Containers in AWS

www.chmurowisko.pl
RUNNING CONTAINERS
05.09.2019 Przemysław Malak – Chmurowisko
Łukasz Dorosz - Chmurowisko
IN AMAZONWEB SERVICES
WEBINAR

Cloud Architect - Chmurowisko
Przemek Malak
Head of AWS Architecture/
Cloud Architect - Chmurowisko
Łukasz Dorosz
About us

Cloud Adoption
Strategy
WHAT WE DO
Cloud Implementation
Guide
Executive
Consulting
Cloud Security
Cloud Migration Plan AI/ML BIG DATA Trainings

Agenda
1. Docker
2. ECS
3. DEMO
4. EKS
5. DEMO
6. Q&A https://sli.do PIN: #8365
7. Contest
What you can expect
Have a question? Just ask us in SLI.DO #8365

Questions: sli.do #8365
What is Docker?
Chmurowisko Sp. z o.o.
Docker is an open
platform that allows you
to build, ship, and run
distributed applications,
whether on laptop, data
center VMs or the Cloud.
Docker packages
software into
standardised units called
Containers.
Containers allow you to easily
package an application’s code,
dependencies and configuration
into easy to use building blocks.
It’s provide environmental
consistency, operational
efficiency and version control.
10.09.2019

How it different from virtualization?
Chmurowisko Sp. z o.o.10.09.2019

Advantages of Containerisation
Forget about dependencynightmares
Consistent progression from DEV -> TEST -> QA -> PROD
Isolation- performance or stabilityissues of App A in containerA, wont impact App B in containerB.
Better resource management.
Extreme code portability
Microservices

Docker components
Docker images
Docker container
Layers / Union file system
DockerFile
Docker Engine
Docker Client
Docker registries / Docker hub
10.09.2019

Containers are everywhere
AWS Lambda
AWS Elastic
Beanstalk
Amazon EC2
10.09.2019
AWS Batch

Amazon Elastic
Container Service

Amazon Elastic Container Service
Amazon Elastic Container Service (AmazonECS) is a highly scalable, high-performance container
orchestration service that supports Docker containers and allows you to easily run and scale
containerized applications on AWS.
With simple API calls, you can launch and stop Docker-enabled applications, query the complete
state of your application, and access many familiar features such as IAM roles, security groups, load
balancers, AmazonCloudWatch Events, AWS CloudFormation templates, and AWS CloudTrail logs.

Features of Amazon ECS
Amazon ECS is a regional service that simplifies running application containers in a highly available manner across multiple
Availability Zones within a region. You can create Amazon ECS clusters within a new or existing VPC.
To deploy applications on Amazon ECS, your application components must be architected to run in containers.
A Docker container is a standardized unit of software development, containing everything that your software application
needs to run: code, runtime, system tools, system libraries, etc. Containers are created from a read-only template called an
image.
Images are typically built from a Dockerfile, a plain text file that specifies all of the components that are included in the
container.
These images are then stored in a registry from which they can be downloaded and run on your cluster.
10.09.2019

Containers and Images
Container Registry
(Amazon ECR, Docker Hub,
self-hosted)
Container
Image
Dockerfile
Create container image
Publish image
10.09.2019

Task definition
To prepare your application to run on Amazon ECS, you create a task definition.
The task definition is a text file, in JSON format, that describes one or more containers, up to a
maximum of ten, that form your application. Task definitions specify various parameters for your
application like:
• Imagefor containers in your task
• CPU and RAM for each container
• Networking mode
• IAM Role for task
• Environment Variables passed into containers

Task scheduler
The Amazon ECS task scheduler is responsible for placing tasks
within your cluster.
There are several different scheduling options available.
For example, you can define a service that runs and maintains a
specified number of tasks simultaneously.

