一、架構圖
1.1、架構圖
1.2、一些文件解釋
- buildspec.yaml: 主要是 codebuile 在構建過程中需要的一個文件,用了告知如何構建。
- appspec.yaml: 是 codedeploy 在部署過程中的修訂文件,可以比作爲一個環境變量配置文件吧。
- taskdef.json:是我們的 ECS task 的一個定義文件,有這個文件 codepipeline 纔可以在每次構建中根據要求爲我們創建 task definition。
- imageDetail.json:用來輸出我們新構建的鏡像地址,用於新的部署使用。
1.3、流程
- codebuild 通過文件
buildspec.yaml
進行構建,生成文件imageDetail.json
; - codepipeline 會提取文件
imageDetail.json
中的 imageurl,放入環境變量IMAGE1_NAME
; - codepipeline 把
taskdef.json
中的<IMAGE1_NAME>
替換爲新的 URL,並請求 ECS RegisterTaskDefinition API 進行新的任務定義註冊; - 註冊完成後 API 會返回其任務定義 ARN,codepipeline 並用此 ARN 信息替換
appspec.yaml
中的<TASK_DEFINITION>
; - 而後 CodePipeline 根據
appspec.yaml
的信息,發動 CreateDeployment API 開始透過 CodeDeploy 執行藍綠佈署。
二、創建 ECR 倉庫
創建 ECR 鏡像倉庫,我所有的操作都是在 us-east-1 這個區域,操作的 IAM 用戶擁有 root 權限。
$ aws ecr create-repository --repository-name nginx-ecs --image-scanning-configuration scanOnPush=true --region us-east-1
{
"repository": {
"repositoryUri": "921283538843.dkr.ecr.us-east-1.amazonaws.com/nginx-ecs",
"imageScanningConfiguration": {
"scanOnPush": true
},
"registryId": "921283538843",
"imageTagMutability": "MUTABLE",
"repositoryArn": "arn:aws:ecr:us-east-1:921283538843:repository/nginx-ecs",
"repositoryName": "nginx-ecs",
"createdAt": 1580358204.0
}
}
三、創建 codebuild project
3.1、創建 ServiceRole
codebuild 需要獲取 s3 等權限。
$ aws iam create-role --role-name AWSCodeBuildServiceRole --assume-role-policy-document '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":{"Service":"codebuild.amazonaws.com"},"Action":"sts:AssumeRole"}}'
創建 policy。
$ aws iam create-policy --policy-name AWSCodeBuildPolicy --policy-document https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/AWSCodeBuildPolicy.json
{
"Policy": {
"PolicyName": "AWSCodeBuildPolicy",
"PermissionsBoundaryUsageCount": 0,
"CreateDate": "2020-01-30T09:34:36Z",
"AttachmentCount": 0,
"IsAttachable": true,
"PolicyId": "ANPA5NAGHF6NYARCBUGDT",
"DefaultVersionId": "v1",
"Path": "/",
"Arn": "arn:aws:iam::921283538843:policy/AWSCodeBuildPolicy",
"UpdateDate": "2020-01-30T09:34:36Z"
}
}
角色附加策略。
$ aws iam attach-role-policy --role-name AWSCodeBuildServiceRole --policy-arn arn:aws:iam::921283538843:policy/AWSCodeBuildPolicy
$ aws iam attach-role-policy --role-name AWSCodeBuildServiceRole --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser
3.2、創建 codebuild project
$ wget https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/create-project.json
$ wget aws codebuild create-project --cli-input-json file://create-project.json
- 參考文檔:https://docs.aws.amazon.com/zh_cn/codebuild/latest/userguide/create-project.html#create-project-cli
- buildspec.yaml : https://docs.aws.amazon.com/zh_cn/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-syntax
四、創建 ECS 藍綠 CodeDeploy
4.1、爲 CodeDeploy 創建服務角色
$ aws iam create-role --role-name AWSCodeDeployServiceRole --assume-role-policy-document '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":{"Service":"codedeploy.amazonaws.com"},"Action":"sts:AssumeRole"}}'
附加策略。
$ aws iam attach-role-policy --role-name AWSCodeDeployServiceRole --policy-arn arn:aws:iam::aws:policy/AWSCodeDeployRoleForECS
4.2、創建 ECS 使用的 ALB
使用 create-load-balancer 命令創建 應用程序負載均衡器。指定兩個不屬於同一可用區的子網以及一個安全組。
aws elbv2 create-load-balancer \
--name nginx-ecs-bluegreen-alb \
--subnets subnet-694b2b35 subnet-f5761192 \
--security-groups sg-cdc5cf8f \
--region us-east-1
使用 create-target-group 命令創建目標組。此目標組將流量路由到服務中的原始任務集。
aws elbv2 create-target-group \
--name bluegreentarget1 \
--protocol HTTP \
--port 80 \
--target-type ip \
--vpc-id vpc-ebff4c91 \
--region us-east-1
aws elbv2 create-target-group \
--name bluegreentarget2 \
--protocol HTTP \
--port 80 \
--target-type ip \
--vpc-id vpc-ebff4c91 \
--region us-east-1
使用 create-listener 命令創建負載均衡器偵聽器,該偵聽器帶有將請求轉發到目標組的默認規則。
aws elbv2 create-listener \
--load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:921283538843:loadbalancer/app/nginx-ecs-bluegreen-alb/28cd5055a92630c1 \
--protocol HTTP \
--port 80 \
