{"id":35907,"date":"2023-06-08T05:12:36","date_gmt":"2023-07-20T06:06:12","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/"},"modified":"2024-04-30T07:50:27","modified_gmt":"2024-04-29T23:50:27","slug":"%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/","title":{"rendered":"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09"},"content":{"rendered":"<h1>\u9996\u5148<\/h1>\n<p>\u5982\u679c\u63d0\u5230\u5bb9\u5668\u7f16\u6392\u5de5\u5177\uff0c\u9664\u4e86\u516c\u5171\u4e91\u63d0\u4f9b\u5546\u63d0\u4f9b\u7684\u6258\u7ba1\u670d\u52a1\u4e4b\u5916\uff0c\u53ef\u4ee5\u8bf4 Kubernetes \u5df2\u7ecf\u57fa\u672c\u6210\u4e3a\u4e8b\u5b9e\u6807\u51c6\u3002<br \/>\n\u56e0\u6b64\uff0c\u6211\u8ba4\u4e3a\u5f88\u591a\u4eba\u5728\u5c1d\u8bd5\u8ba4\u771f\u5b66\u4e60 Kubernetes \u65f6\u53ef\u80fd\u4f1a\u5728\u7b2c\u4e00\u6b65\u9047\u5230\u56f0\u96be\u3002<br \/>\n\u5728\u672c\u6587\u4e2d\uff0c\u6211\u4f1a\u5c1d\u8bd5\u4e3a\u521d\u5b66\u8005\u7f16\u5199\u5173\u4e8e\u5982\u4f55\u5c1d\u8bd5 Kubernetes \u7684\u5185\u5bb9\u3002<br \/>\n\u867d\u7136\u6211\u5bf9\u662f\u5426\u6b63\u786e\u6709\u4e9b\u7591\u8651\uff0c\u4f46\u8003\u8651\u5230\u53ef\u4ee5\u51cf\u514d Kubernetes \u63a7\u5236\u5e73\u9762\u7684\u5b89\u88c5\u7b49\u9ebb\u70e6\uff0c\u6211\u4eec\u5c06\u5c1d\u8bd5\u4f7f\u7528 EKS\u3002<\/p>\n<p>\u8003\u8651\u5230\u5bb9\u5668\u548c\u516c\u6709\u4e91\u65b9\u9762\uff0c\u7531\u4e8e\u5bf9\u4e8e\u5b8c\u5168\u7684\u521d\u5b66\u8005\u6765\u8bf4\u5199\u4f5c\u5e76\u4e0d\u5bb9\u6613\uff0c\u56e0\u6b64\u5047\u8bbe\u8bfb\u8005\u5177\u5907\u4ee5\u4e0b\u77e5\u8bc6\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">ECS \u3067\u306e\u30b3\u30f3\u30c6\u30ca\u7ba1\u7406\u3092\u5c11\u3057\u3067\u3082\u3057\u305f\u3053\u3068\u304c\u3042\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">Terraform \u3092\u305d\u3053\u305d\u3053\u66f8\u3044\u305f\u3053\u3068\u304c\u3042\u308b<\/ul>\n<p>\u5c3d\u7ba1 Terraform \u5e76\u975e\u5fc5\u9700\uff0c\u4f46\u65e2\u7136\u5df2\u7ecf\u4f7f\u7528\u4e86\u5bb9\u5668\u5316\uff0c\u56e0\u6b64\u5e94\u8be5\u91c7\u7528\u53ef\u5e42\u7b49\u7684\u65b9\u5f0f\u521b\u5efa\u3002\u672c\u6587\u7684\u76ee\u6807\u662f\u901a\u8fc7\u4e00\u6b21 terraform apply \u547d\u4ee4\uff0c\u5728 Fargate \u4e0a\u542f\u52a8 EKS\uff0c\u5e76\u901a\u8fc7 ALB \u5b9e\u73b0\u4ece\u4e92\u8054\u7f51\u8bbf\u95ee Nginx \u670d\u52a1\u3002<\/p>\n<p>\u53e6\u5916\uff0c\u7531\u4e8e\u672c\u6b21\u4f18\u5148\u8003\u8651\u5148\u4f7f\u5176\u52a8\u8d77\u6765\uff0c\u6545\u5b89\u5168\u7ec4\u7684\u8bbe\u7f6e\u4ecd\u7136\u4fdd\u6301\u9ed8\u8ba4\u72b6\u6001\uff08\u5373\u5728 EKS \u521b\u5efa\u65f6\u81ea\u52a8\u521b\u5efa\u7684\u548c\u5728 ALB \u521b\u5efa\u65f6\u81ea\u52a8\u521b\u5efa\u7684\u672a\u8fdb\u884c\u66f4\u6539\uff09\u3002\u8bf7\u6839\u636e\u9700\u8981\u8fdb\u884c\u4fee\u6b63\u3002<\/p>\n<h1>\u6700\u5f00\u59cb\u7684\u7ed3\u8bba<\/h1>\n<p>\u4e8b\u5148\u5199\u4e0b\u7ed3\u8bba\u3002<\/p>\n<p>\u518d\u6b21\u611f\u53d7\u5230ECS\u505a\u5f97\u975e\u5e38\u597d\u3002<br \/>\n\u81f3\u5c11\u5bf9\u4e8e\u73b0\u5728\u6b63\u5728\u4f7f\u7528ECS\u7684\u4eba\u6765\u8bf4\uff0c\u9664\u4e86\u5047\u8bbe\u8981\u6362\u6389\u516c\u5171\u4e91\u63d0\u4f9b\u5546\u5e76\u8f6c\u5411EKS\u4e4b\u5916\uff0c\u6211\u89c9\u5f97\u4e58\u5750ECS \u2192 EKS\u5e76\u6ca1\u6709\u5f88\u591a\u597d\u5904\uff08\u5047\u5982\u80af\u6362\u6389\u5c31\u5e72\u8106\u76f4\u63a5\u6362\u6210EKS\u4e5f\u8bb8\u4f1a\u66f4\u597d\uff09\u3002<br \/>\n\u5982\u679c\u4f60\u6253\u7b97\u4ece\u96f6\u5f00\u59cb\u5b66\u4e60\u5bb9\u5668\uff0c\u6211\u8ba4\u4e3aKubernetes\u53ef\u4ee5\u6210\u4e3a\u4e00\u4e2a\u9009\u62e9\u3002\u4f46\u662f\uff0c\u5b83\u5e76\u4e0d\u50cfECS\u90a3\u6837\u5b8c\u5168\u6574\u5408\u5230AWS\u73af\u5883\u4e2d\uff0c\u6240\u4ee5\u9700\u8981\u638c\u63e1\u7684\u77e5\u8bc6\u4f1a\u6bd4ECS\u591a\u4e00\u4e9b\u3002<\/p>\n<p>\u53e6\u5916\uff0c\u5982\u679c\u4e0d\u719f\u6089\u539f\u751f\u7684 EKS \u64cd\u4f5c\uff0c\u4f1a\u975e\u5e38\u56f0\u96be\u751a\u81f3\u4f1a\u51fa\u9519\uff0c\u6240\u4ee5 eksctl\uff08\u7528\u4e8e\u901a\u8fc7\u547d\u4ee4\u884c\u63a7\u5236EKS\u7684\u547d\u4ee4\uff09 \u662f\u5fc5\u5907\u7684\u3002\u8981\u786e\u4fdd\u6b63\u786e\u5b89\u88c5\u597d\u3002\u800c\u4e14\uff0c\u4e00\u65e6\u7406\u89e3\u4e86\u5176\u673a\u5236\uff0c\u6211\u8ba4\u4e3a\u5f88\u5c11\u6709\u4e0d\u4f7f\u7528 eksctl \u7684\u7406\u7531\u3002<\/p>\n<p>2021\/8\/11\u8ffd\u8bb0<br \/>\n\u5c3d\u7ba1\u5728\u4e0a\u9762\u63d0\u5230\u4e86\u4f7f\u7528 eksctl \u6ca1\u6709\u7406\u7531\u7684\u60c5\u51b5\uff0c\u4f46\u662f\u7531\u4e8e eksctl \u5728\u5185\u90e8\u8fd0\u884c CloudFormation\uff0c\u56e0\u6b64\u5728\u8d44\u6e90\u7ba1\u7406\u65b9\u9762\u4ecd\u7136\u5b58\u5728\u4e00\u5b9a\u7684\u56f0\u5883\u3002\u5982\u679c\u4e0e Terraform \u7ed3\u5408\u4f7f\u7528\uff0c\u5c31\u9700\u8981\u52aa\u529b\u4f7f terraform\u3001eksctl\u3001cloudformation \u548c kubectl \u521b\u5efa\u7684\u8d44\u6e90\u76f8\u4e92\u534f\u8c03\u3002\u5728\u672c\u6587\u4e2d\uff0c\u4f5c\u4e3a\u8865\u5145\u5185\u5bb9\uff0c\u5c06\u4ecb\u7ecd\u5728\u6700\u5927\u9650\u5ea6\u5730\u4f7f\u7528 terraform \u8fdb\u884c\u8d44\u6e90\u521b\u5efa\uff0c\u5e76\u4ec5\u5728\u65e0\u6cd5\u907f\u514d\u7684\u60c5\u51b5\u4e0b\u4f7f\u7528 kubectl \u7684\u65b9\u6cd5\u3002<\/p>\n<h1>\u6574\u4e2a\u7ec4\u6210<\/h1>\n<p>\u5728\u6b64\u6b21 Terraform \u4e2d\uff0c\u5c06\u521b\u5efa\u4ee5\u4e0b\u8d44\u6e90\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">VPC\u3001\u30b5\u30d6\u30cd\u30c3\u30c8<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">EKS \u30af\u30e9\u30b9\u30bf\u3001Fargate \u30d7\u30ed\u30d5\u30a1\u30a4\u30eb<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">OIDC\u30d7\u30ed\u30d0\u30a4\u30c0<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">ALB Ingress Controller(Kubernetes\u306e\u30ea\u30bd\u30fc\u30b9)<\/ul>\n<p>\u53ef\u4ee5\u4f7f\u7528\u73b0\u6709\u7684VPC\uff0c\u4f46\u662f\u4e3a\u4e86\u8ba9EKS\u5728\u591a\u4e2a\u540e\u7aef\u8fdb\u884c\u5fc5\u8981\u7684\u8bc6\u522b\uff0c\u9700\u8981\u5c06\u6807\u8bc6\u7b26\u5d4c\u5165\u6807\u7b7e\u4e2d\u3002\u5982\u679c\u4e0d\u60f3\u7834\u574f\u73b0\u6709\u73af\u5883\uff0c\u6700\u597d\u65b0\u5efa\u4e00\u4e2aVPC\u3002<\/p>\n<p>\u53e6\u5916\uff0c\u5728\u8fc7\u7a0b\u4e2d\u53ef\u80fd\u4f1a\u9047\u5230\u65e0\u6cd5\u901a\u8fc7terraform destroy\u547d\u4ee4\u5220\u9664\u7684\u8d44\u6e90\uff0c\u8bf7\u6ce8\u610f\u3002\u5bf9\u4e8e\u8fd9\u4e9b\u8d44\u6e90\uff0c\u5728\u672c\u6587\u7ae0\u4e2d\u4e5f\u4f1a\u8fdb\u884c\u6ce8\u8bb0\u3002<\/p>\n<h1>\u5efa\u7acb\u7f51\u7edc<\/h1>\n<p>\u8fd9\u91cc\u5e76\u4e0d\u662f\u90a3\u4e48\u56f0\u96be\u3002\u6839\u636eEKS\u7684\u9650\u5236\uff0c\u81f3\u5c11\u9700\u8981\u4e24\u4e2a\u4ee5\u4e0a\u7684\u79c1\u6709\u7f51\u7edc\uff0c\u6240\u4ee5\u6211\u4eec\u9700\u8981\u5206\u522b\u521b\u5efa\u5b83\u4eec\u5e76\u9644\u52a0Nat Gateway\u3002<\/p>\n<p>\u6b64\u5916\uff0c\u6211\u5011\u9700\u8981\u5c07 &#8220;kubernetes.io\/cluster\/${local.eks_cluster_name}&#8221; = &#8220;shared&#8221; \u7684\u6a19\u7c64\u6dfb\u52a0\u5230 VPC \u548c\u5b50\u7db2\u8def\u8cc7\u6e90\u4e0a\uff0c\u5426\u5247\u7cfb\u7d71\u7121\u6cd5\u6b63\u5e38\u904b\u4f5c\u3002\u540c\u6642\uff0c\u5728\u516c\u5171\u5b50\u7db2\u8def\u4e0a\u6dfb\u52a0 &#8220;kubernetes.io\/role\/elb&#8221; = &#8220;1&#8221; \u7684\u6a19\u7c64\uff0c\u5728\u79c1\u6709\u5b50\u7db2\u8def\u4e0a\u6dfb\u52a0 &#8220;kubernetes.io\/role\/internal-elb&#8221; = &#8220;1&#8221; \u7684\u6a19\u7c64\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># VPC                                                                          #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_vpc\"<\/span> <span class=\"s2\">\"for_eks_fargate\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">cidr_block<\/span>           <span class=\"p\">=<\/span> <span class=\"s2\">\"192.168.0.0\/16\"<\/span>\r\n  <span class=\"nx\">instance_tenancy<\/span>     <span class=\"p\">=<\/span> <span class=\"s2\">\"default\"<\/span>\r\n  <span class=\"nx\">enable_dns_support<\/span>   <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n  <span class=\"nx\">enable_dns_hostnames<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">Name<\/span>                                              <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">vpc_name<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/cluster\/<\/span><span class=\"k\">${<\/span><span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"shared\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Public Subnet                                                                #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_subnet\"<\/span> <span class=\"s2\">\"public1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span>                  <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">cidr_block<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"192.168.0.0\/24\"<\/span>\r\n  <span class=\"nx\">map_public_ip_on_launch<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n  <span class=\"nx\">availability_zone<\/span>       <span class=\"p\">=<\/span> <span class=\"s2\">\"ap-northeast-1a\"<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"Name\"<\/span>                                            <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">public_subnet_name1<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/cluster\/<\/span><span class=\"k\">${<\/span><span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"shared\"<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/role\/elb\"<\/span>                          <span class=\"p\">=<\/span> <span class=\"s2\">\"1\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_subnet\"<\/span> <span class=\"s2\">\"public2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span>                  <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">cidr_block<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"192.168.1.0\/24\"<\/span>\r\n  <span class=\"nx\">map_public_ip_on_launch<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n  <span class=\"nx\">availability_zone<\/span>       <span class=\"p\">=<\/span> <span class=\"s2\">\"ap-northeast-1c\"<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"Name\"<\/span>                                            <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">public_subnet_name2<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/cluster\/<\/span><span class=\"k\">${<\/span><span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"shared\"<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/role\/elb\"<\/span>                          <span class=\"p\">=<\/span> <span class=\"s2\">\"1\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Private Subnet                                                               #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_subnet\"<\/span> <span class=\"s2\">\"private1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span>                  <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">cidr_block<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"192.168.2.0\/24\"<\/span>\r\n  <span class=\"nx\">map_public_ip_on_launch<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">false<\/span>\r\n  <span class=\"nx\">availability_zone<\/span>       <span class=\"p\">=<\/span> <span