Scheduled Tasks
• Fixed interval:
• Minutes
• Hours
• Days
• cron expression
• cron(0 1 * * ? *) – run daily at 1AM (UTC)
• cron(0 19 ? * 2L *) – run 19 last Monday of the month
• cron(0/15 * * * ? *) – run every 15 minutes

Task Placement Strategies
Algorithm that spreads tasks across instances in ECS cluster.
• CPU requirements
• Memory requirements
• Available resources

Task Placement Strategies
Available strategies
• Binpack – places tasks n the least available CPU or memory. Used to minimize stances in use.
• Spread – places tasks evenly based on an attriguite of an instance i.e. AZ
• Random – places task on any random instance
TASK DEFINITION TASK DEFINITION
Binpack Spread

Clusters
When you run tasks using AmazonECS, you place them on a cluster, which is a logical grouping of
resources.
If you use the Fargate launch type with tasks within your cluster, AmazonECS manages your cluster
resources.
If you use the EC2 launch type, then your clusters will be a group of container instances you
manage.
Amazon ECS downloads your container images from a registry that you specify, and runs those
images within your cluster.

Container Agent
The container agent runs on each infrastructure resource within an AmazonECS cluster. It sends
information about the resource's current running tasks and resource utilization to Amazon ECS, and
starts and stops tasks whenever it receives a request from Amazon ECS.

Container Registry
(Amazon ECR,Docker Hub,
self-hosted)
ECS Agent
Tasks
Run tasks
Schedule task
Amazon ECS Cluster
Download container
image

Task Lifecycle
PENDING RUNNING STOPPED
Start End
Failed on startup
Pull container image
and start
Run task or
exits with error

Service
Service supervises task.
It keeps tasks running.
Exposes tasks to outside world.
Tracks where in the cluster task is running.
Directs traffic to the correct instsance and port.

Dynamic Host Port Mapping
tcp/80 tcp/80 tcp/80 tcp/80
"portMappings": [
{
"hostPort": 0,
"protocol": "tcp",
"containerPort": 80
}
],
tcp/32678 tcp/32679 tcp/32680 tcp/32681
Task 1
tcp/80

OK AZ Outage
High Availability
VPC
Availability Zone
Subnet
ECS Host
ECS Host
Availability Zone
Subnet
ECS Host
ECS Host
VPC
Availability Zone
Subnet
ECS Host
ECS Host
Availability Zone
Subnet
ECS Host
ECS Host

Service Discovery
AWS Cloud
Amazon Route 53
Multivalue Answer Routing
Namespace: local
service1server.local
10.0.0.6
10.0.0.8
VPC
Availability Zone
Subnet
Availability Zone
SubnetECS Cluster
IP/port
Task Registrations
Health Checks

Path Based Routing
Instance 1 Instance 2 Instance 3
web auth web serviceservice service
/web*
/auth*
/service*

Autoscaling
VPC
Availability Zone
Subnet
ECS Host
ECS Host
Availability Zone
Subnet
ECS Host
ECS Host
ECS Cluster
CloudWatch
ECS
Metrics
Scale in/out
policies
Add or
Remove
tasks

AWS Fargate
AWS Fargate is a technology for AmazonECS and EKS* that allows you to run containers without
having to manageservers or clusters.
*maybe in future

Cost Optimization
Right-sizing instances
• Measure utilization in CloudWatch
• Select the cheapest instance that satisfies requirements
• Look at memory, CPU, network and storage
Do not use reserved instances at the beginning. Only after right sizing.

Cost Optimization
c5.xlarge
m5.large
On-demand price Specs CloudWatch Metrics
139 $ 4 vCPUs
8 GiB RAM
35% CPU
On-demand price Specs Savings
83 $ 2 vCPUs
8 GiB RAM
~ 42 %

Cost Optimization
Turn off non production instances
• Dev or test environments
• Automate– AWS Instance Scheduler
Enable autoscaling in production
• Combine on-demand instances with reserved instances
• Scale up and down based on demand

EC2
COST
cost = instances * hours * instance hourly price
Example:
30 days * 5 t3.small instances
720 * 5 * 0,024$ = 86,4$/mo
Pricing Models
VPC
Availability Zone Availability Zone
ECS Cluster
EC2 instances EC2 instances

