我有这个任务定义代码,有问题:
{
"family": "ikg-api",
"taskRoleArn": "",
"executionRoleArn": "arn:aws:iam::913xxxx371:role/ecsTaskExecutionRole",
"networkMode": "awsvpc",
"containerDefinitions": [
{
"name": "ikg-api",
"image": "913xxxx371.dkr.ecr.us-west-2.amazonaws.com/ikg_api:fda0b49f8",
"cpu": 512,
"memory": 1024,
"memoryReservation": 1024,
"portMappings": [
{
"containerPort": 80,
"hostPort": 80,
"protocol": "tcp"
}
],
"essential": true,
"environment": [
{
"name": "is_docker",
"value": "yes"
}
],
"secrets": [
{
"name": "bitbucket_password",
"valueFrom": "arn:aws:ssm:us-west-1:913xxxx0371:parameter/bitbucket_pwd"
}
],
"startTimeout": 10,
"stopTimeout": 19,
"user": "root",
"workingDirectory": "/apps",
"disableNetworking": false,
"privileged": false,
"readonlyRootFilesystem": false,
"interactive": false,
"pseudoTerminal": false,
"healthCheck": {
"command": [
"curl",
"localhost"
],
"interval": 30,
"timeout": 20,
"retries": 1,
"startPeriod": 50
}
}
],
"networkConfiguration": {
"awsvpcConfiguration": {
"assignPublicIp": "ENABLED",
"securityGroups": [
"sg-0a6e7d4a5238fe3c6"
],
"subnets": [
"subnet-05a6557c"
]
}
},
"requiresCompatibilities": [
"FARGATE"
],
"cpu": "512",
"memory": "1024",
"tags": [
{
"key": "Project",
"value": "IKG"
}
]
}
当我使用以下方式上传定义时:
aws ecs run-task --cluster tutorial --task-definition ikg-api:1 --count 1
我收到此错误:
调用RunTask时发生错误(InvalidParameterException) 操作:网络模式时必须提供网络配置 指定了“awsvpc”。
我一生都不知道如何解决它。我尝试为我能找到的网络配置设置最理智的值...没有骰子。 有人知道我如何解决这个问题吗?
这是包含网络配置的运行任务命令
aws ecs run-task --cluster your-cluster --task-definition your-task:1
--count 1 --launch-type FARGATE
--network-configuration "awsvpcConfiguration={subnets=[subnet-0123456789],securityGroups=[sg-0123456789]}"
您将需要类似下面的东西(我工作中的快照)
NetworkConfiguration:
AwsvpcConfiguration:
AssignPublicIp: DISABLED
SecurityGroups:
- !Ref ECSServicesSecurityGroup
Subnets:
- Fn::ImportValue: !Sub ${VPCStack}-SubnetPrivateA
- Fn::ImportValue: !Sub ${VPCStack}-SubnetPrivateB
- Fn::ImportValue: !Sub ${VPCStack}-SubnetPrivateC
我认为@user2014363的答案是正确的,我能够用它来运行我的任务。如果其他人尝试在 CI 中执行此操作,您可能无法提前知道您的子网/安全组 ID。我能够使用 AWS CLI 来获取这些(您需要有某种方法来识别所需的子网/安全组,例如按标签进行过滤):
mytask:
image: python:3.8
stage: deploy
only:
- master
when: manual
before_script:
- pip install awscli
- apt-get -qq update && apt-get -y install jq
- |
subnets=$( \
aws ec2 describe-subnets \
--filters \
Name=tag:aws:cloudformation:stack-name,Values=${ENVIRONMENT}-${APP_NAME}-stack \
Name=tag:aws-cdk:subnet-type,Values=Public \
| jq -r '.Subnets | map(.SubnetId) | join(",")')
script:
- |
aws ecs run-task \
--cluster ${ENVIRONMENT}-${APP_NAME}-cluster \
--task-definition ${ENVIRONMENT}-${APP_NAME}-collectstatic \
--network-configuration "awsvpcConfiguration={subnets=[${subnets}],assignPublicIp=ENABLED}" \
--count 1 \
--launch-type FARGATE
对于使用 Terraform 的用户,您需要在“aws_ecs_service”资源中添加 network_configuration 块。
network_configuration {
subnets = aws_subnet.private.*.id
}