Meetup organized by the AWS and CNCF folks to go through the latest container related announcements in AWS land

1. Re:Cap Containers (recent) announcements
CNCF + AWS Meetup
Jan 15th 2020
Massimo Re Ferrè
Principal Developer Advocate @ Amazon Web Services
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

2. (Rough) Agenda
• “5 years in 5 minutes”
• Hints to some announcements (20 mins ~ )
• no slides, occasionally a Console bird’s-eye view?
• Dive slightly deeper in some other announcements (30 mins ~ )
• a few slides
• Dive deeper in a couple of announcements (50 mins ~ )
• slides + demos

3. Containers options on AWS – over time
AWS Cloud
AWSmanagedCustomermanaged

4. Containers options on AWS – over time
Docker
Host
AWS Cloud
AWSmanagedCustomermanaged

5. Containers options on AWS – over time
Amazon ECS
EC2 Container
Instances
Auto Scaling group
2015
ECS API
Docker
Host
AWS Cloud
AWSmanagedCustomermanaged

6. Containers options on AWS – over time
AWS Fargate
Amazon ECS
EC2 Container
Instances
Auto Scaling group
2017
ECS API
Docker
Host
AWS Cloud
AWSmanagedCustomermanaged

7. Containers options on AWS – over time
AWS Fargate
Amazon ECS
EC2 Container
Instances
Auto Scaling group
Worker
nodes
Auto Scaling group
DIY K8S
ECS API
K8s API
Docker
Host
AWS Cloud
AWSmanagedCustomermanaged

8. Containers options on AWS – over time
AWS Fargate
Amazon ECSAmazon EKS
EC2 Container
Instances
Auto Scaling group
Worker
nodes
Auto Scaling group
DIY K8S
2018
K8s API ECS API
K8s API
Docker
Host
AWS Cloud
AWSmanagedCustomermanaged

9. Containers options on AWS – over time
AWS Fargate
Amazon ECSAmazon EKS
EC2 Container
Instances
Auto Scaling group
Managed
Node Groups
Auto Scaling group
Worker
nodes
Auto Scaling group
DIY K8S
2019
K8s API ECS API
K8s API
Docker
Host
AWS Cloud
AWSmanagedCustomermanaged

10. Containers options on AWS – over time
AWS Fargate
Amazon ECSAmazon EKS
EC2 Container
Instances
K8s API ECS API
AWS Cloud
Auto Scaling group
Managed
Node Groups
Auto Scaling group
Worker
nodes
Auto Scaling group
DIY K8S
NEW
Docker
Host
K8s API
AWSmanagedCustomermanaged

11. The EC2 flow at 33,000 feet
Amazon EC2
Customer AccountAWS
VPC
PodService
You have to manage this
capacity (e.g., with ASGs)
Run a container on EC2
for me, please
EC2
Control Plane
ENI

12. The Fargate flow at 33,000 feet
Customer AccountAWS
Control Plane
VPC
AWS Fargate
Run a container on
FARGATE for me, please
You don’t have to
manage capacity
FARGATE
PodService
ENI

13. All Topics we will (at least) mention
• Fargate saving plans (for ECS only) *
• Fargate Spot (for ECS only) *
• ECS Capacity Providers
• ECS CLI v2
• Image Scanning for ECR *
• ECS/ECR for Outpost
• EKS Managed NodeGroups *
• EKS / Fargate
• Public Container Roadmap *

14. Topics we will dive into (to an extent)
• ECS/ECR for Outpost *
• ECS Capacity Providers *
• EKS / Fargate
• ECS CLI v2

15. Topics we will dive into (with a demo)
• ECS CLI v2
• EKS / Fargate

17. Why Outposts?
• Law of Physics (latency sensitive scenarios)
• Law of Economics (massive expensive data transfers)

18. AZ1
AZ2
AZ3
Subnet1Subnet2Subnet3
What’s Outpost ?

19. AZ1
AZ2
AZ3
Subnet1Subnet2Subnet3
Customer network
What’s Outpost ?
Customer Data Center

20. AZ1
AZ2
AZ3
Subnet1Subnet2Subnet3
Customer network
What’s Outpost ?
Customer Data Center

21. AZ1
AZ2
AZ3
Subnet1Subnet2Subnet3
Customer network
Subnet 4
What’s Outpost ?
Customer Data Center

22. AZ1
AZ2
AZ3
Subnet1Subnet2Subnet3
Customer network
Subnet 4
LGW
What’s Outpost ?
Customer Data Center

23. AZ1
AZ2
AZ3
Subnet1Subnet2Subnet3
Customer network
Subnet 4
LGW
Internet or Direct Connect
What’s Outpost ?
Customer Data Center

24. AZ1
AZ2
AZ3
Subnet1Subnet2Subnet3
Customer network
Subnet 4
LGW
Internet or Direct Connect
What’s Outpost ?
ECS/EKSControlPlane
ECS/EKSDataPlane
(EC2Fargate)
ECS/EKSDataPlane
(EC2)
Customer Data Center

26. NEW: ECS capacity provider– Application-focus with ECS
Build and operate applications, not infrastructure

27. Application First
Tenets for Application First:
• Applications own their requirements.
• Infrastructure responds to application requirements.

