amazon-web-services - AWS ECS Fargate-任务未运行

Question

我按照此AWS教程上的说明在AWS ECS Fargate https://docs.aws.amazon.com/AmazonECS/latest/userguide/ECS_AWSCLI_Fargate.html上设置任务

我在ECR中有一个镜像，已经设置了集群和服务以及任务定义，但没有任何运行。我必须在aws控制台中手动运行该任务才能启动它，并且当我使用新的任务定义更新服务时，即使强制部署也无法更新正在运行的任务。

我想要一个非常简单的设置，因此没有ELB或AutoScaling策略，并且该服务没有以下设置:

任务数
1

最低健康百分比
100

最大百分比
200

部署类型:滚动更新

我感觉好像丢失了一些东西，我的任务没有自动启动，也没有在服务更新时更新。

如果有帮助，我会在我的位桶管道中附加正在使用的部署代码下面:

    #!/bin/bash

    set -e

    # possible -b (base / app name) -i (image version), -e (deploy env) and -s (service id)
    while getopts b:i:e:s:r: option
    do
    case "${option}"
    in
    b) BASE_NAME=${OPTARG};;
    i) IMG_VERSION=${OPTARG};;
    e) DEPLOY_ENV=${OPTARG};;
    s) SERVICE_ID=${OPTARG};;
    r) EXECUTION_ROLE=${OPTARG};;
    esac
    done

    echo "BASE_NAME: " $BASE_NAME
    echo "IMG_VERSION: " $IMG_VERSION
    echo "DEPLOY_ENV: " $DEPLOY_ENV
    echo "SERVICE_ID: " $SERVICE_ID
    echo "EXECUTION_ROLE: " $EXECUTION_ROLE

    if [ -z "$BASE_NAME" ]; then
        echo "exit: No BASE_NAME specified"
        exit;
    fi

    if [ -z "$SERVICE_ID" ]; then
        echo "exit: No SERVICE_ID specified"
        exit;
    fi

    if [ -z "$DEPLOY_ENV" ]; then
        echo "exit: No DEPLOY_ENV specified"
        exit;
    fi

    if [ -z "$IMG_VERSION" ]; then
        echo "exit: No IMG_VERSION specified"
        exit;
    fi

    if [ -z "$EXECUTION_ROLE" ]; then
        echo "exit: No EXECUTION_ROLE specified"
        exit;
    fi

    # Define variables
    TASK_FAMILY=${BASE_NAME}-${DEPLOY_ENV}-${SERVICE_ID}
    SERVICE_NAME=${BASE_NAME}-${DEPLOY_ENV}-${SERVICE_ID}-service
    CLUSTER_NAME=${BASE_NAME}-${DEPLOY_ENV}-cluster

    IMAGE_PACEHOLDER="<IMAGE_VERSION>"

    CONTAINER_DEFINITION_FILE=$(cat ${BASE_NAME}-$SERVICE_ID.container-definition.json)
    CONTAINER_DEFINITION="${CONTAINER_DEFINITION_FILE//$IMAGE_PACEHOLDER/$IMG_VERSION}"


    export TASK_VERSION=$(aws ecs register-task-definition --family ${TASK_FAMILY} --container-definitions "$CONTAINER_DEFINITION" --requires-compatibilities '["FARGATE"]' --cpu "512" --memory "1024" --network-mode "awsvpc" --execution-role-arn ${EXECUTION_ROLE} | jq --raw-output '.taskDefinition.revision')
    echo "Registered ECS Task Definition: " $TASK_VERSION



    if [ -n "$TASK_VERSION" ]; then
        echo "Update ECS Cluster: " $CLUSTER_NAME
        echo "Service: " $SERVICE_NAME
        echo "Task Definition: " $TASK_FAMILY:$TASK_VERSION


        #Update ECS Service
        DEPLOYED_SERVICE=$(aws ecs update-service --cluster $CLUSTER_NAME --service $SERVICE_NAME --task-definition $TASK_FAMILY:$TASK_VERSION --force-new-deployment | jq --raw-output '.service.serviceName')

        echo "Deployment of $DEPLOYED_SERVICE complete"


    else
        echo "exit: No task definition"
        exit;
    fi

编辑:

这是我的任务定义:

    {
      "ipcMode": null,
      "executionRoleArn": "arn:aws:iam::<Account-id>:role/:arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole",
      "containerDefinitions": [
        {
          "dnsSearchDomains": null,
          "logConfiguration": null,
          "entryPoint": [],
          "portMappings": [
            {
              "hostPort": 80,
              "protocol": "tcp",
              "containerPort": 80
            },
            {
              "hostPort": 443,
              "protocol": "tcp",
              "containerPort": 443
            }
          ],
          "command": [],
          "linuxParameters": null,
          "cpu": 0,
          "environment": [],
          "resourceRequirements": null,
          "ulimits": null,
          "dnsServers": null,
          "mountPoints": [],
          "workingDirectory": "/usr/share/nginx/html/",
          "secrets": null,
          "dockerSecurityOptions": null,
          "memory": null,
          "memoryReservation": null,
          "volumesFrom": [],
          "stopTimeout": null,
          "image": "<Account-id>.dkr.ecr.us-east-1.amazonaws.com/<my-ecr-image>:latest",
          "startTimeout": null,
          "dependsOn": null,
          "disableNetworking": null,
          "interactive": null,
          "healthCheck": null,
          "essential": true,
          "links": null,
          "hostname": null,
          "extraHosts": null,
          "pseudoTerminal": null,
          "user": null,
          "readonlyRootFilesystem": null,
          "dockerLabels": null,
          "systemControls": null,
          "privileged": null,
          "name": "dig-website"
        }
      ],
      "placementConstraints": [],
      "memory": "1024",
      "taskRoleArn": null,
      "compatibilities": [
        "EC2",
        "FARGATE"
      ],
      "taskDefinitionArn": "arn:aws:ecs:us-east-1:<Account-id>:task-definition/myapp-production-website:11",
      "family": "myapp-production-website",
      "requiresAttributes": [
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "com.amazonaws.ecs.capability.docker-remote-api.1.17"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "ecs.capability.execution-role-ecr-pull"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "ecs.capability.task-eni"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "com.amazonaws.ecs.capability.ecr-auth"
        }
      ],
      "pidMode": null,
      "requiresCompatibilities": [
        "FARGATE"
      ],
      "networkMode": "awsvpc",
      "cpu": "512",
      "revision": 11,
      "status": "ACTIVE",
      "proxyConfiguration": null,
      "volumes": []
    }

Answer 1

解决了我的问题。该错误源自我传递给我的Bitbucket管道的参数。

我在管道中有一个env变量来填充执行角色，我不知道是要传递给aws cli进行ecs register-task的所有操作只是角色的名称，而不是完整的ARN，如下所示:

"executionRoleArn": "arn:aws:iam::<Account-id>:role/:arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole"

应该改为:

 "executionRoleArn": "arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole"

因为它无法解析arn，所以将引发错误消息，指出角色没有正确的权限。