What are your options for running containers on AWS? This session cover your options and helps you to choose the right one for your workload.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Uri Segev – AWS Solutions Architect
May, 2018
A W S B u i l d e r s ’ D a y - J e r u s a l e m
Running Containers on AWS

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon ECS
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cluster of hosts on Amazon EC2
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lightweight agent on each host
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
API for launching containers on the cluster
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Container task is placed on a host
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Traffic is sent to your services
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Make AWS the
BEST PLACE
to run containerized
applications
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Make
containers a
fundamental
compute
primitive
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Make
containers
tasks a
fundamental
compute
primitive

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
IAM roles
for tasks

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Task
autoscaling

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Task LBs

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Task
networking

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Service Discovery for Amazon ECS
Build apps where services are invoked by name and name
resolves to IP/port dynamically.
Service discovery is activated during service deployment.

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Codepipeline and Amazon ECS

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS CodePipeline for ECS
AWS
CodeCommit
AWS
CodeBuild
Amazon ECR
AWS
CodePipeline
Amazon ECS
Source
Repository Build Deploy
or or

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cluster
Management
is a relic
of physical
infrastructure

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
An API for
containers

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is
Fargate?

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
RUNNING FARGATE CONTAINERS WITH ECS
Use ECS APIs to launch Fargate Containers
Easy migration – Run Fargate and EC2 launch
type tasks in the same cluster
Same Task Definition schema

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NETWORKING

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NETWORKING WITH FARGATE IN ECS
Internet
Gateway
172.31.0.0/16
Subnet 3
Fargate
Task
Public IP
54.191.135.69
172.31.3.0/24
ENI
Subnet 1
Fargate
Task
Public IP
54.191.135.66
172.31.1.0/24
ENI
Subnet 2
Fargate
Task
172.31.2.0/24
ENI
• AWS VPC Networking Mode – each task gets its own interface
• Full control of network access via Security Groups and Network ACLs
• Public IP support

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
LOAD BALANCING
APPLICATION LOAD BALANCER
NETWORK LOAD BALANCER

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SECURITY

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CLUSTER LEVEL ISOLATION
PROD Cluster Infrastructure
DEV Cluster Infrastructure
BETA Cluster Infrastructure
QA Cluster Infrastructure
Web Web
Shopping
Cart
Shopping
Cart
Notifications NotificationsWeb
Shopping
Cart NotificationsWeb
Shopping
Cart
Shopping
Cart
Notifications NotificationsWeb Web
PROD CLUSTER BETA CLUSTER
DEV CLUSTER QA CLUSTER

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PERMISSION TIERS
Cluster
Permissions
Application
Permissions
Task
Housekeeping
Permissions
Cluster
Fargate Task
Cluster Permissions:
Who can run/see tasks in the cluster?
Application (Task) Permissions:
Which of my AWS resources can this application access?
Housekeeping Permissions:
What permissions do I want to grant ECS to perform?
e.g.
• ECR Image Pull
• CloudWatch logs pushing
• ENI creation
• Register/Deregister targets into ELB

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CONTAINER REGISTRIES

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
REGISTRY SUPPORT
3rd Party Private Repositories (coming soon!)
Public Repositories supported
Amazon Elastic Container Registry (ECR)

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
VISIBILITY AND MONITORING
Service-level metrics available
CloudWatch logs and
CloudWatch events supported

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CONFIGURATIONS & PRICING

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PRICING DIMENSIONS
{
"memory": “3GB”,
"cpu": “1 vCPU”,
"networkMode": ”AWSVPC",
"compatibilities": [”FARGATE",
”EC2"],
"placementConstraints": [],
"containerDefinitions": [
{
<snip>…....
Task level resources
• Configurable independently (within a range)
Dimensions: Task level CPU and memory
Per-second billing

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
TASK CPU & MEMORY CONFIGURATIONS
Flexible configuration options –
50 CPU/memory configurations
CPU Memory
256 (.25 vCPU) 512MB, 1GB, 2GB
512 (.5 vCPU) 1GB, 2GB, 3GB, 4GB
1024 (1 vCPU) 2GB, 3GB, 4GB, 5GB, 6GB, 7GB, 8GB
2048 (2 vCPU) Between 4GB and 16GB in 1GB increments
4096 (4 vCPU) Between 8GB and 30GB in 1GB increments

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

40. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
WHAT ABOUT KUBERNETES?

41. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

42. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
“Run Kubernetes for me.”

43. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
“Native AWS Integrations.”

44. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
”An Open Source Kubernetes Experience.”

45. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
+
=
E L A S T I C C O N T A I N E R S E R V I C E F O R K U B E R N E T E S
(EKS)

46. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
mycluster.eks.amazonaws.com
Availability
Zone 1
Availability
Zone 2
Availability
Zone 3
Kubectl

47. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

48. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

49. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

50. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Heptio IAM Authenticator
h t t p s : / / g i t h u b . c o m / h e p t i o l a b s / k u b e r n e t e s - a w s - a u t h e n t i c a t o r
An open source approach to integrating
AWS IAM authentication with Kubernetes

51. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Kubectl
3) Authorizes AWS Identity with RBAC
K8s API
1) Passes AWS Identity
2) Verifies AWS Identity
4) K8s action
allowed/denied
AWS Auth

52. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GENERALLY
AVAILABLE
2018

53. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
One more thing

54. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
WITH

55. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
THANK YOU