Aller au contenu principal

Task Definitions

1 - Structure complète​

1.1 Task Definition Fargate​

{
  "family": "mon-application",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::123456789:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123456789:role/ecsTaskRole",
  
  "containerDefinitions": [
    {
      "name": "app",
      "image": "123456789.dkr.ecr.eu-west-1.amazonaws.com/app:v1.0",
      "essential": true,
      "portMappings": [
        {
          "containerPort": 8080,
          "protocol": "tcp"
        }
      ],
      "environment": [
        {"name": "NODE_ENV", "value": "production"},
        {"name": "PORT", "value": "8080"}
      ],
      "secrets": [
        {
          "name": "DATABASE_URL",
          "valueFrom": "arn:aws:secretsmanager:eu-west-1:123456789:secret:db-url"
        },
        {
          "name": "API_KEY",
          "valueFrom": "arn:aws:ssm:eu-west-1:123456789:parameter/app/api-key"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/mon-application",
          "awslogs-region": "eu-west-1",
          "awslogs-stream-prefix": "app"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3,
        "startPeriod": 60
      },
      "linuxParameters": {
        "initProcessEnabled": true
      }
    }
  ],
  
  "volumes": [],
  
  "tags": [
    {"key": "Environment", "value": "Production"},
    {"key": "Application", "value": "MonApp"}
  ]
}

2 - CPU et mémoire Fargate​

2.1 Combinaisons valides​

CPU (vCPU)Mémoire (GB)
256 (.25)0.5, 1, 2
512 (.5)1, 2, 3, 4
1024 (1)2, 3, 4, 5, 6, 7, 8
2048 (2)4 - 16 (incréments de 1)
4096 (4)8 - 30 (incréments de 1)
8192 (8)16 - 60 (incréments de 4)
16384 (16)32 - 120 (incréments de 8)

2.2 Répartition entre conteneurs​

{
  "containerDefinitions": [
    {
      "name": "app",
      "cpu": 384,
      "memory": 768,
      "memoryReservation": 512
    },
    {
      "name": "sidecar",
      "cpu": 128,
      "memory": 256
    }
  ],
  "cpu": "512",
  "memory": "1024"
}

3 - Container Definitions​

3.1 Configuration d'image​

{
  "name": "app",
  "image": "123456789.dkr.ecr.eu-west-1.amazonaws.com/app:v1.0",
  "repositoryCredentials": {
    "credentialsParameter": "arn:aws:secretsmanager:...:secret:dockerhub"
  }
}

3.2 Port mappings​

{
  "portMappings": [
    {
      "containerPort": 8080,
      "hostPort": 8080,
      "protocol": "tcp",
      "name": "http",
      "appProtocol": "http"
    },
    {
      "containerPort": 9090,
      "protocol": "tcp",
      "name": "metrics"
    }
  ]
}

3.3 Variables d'environnement​

{
  "environment": [
    {"name": "ENV", "value": "production"},
    {"name": "LOG_LEVEL", "value": "info"}
  ],
  "environmentFiles": [
    {
      "value": "arn:aws:s3:::bucket/env-files/prod.env",
      "type": "s3"
    }
  ]
}

3.4 Secrets​

{
  "secrets": [
    {
      "name": "DB_PASSWORD",
      "valueFrom": "arn:aws:secretsmanager:eu-west-1:123456789:secret:db-creds:password::"
    },
    {
      "name": "API_KEY",
      "valueFrom": "arn:aws:ssm:eu-west-1:123456789:parameter/app/api-key"
    }
  ]
}

4 - Logging​

4.1 CloudWatch Logs​

{
  "logConfiguration": {
    "logDriver": "awslogs",
    "options": {
      "awslogs-group": "/ecs/app",
      "awslogs-region": "eu-west-1",
      "awslogs-stream-prefix": "app",
      "awslogs-create-group": "true",
      "mode": "non-blocking",
      "max-buffer-size": "25m"
    }
  }
}

4.2 FireLens (Fluentd/Fluent Bit)​

{
  "containerDefinitions": [
    {
      "name": "log_router",
      "image": "amazon/aws-for-fluent-bit:latest",
      "essential": true,
      "firelensConfiguration": {
        "type": "fluentbit",
        "options": {
          "config-file-type": "file",
          "config-file-value": "/fluent-bit/configs/parse-json.conf"
        }
      }
    },
    {
      "name": "app",
      "logConfiguration": {
        "logDriver": "awsfirelens",
        "options": {
          "Name": "cloudwatch_logs",
          "region": "eu-west-1",
          "log_group_name": "/ecs/app",
          "auto_create_group": "true"
        }
      }
    }
  ]
}

5 - Health Checks​

5.1 Container Health Check​

{
  "healthCheck": {
    "command": [
      "CMD-SHELL",
      "curl -f http://localhost:8080/health || exit 1"
    ],
    "interval": 30,
    "timeout": 5,
    "retries": 3,
    "startPeriod": 60
  }
}

5.2 ALB Health Check​

Le ALB effectue ses propres health checks sur le target group.

TargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    HealthCheckPath: /health
    HealthCheckIntervalSeconds: 30
    HealthCheckTimeoutSeconds: 5
    HealthyThresholdCount: 2
    UnhealthyThresholdCount: 3

6 - Volumes et stockage​

6.1 EFS Volume​

{
  "volumes": [
    {
      "name": "efs-storage",
      "efsVolumeConfiguration": {
        "fileSystemId": "fs-123456",
        "rootDirectory": "/app-data",
        "transitEncryption": "ENABLED",
        "authorizationConfig": {
          "accessPointId": "fsap-123456",
          "iam": "ENABLED"
        }
      }
    }
  ],
  "containerDefinitions": [
    {
      "mountPoints": [
        {
          "sourceVolume": "efs-storage",
          "containerPath": "/data",
          "readOnly": false
        }
      ]
    }
  ]
}

6.2 Bind Mount (ephemeral)​

{
  "volumes": [
    {
      "name": "scratch"
    }
  ],
  "containerDefinitions": [
    {
      "name": "app",
      "mountPoints": [
        {
          "sourceVolume": "scratch",
          "containerPath": "/tmp/data"
        }
      ]
    },
    {
      "name": "sidecar",
      "mountPoints": [
        {
          "sourceVolume": "scratch",
          "containerPath": "/shared"
        }
      ]
    }
  ]
}

7 - Multi-conteneurs​

7.1 Pattern Sidecar​

{
  "containerDefinitions": [
    {
      "name": "app",
      "image": "app:latest",
      "essential": true,
      "portMappings": [{"containerPort": 8080}],
      "dependsOn": [
        {"containerName": "envoy", "condition": "START"}
      ]
    },
    {
      "name": "envoy",
      "image": "envoyproxy/envoy:v1.27",
      "essential": true,
      "portMappings": [{"containerPort": 9901}]
    },
    {
      "name": "datadog-agent",
      "image": "datadog/agent:latest",
      "essential": false
    }
  ]
}

7.2 Container Dependencies​

{
  "dependsOn": [
    {"containerName": "init", "condition": "SUCCESS"},
    {"containerName": "sidecar", "condition": "HEALTHY"}
  ]
}
ConditionDescription
STARTLe conteneur a démarré
COMPLETELe conteneur s'est terminé
SUCCESSExit code 0
HEALTHYHealth check OK

8 - Via CloudFormation​

TaskDefinition:
  Type: AWS::ECS::TaskDefinition
  Properties:
    Family: mon-application
    NetworkMode: awsvpc
    RequiresCompatibilities:
      - FARGATE
    Cpu: '512'
    Memory: '1024'
    ExecutionRoleArn: !GetAtt ExecutionRole.Arn
    TaskRoleArn: !GetAtt TaskRole.Arn
    
    ContainerDefinitions:
      - Name: app
        Image: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/app:latest
        Essential: true
        PortMappings:
          - ContainerPort: 8080
        Environment:
          - Name: ENV
            Value: production
        Secrets:
          - Name: DB_PASSWORD
            ValueFrom: !Ref DBPasswordSecret
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group: !Ref LogGroup
            awslogs-region: !Ref AWS::Region
            awslogs-stream-prefix: app
        HealthCheck:
          Command:
            - CMD-SHELL
            - curl -f http://localhost:8080/health || exit 1
          Interval: 30
          Timeout: 5
          Retries: 3
          StartPeriod: 60

Résumé​

Dans ce chapitre, nous avons appris :

  • La structure complète d'une Task Definition
  • Les combinaisons CPU/Mémoire pour Fargate
  • Les Container Definitions et leurs options
  • La configuration du logging
  • Les health checks
  • Les volumes (EFS, bind mounts)
  • Les patterns multi-conteneurs

Prochaine étape​

Dans le prochain chapitre, nous verrons les Services ECS.

→ Chapitre suivant : Services ECS

← Retour à la table des matières