Fargate
COST
Sum of:
• hours * vCPUs * vCPU hourly price
• hours * memory * memory hourly price
Example:
30 days, 1 v CPU, 2GiB
720 * 1 vCPU * 0,04048$ = 29,15$
720 * 2 GiB * 0.004445$ = 6,40$
29,15 + 6,40 = 35,55$/mo
Pricing Models
VPC
Availability Zone Availability Zone
ECS Cluster
Fargate Fargate

EC2 vs Fargate – What to choose?
FARGATE:
• Batch jobs
• Short-running tasks
EC2:
• Long-running tasks
• Services
• Access underlying instance

EC2 vs Fargate – What to choose?
PEOPLE COST

DEMO FARGATE
WEB SERVICE
SERVICE 1

DEMO FARGATE
Fargate Cluster
web
service1
/*
Amazon Route 53
service1
service1
10.09.2019

Amazon Elastic
Container Service
for Kubernetes

What is Kubernetes?
Open source conatiner orchestration system written i GoLang
Automatic deployment, scaling and management
Developed by Google based on Borg
Young: Released on July 2015

Kubernetes architecture

What Is Amazon EKS?
Amazon Elastic Container Service for Kubernetes (Amazon EKS) is a managedservice that makes it
easy for you to run Kubernetes on AWS without needing to stand up or maintain your own
Kubernetes control plane.
Amazon EKS runs Kubernetes control plane instances across multiple Availability Zones to ensure
high availability.
Amazon EKS automaticallydetects and replaces unhealthy control plane instances, and it provides
automated version upgrades and patching for them.

Introducing Amazon EKS
Availability Zone 1 Availability Zone 2 Availability Zone 3
10.09.2019

democluster.eks.amazonaws.com
Masters (AWS Managed)
10.09.2019

Workers (Customer Managed)
10.09.2019

Workers (Customer Managed)
kubectl
10.09.2019

• Applications running on Amazon EKS are fully compatible with applications running on any
standard Kubernetes environment.
• Amazon EKS automaticallyruns K8s with three masters across three AZs to protect againsta
single point of failure.
• Amazon EKS also automatically detects and replaces unhealthy masters, and it provides
automated version upgrades and patching for the masters.
• Amazon EKS is integrated with a number of key AWS features such as Elastic Load Balancing for
load distribution, IAM for authentication, Amazon VPC for isolation, AWS PrivateLink for private
network access, and AWS CloudTrail for logging.

How Does Amazon EKS Work?

Additional tools
CSI-DRIVERS
AWS-IAM-AUTHENTICATOR
AMAZON-VPC-CNI-K8S
more

AWS-CSI-DRIVER for:
CSI driver for Amazon EBS
CSI Driver for Amazon EFS
CSI Driver of AmazonFSx
Automatically mounts volumes
Attach storage directly to containers
Container Storage Interface

aws-iam-authenticator
It provides IAM based authentication for Kubernetes cluster
Allow users to services access to resources
Ex. Connect to cluster and get a list of deployed pods
For permission control Kubernetes RBAC is used

VPC with Kubernetes pods
The CNI plugin is responsible for allocating VPC IP addresses to Kubernetes nodes and configuring
the necessary networking for pods on each node.
• Bridge between the K8s land – AmazonVPC
• Thin layer – no performance impact
• Pod IP ENI Secondary IP
• Security Group is attached to the ENI

VPC with Kubernetes pods

Calico Policy
Project Calico is a network policy engine for Kubernetes.
Implement network segmentation and tenant isolation.
You can assignnetwork policies to pods using pod selectors and labels.
10.09.2019

Questions: sli.do #8365Chmurowisko Sp. z o.o.10.09.2019

Amazon EKS Workshop
10.09.2019 Chmurowisko Sp. z o.o.

Jak nazywa się usługa, która pozwala nam
zarządzać naszymi mikro serwisami za pomocą
Service Discovery?

Containers in AWS

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Containers in AWS

Semelhante a Containers in AWS (20)

Último

Último (20)

Containers in AWS