class=\"s2\">\"ap-northeast-1a\"<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"Name\"<\/span>                                            <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">private_subnet_name1<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/cluster\/<\/span><span class=\"k\">${<\/span><span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"shared\"<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/role\/internal-elb\"<\/span>                 <span class=\"p\">=<\/span> <span class=\"s2\">\"1\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_subnet\"<\/span> <span class=\"s2\">\"private2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span>                  <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">cidr_block<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"192.168.3.0\/24\"<\/span>\r\n  <span class=\"nx\">map_public_ip_on_launch<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">false<\/span>\r\n  <span class=\"nx\">availability_zone<\/span>       <span class=\"p\">=<\/span> <span class=\"s2\">\"ap-northeast-1c\"<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"Name\"<\/span>                                            <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">private_subnet_name2<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/cluster\/<\/span><span class=\"k\">${<\/span><span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"shared\"<\/span>\r\n    <span class=\"s2\">\"kubernetes.io\/role\/internal-elb\"<\/span>                 <span class=\"p\">=<\/span> <span class=\"s2\">\"1\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Internet Gateway                                                             #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_internet_gateway\"<\/span> <span class=\"s2\">\"for_eks_fargate\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"Name\"<\/span> <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">igw_name<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># EIP                                                                          #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_eip\"<\/span> <span class=\"s2\">\"for_nat_gateway1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">Name<\/span> <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eip_name1<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_eip\"<\/span> <span class=\"s2\">\"for_nat_gateway2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">Name<\/span> <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eip_name2<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Nat Gateway                                                                  #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_nat_gateway\"<\/span> <span class=\"s2\">\"for_eks_fargate1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">aws_internet_gateway<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">subnet_id<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">allocation_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eip<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_nat_gateway1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">Name<\/span> <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">ngw_name1<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_nat_gateway\"<\/span> <span class=\"s2\">\"for_eks_fargate2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">aws_internet_gateway<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">subnet_id<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">allocation_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eip<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_nat_gateway2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">Name<\/span> <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">ngw_name2<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Route Table                                                                  #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table\"<\/span> <span class=\"s2\">\"public1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route\"<\/span> <span class=\"s2\">\"public1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">route_table_id<\/span>         <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">public1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">gateway_id<\/span>             <span class=\"p\">=<\/span> <span class=\"nx\">aws_internet_gateway<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">destination_cidr_block<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"0.0.0.0\/0\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table_association\"<\/span> <span class=\"s2\">\"public1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">subnet_id<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">route_table_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">public1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table\"<\/span> <span class=\"s2\">\"public2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route\"<\/span> <span class=\"s2\">\"public2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">route_table_id<\/span>         <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">public2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">gateway_id<\/span>             <span class=\"p\">=<\/span> <span class=\"nx\">aws_internet_gateway<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">destination_cidr_block<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"0.0.0.0\/0\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table_association\"<\/span> <span class=\"s2\">\"public2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">subnet_id<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">route_table_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">public2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table\"<\/span> <span class=\"s2\">\"private1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route\"<\/span> <span class=\"s2\">\"private1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">route_table_id<\/span>         <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">private1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">nat_gateway_id<\/span>         <span class=\"p\">=<\/span> <span class=\"nx\">aws_nat_gateway<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">destination_cidr_block<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"0.0.0.0\/0\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table_association\"<\/span> <span class=\"s2\">\"private1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">subnet_id<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">private1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">route_table_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">private1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table\"<\/span> <span class=\"s2\">\"private2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">vpc_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route\"<\/span> <span class=\"s2\">\"private2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">route_table_id<\/span>         <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">private2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">nat_gateway_id<\/span>         <span class=\"p\">=<\/span> <span class=\"nx\">aws_nat_gateway<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">destination_cidr_block<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"0.0.0.0\/0\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_route_table_association\"<\/span> <span class=\"s2\">\"private2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">subnet_id<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">private2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">route_table_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_route_table<\/span><span class=\"p\">.<\/span><span class=\"nx\">private2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h1>\u6211\u6b63\u5728\u51c6\u5907\u3002<\/h1>\n<p>\u4e3a\u4e86\u4f7f\u7528 EKS \u96c6\u7fa4\u548c\u6267\u884c Pod\uff0c\u60a8\u9700\u8981\u521b\u5efa\u670d\u52a1\u89d2\u8272\u3002<br \/>\n\u56e0\u4e3a\u6709\u76f8\u5e94\u7684 AWS \u6258\u7ba1 IAM \u7b56\u7565\uff0c\u53ea\u9700\u5c06\u5176\u9644\u52a0\u5373\u53ef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># IAM Role for EKS Cluster                                                     #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_iam_role\"<\/span> <span class=\"s2\">\"ekscluster\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>               <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster_role_name<\/span>\r\n  <span class=\"nx\">assume_role_policy<\/span> <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_iam_policy_document<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster_assume<\/span><span class=\"p\">.<\/span><span class=\"nx\">json<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"aws_iam_policy_document\"<\/span> <span class=\"s2\">\"ekscluster_assume\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">statement<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">effect<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Allow\"<\/span>\r\n\r\n    <span class=\"nx\">actions<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n      <span class=\"s2\">\"sts:AssumeRole\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"p\">]<\/span>\r\n\r\n    <span class=\"nx\">principals<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Service\"<\/span>\r\n      <span class=\"nx\">identifiers<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n        <span class=\"s2\">\"eks.amazonaws.com\"<\/span><span class=\"p\">,<\/span>\r\n      <span class=\"p\">]<\/span>\r\n    <span class=\"p\">}<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_iam_role_policy_attachment\"<\/span> <span class=\"s2\">\"ekscluster1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">policy_arn<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"arn:aws:iam::aws:policy\/AmazonEKSClusterPolicy\"<\/span>\r\n  <span class=\"nx\">role<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_iam_role_policy_attachment\"<\/span> <span class=\"s2\">\"ekscluster2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">policy_arn<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"arn:aws:iam::aws:policy\/AmazonEKSVPCResourceController\"<\/span>\r\n  <span class=\"nx\">role<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># IAM Role for EKS Pod Execution                                               #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_iam_role\"<\/span> <span class=\"s2\">\"ekspodexecution\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>               <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekspodexecution_role_name<\/span>\r\n  <span class=\"nx\">assume_role_policy<\/span> <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_iam_policy_document<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekspodexecution_assume<\/span><span class=\"p\">.