amazon-web-services - Cloudformation 脚本任务集无法从 ECR 中提取镜像

Question

在我当前的设置中，我使用 cloudformation 来设置环境。到目前为止配置的所有步骤似乎都有效，除了任务集。我使用 AWS ECR 存储库上的镜像来启动 Fargate 实例，该实例被放入带有服务的新集群中。

当我创建堆栈时，所有步骤都会成功，但服务的创建永远停留在“CREATE_IN_PROGRESS”状态。当我查看创建的服务，更具体地说是任务时，我发现 cloudformation 无法获取图像。错误如下:

STOPPED (CannotPullContainerError: Error response from daem)

现在，当我手动尝试在所述集群上使用相同图像的实例时，它工作得很好。经过一番谷歌搜索后，我找到了某些解决方案。我已经实现了所有这些，例如:

• 创建一个包含安全组的网络，允许传出流量到达所有目的地
• 在 awsvpc 配置中将标记 AssignPublicIp 设置为“启用”
• 将用户执行角色设置为我在手动创建时使用的相同角色

请注意，该任务确实已创建，并且确实收到了公共(public)和私有(private) IP 地址。另外，我尝试丢弃 ECR 实例并使用新名称创建一个新实例(当然还标记并推送了图像)。

以下代码片段是我的服务和任务集定义(重命名了一些敏感信息):

    "MyVPC": {
        "Type": "AWS::EC2::VPC",
        "Properties": {
            "CidrBlock": "10.0.1.0/16",
            "Tags": [
                {"Key":"Name", "Value":"MyVPC"
                }
            ]
        },
    },
    "MyInternetGateway" : {
      "Type" : "AWS::EC2::InternetGateway",
          "Properties" : {
          }
       },
    "MySubPublic": {
        "Type": "AWS::EC2::Subnet",
        "Properties": {
            "AvailabilityZone": "eu-central-1a",
            "CidrBlock": "10.0.1.0/28",
            "MapPublicIpOnLaunch": true,
            "VpcId": {
                "Ref": "MyVPC"
            }
        },
        "DependsOn": "MyInternetGateway"
    },
    "MySecGroup":
            {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
          "GroupDescription" : "My security group for all incoming and outgoing.",
          "GroupName" : "MySecGroup",
          "SecurityGroupEgress" : [ {
              "CidrIp" : "0.0.0.0/0",
              "Description" : "Allow machine to reach internet.",
              "FromPort" : -1,
              "IpProtocol" : -1,
              "ToPort" : -1
            } ],
          "SecurityGroupIngress" : [ {
              "CidrIp" : "0.0.0.0/0",
              "Description" : "Allow machine to be reached from the entire internet.",
              "FromPort" : -1,
              "IpProtocol" : -1,
              "ToPort" : -1
            } ],
          "VpcId" : {"Ref": "MyVPC"}
        },
        "DependsOn": "MyVPC"
    },
    "MyCluster": {
        "Type": "AWS::ECS::Cluster",
        "Properties": {
            "ClusterName": "MyCluster"
        },
        "DependsOn": [
            "MyVPC"
        ]
    },
    "MyDockerTask": {
        "Type": "AWS::ECS::TaskDefinition",
        "Properties": {
            "ContainerDefinitions": [
                {
                    "Cpu": 512,
                    "Image": "<NRHERE>.dkr.ecr.eu-central-1.amazonaws.com/mysqs",
                    "Memory": 1024,
                    "MemoryReservation": 1024,
                    "Name": "MyContainer"
                }
            ],
            "Cpu": "512",
            "ExecutionRoleArn": "arn:aws:iam::<NRHERE>:role/ecsTaskExecutionRole",
            "Family": "MyFam",
            "Memory": "1024",
            "NetworkMode": "awsvpc",
            "RequiresCompatibilities": [
                "FARGATE",
                "EC2"
            ],
            "TaskRoleArn": "arn:aws:iam::<NRHERE>:role/ecsTaskExecutionRole"
        },
    },
    "MyService": {
      "Type" : "AWS::ECS::Service",
      "Properties" : {
          "Cluster" : {"Fn::GetAtt": ["MyCluster", "Arn"]},
          "DesiredCount" : 1,
          "LaunchType" : "FARGATE",
          "NetworkConfiguration" : {
             "AwsvpcConfiguration" : {
                  "AssignPublicIp" : "ENABLED",
                  "SecurityGroups" : [ {"Fn::GetAtt": ["MySecGroup", "GroupId"]} ],
                  "Subnets" : [ {"Ref": "MySubPublic"}]
                }
          },
          "SchedulingStrategy" : "REPLICA",
          "ServiceName" : "MyService",
          "TaskDefinition": {"Ref": "MyDockerTask"}
        },
        "DependsOn": "MySubPublic"
    },
    "MyTaskSet": {
        "Type": "AWS::ECS::TaskSet",
        "Properties": {
            "Cluster": {
                "Ref": "MyCluster"
            },
            "LaunchType": "FARGATE",
            "NetworkConfiguration" : {
                 "AwsvpcConfiguration" : {
                      "AssignPublicIp" : "ENABLED",
                      "SecurityGroups" : [ {"Fn::GetAtt": ["MySecGroup", "GroupId"]} ],
                      "Subnets" : [ {"Ref": "MySubPublic"}]
                    }
              },
            "Service": {"Ref": "MyService"},
            "TaskDefinition": {
                "Ref": "MyDockerTask"
            }
        },
        "DependsOn": [
            "MyCluster"
        ]
    },

以上均未提供解决方案。我愿意接受任何建议/解决方案

Answer 1

根据提供的 CFN 模板，我可以得出结论:MySubPublic 无法访问互联网。

具体来说，我发现您正在创建以下 VPC 相关资源:

• AWS::EC2::VPC
• AWS::EC2::InternetGateway
• AWS::EC2::子网
• AWS::EC2::SecurityGroup

但是，问题是缺乏:

• AWS::EC2::VPCGatewayAttachment 会将 InternetGateway 连接到您的 VPC

• AWS::EC2::RouteTable 和 AWS::EC2::Route 的定义，将用于使您的 MySubPublic code> 将流量路由到 AWS::EC2::InternetGateway。

描述了在子网中启用 Internet 访问的一般步骤 here :

Attach an internet gateway to your VPC.

Add a route to your subnet's route table that directs internet-bound traffic to the internet gateway. If a subnet is associated with a route table that has a route to an internet gateway, it's known as a public subnet. If a subnet is associated with a route table that does not have a route to an internet gateway, it's known as a private subnet.

Ensure that instances in your subnet have a globally unique IP address (public IPv4 address, Elastic IP address, or IPv6 address).

Ensure that your network access control lists and security group rules allow the relevant traffic to flow to and from your instance.