![Run Below command from
Project Directory to build the image
Before that install docker:
https://docs.docker.com/engine/install/
To Make Docker Build
docker image build -t <image_name>:tag .
(“.” refer to current directory)
e.g.
docker image build -t cicd-demo:v1 .
Test image running fine or not:
docker run -d --name cicd-demo -p 3000:3000 cicd-demo:v1
Dockerfile
FROM node:14
# Setting working directory. All the path will be
relative to WORKDIR
WORKDIR /usr/src/app
# Install app dependencies
# A wildcard is used to ensure both package.json
AND package-lock.json are copied
# where available (npm@5+)
COPY package*.json ./
RUN npm install
# If you are building your code for production
# RUN npm ci --only=production
# Bundle app source
COPY . .
EXPOSE 3000
CMD [ "node", "index.js" ]
Build the docker image using Dockerfile](https://image.slidesharecdn.com/awselastickubernetesservicecicd1642308244-220422073001/95/What-Is-AWS-Elastic-Kubernetes-Service-12-638.jpg)
![Let’s create Required IAM Role
In the first try you will see access denied error, to resolve that and add proper
IAM access, we will create a fresh AWS IAM Role and add needed policy
there and then attach that to the codebuild project
Run :
chmod +x /eks_cicd/create_iam_role.sh
sh /eks_cicd/create_iam_role.sh
This will create a role called: CodeBuildKubectlRole
And in console you will see output as below like:
arn:aws:iam::youeaccountid:role/CodeBuildKubectlRole
Make sure to update/Edit CodeBuild role as shown
in video tutorial so that CodeBuild project will
have required access:
https://www.youtube.com/watch?v=nEK7e0QUVio
create_iam_role.sh
#!/usr/bin/env bash
TRUST="{ "Version": "2012-10-17", "Statement": [ {
"Effect": "Allow", "Principal": {
"Service": "codebuild.amazonaws.com" },
"Action": "sts:AssumeRole" } ] }"
echo '{ "Version": "2012-10-17", "Statement": [ { "Effect":
"Allow", "Action": "eks:Describe*", "Resource": "*" } ] }' >
/tmp/iam-role-policy
aws iam create-role --role-name CodeBuildKubectlRole
--assume-role-policy-document "$TRUST" --output text --query
'Role.Arn'
aws iam put-role-policy --role-name CodeBuildKubectlRole
--policy-name eks-describe --policy-document
file:///tmp/iam-role-policy
aws iam attach-role-policy --role-name CodeBuildKubectlRole
--policy-arn arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
aws iam attach-role-policy --role-name CodeBuildKubectlRole
--policy-arn arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess
aws iam attach-role-policy --role-name CodeBuildKubectlRole
--policy-arn arn:aws:iam::aws:policy/AWSCodeCommitFullAccess
aws iam attach-role-policy --role-name CodeBuildKubectlRole
--policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess
aws iam attach-role-policy --role-name CodeBuildKubectlRole
--policy-arn
arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess](https://image.slidesharecdn.com/awselastickubernetesservicecicd1642308244-220422073001/95/What-Is-AWS-Elastic-Kubernetes-Service-16-638.jpg)
What Is AWS Elastic Kubernetes Service
- 1. 1) Introduction to AWS EKS (Small Overview) 2) Set up EKS Clusters Using eksctl 3) Deploy Simple NodeJs App using kubectl 4) Setting Up CI/CD With AWS CodePipeline + AWS CodeCommit + AWS CodeBuild 5) Configuring AWS EKS Cluster for CI/CD A practical guide to AWS EKS CI/CD By Sandip Das
- 2. Contents ➔ Introduction to AWS EKS ➔ Benefits ➔ Cost ➔ AWS EKS Architecture ➔ Kubernetes and VPC Networking ➔ Companies Using AWS EKS ➔ Let’s Create An AWS EKS Cluster & Deploy A Simple NodeJs Application ➔ Install Essential Tools ➔ Create AWS EKS Cluster ➔ Build the docker image using Dockerfile ➔ Publishing/Store Image to AWS ECR (Elastic Container Registry ) ➔ Finally Let’s deploy the Application ➔ Let’s set-up the pipeline ➔ Add Required IAM Role ➔ Configuring AWS EKS Cluster for CI/CD ➔ Clean up everything ➔ More learning resources ➔ Thanks You 😇
- 3. AWS EKS Amazon Elastic Kubernetes Service (Amazon EKS) makes it easy to deploy, manage, and scale containerized applications using Kubernetes on AWS. Amazon EKS runs the Kubernetes management infrastructure for you across multiple AWS availability zones to eliminate a single point of failure. Amazon EKS is certified Kubernetes conformant so you can use existing tooling and plugins from partners and the Kubernetes community. Applications running on any standard Kubernetes environment are fully compatible and can be easily migrated to Amazon EKS. Amazon EKS is generally available for all AWS customers.
