Fargate 支持 EFS，使用 Terraform 构建您的 WordPress 环境

我叫寺冈，是一名基础设施工程师。

AWS拥​​有一项名为“ Amazon ECS”的服务，有两种启动模式：“ Amazon EC2”和“ AWS Fargate”。

Fargate是AWS提供的完全托管的容器执行环境，这很方便，因为它消除了群集管理的需求。在停止服务的同时。

● Fargate任务存储

当此次测试的WordPress在容器中启动时，已发布文章中使用的所有图像都将保存到本地卷中，因此，如果删除存储空间，这将是一个问题。

如果您仍然想使用Fargate，因为它很方便，我们对您有个好消息。
Fargate从平台版本1.4开始支持EFS端点。

● AWS Fargate发布平台1.4版

这样，似乎可以在保留持久数据的同时共享容器之间的数据。
我实际上尝试了。

这次测试了配置

如果您遵循本文中的说明，最终将获得这样的配置：

所有构造均使用Terraform完成，因此代码在下面编写。
Terraform版本为“ 0.12.24”。
使用它作为参考时请小心。

我写的代码

目录结构在下面。

$ TREE。 Fargate_task_assume_role.json│││││││││││││││││ ├ - ─triables.tf└└─..pc.tf2目录，16个文件

提供商.tf

提供商“aws” { access_key = var.access_key Secret_key = var.secret_key 区域 = var.region Should_role { role_arn = var.role_arn } }

变量.tf

#################### # 提供程序 ###################### 变量 "access_key" { 描述 = " AWS 访问密钥" } 变量 "secret_key" { 描述 = "AWS 密钥" } 变量 "role_arn" { 描述 = "AWS Role Arn" } 变量 "region" { 默认 = "ap-northeast-1" }

vpc.tf

#################### # VPC #################### 资源 "aws_vpc" "vpc" { cidr_block =“ 10.0.0.0/16” enable_dns_support = true enable_dns_hostnames = true tags = {name = {name =“ vpc-fargate-efs”}}} #########################子网 #################### 资源 "aws_subnet" "public_1a" { vpc_id = aws_vpc.vpc.idavailability_zone = "${var.region}a" cidr_block = " 10.0.10.0/24“ map_public_ip_ip_on_launch = true tags = {name =“ subnet-fargate-efs-public-1a”}}资源“ aws_subnet”“ aws_subnet”“ public_1c” {vpc_id = aws_vpc.vpc.vpc.id averavilecome_id averavion_id averavilecome_i = } c“ cidr_block =” 10.0.11.0/24“ map_public_ip_ip_on_launch = true tags = {name =“ subnet-fargate-efs-public-1c”}}}}} resources“ aws_subnet” "${var.region}a" cidr_block = "10.0.20.0/24" map_public_ip_on_launch = true tags = { Name = "subnet-fargate-efs-dmz-1a" } } resource "aws_subnet" "dmz_1c" { vpc_id = aws_vpc .vpc.id availability_zone =“ $ {var.region} c” cidr_block =“ 10.0.0.21.0/24” map_public_ip_ip_ip_ip_ip_on_launch = true tags = {name = {subnet-fargate-fargate-efs-efs-efs-efs-fargate-efs-dmz-1c} private_1a“ {vpc_id = aws_vpc.vpc.vpc.id availability_zone =” $ {var.region} a“ cidr_block =” 10.0.0.30.0/24“ map_public_ip_ip_ip_ip_ip_ip_ip_on_launch = true tags = true tags = true tags = {name = { }资源“ aws_subnet”“ private_1c” {vpc_id = aws_vpc.vpc.vpc.id avaibalibality_zone =“ $ {var.region} c” cidr_block =“ 10.0.0.31.0/24” -private-1c" } } ################### # 路由表####################资源“ aws_route_table”“”“ public” {vpc_id = aws_vpc.vpc.vpc.id tags = {name =“ route-fargate-efs-public”}} resource“ aws_route_table” aws_route_table“ dmz” “ Route-fargate-efs-dmz”}}}}资源“ aws_route_table”“ private” {vpc_id = aws_vpc.vpc.vpc.id tags = {name =“ route-fargate-efs-private”} ############ # IGW ################### 资源 "aws_internet_gateway" "igw" { vpc_id = aws_vpc.vpc.id 标签 = {name =“ igw-fargate-efs”}}}} ###################### ####资源“ aws_eip”“ natgw” {vpc = true tags = {name =“ natgw-fargate-efs”}}}}}资源“ aws_nat_gateway”“ natgw” {natgw“ id tags = {name =“ natgw-fargate-efs”} deweds_on = [aws_internet_gateway.igw]} ######################### ##############资源“aws_route”“public”{route_table_id = aws_route_table.public.id target_cidr_block =“0.0.0.0/0”gateway_id = aws_internet_gateway.igw.iddepends_on = [aws_route_table.公共] }资源“aws_route”“dmz”{route_table_id = aws_route_table.dmz.id target_cidr_block =“0.0.0.0/0”nat_gateway_id = aws_nat_gateway.natgw.id dependent_on = [aws_route_table.dmz] } ###### ## ############ # 路由关联 ################### 资源 "aws_route_table_association" "public_1a" {subnet_id = aws_subnet.public_1a .id route_table_id = aws_route_table.public.id}资源“aws_route_table_association”“public_1c”{subnet_id = aws_subnet.public_1c.idroute_table_id = aws_route_table.public.id}资源“aws_route_table_association”“dmz_1a”{subnet_id = aws_subnet.dmz_1a.idroute_table_id = aws_route _表.dmz .id}资源“aws_route_table_association”“dmz_1c”{subnet_id = aws_subnet.dmz_1c.idroute_table_id = aws_route_table.dmz.id}资源“aws_route_table_association”“private_1a”{subnet_id = aws_subnet.private_1a。 id } 资源“aws_route_table_association”“private_1c”{subnet_id = aws_subnet.private_1c.idroute_table_id = aws_route_table.private.id }

