AWS ECS私有和公共服务 [英] AWS ECS Private and Public Services

问题描述

我有一个场景，我必须在AWS ECS上部署多个微服务。我想使服务能够通过在每个微服务中开发的API相互通信。我也想在AWS ECS上部署前端，该前端可以公开访问，也可以与AWS ECS上部署的其他微服务通信。我该如何实现？我可以通过将所有服务都放在私有子网中以启用它们之间的通信来使用AWS ECS服务发现吗？我可以使用Elastic Load Balancer使前端微服务仅通过HTTP / HTTPS协议通过Internet允许最终用户通过互联网访问，同时将其保留在专用子网中吗？

I have a scenario where I have to deploy multiple micro-services on AWS ECS. I want to make services able to communicate with each other via APIs developed in each micro-service. I want to deploy the front-end on AWS ECS as well that can be accessed publicly and can also communicate with other micro-services deployed on AWS ECS. How can I achieve this? Can I use AWS ECS service discovery by having all services in a private subnet to enable communication between each of them? Can I use Elastic Load Balancer to make front-end micro-service accessible to end-users over the internet only via HTTP/HTTPS protocols while keeping it in a private subnet?

推荐答案

AWS负载平衡器（用于公共访问）和Amazon ECS服务发现（用于内部通信）的组合是Web应用程序的理想选择。

The combination of both AWS load balancer ( for public access) and Amazon ECS Service Discovery ( for internal communication) is the perfect choice for the web application.

ECS中的内置服务发现是另一个功能，使
易于开发动态容器环境，而无需
管理外部的许多资源您的应用程序。 ECS和Route 53
结合在一起提供高可用性，完全托管和安全的服务
发现

Built-in service discovery in ECS is another feature that makes it easy to develop a dynamic container environment without needing to manage as many resources outside of your application. ECS and Route 53 combine to provide highly available, fully managed, and secure service discovery

服务发现是一种使用容器直接IP地址而不是像负载平衡器之类的中介将流量从一个容器传递到另一个容器的技术。它适用于各种用例：

Service discovery is a technique for getting traffic from one container to another using the containers direct IP address, instead of an intermediary like a load balancer. It is suitable for a variety of use cases:

• 私有的内部服务发现


• 低延迟服务之间的通信


• 长期存在的双向连接，例如gRPC。

是的，您可以使用 AWS ECS服务发现，将所有服务都放在私有子网中以实现它们之间的通信。

Yes, you can use AWS ECS service discovery having all services in a private subnet to enable communication between them.

ECS服务可能会自动在Amazon Route 53中使用可预测且友好的DNS名称自动注册
本身。随着
您的服务根据负载或容器
的运行状况而扩大或缩小53个托管区域保持最新状态，从而允许其他
服务根据每个服务的
状态在需要连接的地方进行查找。

This makes it possible for an ECS service to automatically register itself with a predictable and friendly DNS name in Amazon Route 53. As your services scale up or down in response to load or container health, the Route 53 hosted zone is kept up to date, allowing other services to lookup where they need to make connections based on the state of each service.

是的，您可以使用 Load Balancer 使前端微服务可供最终用户通过Internet访问。您可以查看该图，其中显示了ECS中Web应用程序的AWS LB和服务发现。

Yes, you can use Load Balancer to make front-end micro-service accessible to end-users over the internet. You can look into this diagram that shows AWS LB and service discovery for a Web application in ECS.

您可以看到位于私有子网中的后端容器，通过ALB服务于公共请求，而其余容器使用AWS服务发现。

You can see the backend container which is in private subnet, serve public request through ALB while rest of the container use AWS service discovery.

Amazon ECS服务发现

让我们启动带有服务发现功能的应用程序！首先，我将为
创建两个任务定义：烧瓶后端和烧瓶工人。两者都是
个简单的AWS Fargate任务，仅一个容器即可处理HTTP
请求。我要烧瓶后端要求worker.corp做一些工作，然后
我将返回响应以及Route 53为
工作人员返回的地址。类似于以下代码：

Let’s launch an application with service discovery! First, I’ll create two task definitions: "flask-backend" and "flask-worker". Both are simple AWS Fargate tasks with a single container serving HTTP requests. I’ll have flask-backend ask worker.corp to do some work and I’ll return the response as well as the address Route 53 returned for worker. Something like the code below:

@app.route("/")
namespace = os.getenv("namespace")
worker_host = "worker" + namespace
def backend():
    r = requests.get("http://"+worker_host)
    worker = socket.gethostbyname(worker_host)
    return "Worker Message: {]\nFrom: {}".format(r.content, worker)

请注意，在此私有体系结构中，没有公共子网，只有私有子网。子网内的容器可以使用其内部IP地址相互通信。但是他们需要某种方式来发现彼此的IP地址。

Note that in this private architecture there is no public subnet, just a private subnet. Containers inside the subnet can communicate to each other using their internal IP addresses. But they need some way to discover each other’s IP address.

AWS服务发现提供两种方法：

AWS service discovery offers two approaches:

• 基于DNS（路由53创建并维护一个自定义DNS名称，
  解析为其他容器的一个或多个IP地址，例如
  ， http：//nginx.service.production 然后，其他容器可以通过仅使用
  打开此DNS的连接，
  将流量发送到目标名称）


• 基于API（容器可以查询API以获得可用的IP地址
  目标列表，然后直接打开与另一个
  的连接

• DNS based (Route 53 create and maintains a custom DNS name which resolves to one or more IP addresses of other containers, for example, http://nginx.service.production Then other containers can send traffic to the destination by just opening a connection using this DNS name)
• API based (Containers can query an API to get the list of IP address targets available, and then open a connection directly to one of the other container.)

您可以阅读有关 amazon-ecs-service-discovery 和此处

这篇关于AWS ECS私有和公共服务的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！