<\/span><span class=\"nx\">json<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"aws_iam_policy_document\"<\/span> <span class=\"s2\">\"ekspodexecution_assume\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">statement<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">effect<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Allow\"<\/span>\r\n\r\n    <span class=\"nx\">actions<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n      <span class=\"s2\">\"sts:AssumeRole\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"p\">]<\/span>\r\n\r\n    <span class=\"nx\">principals<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Service\"<\/span>\r\n      <span class=\"nx\">identifiers<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n        <span class=\"s2\">\"eks-fargate-pods.amazonaws.com\"<\/span><span class=\"p\">,<\/span>\r\n      <span class=\"p\">]<\/span>\r\n    <span class=\"p\">}<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_iam_role_policy_attachment\"<\/span> <span class=\"s2\">\"ekspodexecution1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">policy_arn<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"arn:aws:iam::aws:policy\/AmazonEKSFargatePodExecutionRolePolicy\"<\/span>\r\n  <span class=\"nx\">role<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekspodexecution<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h1>\u521b\u5efa EKS \u96c6\u7fa4<\/h1>\n<p>\u7ec8\u4e8e\u5230\u4e86\u521b\u5efa EKS \u96c6\u7fa4\u7684\u65f6\u5019\u4e86\u3002<br \/>\n\u5728\u8fd9\u91cc\u9700\u8981\u4f7f\u7528\u5230 aws_eks_cluster \u548c aws_eks_fargate_profile\u3002<br \/>\n\u5bf9\u4e8e aws_cloudwatch_log_group\uff0c\u53ea\u6709\u5728\u9700\u8981\u8fdb\u884c\u65e5\u5fd7\u6536\u96c6\u65f6\u624d\u9700\u8981\u8fdb\u884c\u914d\u7f6e\u3002\u5982\u679c\u4e0d\u6307\u5b9a\u4efb\u4f55\u8bbe\u7f6e\uff0c\u5b83\u5c06\u9ed8\u8ba4\u914d\u7f6e\uff0c\u4f46\u4fdd\u5b58\u671f\u9650\u4f1a\u65e0\u9650\u5ef6\u957f\uff0c\u56e0\u6b64\u6700\u597d\u4e8b\u5148\u521b\u5efa\u4e00\u4e2a\u4ee5 EKS \u6307\u5b9a\u540d\u79f0\u547d\u540d\u7684 log group\uff0c\u4ee5\u4fbf\u5c06\u5176\u7eb3\u5165 Terraform \u7684\u63a7\u5236\u3002<\/p>\n<p>\u4e3a\u4e86\u660e\u786e\u63a7\u5236aws_eks_cluster\u4e2d\u7b56\u7565\u7684\u9644\u52a0\u987a\u5e8f\uff0c\u9700\u8981\u4f7f\u7528depends_on\u786e\u4fdd\u7b56\u7565\u7684\u9644\u52a0\u5148\u4e8e\u5176\u4ed6\u64cd\u4f5c\u5b8c\u6210\u3002\u5bf9\u4e8evpc_config\uff0c\u9700\u8981\u8bbe\u7f6e\u6240\u6709\u521b\u5efa\u7684\u5b50\u7f51\uff0c\u65e0\u8bba\u662f\u516c\u5171\u8fd8\u662f\u79c1\u6709\u7684\u3002<br \/>\n\u5bf9\u4e8eaws_eks_fargate_profile\u4e2d\u7684subnet_ids\uff0c\u56e0\u4e3a\u5b83\u662f\u7528\u4e8e\u521b\u5efa\u540e\u7aef\u8282\u70b9\u7684\u5b50\u7f51\uff0c\u6240\u4ee5\u53ea\u9700\u8981\u79c1\u6709\u5b50\u7f51\u5373\u53ef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># EKS                                                                          #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_eks_cluster\"<\/span> <span class=\"s2\">\"example\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">aws_iam_role_policy_attachment<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster1<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">aws_iam_role_policy_attachment<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster2<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">aws_cloudwatch_log_group<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">name<\/span>     <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span>\r\n  <span class=\"nx\">role_arn<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n  <span class=\"nx\">version<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"1.19\"<\/span>\r\n\r\n  <span class=\"nx\">vpc_config<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">subnet_ids<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n      <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span>\r\n      <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span>\r\n      <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">private1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span>\r\n      <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">private2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"p\">]<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">enabled_cluster_log_types<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"api\"<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\"audit\"<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\"authenticator\"<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\"controllerManager\"<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\"scheduler\"<\/span><span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_eks_fargate_profile\"<\/span> <span class=\"s2\">\"kubesystem\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">cluster_name<\/span>           <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">fargate_profile_name<\/span>   <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_fargate_kubesystem_profile_name<\/span>\r\n  <span class=\"nx\">pod_execution_role_arn<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekspodexecution<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n  <span class=\"nx\">subnet_ids<\/span>             <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">private1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span> <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">private2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">selector<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">namespace<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"default\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">selector<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">namespace<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kube-system\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"aws_cloudwatch_log_group\"<\/span> <span class=\"s2\">\"eks_cluster\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"\/aws\/eks\/<\/span><span class=\"k\">${<\/span><span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\/cluster\"<\/span>\r\n  <span class=\"nx\">retention_in_days<\/span> <span class=\"p\">=<\/span> <span class=\"mi\">3<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h1>\u521b\u5efaKubernetes\u6240\u9700\u7684YAML.<\/h1>\n<p>\u597d\u7684\uff0c\u5230\u76ee\u524d\u4e3a\u6b62\u6ca1\u6709\u4ec0\u4e48\u5927\u4e0d\u4e86\u7684\uff08\u5b9e\u9645\u4e0a\uff0c\u5982\u679c\u4f7f\u7528EKS on EC2\uff0c\u57fa\u672c\u4e0a\u5c31\u5728\u8fd9\u91cc\u7ed3\u675f\u4e86\uff09\uff0c\u4f46\u4ece\u8fd9\u91cc\u5f00\u59cb\u5c31\u662f\u56f0\u96be\u7684\u90e8\u5206\u4e86\u3002<br \/>\n\u6211\u4eec\u5c06\u521b\u5efa\u7528\u4e8e\u63a7\u5236Kubernetes\u7684YAML\u6587\u4ef6\u3002<\/p>\n<p>\u5fc5\u987b\u7684\u4e1c\u897f\u5982\u4e0b\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Kubernetes \u306e Config \u30d5\u30a1\u30a4\u30eb<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">ALB Ingress Controller \u306e Manifest \u30d5\u30a1\u30a4\u30eb<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Kubernetes \u306b\u8a2d\u5b9a\u3059\u308b\u30ed\u30fc\u30eb\u306e Manifest \u30d5\u30a1\u30a4\u30eb<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">Nginx \u30b3\u30f3\u30c6\u30ca\u3092\u8d77\u52d5\u3059\u308b\u305f\u3081\u306e Manifest \u30d5\u30a1\u30a4\u30eb<\/ul>\n<p>\u56e0\u4e3a\u6bcf\u4e2a\u4eba\u90fd\u5fc5\u987b\u5d4c\u5165AWS\u8d44\u6e90\uff0c\u6240\u4ee5\u53ef\u4ee5\u4f7f\u7528template_file\u6765\u81ea\u52a8\u521b\u5efa\u3002<\/p>\n<p>\u987a\u4fbf\u8bf4\u4e00\u4e0b\uff0c\u8fd9\u90e8\u5206\u7684\u539f\u59cb\u8d44\u6599\u662f\u6765\u81eaAWS\u7684\u535a\u5ba2\uff0c\u4f46\u662f\u590d\u5236\u7c98\u8d34\u7684YAML\u6587\u4ef6\u53ef\u80fd\u51fa\u73b0\u635f\u574f\uff0c\u6216\u8005\u5df2\u7ecf\u8fc7\u53bb\u4e86\u4e00\u6bb5\u65f6\u95f4\u5bfc\u81f4\u67d0\u4e9b\u65e0\u6cd5\u4f7f\u7528\u7684apiVersion\uff0c\u6240\u4ee5\u76f8\u5f53\u9ebb\u70e6&#8230;&#8230;\u5c3d\u7ba1\u8fd9\u662f\u4e00\u5e74\u591a\u524d\u7684\u6587\u7ae0\uff0c\u4f46\u5df2\u7ecf\u88ab\u5e9f\u5f03\u4e86\u6216\u65e0\u6cd5\u4f7f\u7528\u7684\u8bed\u6cd5\u5b58\u5728\u7684\u901f\u5ea6\uff0c\u4e5f\u662f\u4eba\u4eec\u8bf4EKS\u5f88\u56f0\u96be\u7684\u539f\u56e0\u4e4b\u4e00&#8230;&#8230;<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Local File for Kubernetes Config                                             #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"local_file\"<\/span> <span class=\"s2\">\"kubeconfig\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">filename<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\".\/output_files\/kubeconfig.yaml\"<\/span>\r\n  <span class=\"nx\">content<\/span>  <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">template_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">rendered<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"template_file\"<\/span> <span class=\"s2\">\"kubeconfig\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">template<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">file<\/span><span class=\"p\">(<\/span><span class=\"s2\">\"<\/span><span class=\"k\">${<\/span><span class=\"nx\">path<\/span><span class=\"p\">.<\/span><span class=\"k\">module}<\/span><span class=\"s2\">\/kubernetes_template\/01_kubeconfig_template.yaml\"<\/span><span class=\"p\">)<\/span>\r\n\r\n  <span class=\"nx\">vars<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">eks_certificate_authority_data<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">certificate_authority<\/span><span class=\"p\">.<\/span><span class=\"mi\">0<\/span><span class=\"p\">.<\/span><span class=\"k\">data<\/span>\r\n    <span class=\"nx\">eks_cluster_endpoint<\/span>           <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">endpoint<\/span>\r\n    <span class=\"nx\">eks_cluster_arn<\/span>                <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n    <span class=\"nx\">eks_cluster_region<\/span>             <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_region<\/span><span class=\"p\">.<\/span><span class=\"nx\">current<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n    <span class=\"nx\">eks_cluster_name<\/span>               <span class=\"p\">=<\/span> <span class=\"kd\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Local File for ALB Ingress Controller                                        #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"local_file\"<\/span> <span class=\"s2\">\"alb_ingress_controller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">filename<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\".\/output_files\/alb-ingress-controller.yaml\"<\/span>\r\n  <span class=\"nx\">content<\/span>  <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">template_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">alb_ingress_controller<\/span><span class=\"p\">.<\/span><span class=\"nx\">rendered<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"template_file\"<\/span> <span class=\"s2\">\"alb_ingress_controller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">template<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">file<\/span><span class=\"p\">(<\/span><span class=\"s2\">\"<\/span><span class=\"k\">${<\/span><span class=\"nx\">path<\/span><span class=\"p\">.