amazon-web-services - AWS CDK 设置第二个监听器 + 目标会忽略目标端口

Question

我有一个 ECS 容器，它在两个不同的端口上运行两个端点。我在其前面配置了一个网络负载均衡器，使其具有两个监听器，每个监听器都有自己的目标组。

我的堆栈的 AWS CDK 代码位于此处(注意:我更改了示例中的构造)

class MyStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, certificate: Certificate, vpc: Vpc, repository: Repository, subnets: SubnetSelection, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

      cluster: Cluster = Cluster(self, "MyCluster", vpc=vpc, container_insights=True)
      image: ContainerImage = ContainerImage.from_ecr_repository(repository=repository, tag="latest")
    
      task_definition: FargateTaskDefinition = FargateTaskDefinition(
            self, "MyTaskDefinition", cpu=512, memory_limit_mib=1024,
      )

      container: ContainerDefinition = task_definition.add_container(
            "MyContainer", image=image, environment={}
      )

      # As you can see, here I add two port mappings on my container
      container.add_port_mappings(PortMapping(container_port=9876, host_port=9876))
      container.add_port_mappings(PortMapping(container_port=8000, host_port=8000))

      load_balancer: NetworkLoadBalancer = NetworkLoadBalancer(
        self, "MyNetworkLoadBalancer",
        load_balancer_name="my-nlb",
        vpc=vpc,
        vpc_subnets=subnets,
        internet_facing=False
      )

      security_group: SecurityGroup = SecurityGroup(
        self, "MyFargateServiceSecurityGroup",
        vpc=vpc,
        allow_all_outbound=True,
        description="My security group"
      )

      security_group.add_ingress_rule(
        Peer.any_ipv4(), Port.tcp(9876), 'Allow a connection on port 9876 from anywhere'
      )
      security_group.add_ingress_rule(
        Peer.any_ipv4(), Port.tcp(8000), "Allow a connection on port 8000 from anywhere"
      )

      service: FargateService = FargateService(
        self, "MyFargateService",
        cluster=cluster,
        task_definition=task_definition,
        desired_count=1,
        health_check_grace_period=Duration.seconds(30),
        vpc_subnets=subnets,
        security_groups=[security_group]
      )

      # Listener 1 is open to incoming connections on port 9876
      listener_9876: NetworkListener = load_balancer.add_listener(
        "My9876Listener",
        port=9876,
        protocol=Protocol.TLS,
        certificates=[ListenerCertificate(certificate.certificate_arn)],
        ssl_policy=SslPolicy.TLS12_EXT
      )

      # Incoming connections on 9876 are redirected to the container on 9876
      # A health check is done on 8000/health
      listener_9876.add_targets(
        "My9876TargetGroup", targets=[service], port=9876, protocol=Protocol.TCP,
        health_check=HealthCheck(port="8000", protocol=Protocol.HTTP, enabled=True, path="/health")
      )

      # Listener 2 is open to incoming connections on port 443
      listener_443: NetworkListener = load_balancer.add_listener(
        "My443Listener",
        port=443,
        protocol=Protocol.TLS,
        certificates=[ListenerCertificate(certificates.quickfix_certificate.certificate_arn)],
        ssl_policy=SslPolicy.TLS12_EXT
      )

      # Incoming connections on 443 are redirected to the container on 8000
      # A health check is done on 8000/health
      listener_443.add_targets(
        "My443TargetGroup", targets=[service], port=8000, protocol=Protocol.TCP,
        health_check=HealthCheck(port="8000", protocol=Protocol.HTTP, enabled=True, path="/health")
      )

现在我成功部署了这个堆栈，但结果不是我预期的

两个目标组将流量定向到我的容器，但都在端口 9876 上。

我在文档中读到，负载均衡器可以通过不同的目标组将流量定向到不同的端口。

我做错了什么吗？或者AWS CDK不支持这个？

我仔细检查了合成的 cloudformation 模板。它正确生成两个目标组，一个使用端口 9876，另一个使用端口 8000。

Answer 1

您好，您需要从服务创建一个目标，然后将其作为目标添加到监听器。

const target = service.loadBalancerTarget({
  containerName: 'MyContainer',
  containerPort: 8000
}));