--default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:921283538843:targetgroup/bluegreentarget1/80b89a8c4e5f574d \
--region us-east-1
4.3、創建 Amazon ECS 集羣
使用 create-cluster 命令創建要使用的名爲 nginx-ecs-bluegreen 的集羣。
aws ecs create-cluster \
--cluster-name nginx-ecs-bluegreen \
--region us-east-1
爲 ECS task 創建執行角色。
$ aws iam create-role --role-name AWSECSTaskServiceRole --assume-role-policy-document '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":{"Service":"ecs-tasks.amazonaws.com"},"Action":"sts:AssumeRole"}}'
附加策略 AmazonECSTaskExecutionRolePolicy。
$ aws iam attach-role-policy --role-name AWSECSTaskServiceRole --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
然後,使用您創建的 fargate-task.json 文件註冊任務定義。
$ wget https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/fargate-task.json
$ aws ecs register-task-definition \
--cli-input-json file://fargate-task.json \
--region us-east-1
創建 ECS Service。
$ wget https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/service-bluegreen.json
$ aws ecs create-service \
--cli-input-json file://service-bluegreen.json \
--region us-east-1
4.4、創建 AWS CodeDeploy 資源
使用 create-application 命令創建 CodeDeploy 應用程序。指定 ECS 計算平臺。
$ aws deploy create-application \
--application-name nginx-ecs \
--compute-platform ECS \
--region us-east-1
使用 create-deployment-group 命令創建 CodeDeploy 部署組。
$ wget https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/deployment-group.json
$ aws deploy create-deployment-group \
--cli-input-json file://deployment-group.json \
--region us-east-1
- 參考文檔:https://docs.aws.amazon.com/zh_cn/AmazonECS/latest/developerguide/create-blue-green.html#create-blue-green-loadbalancer
- imageDetail.json :https://docs.aws.amazon.com/zh_cn/codepipeline/latest/userguide/file-reference.html#file-reference-ecs-bluegreen
- taskdef.json : https://docs.aws.amazon.com/zh_cn/codepipeline/latest/userguide/tutorials-ecs-ecr-codedeploy.html#tutorials-ecs-ecr-codedeploy-taskdefinition
四、創建 codepipeline
4.1、創建 codepipeline 所需 SerivceRole
如果您的 AWS 賬戶中還沒有 CodePipeline 服務角色,請創建一個。藉助此服務角色,CodePipeline 可代表您與其他 AWS 服務進行交互,包括 AWS CodeBuild。
$ aws iam create-role --role-name AWSCodePipelineServiceRole --assume-role-policy-document '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":{"Service":"codepipeline.amazonaws.com"},"Action":"sts:AssumeRole"}}'
爲 codepipeline role 創建 policy,並將 policy 附加到 AWSCodePipelineServiceRole。
$ aws iam create-policy --policy-name AWSCodePipelineServiceRolePolicy --policy-document https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/AWSCodePipelineServiceRolePolicy.json
{
"Policy": {
"PolicyName": "AWSCodePipelineServiceRolePolicy",
"PermissionsBoundaryUsageCount": 0,
"CreateDate": "2020-01-30T05:33:22Z",
"AttachmentCount": 0,
"IsAttachable": true,
"PolicyId": "ANPA5NAGHF6NULEJS574V",
"DefaultVersionId": "v1",
"Path": "/",
"Arn": "arn:aws:iam::921283538843:policy/AWSCodePipelineServiceRolePolicy",
"UpdateDate": "2020-01-30T05:33:22Z"
}
}
角色附加策略。
$ aws iam attach-role-policy --role-name AWSCodePipelineServiceRole --policy-arn arn:aws:iam::921283538843:policy/AWSCodePipelineServiceRolePolicy
4.2、創建 pipeline
$ wget https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/create-pipeline.json
$ aws codepipeline create-pipeline --cli-input-json file://create-pipeline.json --region us-east-1
注意:文檔中的 OAuthToken 自己去 github 中去申請。
- 參考文檔:https://docs.aws.amazon.com/zh_cn/codepipeline/latest/userguide/GitHub-create-personal-token-CLI.html
- https://docs.aws.amazon.com/zh_cn/codepipeline/latest/userguide/pipelines-create.html#pipelines-create-cli
4.3、爲 pipeline 創建 webhook
$ wget https://raw.githubusercontent.com/wangzan18/codepipeline-ecs/master/awscli/my-webhook.json
$ aws codepipeline put-webhook --cli-input-json file://my-webhook.json --region us-east-1
$ aws codepipeline register-webhook-with-third-party --webhook-name nginx-ecs-webhook --region us-east-1
相關參數可以根據自己情況填寫,參考文檔:https://docs.aws.amazon.com/zh_cn/codepipeline/latest/userguide/pipelines-webhooks-create.html。
獲得了 webhook 的相關信息之後,我們登陸 github,選擇相應的存儲庫,