安全组.tf

#################### # 安全组 ###################### 资源 "aws_security_group" "alb" { 名称 = "alb-sg" 描述 = "对于 ALB" vpc_id = aws_vpc.vpc.id } 资源 "aws_security_group" "fargate" { 名称 = "fargate-sg" 描述 = "对于 Fargate" vpc_id = aws_vpc.vpc.id }资源“ aws_security_group”“ efs” {name =“ efs-sg” description =“ for efs” vpc_id = aws_vpc.vpc.vpc.vpc.id} resource“ aws_security_group” “ vpc_id = aws_vpc.vpc.id} ######################### #####资源“ AWS_SECURITY_GROUP_RULE”“允许_http_for_alb” {security_group_id = aws_security_group.alb.id type type type =“ Ingress” intress =“ intress”允许_http_for_alb“}资源” alb_to_fargate“}资源” aws_security_group_规则“” from_fargate_to_efs” {security_group_id = aws_security_group.efs.id type =“ Ingress” stologation =“ TCP” from_port = 2049 to_port = 2049 source_security_security_group_group_group_group_group_group_group_group_group_security_group_security_fargate.fargate.fargate.fargate.fargate.fargate =规则“” from_fargate_to_rds” { security_group _id = aws_security_group.rds.id type =“ Ingress”协议=“ tcp” from_port = 3306 to_port = 3306 source source_security_group_id = aws_security_group.fargate.fargate.fargate.fargate.id descript_ group_id = aws_security_group.alb 。 。 。 .id type =“ egress” stolopty =“ -1” from_port = 0 to_port = 0 cidr_blocks = [“ 0.0.0.0.0/0”] description =“ utbound ast abound”}

白蛋白.tf

#################### # ALB #################### 资源 "aws_lb" "alb" { name =“ alb-fargate-efs”内部= false load_balancer_type =“ application” security_groups = [aws_security_group.alb.alb.id] subnets = [aws_subnet.public_1a.id ############＃目标组################## ” 端口 = “80” 协议 = “HTTP” target_type = “ip” vpc_id = aws_vpc.vpc.id deregistration_delay = “60” health_check { 间隔 = “10” 路径 = “/” 端口 = “流量端口” 协议 = “ HTTP" timeout = "4"healthy_threshold = "2" unhealthy_threshold = "10" matcher = "200-302" } } #################### # 侦听器 # # ################## 资源 "aws_lb_listener" "alb" { load_balancer_arn = aws_lb.alb.arn 端口 = "80" 协议 = "HTTP" default_action { 类型 = "forward " target_group_arn = aws_lb_target_group.alb.arn } }

