amazon-web-services - 如何使用 CloudFormation 组织 ECS CodePipeline

Question

我正在尝试为我们的应用程序构建一系列部署管道。我们的应用程序部署在 ECS Fargate 中。我已经使用 CloudFormation 创建了基本基础设施(ALB、主/辅助监听器、主/辅助目标组、FargateService、TaskDefinition)。我还为较低环境的 ECS 集群创建了一个部署管道，如下所示 CodeBuild -> ECR(docker image)/S3(appspec.yml/taskdef.json) -> CodePipeline -> CodeDeploy ECS Blue/Green。我使用 CodeBuild 来处理该流程的原因是能够基于多个分支的事件进行构建。

我想以同样的方式在 CloudFormation 中设置部署管道。由于目标组之一未向负载均衡器注册，我无法将其添加到 CloudFormation 模板中。我认为这就是 CodeDeploy 的工作方式。作为部署过程的一部分，它会在 ALB 中添加和删除目标组。我在这里缺少什么吗？有没有办法结合 CodePipeline 和 CodeDeploy for ECS 构建 CloudFormation 模板？

这是迄今为止我的模板:

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  Cluster:
    Type: String
    Default: cluster-dev
  DesiredCount:
    Type: Number
    Default: 1
  ContainerPort:
    Type: Number
    Default: 8080
  LaunchType:
    Type: String
    Default: Fargate
    AllowedValues:
      - Fargate
  MainTargetGroupName:
    Type: String
    MaxLength: 32
  CodeDeployTargetGroupName:
    Type: String
    MaxLength: 32
  SourceSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup::Id'
  PrivateSubnets:
    Type: 'List<AWS::EC2::Subnet::Id>'
  PublicSubnets:
    Type: 'List<AWS::EC2::Subnet::Id>'
  ALBSecurityGroups:
    Type: 'List<AWS::EC2::SecurityGroup::Id>'
  VPC:
    Type: 'AWS::EC2::VPC::Id'
Conditions:
  Fargate: !Equals 
    - !Ref LaunchType
    - Fargate
  EC2: !Equals 
    - !Ref LaunchType
    - EC2
Resources:
  ApplicationLoadBalancer:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Properties:
        Name: "test-Application-Load-Balancer"
        Scheme: "internet-facing"
        Type: "application"
        Subnets: !Ref PublicSubnets
        SecurityGroups: !Ref ALBSecurityGroups
        IpAddressType: "ipv4"
        LoadBalancerAttributes: 
            - Key: "access_logs.s3.enabled"
              Value: "false"
            - Key: "idle_timeout.timeout_seconds"
              Value: "60"
            - Key: "deletion_protection.enabled"
              Value: "false"
            - Key: "routing.http2.enabled"
              Value: "true"
            - Key: "routing.http.drop_invalid_header_fields.enabled"
              Value: "false"
  ServiceTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
        HealthCheckIntervalSeconds: 30
        HealthCheckPath: "/ping"
        Port: 443
        Protocol: "HTTPS"
        HealthCheckPort: "traffic-port"
        HealthCheckProtocol: "HTTPS"
        HealthCheckTimeoutSeconds: 5
        UnhealthyThresholdCount: 2
        TargetType: "ip"
        Matcher: 
            HttpCode: "200"
        HealthyThresholdCount: 5
        VpcId: !Ref VPC
        Name: !Ref MainTargetGroupName
        HealthCheckEnabled: true
        TargetGroupAttributes: 
          - Key: "stickiness.enabled"
            Value: "false"
          - Key: "deregistration_delay.timeout_seconds"
            Value: "300"
          - Key: "stickiness.type"
            Value: "lb_cookie"
          - Key: "stickiness.lb_cookie.duration_seconds"
            Value: "86400"
          - Key: "slow_start.duration_seconds"
            Value: "0"
          - Key: "load_balancing.algorithm.type"
            Value: "round_robin"
  GreenTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
        HealthCheckIntervalSeconds: 30
        HealthCheckPath: "/ping"
        Port: 8443
        Protocol: "HTTPS"
        HealthCheckPort: "traffic-port"
        HealthCheckProtocol: "HTTPS"
        HealthCheckTimeoutSeconds: 5
        UnhealthyThresholdCount: 2
        TargetType: "ip"
        Matcher: 
            HttpCode: "200"
        HealthyThresholdCount: 5
        VpcId: !Ref VPC
        Name: !Ref CodeDeployTargetGroupName
        HealthCheckEnabled: true
        TargetGroupAttributes: 
          - Key: "stickiness.enabled"
            Value: "false"
          - Key: "deregistration_delay.timeout_seconds"
            Value: "300"
          - Key: "stickiness.type"
            Value: "lb_cookie"
          - Key: "stickiness.lb_cookie.duration_seconds"