- 4. Benefits Let’s discuss in short what features it provides ➔ No Control plane to manage ➔ Secure by default ➔ Comformant and Compatible ➔ Optimized for cost ➔ Build with the community
- 5. Cost Let’s discuss about the cost ➔ Each EKS Cluster Cost $0.10/hour i.e. $73/month You can use a single Amazon EKS cluster to run multiple applications by taking advantage of Kubernetes namespaces and IAM security policies. ➔ EC2 Instances & EBS volumes used in AS Worker Nodes You pay for AWS resources , you create to run your Kubernetes worker nodes. You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.
- 8. Companies Using AWS EKS
- 9. Let’s Create An AWS EKS Cluster & Deploy A Simple NodeJs Application Make sure to install awscli, eksctl, kubectl,aws-iam-authenticator To make sure everything installed and all set, run: sh prereqs.sh Project GitHub url: https://github.com/sd031/aws_codebuild_codedeploy_nodeJs_demo All Kubernetes related config files are in “eks_cicd” folder Video Tutorial on YouTube: https://www.youtube.com/watch?v=nEK7e0QUVio
- 10. Install Essential Tools We will need below tools to be installed ➔ Install aws cli https://docs.aws.amazon.com/cli/latest/userg uide/cli-chap-install.html (install cli v2) ➔ Install kubectl https://docs.aws.amazon.com/eks/latest/user guide/install-kubectl.html ➔ Install aws-iam-authenticator https://docs.aws.amazon.com/eks/latest/user guide/install-aws-iam-authenticator.html ➔ Install eksctl https://docs.aws.amazon.com/eks/latest/user guide/getting-started-eksctl.html or https://eksctl.io/introduction/installation/
- 11. cluster.yaml apiVersion: eksctl.io/v1alpha5 kind: ClusterConfig metadata: name: cicd-demo #cluster name region: us-west-2 #desired region nodeGroups: - name: ng-1 #cluster node group name instanceType: t2.medium #desired instance type desiredCapacity: 3 #desired nodes count / capacity ssh: allow: false Create Cluster: eksctl create cluster -f cluster.yaml Then check for the message: EKS cluster "<cluster name>" in "<aws region>" region is ready Check that kubectl client get auto set properly or not by: cat /home/ec2-user/.kube/config If want to Delete Cluster anytime: eksctl delete cluster -f cluster.yaml Note: Running delete command will remove all the resources Create AWS EKS Cluster
- 12. Run Below command from Project Directory to build the image Before that install docker: https://docs.docker.com/engine/install/ To Make Docker Build docker image build -t <image_name>:tag . (“.” refer to current directory) e.g. docker image build -t cicd-demo:v1 . Test image running fine or not: docker run -d --name cicd-demo -p 3000:3000 cicd-demo:v1 Dockerfile FROM node:14 # Setting working directory. All the path will be relative to WORKDIR WORKDIR /usr/src/app # Install app dependencies # A wildcard is used to ensure both package.json AND package-lock.json are copied # where available (npm@5+) COPY package*.json ./ RUN npm install # If you are building your code for production # RUN npm ci --only=production # Bundle app source COPY . . EXPOSE 3000 CMD [ "node", "index.js" ] Build the docker image using Dockerfile
- 13. It’s just like Docker Hub, where we can push and Pull image and we can use it with AWS ECR same way. To get the docker login and auto execute the login the command is: aws ecr get-login-password --region <region name> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.us-west-2.amazonaws.com E.g aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-west-2.amazonaws.com After this create a ECR repo from AWS Management console, it will give a url like Showing in right side diagram, after that tag The image: (All command are already given in AWS ECR UI, just use the same) docker tag cicd-demo:latest 123456789012.dkr.ecr.us-west-2.amazonaws.com/cicd-demo:latest docker push 123456789012.dkr.ecr.us-west-2.amazonaws.com/cicd-demo:latest Make sure you use the right tags Publishing Image to AWS ECR