<\/span><span class=\"k\">module}<\/span><span class=\"s2\">\/kubernetes_template\/11_alb-ingress-controller.yaml\"<\/span><span class=\"p\">)<\/span>\r\n\r\n  <span class=\"nx\">vars<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">eks_cluster_name<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n    <span class=\"nx\">vpc_id<\/span>           <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n    <span class=\"nx\">region_name<\/span>      <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_region<\/span><span class=\"p\">.<\/span><span class=\"nx\">current<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Local File for RBAC Role                                                     #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"local_file\"<\/span> <span class=\"s2\">\"rbac_role\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">filename<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\".\/output_files\/rbac-role.yaml\"<\/span>\r\n  <span class=\"nx\">content<\/span>  <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">template_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">rbac_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">rendered<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"template_file\"<\/span> <span class=\"s2\">\"rbac_role\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">template<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">file<\/span><span class=\"p\">(<\/span><span class=\"s2\">\"<\/span><span class=\"k\">${<\/span><span class=\"nx\">path<\/span><span class=\"p\">.<\/span><span class=\"k\">module}<\/span><span class=\"s2\">\/kubernetes_template\/12_rbac-role.yaml\"<\/span><span class=\"p\">)<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Local File for Nginx Deployment                                              #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"local_file\"<\/span> <span class=\"s2\">\"nginx_deployment\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">filename<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\".\/output_files\/nginx-deployment.yaml\"<\/span>\r\n  <span class=\"nx\">content<\/span>  <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">template_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_deployment<\/span><span class=\"p\">.<\/span><span class=\"nx\">rendered<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"template_file\"<\/span> <span class=\"s2\">\"nginx_deployment\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">template<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">file<\/span><span class=\"p\">(<\/span><span class=\"s2\">\"<\/span><span class=\"k\">${<\/span><span class=\"nx\">path<\/span><span class=\"p\">.<\/span><span class=\"k\">module}<\/span><span class=\"s2\">\/kubernetes_template\/13_nginx-deployment.yaml\"<\/span><span class=\"p\">)<\/span>\r\n\r\n  <span class=\"nx\">vars<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">eks_fargate_profile_name<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_fargate_profile<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubesystem<\/span><span class=\"p\">.<\/span><span class=\"nx\">fargate_profile_name<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Local File for Nginx Service                                                 #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"local_file\"<\/span> <span class=\"s2\">\"nginx_service\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">filename<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\".\/output_files\/nginx-service.yaml\"<\/span>\r\n  <span class=\"nx\">content<\/span>  <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">template_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_service<\/span><span class=\"p\">.<\/span><span class=\"nx\">rendered<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"template_file\"<\/span> <span class=\"s2\">\"nginx_service\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">template<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">file<\/span><span class=\"p\">(<\/span><span class=\"s2\">\"<\/span><span class=\"k\">${<\/span><span class=\"nx\">path<\/span><span class=\"p\">.<\/span><span class=\"k\">module}<\/span><span class=\"s2\">\/kubernetes_template\/14_nginx-service.yaml\"<\/span><span class=\"p\">)<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Local File for Nginx Ingress                                                 #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"local_file\"<\/span> <span class=\"s2\">\"nginx_ingress\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">filename<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\".\/output_files\/nginx-ingress.yaml\"<\/span>\r\n  <span class=\"nx\">content<\/span>  <span class=\"p\">=<\/span> <span class=\"k\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">template_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_ingress<\/span><span class=\"p\">.<\/span><span class=\"nx\">rendered<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">data<\/span> <span class=\"s2\">\"template_file\"<\/span> <span class=\"s2\">\"nginx_ingress\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">template<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">file<\/span><span class=\"p\">(<\/span><span class=\"s2\">\"<\/span><span class=\"k\">${<\/span><span class=\"nx\">path<\/span><span class=\"p\">.<\/span><span class=\"k\">module}<\/span><span class=\"s2\">\/kubernetes_template\/15_nginx-ingress.yaml\"<\/span><span class=\"p\">)<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">v1<\/span>\r\n<span class=\"na\">clusters<\/span><span class=\"pi\">:<\/span>\r\n<span class=\"pi\">-<\/span> <span class=\"na\">cluster<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">certificate-authority-data<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_certificate_authority_data}<\/span>\r\n    <span class=\"na\">server<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_cluster_endpoint}<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_cluster_arn}<\/span>\r\n<span class=\"na\">contexts<\/span><span class=\"pi\">:<\/span>\r\n<span class=\"pi\">-<\/span> <span class=\"na\">context<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">cluster<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_cluster_arn}<\/span>\r\n    <span class=\"na\">user<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_cluster_arn}<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_cluster_arn}<\/span>\r\n<span class=\"na\">current-context<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_cluster_arn}<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Config<\/span>\r\n<span class=\"na\">preferences<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">{}<\/span>\r\n<span class=\"na\">users<\/span><span class=\"pi\">:<\/span>\r\n<span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_cluster_arn}<\/span>\r\n  <span class=\"na\">user<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">exec<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">client.authentication.k8s.io\/v1alpha1<\/span>\r\n      <span class=\"na\">args<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">--region<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">${eks_cluster_region}<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">eks<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">get-token<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">--cluster-name<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">${eks_cluster_name}<\/span>\r\n      <span class=\"na\">command<\/span><span class=\"pi\">:<\/span> <span class=\"s\">aws<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">apps\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Deployment<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">kube-system<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n  <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">app.kubernetes.io\/name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">selector<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">matchLabels<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">app.kubernetes.io\/name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n  <span class=\"na\">template<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">app.kubernetes.io\/name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n    <span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">containers<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n        <span class=\"na\">args<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">--ingress-class=alb<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">--cluster-name=${eks_cluster_name}<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">--aws-vpc-id=${vpc_id}<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">--aws-region=${region_name}<\/span>\r\n        <span class=\"na\">image<\/span><span class=\"pi\">:<\/span> <span class=\"s\">docker.io\/amazon\/aws-alb-ingress-controller:v1.1.4<\/span>\r\n      <span class=\"na\">serviceAccountName<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"nn\">---<\/span>\r\n<span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">rbac.authorization.k8s.io\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ClusterRole<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">app.kubernetes.io\/name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n<span class=\"na\">rules<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">apiGroups<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">\"<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">extensions<\/span>\r\n    <span class=\"na\">resources<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">configmaps<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">endpoints<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">events<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">ingresses<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">ingresses\/status<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">services<\/span>\r\n    <span class=\"na\">verbs<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">create<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">get<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">list<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">update<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">watch<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">patch<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">apiGroups<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">\"<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">extensions<\/span>\r\n    <span class=\"na\">resources<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">nodes<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">pods<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">secrets<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">services<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">namespaces<\/span>\r\n    <span