EKS구성

mongodb install

sudo dnf install mongodb-mongosh-shared-openssl3

 

https://www.mongodb.com/docs/manual/tutorial/install-mongodb-on-red-hat/

Install MongoDB Community Edition on Red Hat or CentOS — MongoDB Manual

https://velog.io/@fermion/EC2-환경에-DB를-설치해보자-2

EC2 환경에 DB를 설치해보자 - 2

 

redis install

https://uchupura.tistory.com/224

[Redis] centos redis-cli 설치

https://pinggoopark.tistory.com/656

[Redis] (error) MOVED 에러 해결 방법

dockerfile작성

# 빌드용 이미지 가져오기
FROM golang:latest AS builder

# 작업 디렉토리 설정
WORKDIR /app 

# 의존성 다운로드
COPY go.mod go.sum ./
RUN go mod download

# go mod tidy 명령 실행하여 필요한 모듈 정리
RUN go mod tidy

# 소스 코드 복사 및 빌드
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main .

# 실행용 이미지 가져오기
FROM alpine:latest

# 작업 디렉토리 설정
WORKDIR /app

RUN wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

# 빌드된 바이너리 복사
COPY --from=builder /app/main .

# 어플리케이션 실행
CMD ["./main"]

 

docker buildcache삭제

docker builder prune

 

build후 테스트를 마치고 ecr에 push

 

eksctl kubectl 설치

https://kubernetes.io/ko/docs/tasks/tools/install-kubectl-linux/

리눅스에 kubectl 설치 및 설정

https://docs.aws.amazon.com/ko_kr/emr/latest/EMR-on-EKS-DevelopmentGuide/setting-up-eksctl.html#setting-up-eksctl-linux

eksctl 설치 - Amazon EMR

 

cluster생성

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: wsi-cluster
  region: ap-northeast-2 
  version: "1.26"

iam:
  withOIDC: true

vpc:
  subnets:
    private:
      ap-northeast-2a:
        id: subnet-05869d646599a7335
      ap-northeast-2b:
        id: subnet-0b65b5b1bee53e589

fargateProfiles:
  - name: wsi-fargate-pod
    selectors:  #같은 애들 fargate로 생성
      - namespace: wsi-namespace
        labels: #pod label
          pod: fargate
    podExecutionRoleArn: arn:aws:iam::702661606257:role/fargatePodExecutionRole  #fargatePodExecutionRole생성해서 넣으면 됨

managedNodeGroups:
  - name: wsi-app  #노드그룹 이름
    minSize: 2
    desiredCapacity: 2
    maxSize: 16
    labels:
      wsi: app #node-label
    instanceType: c5.large  #node group ec2 type
    privateNetworking: true
    iam:
      withAddonPolicies:
        imageBuilder: true
        autoScaler: true
        externalDNS: true
        certManager: true
        appMesh: true
        appMeshPreview: true
        ebs: true
        fsx: true
        efs: true
        awsLoadBalancerController: true
        xRay: true
        cloudWatch: true
  # - name: wsi-addon  #node group name
  #   labels:
  #     skills/dedicated: addon #node-label
  #   instanceType: c5.large  #node group ec2 type
  #   desiredCapacity: 2
  #   privateNetworking: true
  #   iam:
  #     withAddonPolicies:
  #       imageBuilder: true
  #       autoScaler: true
  #       externalDNS: true
  #       certManager: true
  #       appMesh: true
  #       appMeshPreview: true
  #       ebs: true
  #       fsx: true
  #       efs: true
  #       awsLoadBalancerController: true
  #       xRay: true
  #       cloudWatch: true

cloudWatch:
  clusterLogging:
    enableTypes: ["*"]  #모든 유형의 log활성화

 

 

namespace생성

apiVersion: v1
kind: Namespace
metadata:
  name: wsi-namespace

 

secret manager를 쓰기 위한 설정

 

전에 helm 설치

https://velog.io/@tkfka/Helm-설치-및-사용

Helm 설치 및 사용

 

secret 연결

 

동기화를 할 때(fargate는 불가능하다)

 

*수정해야 하는 부분(이렇게 해줘야 secret-store-csi-driver를 설치할 수 있음)*

 

helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts

 

helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --namespace kube-system -f values.secrets-store.yaml