- 14. Finally Let’s deploy the Application deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: labels: app.kubernetes.io/name: cicd-demo app.kubernetes.io/instance: cicd-demo-instance app.kubernetes.io/version: '1.0.0' app.kubernetes.io/managed-by: kubectl name: cicd-demo-deployment spec: replicas: 1 selector: matchLabels: app: cicd-demo template: metadata: labels: app: cicd-demo spec: containers: - image: 120717539064.dkr.ecr.us-west-2.amazonaws.com/cicd-demo:latest imagePullPolicy: Always name: cicd-demo ports: - containerPort: 3000 service.yaml apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/name: cicd-demo app.kubernetes.io/instance: cicd-demo-instance app.kubernetes.io/version: "1.0.0" app.kubernetes.io/component: backend app.kubernetes.io/managed-by: kubectl name: cicd-demo spec: selector: app: cicd-demo type: LoadBalancer ports: - protocol: TCP port: 80 targetPort: 3000 kubectl apply -f deployment.yaml kubectl apply -f service.yaml If any issue check logs: kubectl get pods kubectl describe pod pod_name_here
- 15. Let’s set-up the pipeline We will be creating one AWS Pipeline project e.g. cicd-demo Then Configure AWS CodeCommit as source And then using AWS CodeBuild We will make Build and Deploy changes in AWS EKS While Configuring AWS CodeBuild , make sure to set the build spec file properly and to enter the required environment variables as follow: AWS_DEFAULT_REGION AWS_CLUSTER_NAME AWS_ACCOUNT_ID IMAGE_REPO_NAME IMAGE_TAG Also add, ecr, eks, s3 access to the build role buildspec.yml
- 16. Let’s create Required IAM Role In the first try you will see access denied error, to resolve that and add proper IAM access, we will create a fresh AWS IAM Role and add needed policy there and then attach that to the codebuild project Run : chmod +x /eks_cicd/create_iam_role.sh sh /eks_cicd/create_iam_role.sh This will create a role called: CodeBuildKubectlRole And in console you will see output as below like: arn:aws:iam::youeaccountid:role/CodeBuildKubectlRole Make sure to update/Edit CodeBuild role as shown in video tutorial so that CodeBuild project will have required access: https://www.youtube.com/watch?v=nEK7e0QUVio create_iam_role.sh #!/usr/bin/env bash TRUST="{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }" echo '{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "eks:Describe*", "Resource": "*" } ] }' > /tmp/iam-role-policy aws iam create-role --role-name CodeBuildKubectlRole --assume-role-policy-document "$TRUST" --output text --query 'Role.Arn' aws iam put-role-policy --role-name CodeBuildKubectlRole --policy-name eks-describe --policy-document file:///tmp/iam-role-policy aws iam attach-role-policy --role-name CodeBuildKubectlRole --policy-arn arn:aws:iam::aws:policy/CloudWatchLogsFullAccess aws iam attach-role-policy --role-name CodeBuildKubectlRole --policy-arn arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess aws iam attach-role-policy --role-name CodeBuildKubectlRole --policy-arn arn:aws:iam::aws:policy/AWSCodeCommitFullAccess aws iam attach-role-policy --role-name CodeBuildKubectlRole --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess aws iam attach-role-policy --role-name CodeBuildKubectlRole --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess
- 17. Configuring AWS EKS Cluster for CI/CD Even though the CodeBuild role has permission to authenticate to the cluster, it doesn’t have the requisite RBAC access to do any other action on the cluster. You can even list pods in the cluster. You should read the following quote from EKS documentation: “When you create an Amazon EKS cluster, the IAM entity user or role, such as a federated user that creates the cluster, is automatically granted system:masters permissions in the cluster's RBAC configuration. To grant additional AWS users or roles the ability to interact with your cluster, you must edit the aws-auth ConfigMap within Kubernetes.” So, we need to edit the aws-auth configmap. How do you do that? If you are the one who created the cluster, you need to run the following in your local terminal to create a copy of the aws-auth configMap. Option 1: Since we are using eksctl tool, we can simply do the role mapping by running this command: eksctl create iamidentitymapping --cluster cluster_name_here --arn role_arn_here --group system:masters --username intended_user_name_here E.g. eksctl create iamidentitymapping --cluster cicd-demo --arn arn:aws:iam::your_accoun_tid_here:role/CodeBuildKubectlRole --group system:masters --username CodeBuildKubectlRole Check below URL for documentation https://eksctl.io/usage/iam-identity-mappings/
- 18. Configuring AWS EKS Cluster for CI/CD Option 2: aws eks update-kubeconfig --name eks-cluster-name --region aws-region kubectl get configmaps aws-auth -n kube-system -o yaml > aws-auth.yaml Now, edit your aws-auth.yaml, and add the following under data.mapRoles -rolearn: arn:aws:iam::510442909921:role/role-name username: role-name groups: -system:masters Apply this configuration from your terminal: kubectl apply -f aws-auth.yaml If face any issue, follow this debug steps: https://aws.amazon.com/premiumsupport/knowledge-center/am azon-eks-cluster-access/ aws-auth.yaml sample file apiVersion: v1 kind: ConfigMap metadata: name: aws-auth namespace: kube-system data: mapRoles: | - rolearn: arn:aws:iam::11122223333:role/EKS-Worker-NodeInstance Role-1I00GBC9U4U7B username: system:node:{{EC2PrivateDNSName}} groups: - system:bootstrappers - system:nodes - rolearn: arn:aws:iam::11122223333:role/designated_role username: designated_role groups: - system:masters
- 19. Since we have used eksctl, it’s a lot easier Delete cluster: eksctl delete cluster -f cluster.yaml Behind the scene the cloud formation stack will get deleted and accordingly resources will be deleted as well, must do it if you are doing in development or test as a temporary deployment otherwise it will cost you a lot Clean up everything
- 20. There are few more things you need to know This demo is just the start points of CICD and there is a lot more out there, the more you use it , the more experience you will gather, so I will highly suggest try by yourself and deploy your own AWS EKS Cluster. After trying the basic app deployments , the next thing you might be interested to learn are: 1) Using Spot instances with Kubernetes and save 90% of cost 2) Types of Deployments available in Kubernetes Deployment and how to configure it 3) Types of Services available in Kubernetes Service and how to configure it. 4) CI/CD with Kubernetes 5) Logging with Cloud Trail 6) Logging to Cloudwatch with Fluentd 7) Complex Authentication , Roles etc
- 21. Good luck! I hope you’ll use this knowledge and build awesome solutions. If any issue contact me in Linkedin: https://www.linkedin.com/in/sandip-das-developer/