amazon-web-services - ECS - 目标类型ip与任务定义中指定的桥接网络模式不兼容

Question

问题

尝试使用目标组使用 IP 作为目标类型的现有 NLB 创建 ECS 服务时，出现目标类型 ip，与桥接网络模式不兼容错误。

错误来自 Terraform，因为使用它来创建所有 AWS 资源。

Error: InvalidParameterException: The provided target group arn:aws:elasticloadbalancing:$REGION:$ACCOUNT:targetgroup ... has target type ip,which is incompatible with the bridge network mode specified in the task definition.

TF_DEBUG output Terraform Github 的 issue #11719似乎表明这是限制，如果 Terraform(或其消息)是正确的。

2020-01-22T20:04:46.819Z [DEBUG] plugin.terraform-provider-aws_v2.45.0_x4: 2020/01/22 20:04:46 [DEBUG] [aws-sdk-go] {"__type":"InvalidParameterException","message":"The provided target group arn:aws:elasticloadbalancing:us-east-1:xxx:targetgroup/llprd20200122052638603300000006/a0a2d775807f6620 has target type ip, which is incompatible with the bridge network mode specified in the task definition."}

问题

请告知这是否是 AWS 的限制。到目前为止，就我查看 AWS 文档而言，没有任何信息表明 IP 目标类型不能用于桥接网络模式。但是，想要 100% 确定。

• ECS Service - Creating a Network Load Balancer - Configure Routing

  4. For Target type, choose whether to register your targets with an instance ID or an IP address.
     
     Important
     If your service's task definition uses the awsvpc network mode (which is required for the Fargate launch type), you must choose ip as the target type, not instance. This is because tasks that use the awsvpc network mode are associated with an elastic network interface, not an Amazon EC2 instance.
     
     You cannot register instances by instance ID if they have the following instance types: C1, CC1, CC2, CG1, CG2, CR1, G1, G2, HI1, HS1, M1, M2, M3, and T1. You can register instances of these types by IP address.

地形

• Terraform aws_lb_target_group

resource "aws_lb_target_group" "this" {
  count = length(var.listeners)
  name_prefix           = "${substr("${var.name}", 0, 6)}"
  vpc_id                = "${var.vpc_id}"
  target_type           = "ip"
  port                  = 8080
  protocol              = "tcp"
  ...
}

我没有指定 network_mode在aws_ecs_task_definition资源配置，因此使用默认的“bridge”。

TF_DEBUG

...
2020-03-03T18:54:10.301+1100 [DEBUG] plugin.terraform-provider-aws_v2.50.0_x4: 2020/03/03 18:54:10 [DEBUG] [aws-sdk-go] {"__type":"InvalidParameterException","message":"The provided target group arn:aws:elasticloadbalancing:us-east-2:ACCOUNT:targetgroup/****/4689fc19ff99ca57 has target type ip, which is incompatible with the bridge network mode specified in the task definition."}
2020-03-03T18:54:10.301+1100 [DEBUG] plugin.terraform-provider-aws_v2.50.0_x4: 2020/03/03 18:54:10 [DEBUG] [aws-sdk-go] DEBUG: Validate Response ecs/CreateService failed, attempt 0/25, error InvalidParameterException: The provided target group arn:aws:elasticloadbalancing:us-east-2:ACCOUNT:targetgroup/****/4689fc19ff99ca57 has target type ip, which is incompatible with the bridge network mode specified in the task definition.
...

环境

• ECS 类型是 EC2，不是 Fargate
• 使用在 Ubuntu“18.04.4 LTS (Bionic Beaver)”上运行的 Terraform v0.12.20

Answer 1

如 AWS service discovery guidelines 中所述，您不能使用 ip 引用具有 bridge 网络模式的 ECS 容器。实际上，您只能为此类服务指定 SRV DNS 记录。

此处的选项是将任务定义网络模式更改为 awsvpc 或将 target_type 更改为 instance。

就我个人而言，我只有 awsvpc 网络模式的经验。