 

https://sjquant.tistory.com/67

AWS Secrets Manager로 쿠버네티스 시크릿(Secret)을 관리해보자

https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation

Installation - Secrets Store CSI Driver

secret-provider.yaml

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: wsi-secret-provider
  namespace: wsi-namespace
spec:
  provider: aws
  parameters: 
    objects: | 
      - objectName: "dbinfo" #aws secretmanager 이름
        objectType: "secretsmanager"
        jmesPath:
          - path: DBURI #aws secretmanger 안에 있는 key이름
            objectAlias: DBURI  #볼륨에 들어갈 이름
  secretObjects:                
    - secretName: dbinfo #내가 만들 eks secret 이름
      type: Opaque
      data:
        - objectName: DBURI #secret내용에 들어갈 key 이름
          key: DBURI  #볼륨에 있는 이름 jmesPath.objectAlias

 

 

fargate에 secret을 사용할 때

https://medium.com/@nrglv/how-to-install-secret-manager-to-eks-fargate-7eeb4d88165b

How to install Secret Manager to EKS Fargate

 

ec2-deployment생성

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: wsi-namespace
  name: wsi-docdb-deployment
  labels:
    app: wsi-docdb-deployment
spec:
  replicas: 2
  selector:
    matchLabels:  #pod label선택
      app: docdb-pod
  template:
    metadata:
      labels: #pod label
        app: docdb-pod
    spec:
      serviceAccountName: "dbaccess"  #serviceaccount이름 secret access하게 해줌
      nodeSelector:
        wsi: app
      containers:
      - name: docdb
        image: 702661606257.dkr.ecr.ap-northeast-2.amazonaws.com/wsi-docdb-ecr:latest
        ports:
        - containerPort: 8080
        resources:
          limits:
            cpu: 500m
          requests:
            cpu: 200m
        volumeMounts:
        - name: secrets-store-inline
          mountPath: "/mnt/secrets" #secret이 저장되는 볼륨 경로
          readOnly: true
        env:  #얘는 하나씩 넣을 때(secretmanager에서 value를 json형식으로 저장하면 여러개 불러올 수 있음)
          - name: DBURI #환경변수 이름
            valueFrom:
              secretKeyRef:
                name: dbinfo #eks secret 이름
                key: DBURI  #eks secret 안에 있는 값중에 어떤 key 인지 지정
        # envFrom:  #얘는 json형식으로 환경변수를 넣을 때 (secretmanager이름이랑 환경변수이름이랑 같으면 쓸 수 있음)
        # - secretRef:
        #     name: dbinfo
      volumes:
      - name: secrets-store-inline  #볼륨이름
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: wsi-secret-provider  #secretProvider 이름

 

 

alb controller 설치

https://docs.aws.amazon.com/ko_kr/eks/latest/userguide/aws-load-balancer-controller.html

AWS Load Balancer Controller 추가 기능 설치 - Amazon EKS

 

service생성

apiVersion: v1
kind: Service
metadata:
  name: wsi-service
  namespace: wsi-namespace
spec:
  selector: #pod label
    app: docdb
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080

 

 

ingres생성

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: wsi
  namespace: wsi-namespace
  annotations:
    alb.ingress.kubernetes.io/load-balancer-name: wsi-alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/subnets: subnet-0bed2ae1cd75c24eb, subnet-0322ca3036b92eb2f #프라이빗 서브넷은 외부에서 접근못함
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/healthcheck-path: /health
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "5"
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "2"
    alb.ingress.kubernetes.io/healthy-threshold-count: "2"
    alb.ingress.kubernetes.io/unhealthy-threshold-count: "2"
    alb.ingress.kubernetes.io/target-group-attributes: deregistration_delay.timeout_seconds=0
    alb.ingress.kubernetes.io/actions.response-403: >
      {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"403","messageBody":"403 error text"}}
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: wsi-service
            port:
              number: 80
      # - path: /
      #   pathType: Prefix
      #   backend:
      #     service:
      #       name: response-403
      #       port:
      #         name: use-annotation

 

 

 

만약 eksctl, kubectl 명령어를 실행했을 때 
error: You must be logged in to the server (Unauthorized) 이런 에러가 나온다면 

aws console에서 eks cluster의 액세스탭에서 IAM 액세스 항목에

aws sts get-caller-identity

이 명령어를 사용했을 때 나오는 ARN을 추가해준다

 

aws configure set region ap-northeast-2
리전설정

 

https://github.com/changhyun06

changhyun06 - Overview