class=\"na\">verbs<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">get<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">list<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"s\">watch<\/span>\r\n<span class=\"nn\">---<\/span>\r\n<span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">rbac.authorization.k8s.io\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ClusterRoleBinding<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">app.kubernetes.io\/name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n<span class=\"na\">roleRef<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">apiGroup<\/span><span class=\"pi\">:<\/span> <span class=\"s\">rbac.authorization.k8s.io<\/span>\r\n  <span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ClusterRole<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n<span class=\"na\">subjects<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ServiceAccount<\/span>\r\n    <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n    <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">kube-system<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">apps\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Deployment<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">default<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx-deployment<\/span>\r\n  <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">eks.amazonaws.com\/fargate-profile<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_fargate_profile_name}<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">selector<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">matchLabels<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">app<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx<\/span>\r\n  <span class=\"na\">replicas<\/span><span class=\"pi\">:<\/span> <span class=\"m\">2<\/span>\r\n  <span class=\"na\">template<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">app<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx<\/span>\r\n    <span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">containers<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"na\">image<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx:1.20<\/span>\r\n        <span class=\"na\">imagePullPolicy<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Always<\/span>\r\n        <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx<\/span>\r\n        <span class=\"na\">ports<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"na\">containerPort<\/span><span class=\"pi\">:<\/span> <span class=\"m\">80<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Service<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">default\"<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">nginx-service\"<\/span>\r\n  <span class=\"na\">annotations<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">alb.ingress.kubernetes.io\/target-type<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ip<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">selector<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">app<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">nginx\"<\/span>\r\n  <span class=\"na\">ports<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">port<\/span><span class=\"pi\">:<\/span> <span class=\"m\">80<\/span>\r\n    <span class=\"na\">targetPort<\/span><span class=\"pi\">:<\/span> <span class=\"m\">80<\/span>\r\n    <span class=\"na\">protocol<\/span><span class=\"pi\">:<\/span> <span class=\"s\">TCP<\/span>\r\n  <span class=\"na\">type<\/span><span class=\"pi\">:<\/span> <span class=\"s\">NodePort<\/span>\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">networking.k8s.io\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Ingress<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">default<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx-ingress<\/span>\r\n  <span class=\"na\">annotations<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">kubernetes.io\/ingress.class<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb<\/span>\r\n    <span class=\"na\">alb.ingress.kubernetes.io\/scheme<\/span><span class=\"pi\">:<\/span> <span class=\"s\">internet-facing<\/span>\r\n  <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">app<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx-ingress<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">rules<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">http<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">paths<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"na\">path<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\/*<\/span>\r\n        <span class=\"na\">pathType<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Prefix<\/span>\r\n        <span class=\"na\">backend<\/span><span class=\"pi\">:<\/span>\r\n          <span class=\"na\">service<\/span><span class=\"pi\">:<\/span>\r\n            <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx-service<\/span>\r\n            <span class=\"na\">port<\/span><span class=\"pi\">:<\/span>\r\n              <span class=\"na\">number<\/span><span class=\"pi\">:<\/span> <span class=\"m\">80<\/span>\r\n<\/code><\/pre>\n<h1>\u5c06 CoreDNS \u6539\u5199\u4e3a\u9002\u7528\u4e8e Fargate \u7684\u7248\u672c<\/h1>\n<p>\u597d\u7684\uff0c\u539f\u6c41\u539f\u5473\u5730\u542f\u52a8\u7684EKS\u96c6\u7fa4\u6b63\u5728\u5c1d\u8bd5\u5728EC2\u4e0a\u542f\u52a8DNS\uff0c\u4f46\u5361\u4f4f\u4e86\u3002<br \/>\n\u73b0\u5728\u9700\u8981\u5c06\u5176\u8f6c\u5411Fargate\u3002<br \/>\n\u6709\u5173\u547d\u4ee4\u672c\u8eab\uff0c\u8bf7\u53c2\u9605AWS\u5b98\u65b9\u7528\u6237\u6307\u5357\u3002<br \/>\n\u4e3a\u4e86\u63d0\u9ad8\u5e42\u7b49\u6027\uff0c\u6211\u4eec\u5c06\u4f7f\u7528null_resource\u81ea\u52a8\u6253\u8865\u4e01\u5e76\u91cd\u65b0\u542f\u52a8\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"coredns_patch\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">aws_eks_fargate_profile<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubesystem<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">alb_ingress_controller<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">rbac_role<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_deployment<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_ingress<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_service<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl patch deployment coredns -n kube-system --type json -p='[{<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">op<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">: <\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">remove<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">, <\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">path<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">: <\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">\/spec\/template\/metadata\/annotations\/eks.amazonaws.com~1compute-type<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">}]'\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"coredns_restart\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">coredns_patch<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl rollout restart -n kube-system deployment coredns\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h1>\u5efa\u7acbALB<\/h1>\n<div>\u622a\u81f32021\u5e748\u6708\u64b0\u5199\u672c\u6587\u65f6\uff0c\u4f7f\u7528ALB Ingress Controller\u88ab\u8ba4\u4e3a\u662f\u4e00\u79cd\u6700\u4f73\u5b9e\u8df5\uff0c\u4f46\u76ee\u524d\u5df2\u7ecf\u88ab\u5e9f\u5f03\u3002\u622a\u81f32023\u5e7411\u6708\uff0c\u4f7f\u7528\u4e0b\u6587\u63d0\u5230\u7684AWS Load Balancer Controller\u88ab\u89c6\u4e3a\u7406\u8bba\u4e0a\u7684\u6700\u4f73\u9009\u62e9\u3002<\/div>\n<p>\u73b0\u5728\u51c6\u5907\u51e0\u4e4e\u5b8c\u6210\uff0c\u53ea\u5269\u4e0b\u5b9e\u9645\u6784\u5efaALB\u5e76\u90e8\u7f72\u5bb9\u5668\u4e86\u3002\u8fd9\u91cc\u4e5f\u662f\u53c2\u8003\u4e86AWS\u5b98\u65b9\u535a\u5ba2\uff0c\u4f7f\u7528null_resource\u8fdb\u884c\u81ea\u52a8\u5316\u3002<\/p>\n<p>\u9996\u5148\uff0c\u521b\u5efa\u4ee5\u4e0b\u7684ID\u63d0\u4f9b\u7a0b\u5e8f\u548cIAM\u7b56\u7565\uff0c\u4ee5\u4fbf\u80fd\u591f\u63a7\u5236ALB\u7684IAM\u6743\u9650\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">data<\/span> <span class=\"s2\">\"tls_certificate\"<\/span> <span class=\"s2\">\"for_eks_fargate_pod\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">url<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">identity<\/span><span class=\"p\">[<\/span><span class=\"mi\">0<\/span><span class=\"p\">].<\/span><span class=\"nx\">oidc<\/span><span class=\"p\">[<\/span><span class=\"mi\">0<\/span><span class=\"p\">].<\/span><span class=\"nx\">issuer<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_iam_openid_connect_provider\"<\/span> <span class=\"s2\">\"for_eks_fargate_pod\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">client_id_list<\/span>  <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"sts.amazonaws.com\"<\/span><span class=\"p\">]<\/span>\r\n  <span class=\"nx\">thumbprint_list<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">tls_certificate<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate_pod<\/span><span class=\"p\">.<\/span><span class=\"nx\">certificates<\/span><span class=\"p\">[<\/span><span class=\"mi\">0<\/span><span class=\"p\">].<\/span><span class=\"nx\">sha1_fingerprint<\/span><span class=\"p\">]<\/span>\r\n  <span class=\"nx\">url<\/span>             <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">identity<\/span><span class=\"p\">[<\/span><span class=\"mi\">0<\/span><span class=\"p\">].<\/span><span class=\"nx\">oidc<\/span><span class=\"p\">[<\/span><span class=\"mi\">0<\/span><span class=\"p\">].