docker - ECS Fargate 部署卡住，无法部署 ECS 服务

Question

我是 ECS 新手，我正在尝试使用 Cloudformation 部署它。

我通过查看文档以及从博客和一些文章中找到的一些示例来制作以下 cloudformation 模板。

但是，由于某种原因，它在更新其中一个资源时卡住了，最终超时。我不知道为什么它会卡住并失败。

有人能发现我犯的错误吗？

目前，我的目标是在互联网上部署并查看该应用程序。我并不是真的在寻找高级配置。我还在部署 aws cli 时将 ecr url 传递给它。

提前谢谢您。

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: >
  ECS Service

Parameters:
  Environment:
    Type: String
    Default: alpha
    AllowedValues:
      - alpha
      - beta
      - production
  ECRDockerUri:
    Type: String
    Default: <url for ecr repo> 
  ContainerPort: 
    Type: Number
    Default: 8080

Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "${Environment}-fake-user-api-logGroup"
      RetentionInDays: 30

  ECSCluster:
    Type: 'AWS::ECS::Cluster'
    Properties:
      ClusterName: !Sub "${Environment}-MyFargateCluster"

  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${Environment}-${AWS::AccountId}-ExecutionRole"
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'

  ECSService:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: !Sub "${Environment}-${AWS::AccountId}-ECSService"
      Cluster: !Ref ECSCluster
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: 1
  
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      TaskRoleArn: !Ref ExecutionRole
      ContainerDefinitions:
        - Name: !Sub "${Environment}-${AWS::AccountId}-Container"
          Image: !Ref ECRDockerUri
          Memory: 1024
          Essential: true
          DisableNetworking: false
          Privileged: true
          ReadonlyRootFilesystem: true
          Environment: 
            - Name: SPRING_PROFILES_ACTIVE
              Value: !Ref Environment
          PortMappings:
            - ContainerPort: !Ref ContainerPort
              HostPort: !Ref ContainerPort
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref LogGroup
              awslogs-region: ca-central-1

Answer 1

我检查了你的 CFN 堆栈，发现缺少一些东西。我注意到您的集群名称是 ENV-MyFargateCluster，因此我假设您的目标是创建 Fargate 服务。要运行 Fargate 服务，您需要提供网络配置并通过指定启动类型通知您要创建 Fargate 服务。另外，Fargate 任务无法获得特权。

• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-containerdefinitions.html#cfn-ecs-taskdefinition-containerdefinition-privileged

下面是我的代码片段:

AWSTemplateFormatVersion: 2010-09-09
Transform: 'AWS::Serverless-2016-10-31'
Description: |
  ECS Service
Parameters:
  Environment:
    Type: String
    Default: alpha
    AllowedValues:
      - alpha
      - beta
      - production
  ECRDockerUri:
    Type: String
    Default: 'image'
  ContainerPort:
    Type: Number
    Default: 80
Resources:
  LogGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '${Environment}-fake-user-api-logGroup'
      RetentionInDays: 30
  ECSCluster:
    Type: 'AWS::ECS::Cluster'
    Properties:
      ClusterName: !Sub '${Environment}-MyFargateCluster'
  ExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${Environment}-${AWS::AccountId}-ExecutionRole'
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
  ECSService:
    Type: 'AWS::ECS::Service'
    Properties:
      ServiceName: !Sub '${Environment}-${AWS::AccountId}-ECSService'
      LaunchType: FARGATE
      Cluster: !Ref ECSCluster
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: 1
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - sg-XXXXXXXXXX
          Subnets:
            - subnet-XXXXXXXXXX
  TaskDefinition:
    Type: 'AWS::ECS::TaskDefinition'
    Properties:
      RequiresCompatibilities:
        - FARGATE
      TaskRoleArn: !Ref ExecutionRole
      ExecutionRoleArn: !Ref ExecutionRole
      ContainerDefinitions:
        - Name: !Sub '${Environment}-${AWS::AccountId}-Container'
          Image: !Ref ECRDockerUri
          Memory: 1024
          Essential: true
          DisableNetworking: false
          Privileged: false
          ReadonlyRootFilesystem: true
          Environment:
            - Name: SPRING_PROFILES_ACTIVE
              Value: !Ref Environment
          PortMappings:
            - ContainerPort: !Ref ContainerPort
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref LogGroup
              awslogs-region: ca-central-1
              awslogs-stream-prefix: test
      Cpu: '1024'
      Memory: '2048'
      NetworkMode: awsvpc