efs.tf

#################### creation_token =“ fargate-efs” provisioned_throughput_in_mibps =“ 50” tarput_mode =“ provisioned” tags = {name =“ fargate-efs”}}} ###########################安装目标################### 。

rds.tf

#################### {name =“ fargate-efs-pg” family =“ mysql5.7” description =“ for rds”} ########################## ################ .private_1c.id]} ##################### “” rds” {distienifier =“ fargate-efs-db01” egine =“ mysql” egine_version =“ 5.7” instance_class =“ db.t3.micro” storage_type =“ gp2” gp2“ allocated_storage =“ 50” max_allocate_storage =“ max_allocate_storage =” 100“ 100” 100“ 100” username =“ 100“” “ root”密码=“密码” final_snapshot_identifier =“ fargate-efs-db01-final” db_subnet_group_name = aws_db_subnet_group.rds.rds.name parameter_group_group_group_group_group_group_name group.rds.id] backup_retention_period =“ 7” apply_im at = true}

法盖特.tf

################### name =“ cluster-fargate-efs”设置{name =“ containerInsights” value =“ disabled”}}} ##########################＃任务定义#### ##############内存=“ 512” network_mode =“ awsvpc” execution_role_arn = aws_iam_role.fargate_task_task_execution.arn卷{name =“ fargate-efs” efs_volume_configuration “ Fargate”]}} #################### name =“ service-fargate-efs” cluster = aws_ecs_cluster.cluster.arn task_definition = aws_ecs_ecs_task_task_definition.task.task.arn desired_count = 2 laight_type =“ fargate” wordpress“ container_port =” 80“} network_configuration {subnets = [aws_subnet.dmz_1a.id，aws_subnet.dmz_1c.id] security_groups = [aws_security_group.fargate.fargate.fargate.id nods_public_ip = fealse_public_ip = feffals_ip = feffals_ip}

container_definition.json

[{“ name”：“ wordpress”，“ image”：“ wordpress：“ wordpress”，“最新”，“必需”：true，“ portmappings”：[{“ containerport”：80，“ hostport”：80}]：80}]，“ mountpoints”： [{“ containerPath”：“/var/www/html”，“ sourcevolume”：“ fargate-efs”}]，“ secrets”：[{{“ name”：“ wordpress_db_host”，“ wordpress_db_host”，“ value from”，“ {“名称”：“ WordPress_db_user”，“ valuefrom”：“ WordPress_DB_USER”}，{“ name”：“ WordPress_db_password”，“ valuefrom”：“ WordPress_DB_Pass wordpress_db_name“}]}]]

iam.tf

#################### # IAM 角色 #################### 资源 "aws_iam_role" "fargate_task_execution" {name =“ rool-fargate_task_execution” pabul_role_policy = file（“ ./ roles/fargate_task_assume_role.json”）} ########################### ############### json") }

fargate_task_assume_role.json

{ "版本": "2012-10-17", "声明": [ { "效果": "允许", "主体": { "服务": "ecs-tasks.amazonaws.com" }, "操作" : "sts:AssumeRole" } ] }

fargate_task_execution_policy.json

{“版本”：“ 2012-10-17”，“语句”：[{“效果”：“允许”，“ action”：“ ssm：getParameters”，“ resource”：“*”}]}

ssm.tf

################### name =“ wordpress_db_host”描述=“ WordPress_db_host” type =“ string” value = aws_db_instance.rds.rds.rds.rds} resources“ aws_ss_ssm_parameter”“ wordpress_db_user” “}资源” =“ string” value =“ wordpress”}

RDS的初始配置

让我们为WordPress创建数据库和用户。

$创建数据库WordPress; $创建用Mysql_native_password识别的用户'wordpress'@'％'。

操作确认

运行Terraform应用后，将启动两个Fargate任务，因此请访问Alb Endpoint。

将显示WordPress屏幕，执行初始设置后，将显示该站点，如下所示。
到目前为止，这还不是问题。

现在，到主题，让我们在管理屏幕上发布一篇文章。

按下帖子按钮时，您将被重定向到文章页面，然后重复按F5键进行更新。

如果未正确识别EFS，则可能会根据屏幕重新加载显示图像，也可能不会显示出来，但是在重新加载屏幕约100次之后，显示器似乎可以更改。

概括

与Fargate和EFS合作的能力大大扩展了构建时的设计可能性。
平台版1.4版包含许多其他有用的更新，那么为什么不尝试一下呢？