<\/span><span class=\"nx\">issuer<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_iam_policy\"<\/span> <span class=\"s2\">\"alb_ingress_controller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>   <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eksalbingresscontroller_policy_name<\/span>\r\n  <span class=\"nx\">policy<\/span> <span class=\"p\">=<\/span> <span class=\"o\">&lt;&lt;<\/span><span class=\"no\">EOF<\/span><span class=\"sh\">\r\n{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"acm:DescribeCertificate\",\r\n                \"acm:ListCertificates\",\r\n                \"acm:GetCertificate\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"ec2:AuthorizeSecurityGroupIngress\",\r\n                \"ec2:CreateSecurityGroup\",\r\n                \"ec2:CreateTags\",\r\n                \"ec2:DeleteTags\",\r\n                \"ec2:DeleteSecurityGroup\",\r\n                \"ec2:DescribeAccountAttributes\",\r\n                \"ec2:DescribeAddresses\",\r\n                \"ec2:DescribeInstances\",\r\n                \"ec2:DescribeInstanceStatus\",\r\n                \"ec2:DescribeInternetGateways\",\r\n                \"ec2:DescribeNetworkInterfaces\",\r\n                \"ec2:DescribeSecurityGroups\",\r\n                \"ec2:DescribeSubnets\",\r\n                \"ec2:DescribeTags\",\r\n                \"ec2:DescribeVpcs\",\r\n                \"ec2:ModifyInstanceAttribute\",\r\n                \"ec2:ModifyNetworkInterfaceAttribute\",\r\n                \"ec2:RevokeSecurityGroupIngress\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:AddListenerCertificates\",\r\n                \"elasticloadbalancing:AddTags\",\r\n                \"elasticloadbalancing:CreateListener\",\r\n                \"elasticloadbalancing:CreateLoadBalancer\",\r\n                \"elasticloadbalancing:CreateRule\",\r\n                \"elasticloadbalancing:CreateTargetGroup\",\r\n                \"elasticloadbalancing:DeleteListener\",\r\n                \"elasticloadbalancing:DeleteLoadBalancer\",\r\n                \"elasticloadbalancing:DeleteRule\",\r\n                \"elasticloadbalancing:DeleteTargetGroup\",\r\n                \"elasticloadbalancing:DeregisterTargets\",\r\n                \"elasticloadbalancing:DescribeListenerCertificates\",\r\n                \"elasticloadbalancing:DescribeListeners\",\r\n                \"elasticloadbalancing:DescribeLoadBalancers\",\r\n                \"elasticloadbalancing:DescribeLoadBalancerAttributes\",\r\n                \"elasticloadbalancing:DescribeRules\",\r\n                \"elasticloadbalancing:DescribeSSLPolicies\",\r\n                \"elasticloadbalancing:DescribeTags\",\r\n                \"elasticloadbalancing:DescribeTargetGroups\",\r\n                \"elasticloadbalancing:DescribeTargetGroupAttributes\",\r\n                \"elasticloadbalancing:DescribeTargetHealth\",\r\n                \"elasticloadbalancing:ModifyListener\",\r\n                \"elasticloadbalancing:ModifyLoadBalancerAttributes\",\r\n                \"elasticloadbalancing:ModifyRule\",\r\n                \"elasticloadbalancing:ModifyTargetGroup\",\r\n                \"elasticloadbalancing:ModifyTargetGroupAttributes\",\r\n                \"elasticloadbalancing:RegisterTargets\",\r\n                \"elasticloadbalancing:RemoveListenerCertificates\",\r\n                \"elasticloadbalancing:RemoveTags\",\r\n                \"elasticloadbalancing:SetIpAddressType\",\r\n                \"elasticloadbalancing:SetSecurityGroups\",\r\n                \"elasticloadbalancing:SetSubnets\",\r\n                \"elasticloadbalancing:SetWebAcl\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"iam:CreateServiceLinkedRole\",\r\n                \"iam:GetServerCertificate\",\r\n                \"iam:ListServerCertificates\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"cognito-idp:DescribeUserPoolClient\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"waf-regional:GetWebACLForResource\",\r\n                \"waf-regional:GetWebACL\",\r\n                \"waf-regional:AssociateWebACL\",\r\n                \"waf-regional:DisassociateWebACL\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"tag:GetResources\",\r\n                \"tag:TagResources\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"waf:GetWebACL\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"wafv2:GetWebACL\",\r\n                \"wafv2:GetWebACLForResource\",\r\n                \"wafv2:AssociateWebACL\",\r\n                \"wafv2:DisassociateWebACL\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"shield:DescribeProtection\",\r\n                \"shield:GetSubscriptionState\",\r\n                \"shield:DeleteProtection\",\r\n                \"shield:CreateProtection\",\r\n                \"shield:DescribeSubscription\",\r\n                \"shield:ListProtections\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        }\r\n    ]\r\n}\r\n<\/span><span class=\"no\">EOF\r\n<\/span><span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u5728\u6b64\u4e4b\u4e0a\uff0c\u8fdb\u884cKubernetes\u89d2\u8272\u8bbe\u7f6e\u548cIAM\u7684\u5173\u8054\u5982\u4e0b\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"create_rbac_role\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">coredns_restart<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl apply -f .\/output_files\/rbac-role.yaml\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"create_iamserviceaccount\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">create_rbac_role<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"eksctl create iamserviceaccount --name alb-ingress-controller --namespace kube-system --cluster ${aws_eks_cluster.example.name} --attach-policy-arn ${aws_iam_policy.alb_ingress_controller.arn} --approve\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u5728\u8fd9\u91cc\uff0c\u5c06\u521b\u5efa CloudFormation \u5806\u6808\uff0c\u7136\u540e\u521b\u5efa IAM \u89d2\u8272\u5e76\u5c06\u5176\u9644\u52a0\u5230\u7b56\u7565\u4e2d\u3002<br \/>\n\u8bf7\u6ce8\u610f\uff0c\u5982\u679c\u4e0d\u5220\u9664\u5806\u6808\uff0c\u5219\u65e0\u6cd5\u5220\u9664 IAM\uff0c\u8fd9\u5c06\u5bfc\u81f4 terraform destroy \u5931\u8d25\uff0c\u56e0\u6b64\u9700\u8981\u6ce8\u610f\u3002<\/p>\n<p>\u4e00\u65e6\u51c6\u5907\u597d\u521b\u5efaALB\uff0c\u7136\u540e\u4f7f\u7528kubectl apply\u5c06\u4e4b\u524d\u521b\u5efa\u7684Manifest\u6587\u4ef6\u5e94\u7528\u5373\u53ef\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"create_alb_ingress_controller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">create_iamserviceaccount<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl apply -f .\/output_files\/alb-ingress-controller.yaml\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"nginx_service\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">create_alb_ingress_controller<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl apply -f .\/output_files\/nginx-service.yaml\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"nginx_deployment\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_service<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl apply -f .\/output_files\/nginx-deployment.yaml\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"nginx_ingress\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_deployment<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl apply -f .\/output_files\/nginx-ingress.yaml\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u5982\u679c\u80fd\u591f\u6210\u529f\u5236\u4f5c\uff0c\u5c06\u521b\u5efaALB\u5e76\u4e14\u53ef\u4ee5\u901a\u8fc7\u8bbf\u95ee\u8be5URL\u6765\u6253\u5f00Nginx\u754c\u9762\u3002<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d261d37434c4406c363d1\/54-0.png\" alt=\"\u30ad\u30e3\u30d7\u30c1\u30e31.png\" \/><\/div>\n<p>\u987a\u4fbf\u63d0\u4e00\u4e0b\uff0c\u5728\u521b\u5efa\u8fd9\u4e2aALB\u7684\u8fc7\u7a0b\u4e2d\uff0cALB\u3001\u76ee\u6807\u7ec4\u548c\u5b89\u5168\u7ec4\u4f1a\u81ea\u52a8\u4f5c\u4e3aAWS\u8d44\u6e90\u88ab\u521b\u5efa\u3002\u5982\u679c\u4e0d\u5220\u9664\u5b83\u4eec\uff0c\u90a3\u4e48\u5728\u8fd0\u884cterraform destroy\u547d\u4ee4\u65f6\u5c06\u65e0\u6cd5\u5220\u9664VPC\u5e76\u51fa\u73b0\u9519\u8bef\uff0c\u6240\u4ee5\u9700\u8981\u6ce8\u610f\u3002<\/p>\n<p>\u8fd9\u4e2aALB\u53ef\u4ee5\u5728\u7ba1\u7406\u63a7\u5236\u53f0\u4e0a\u786e\u8ba4\uff0c\u4f46\u4e0d\u786e\u5b9a\u5b83\u662f\u5426\u80fd\u6839\u636e\u8d1f\u8f7d\u60c5\u51b5\u8fdb\u884c\u9002\u5f53\u7684\u6269\u5c55\u3002\u5982\u679cALB\u6210\u4e3a\u74f6\u9888\uff0c\u5c06\u6beb\u65e0\u4ef7\u503c\uff0c\u6240\u4ee5\u6211\u4eec\u9700\u8981\u5728\u63a5\u4e0b\u6765\u7684\u5de5\u4f5c\u4e2d\u8fdb\u884c\u5f7b\u5e95\u9a8c\u8bc1\u3002<\/p>\n<h1>2021\u5e748\u670811\u65e5\u8ffd\u8a18\uff1a\u4e0d\u4f7f\u7528eksctl\uff0c\u81ea\u884c\u69cb\u5efaALB\u3002<\/h1>\n<div>\u622a\u81f32021\u5e748\u6708\uff0c\u4f7f\u7528ALB Ingress Controller\u88ab\u8ba4\u4e3a\u662f\u6700\u4f73\u5b9e\u8df5\uff0c\u4f46\u76ee\u524d\u5df2\u4e0d\u63a8\u8350\u4f7f\u7528\u3002\u622a\u81f32023\u5e7411\u6708\uff0c\u4f7f\u7528AWS Load Balancer Controller\u88ab\u89c6\u4e3a\u6807\u51c6\u505a\u6cd5\u3002<\/div>\n<p>\u597d\u5427\uff0c\u6b63\u5982\u4e4b\u524d\u6240\u8ff0\uff0c\u6211\u4eec\u5728\u521b\u5efa\u8d44\u6e90\u7684\u8fc7\u7a0b\u4e2d\u4f7f\u7528 Terraform \u4ee5\u5916\u7684\u5404\u79cd\u8d44\u6e90\uff0c\u4f46\u6211\u4eec\u53ef\u4ee5\u5c06\u5176\u4ec5\u9650\u4e8e ALB \u548c\u76ee\u6807\u7ec4\u3002<\/p>\n<p>\u901a\u8fc7\u8fd9\u6837\u505a\uff0c\u53ef\u4ee5\u5c3d\u53ef\u80fd\u51cf\u5c11\u7531\u4e8e\u64cd\u4f5c\u5931\u8bef\u800c\u65e0\u6cd5\u6d88\u9664\u8d44\u6e90\u7684\u98ce\u9669\u3002<br \/>\n\u203b\u4ece\u6839\u672c\u4e0a\u8bb2\uff0c\u5e76\u6ca1\u6709\u592a\u591a\u9700\u8981\u6d88\u9664\u8d44\u6e90\u7684\u60c5\u51b5\uff0c\u6240\u4ee5\u53ef\u80fd\u4e0d\u4f1a\u9020\u6210\u56f0\u6270\u3002\u5bf9\u4e8e\u8d44\u6e90\u66f4\u65b0\u4e5f\u53ef\u4ee5\u91c7\u53d6\u540c\u6837\u7684\u63aa\u65bd\uff0c\u96c6\u4e2d\u7ba1\u7406\u4e0d\u662f\u4ef6\u574f\u4e8b\u3002<\/p>\n<h2>\u6211\u6b63\u5728\u51c6\u5907IAM\u7684\u989d\u5916\u90e8\u5206\u3002<\/h2>\n<p>\u5728\u521b\u5efa ALB \u4e4b\u524d\uff0c\u6211\u4eec\u6b63\u5728\u521b\u5efa\u4e0e OIDC \u76f8\u5173\u7684\u7b56\u7565\u548c\u63d0\u4f9b\u8005\uff0c\u7136\u540e\u4f7f\u7528\u8fd9\u4e9b\u7b56\u7565\u548c\u63d0\u4f9b\u8005\u901a\u8fc7 eks \u7ecf CloudFormation \u521b\u5efa IAM \u89d2\u8272\u3002\u8ba9\u6211\u4eec\u81ea\u5df1\u521b\u5efa\u5b83\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_iam_role\"<\/span> <span class=\"s2\">\"ekscluster_oidc\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>               <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster_oidc_role_name<\/span>\r\n  <span class=\"nx\">assume_role_policy<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_iam_policy_document<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster_oidc_assume_policy<\/span><span class=\"p\">.<\/span><span class=\"nx\">json<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"alpha.eksctl.io\/cluster-name\"<\/span>                <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n    <span class=\"s2\">\"eksctl.cluster.k8s.io\/v1alpha1\/cluster-name\"<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n    <span class=\"s2\">\"alpha.eksctl.io\/iamserviceaccount-name\"<\/span>      <span class=\"p\">=<\/span> <span class=\"s2\">\"kube-system\/alb-ingress-controller\"<\/span>\r\n    <span class=\"s2\">\"alpha.eksctl.io\/eksctl-version\"<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"0.47.0\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">data<\/span> <span class=\"s2\">\"aws_iam_policy_document\"<\/span> <span class=\"s2\">\"ekscluster_oidc_assume_policy\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">statement<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">actions<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"sts:AssumeRoleWithWebIdentity\"<\/span><span class=\"p\">]<\/span>\r\n    <span class=\"nx\">effect<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"Allow\"<\/span>\r\n\r\n    <span class=\"nx\">condition<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">test<\/span>     <span class=\"p\">=<\/span> <span class=\"s2\">\"StringEquals\"<\/span>\r\n      <span class=\"nx\">variable<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"${replace(aws_iam_openid_connect_provider.for_eks_fargate_pod.url, \"<\/span><span class=\"nx\">https<\/span><span class=\"err\">:<\/span><span class=\"c1\">\/\/\", \"\")}:sub\"<\/span>\r\n      <span class=\"nx\">values<\/span>   <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"system:serviceaccount:kube-system:alb-ingress-controller\"<\/span><span class=\"p\">]<\/span>\r\n    <span class=\"p\">}<\/span>\r\n\r\n    <span class=\"nx\">condition<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">test<\/span>     <span class=\"p\">=<\/span> <span class=\"s2\">\"StringEquals\"<\/span>\r\n      <span class=\"nx\">variable<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"${replace(aws_iam_openid_connect_provider.for_eks_fargate_pod.url, \"<\/span><span class=\"nx\">https<\/span><span class=\"err\">:<\/span><span class=\"c1\">\/\/\", \"\")}:aud\"<\/span>\r\n      <span class=\"nx\">values<\/span>   <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"sts.amazonaws.com\"<\/span><span class=\"p\">]<\/span>\r\n    <span class=\"p\">}<\/span>\r\n\r\n    <span class=\"nx\">principals<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">identifiers<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">aws_iam_openid_connect_provider<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate_pod<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span><span class=\"p\">]<\/span>\r\n      <span class=\"nx\">type<\/span>        <span class=\"p\">=<\/span> <span class=\"s2\">\"Federated\"<\/span>\r\n    <span class=\"p\">}<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_iam_role_policy_attachment\"<\/span> <span class=\"s2\">\"ekscluster_oidc\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">role<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster_oidc<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">policy_arn<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_policy<\/span><span class=\"p\">.