            Value: "86400"
          - Key: "slow_start.duration_seconds"
            Value: "0"
          - Key: "load_balancing.algorithm.type"
            Value: "round_robin"
  HTTPSListener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
        LoadBalancerArn: !Ref ApplicationLoadBalancer
        Port: 443
        Protocol: "HTTPS"
        SslPolicy: "ELBSecurityPolicy-TLS-1-2-Ext-2018-06"
        Certificates: 
          - CertificateArn: '*************************************'
        DefaultActions: 
          - Order: 1
            TargetGroupArn: !Ref ServiceTargetGroup
            Type: "forward"
  GreenListener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
        LoadBalancerArn: !Ref ApplicationLoadBalancer
        Port: 8443
        Protocol: "HTTPS"
        SslPolicy: "ELBSecurityPolicy-TLS-1-2-Ext-2018-06"
        Certificates: 
          - CertificateArn: '************************'
        DefaultActions: 
          - Order: 1
            TargetGroupArn: !Ref GreenTargetGroup
            Type: "forward"
  CloudWatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties: 
      LogGroupName: !Ref AWS::StackName
      RetentionInDays: 7  
  ECSTaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-task
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ecs-tasks.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
      Policies:
        - PolicyName: ssm
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
                Resource:
                  - '*'
  ECSTaskExecRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-taskexec
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ecs-tasks.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
  FargateService:
    Type: 'AWS::ECS::Service'
    Condition: Fargate
    DependsOn: 
      - HTTPSListener
      - GreenListener
    Properties:
      Cluster: !Ref Cluster
      DesiredCount: !Sub ${DesiredCount}
      TaskDefinition: !Ref TaskDefinition
      LaunchType: FARGATE
      HealthCheckGracePeriodSeconds: 300
      EnableExecuteCommand: true
      DeploymentController: 
        Type: CODE_DEPLOY
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !Ref SourceSecurityGroup
          Subnets: !Ref PrivateSubnets
      LoadBalancers:
        - ContainerName: !Sub '${AWS::StackName}'
          ContainerPort: !Sub ${ContainerPort}
          TargetGroupArn: !Ref ServiceTargetGroup
    Metadata:
      'AWS::CloudFormation::Designer':
        id: ***********
  TaskDefinition:
    Type: 'AWS::ECS::TaskDefinition'
    Properties:
      Family: !Sub '${AWS::StackName}'
      RequiresCompatibilities:
        - FARGATE
      Memory: 1024
      Cpu: 512
      NetworkMode: awsvpc
      TaskRoleArn: !GetAtt ECSTaskRole.Arn
      ExecutionRoleArn: !GetAtt ECSTaskExecRole.Arn
      ContainerDefinitions:
        - Name: !Sub '${AWS::StackName}'
          Image: '**********'
          EntryPoint:
            - 'java'
            - '-jar'
            - 'app-1.0.jar'
          Essential: true
          Memory: 1024
          Cpu: 512
          PortMappings:
            - ContainerPort: !Sub ${ContainerPort}
              HostPort: 8080
              Protocol: 'tcp'
          HealthCheck:
              Command: [ "CMD-SHELL", "curl -k -f https://localhost:8080/ping || exit 1" ]
              Interval: 30
              Retries: 5
              Timeout: 10
              StartPeriod: 30
          LogConfiguration:
            LogDriver: awslogs
            Options:
                awslogs-group: !Ref AWS::StackName
                awslogs-region: !Ref AWS::Region
                awslogs-stream-prefix: !Ref AWS::StackName
    Metadata:
      'AWS::CloudFormation::Designer':
        id: ********
Outputs:
  Service:
    Value: !Ref FargateService

如有任何帮助，我们将不胜感激。

杰夫

Answer 1

secret 武器是将以下内容添加到两个目标组中。

DependsOn:
  - ApplicationLoadBalancer

经过进一步审查，我认为 CloudFormation 不支持 CodePipeline 的 BlueGreen ECS 部署设置。这有点牵强，但尝试这样做时可能会出现重大错误。我在 StackOverflow 甚至 AWS 上看到过一些帖子，认为这是不可能的。