28. Scaling the Cluster
EC2 Auto Scaling Group
EC2 Instances
ECS Tasks
ECS Cluster

29. Scaling Metrics
https://garbe.io/blog/2017/04/12/a-better-solution-to-ecs-autoscaling/
https://medium.com/thron-tech/aws-ecs-host-auto-scaling-with-custom-cloudwatch-metrics-and-aws-lambda-b9a9f55faf1d

30. Blog on Capacity Providers scaling behavior
https://aws.amazon.com/blogs/containers/deep-dive-on-amazon-ecs-cluster-auto-scaling/

31. Before: Infrastructure-first
Infrastructure-first:
No way to ensure Service A exclusively run on Spot and Service B exclusively run on EC2 On-Demand instances

32. Now: Application-first with capacity providers

33. Running Tasks with Capacity Provider Strategies
ECS Cluster
ECS Capacity Provider: CP1
ECS Capacity Provider: CP2

35. EKS data plane options
Worker nodes only
Amazon EKS
Availability Zone 1
Auto Scaling group
Availability Zone 2
Auto Scaling group
Worker node Worker node
Worker node Worker node
Amazon EC2
Auto Scaling
Traditional container data plane
Pods

36. EKS data plane options
Mixed mode
Serverless container data plane
NEW
AWS Fargate
Amazon EKS
Availability Zone 1
Auto Scaling group
Availability Zone 2
Auto Scaling group
Worker node Worker node
Worker node Worker node
Amazon EC2
Auto Scaling
Traditional container data plane
PodsPods

37. EKS data plane options
Fargate only
Serverless container data plane
NEW
AWS Fargate
Amazon EKS
Pods

39. {
"name": profile-a,
"clusterName": mycluster,
"podExecutionRole": iam-role-xyz,
"subnets": subnet-0ad888345,
"selectors": [
{
"namespace": prod,
"labels": {
stack: blue
}
}
]
}
Fargate profile
Simplified deployment flow
Availability Zone 1
Auto Scaling group
Availability Zone 2
Auto Scaling group
Worker node Worker node
Worker node Worker node
Amazon EC2 Auto
Scaling
AWS Fargate
KubernetesAmazon EKS
Fargate Scheduler
Pod 4
Mutating/
Validating
Webhooks
namespace: prod
labels:
- stack: blue
- profile = profile-a
- schedulerName = fargate-
scheduler
Pod
3
2 namespace: prod
labels:
- stack: blue
1
Pod

40. {
"name": profile-a,
"clusterName": mycluster,
"podExecutionRole": iam-role-xyz,
"subnets": subnet-0ad888345,
"selectors": [
{
"namespace": prod,
"labels": {
stack: blue
}
}
]
}
Fargate profile
Simplified deployment flow
Availability Zone 1
Auto Scaling group
Availability Zone 2
Auto Scaling group
Worker node Worker node
Worker node Worker node
Amazon EC2 Auto
Scaling
AWS Fargate
KubernetesAmazon EKS
Fargate Scheduler
Pod 4
Mutating/
Validating
Webhooks
namespace: test
1
Pod
2
3

41. How do we pick the size of the pod?
This
CPU Memory
256 (.25 vCPU) 512MB, 1GB, 2GB
512 (.5 vCPU) 1GB, 2GB, 3GB, 4GB
1024 (1 vCPU) 2GB, 3GB, 4GB, 5GB, 6GB, 7GB, 8GB
2048 (2 vCPU) Between 4GB and 16GB in 1GB increments
4096 (4 vCPU) Between 8GB and 30GB in 1GB increments
Closest config
(rounded up)
is picked
Fargate task size combinations
MEMCPU
+256MB
Kubernetes components

43. Here’s the plan
We’re going to build a
service on Amazon ECS 🎉 !

44. Here’s the plan
Production-ready We’re going to build a
service on ECS 🎉 !
Multi-environment
Well-Architected
Multi-service
Continuously delivered

45. A basic app (for demo purposes)
https://github.com/mreferre/nginx-custom-site

46. Architecture overview for an app
1 VPC
2 Public subnets
2 Private subnets
2 Route tables
1 Internet gateways
1 ECS cluster
1 ECS services
AWS resources
2 IAM roles
1 ECR repository
1 Application Load Balancer
1 Target groups
1 ALB route rules
1 Security groups
1 Task definitions
1 Log groups

47. Architecture overview for an app
1 VPC
2 Public subnets
2 Private subnets
2 Route tables
1 Internet gateways
1 ECS cluster
1 ECS services
AWS resources (1 environment)
2 IAM roles
1 ECR repository
1 Application Load Balancer
1 Target groups
1 ALB route rules
1 Security groups
1 Task definitions
1 Log groups

48. Architecture overview for an app
2 VPC
4 Public subnets
4 Private subnets
4 Route tables
2 Internet gateways
2 ECS cluster
2 ECS services
AWS resources (2 environments)
4 IAM roles
1 ECR repositories
2 Application Load Balancer
2 Target groups
2 ALB route rules
2 Security groups
2 Task definitions
2 Log groups

49. Releasing ecs-kudos
Source code:
“master”
branch
AWS CodeBuild:
Build and push
application image
ECS:
Deploy image
to test
environment
Source Build Test Production
ECS:
Deploy image
to prod
environment

50. Architecture overview for an app
2 VPC
4 Public subnets
4 Private subnets
4 Route tables
2 Internet gateways
2 ECS cluster
2 ECS services
AWS resources (2 environments)
4 IAM roles
1 ECR repositories
2 Application Load Balancer
2 Target groups
2 ALB route rules
2 Security groups
2 Task definitions
2 Log groups

51. Architecture overview for an app
2 VPC
4 Public subnets
4 Private subnets
4 Route tables
2 ECS cluster
2 ECS services
AWS Resources (2 environments & CD)
4 IAM roles
1 ECR repositories
2 ALBs
2 Target groups
2 ALB route rules
2 Security groups
2 Task definitions
2 Log groups
1 AWS CodePipeline
1 AWS CodeBuild project
2 Amazon S3 buckets
2 CMK KMS keys
x-account policies
x-region policies