<\/span><span class=\"nx\">alb_ingress_controller<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u5173\u4e8e\u6b63\u5728\u8fdb\u884c\u7684 eksctl \u90e8\u5206\uff0c\u8bf7\u6309\u7167\u4ee5\u4e0b\u65b9\u5f0f\u521b\u5efa\u6e05\u5355\u6587\u4ef6\u5e76\u66ff\u6362\u547d\u4ee4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ServiceAccount<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb-ingress-controller<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">kube-system<\/span>\r\n  <span class=\"na\">annotations<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">eks.amazonaws.com\/role-arn<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${sa_role_arn}<\/span>\r\n<\/code><\/pre>\n<p>\u5173\u4e8e\u4ee5\u4e0a\u8c03\u7528\uff0c\u5c06\u89d2\u8272\u4fe1\u606f\u4f20\u9012\u7ed9Kubernetes\uff0c\u53ef\u4ee5\u6309\u4ee5\u4e0b\u65b9\u5f0f\u8fdb\u884c\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"local_file\"<\/span> <span class=\"s2\">\"serviceaccount\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">filename<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\".\/output_files\/serviceaccount.yaml\"<\/span>\r\n  <span class=\"nx\">content<\/span>  <span class=\"p\">=<\/span> <span class=\"nx\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">template_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">serviceaccount<\/span><span class=\"p\">.<\/span><span class=\"nx\">rendered<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">data<\/span> <span class=\"s2\">\"template_file\"<\/span> <span class=\"s2\">\"serviceaccount\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">template<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">file<\/span><span class=\"p\">(<\/span><span class=\"s2\">\"${path.module}\/kubernetes_template\/serviceaccount.yaml\"<\/span><span class=\"p\">)<\/span>\r\n\r\n  <span class=\"nx\">vars<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">sa_role_arn<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">ekscluster_oidc<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u73b0\u5728\uff0c\u6211\u4eec\u6765\u8fd9\u6837\u8c03\u7528\u5b83\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"create_iamserviceaccount\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">null_resource<\/span><span class=\"p\">.<\/span><span class=\"nx\">create_rbac_role<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span>    <span class=\"p\">=<\/span> <span class=\"s2\">\"kubectl apply -f .\/output_files\/serviceaccount.yaml\"<\/span>\r\n\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">fail<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h2>\u51c6\u5907\u5b89\u5168\u7ec4<\/h2>\n<p>\u5728\u5e94\u752815_nginx-ingress.yaml\u6587\u4ef6\u65f6\uff0cKubernetes\u4f1a\u81ea\u52a8\u4e3a\u6211\u4eec\u51c6\u5907\u5b89\u5168\u7ec4\u3002\u7136\u800c\uff0c\u6709\u65f6\u8fd9\u4e2a\u5b89\u5168\u7ec4\u5e76\u4e0d\u4f1a\u88ab\u5b8c\u5168\u6e05\u9664\uff0c\u5bfc\u81f4\u51aa\u7b49\u6027\u7684\u964d\u4f4e\u3002\u56e0\u6b64\uff0c\u6211\u4eec\u51b3\u5b9a\u81ea\u5df1\u521b\u5efa\u5b89\u5168\u7ec4\uff0c\u5e76\u5c06\u5176\u503c\u4f20\u9012\u7ed9\u6e05\u5355\u6587\u4ef6\u3002<\/p>\n<p>\u9996\u5148\u662f\u5b89\u5168\u7ec4\u7684\u5b9a\u4e49\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_security_group\"<\/span> <span class=\"s2\">\"for_eks_ingress\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>        <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_ingress_sg_name<\/span>\r\n  <span class=\"nx\">description<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"managed LoadBalancer securityGroup by ALB Ingress Controller\"<\/span>\r\n  <span class=\"nx\">vpc_id<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n\r\n  <span class=\"nx\">ingress<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">from_port<\/span>   <span class=\"p\">=<\/span> <span class=\"mi\">80<\/span>\r\n    <span class=\"nx\">to_port<\/span>     <span class=\"p\">=<\/span> <span class=\"mi\">80<\/span>\r\n    <span class=\"nx\">protocol<\/span>    <span class=\"p\">=<\/span> <span class=\"s2\">\"TCP\"<\/span>\r\n    <span class=\"nx\">cidr_blocks<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"0.0.0.0\/0\"<\/span><span class=\"p\">]<\/span>\r\n    <span class=\"nx\">description<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Allow ingress on port 80 from 0.0.0.0\/0\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">egress<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">from_port<\/span>   <span class=\"p\">=<\/span> <span class=\"mi\">0<\/span>\r\n    <span class=\"nx\">to_port<\/span>     <span class=\"p\">=<\/span> <span class=\"mi\">0<\/span>\r\n    <span class=\"nx\">protocol<\/span>    <span class=\"p\">=<\/span> <span class=\"s2\">\"-1\"<\/span>\r\n    <span class=\"nx\">cidr_blocks<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"0.0.0.0\/0\"<\/span><span class=\"p\">]<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">Name<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_ingress_sg_name<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u53e6\u5916\uff0c\u7531\u4e8e\u9700\u8981\u5c06\u4e0a\u8ff0\u5b89\u5168\u7ec4\u4e0eEKS\u96c6\u7fa4\u7684\u5b89\u5168\u7ec4\u5173\u8054\u8d77\u6765\uff0c\u56e0\u6b64\u9700\u8981\u5305\u542b\u4ee5\u4e0b\u5b9a\u4e49\u3002<br \/>\naws_eks_cluster.example.vpc_config[0].cluster_security_group_id \u662f\u65e0\u6cd5\u81ea\u5df1\u521b\u5efa\u7684\uff0c\u53ea\u80fd\u7531EKS\u8d1f\u8d23\uff0c\u6240\u4ee5\u9700\u8981\u4eceEKS\u96c6\u7fa4\u7684\u5b9a\u4e49\u4e2d\u83b7\u53d6\u8be5\u503c\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_security_group_rule\"<\/span> <span class=\"s2\">\"for_eks_cluster_allow_eks_ingress\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">security_group_id<\/span>        <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">vpc_config<\/span><span class=\"p\">[<\/span><span class=\"mi\">0<\/span><span class=\"p\">].<\/span><span class=\"nx\">cluster_security_group_id<\/span>\r\n  <span class=\"nx\">description<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"for_eks_cluster_allow_eks_ingress\"<\/span>\r\n  <span class=\"nx\">type<\/span>                     <span class=\"p\">=<\/span> <span class=\"s2\">\"ingress\"<\/span>\r\n  <span class=\"nx\">from_port<\/span>                <span class=\"p\">=<\/span> <span class=\"mi\">0<\/span>\r\n  <span class=\"nx\">to_port<\/span>                  <span class=\"p\">=<\/span> <span class=\"mi\">65535<\/span>\r\n  <span class=\"nx\">protocol<\/span>                 <span class=\"p\">=<\/span> <span class=\"s2\">\"TCP\"<\/span>\r\n  <span class=\"nx\">source_security_group_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_security_group<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_ingress<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u53e6\u5916\uff0c\u4e3a\u4e86\u5c06\u4e0a\u8ff0\u521b\u5efa\u7684\u5b89\u5168\u7ec4\u8bbe\u7f6e\u7ed9ALB\uff0c\u9700\u8981\u572815_nginx-ingress.yaml\u6587\u4ef6\u4e2d\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\u3002<br \/>\n\u901a\u8fc7\u8fd9\u6837\u505a\uff0c\u5728\u5e94\u7528nginx-ingress\u65f6\u4e0d\u4f1a\u521b\u5efa\u9ed8\u8ba4\u7684\u5b89\u5168\u7ec4\uff0c\u800c\u662f\u53ef\u4ee5\u4f7f\u7528\u6211\u4eec\u81ea\u5df1\u8bbe\u7f6e\u7684\u5b89\u5168\u7ec4\u3002<\/p>\n<pre class=\"post-pre\"><code>  <span class=\"na\">annotations<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">kubernetes.io\/ingress.class<\/span><span class=\"pi\">:<\/span> <span class=\"s\">alb<\/span>\r\n    <span class=\"na\">alb.ingress.kubernetes.io\/scheme<\/span><span class=\"pi\">:<\/span> <span class=\"s\">internet-facing<\/span>\r\n    <span class=\"na\">alb.ingress.kubernetes.io\/security-groups<\/span><span class=\"pi\">:<\/span> <span class=\"s\">${eks_ingress_sg_id}<\/span> <span class=\"c1\"># \u2605\u3053\u308c\u3092\u8ffd\u8a18<\/span>\r\n<\/code><\/pre>\n<p>\u5728\u751f\u6210\u7528\u4e8enginx-ingress\u7684YAML\u7684null_resource\u4e2d\uff0c\u5e94\u8be5\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\u3002<\/p>\n<pre class=\"post-pre\"><code>  <span class=\"nx\">vars<\/span> <span class=\"err\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">eks_ingress_sg_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_security_group<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_ingress<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h2>\u4e3a\u4e86\u4f7fterraform destroy\u5177\u6709\u5e42\u7b49\u6027\uff0c\u8fdb\u4e00\u6b65\u8fdb\u884c\u4fee\u6539\u3002<\/h2>\n<p>\u597d\u5427\uff0c\u73b0\u5728\u6211\u4eec\u5df2\u7ecf\u5b8c\u6210\u4e86\u5927\u90e8\u5206\u8d44\u6e90\u90fd\u8fc1\u79fb\u5230\u4e86 Terraform\uff0c\u4f46\u662f\u5728\u6267\u884c terraform destroy \u7684\u65f6\u5019\uff0c\u4ecd\u7136\u5b58\u5728\u6b8b\u7559\u5783\u573e\u7684\u95ee\u9898\u3002<\/p>\n<p>\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528 null_resource \u5728\u6267\u884c terraform destroy \u65f6\u8fdb\u884c\u64cd\u4f5c\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nx\">resource<\/span> <span class=\"s2\">\"null_resource\"<\/span> <span class=\"s2\">\"kubectl_delete\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">aws_eks_fargate_profile<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubesystem<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">create_namespace_awsobservablity<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">awslogging_cloudwatch_configmap<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">serviceaccount<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">alb_ingress_controller<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">rbac_role<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_service<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_deployment<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">nginx_ingress<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">triggers<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">kubeconfig<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">local_file<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span><span class=\"p\">.<\/span><span class=\"nx\">filename<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">provisioner<\/span> <span class=\"s2\">\"local-exec\"<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">when<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">destroy<\/span>\r\n    <span class=\"nx\">on_failure<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">continue<\/span>\r\n    <span class=\"nx\">environment<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">KUBECONFIG<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">self<\/span><span class=\"p\">.<\/span><span class=\"nx\">triggers<\/span><span class=\"p\">.<\/span><span class=\"nx\">kubeconfig<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">command<\/span> <span class=\"p\">=<\/span> <span class=\"o\">&lt;&lt;-<\/span><span class=\"no\">EOF<\/span><span class=\"sh\">\r\n      kubectl delete -f .\/output_files\/nginx-ingress.yaml --grace-period=0 --force &amp;&amp;\r\n      sleep 30 &amp;&amp;\r\n      kubectl delete -f .\/output_files\/nginx-deployment.yaml --grace-period=0 --force &amp;&amp;\r\n      kubectl delete -f .\/output_files\/nginx-service.yaml --grace-period=0 --force &amp;&amp;\r\n      kubectl delete -f .\/output_files\/alb-ingress-controller.yaml --grace-period=0 --force &amp;&amp;\r\n      kubectl delete -f .\/output_files\/serviceaccount.yaml --grace-period=0 --force &amp;&amp;\r\n      kubectl delete -f .\/output_files\/rbac-role.yaml --grace-period=0 --force &amp;&amp;\r\n<\/span><span class=\"no\">    EOF\r\n<\/span>  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u9996\u5148\uff0c\u6211\u7684\u60f3\u6cd5\u662f\u5148\u7834\u574f\u6389\u6240\u6709\u5df2\u521b\u5efa\u7684\u8d44\u6e90\uff0c\u7136\u540e\u518d\u8fdb\u884c Terraform \u7684\u8d44\u6e90\u5220\u9664\u3002\u521b\u5efa local_file \u4f9d\u8d56\u5173\u7cfb\u662f\u4e3a\u4e86\u9632\u6b62 local_file \u88ab\u9500\u6bc1\uff08\u5373\u65e0\u6cd5\u901a\u8fc7 kubectl \u4f7f\u7528\uff09\u7684\u60c5\u51b5\u53d1\u751f\uff0c\u56e0\u4e3a\u5185\u90e8\u547d\u4ee4\u4f7f\u7528\u4e86\u8be5\u6587\u4ef6\u3002<\/p>\n<p>\u6b64\u5916\uff0c\u5bf9\u4e8e destroy \u64cd\u4f5c\u7684\u672c\u5730\u6267\u884c(local-exec)\u6765\u8bf4\uff0c\u5b58\u5728\u65e0\u6cd5\u5f15\u7528\u503c\u7684\u9650\u5236\u3002\u56e0\u6b64\uff0c\u6211\u4eec\u5f3a\u884c\u5c06\u503c\u586b\u5165\u89e6\u53d1\u5668(triggers)\u4ee5\u4fbf\u8fdb\u884c\u5f15\u7528\u3002<\/p>\n<p>\u5269\u4e0b\u7684\u5c31\u662f\u9010\u6b65\u5220\u9664\u901a\u8fc7 &#8220;kubectl delete &#8211;grace-period=0 &#8211;force&#8221; \u547d\u4ee4\u521b\u5efa\u7684\u8d44\u6e90\uff08\u5982\u679c\u4e0d\u5f3a\u5236\u5220\u9664\uff0c\u53ef\u80fd\u65e0\u6cd5\u5220\u9664\u8d44\u6e90\uff09\u3002\u4e4b\u6240\u4ee5\u4ec5\u5728 nginx-ingress.yaml \u540e\u52a0\u5165\u4e86 &#8220;sleep&#8221;\uff0c\u662f\u56e0\u4e3a\u5728\u5220\u9664\u8d44\u6e90\u7684\u8fc7\u7a0b\u4e2d\u63a5\u6536\u5230\u4e0b\u4e00\u4e2a kubectl \u8bf7\u6c42\u53ef\u80fd\u4f1a\u5bfc\u81f4\u4e00\u4e9b\u4e0d\u4e00\u81f4\uff0c\u6216\u8005\u65e0\u6cd5\u5b8c\u5168\u5220\u9664\u76ee\u6807\u7ec4\u7684\u60c5\u51b5\u3002\u867d\u7136 &#8220;sleep 30&#8221; \u4e0d\u592a\u7f8e\u89c2\uff0c\u4f46\u6211\u65e0\u6cd5\u627e\u5230\u5176\u4ed6\u65b9\u6cd5\u2026\u2026\u3002\u5c3d\u7ba1\u5982\u6b64\uff0c\u5728\u8fd9\u4e4b\u540e\u4ecd\u7136\u53ef\u80fd\u5b58\u5728\u8d44\u6e90\u65e0\u6cd5\u5220\u9664\u7684\u60c5\u51b5\u3002\u9057\u61be\u7684\u662f\uff0c\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0c\u60a8\u53ef\u4ee5\u5c1d\u8bd5\u624b\u52a8\u6309\u7167 ALB \u21d2 \u76ee\u6807\u7ec4\u7684\u987a\u5e8f\u8fdb\u884c\u5220\u9664\uff08\u5148\u5220\u9664 ALB\uff0c\u7136\u540e\u518d\u5220\u9664\u76ee\u6807\u7ec4\uff09\u3002<\/p>\n<p>\u987a\u4fbf\u63d0\u4e00\u4e0b\uff0c\u5c3d\u7ba1\u672c\u6b21\u8865\u5145\u5185\u5bb9\u662f\u5728\u4e0d\u4f7f\u7528eksctl\u7684\u524d\u63d0\u4e0b\u7f16\u5199\u7684\uff0c\u4f46\u5982\u679c\u8981\u4f7f\u7528eksctl\uff0c\u4e5f\u53ef\u4ee5\u5c06<br \/>\nkubectl delete -f .\/output_files\/serviceaccount.yaml &#8211;grace-period=0 &#8211;force &amp;&amp;<br \/>\n\u8fd9\u90e8\u5206\u6539\u4e3a\uff0c<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>eksctl delete iamserviceaccount <span class=\"nt\">--name<\/span> alb-ingress-controller <span class=\"nt\">--namespace<\/span> kube-system <span class=\"nt\">--cluster<\/span> eks-fargate-example-cluster \r\n<\/code><\/pre>\n<p>\u53ef\u4ee5\u4ee5\u4e00\u79cd\u7c7b\u4f3c\u7684\u65b9\u5f0f\u8fdb\u884c\u5220\u9664\u3002<\/p>\n<p>\u5e94\u8be5\u80fd\u591f\u5728\u8fd9\u4e2a\u57fa\u7840\u4e0a\u81ea\u7531\u5730\u8fdb\u884c\u521b\u5efa\u548c\u5220\u9664\u7684\u5c1d\u8bd5\u548c\u9519\u8bef\u4e86\uff01<\/p>\n<h1>2023\u5e7411\u670826\u65e5\u66f4\u65b0\uff1a\u5229\u7528AWS\u8d1f\u8f7d\u5747\u8861\u5668\u63a7\u5236\u5668\u6765\u7ba1\u7406\u5d4c\u5165\u5f0f\u8d1f\u8f7d\u5747\u8861\u5668\u3002<\/h1>\n<p>\u67e5\u770bAWS\u5b98\u65b9\u535a\u5ba2\u53ef\u4e86\u89e3AWS\u8d1f\u8f7d\u5747\u8861\u63a7\u5236\u5668\u7684\u6982\u8ff0\u3002<br \/>\n\u4f5c\u4e3a\u4e0eALB Ingress Controller\u7684\u533a\u522b\uff0cALB Ingress Controller\u4f1a\u521b\u5efaALB\u8fd9\u4e00\u8d44\u6e90\uff0c\u800cAWS\u8d1f\u8f7d\u5747\u8861\u63a7\u5236\u5668\u5219\u5c06\u8d1f\u8f7d\u5747\u8861\u5668\u4e0eKubernetes\u89e3\u8026\uff0c\u5c06\u5176\u5b9a\u4e49\u4e3a\u5e38\u89c4\u7684AWS\u8d44\u6e90\u5e76\u4e0e\u4e4b\u4e92\u52a8\u3002\u8fd9\u6837\u505a\u53ef\u4ee5\u66f4\u6e05\u695a\u5730\u5212\u5206\u8d1f\u8f7d\u5747\u8861\u529f\u80fd\u548c\u670d\u52a1\u63d0\u4f9b\u529f\u80fd\u7684\u8d23\u4efb\u5206\u62c5\u3002<\/p>\n<h2>ALB\u7684\u5b9a\u4e49\u662f\u4f5c\u4e3aAWS\u8d44\u6e90\u7684\u8d1f\u8f7d\u5747\u8861\u5668\u3002<\/h2>\n<p>\u5728Terraform\u4e2d\uff0c\u53ea\u9700\u6309\u7167\u4ee5\u4e0b\u65b9\u5f0f\u6b63\u5e38\u521b\u5efaALB\u5373\u53ef\u3002<br \/>\n\u5728\u5b89\u5168\u7ec4\u4e2d\uff0c\u653e\u7f6e\u5e38\u89c4ALB\u8f6c\u53d1\u6240\u9700\u7684\u8bbe\u7f6e\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># ALB                                                                          #<\/span>\r\n<span class=\"c1\">################################################################################0<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_lb\"<\/span> <span class=\"s2\">\"example\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>               <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">alb_name<\/span>\r\n  <span class=\"nx\">load_balancer_type<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"application\"<\/span>\r\n\r\n  <span class=\"nx\">subnets<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public1<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">aws_subnet<\/span><span class=\"p\">.<\/span><span class=\"nx\">public2<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">security_groups<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">aws_security_group<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_ingress<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"elbv2.k8s.aws\/cluster\"<\/span>    <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span>\r\n    <span class=\"s2\">\"ingress.k8s.aws\/resource\"<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"LoadBalancer\"<\/span>\r\n    <span class=\"s2\">\"ingress.k8s.aws\/stack\"<\/span>    <span class=\"p\">=<\/span> <span class=\"s2\">\"default\/nginx-ingress\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_lb_listener\"<\/span> <span class=\"s2\">\"example\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">load_balancer_arn<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_lb<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n  <span class=\"nx\">port<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"80\"<\/span>\r\n  <span class=\"nx\">protocol<\/span>          <span class=\"p\">=<\/span> <span class=\"s2\">\"HTTP\"<\/span>\r\n\r\n  <span class=\"nx\">default_action<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">type<\/span>             <span class=\"p\">=<\/span> <span class=\"s2\">\"forward\"<\/span>\r\n    <span class=\"nx\">target_group_arn<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_lb_target_group<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_lb_target_group\"<\/span> <span class=\"s2\">\"example\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>        <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">alb_tg_name<\/span>\r\n  <span class=\"nx\">vpc_id<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">port<\/span>        <span class=\"p\">=<\/span> <span class=\"mi\">80<\/span>\r\n  <span class=\"nx\">protocol<\/span>    <span class=\"p\">=<\/span> <span class=\"s2\">\"HTTP\"<\/span>\r\n  <span class=\"nx\">target_type<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"ip\"<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"elbv2.k8s.aws\/cluster\"<\/span>    <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eks_cluster_name<\/span>\r\n    <span class=\"s2\">\"ingress.k8s.aws\/resource\"<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"default\/nginx-ingress-nginx-service:80\"<\/span>\r\n    <span class=\"s2\">\"ingress.k8s.aws\/stack\"<\/span>    <span class=\"p\">=<\/span> <span class=\"s2\">\"default\/nginx-ingress\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h2>IAM\u89d2\u8272\u7684\u914d\u7f6e<\/h2>\n<p>\u6211\u5011\u9700\u8981\u6309\u7167\u4ee5\u4e0b\u65b9\u5f0f\u8a2d\u7f6eIAM\u89d2\u8272\u3002\u70ba\u4e86\u8207Kubernetes\u670d\u52d9\u5e33\u6236\u76f8\u95dc\u806f\uff0c\u6211\u5011\u9700\u8981\u9032\u884cOpenIDConnect\u7684\u8a2d\u5b9a\u3002\u6bcf\u500b\u8a2d\u5b9a\u90fd\u53c3\u8003\u5b98\u65b9\u7528\u6236\u6307\u5357\u4e2d\u7684IAM\u8a2d\u5b9a\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># IAM Policy for AWS Load Balancer Controller                                  #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_iam_role\"<\/span> <span class=\"s2\">\"aws_loadbalancer_controller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>               <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eksawsloadbalancercontroller_role_name<\/span>\r\n  <span class=\"nx\">assume_role_policy<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_iam_policy_document<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_loadbalancer_controller_assume_policy<\/span><span class=\"p\">.<\/span><span class=\"nx\">json<\/span>\r\n\r\n  <span class=\"nx\">tags<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"s2\">\"alpha.eksctl.io\/cluster-name\"<\/span>                <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n    <span class=\"s2\">\"eksctl.cluster.k8s.io\/v1alpha1\/cluster-name\"<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n    <span class=\"s2\">\"alpha.eksctl.io\/iamserviceaccount-name\"<\/span>      <span class=\"p\">=<\/span> <span class=\"s2\">\"kube-system\/aws-load-balancer-controller\"<\/span>\r\n    <span class=\"s2\">\"alpha.eksctl.io\/eksctl-version\"<\/span>              <span class=\"p\">=<\/span> <span class=\"s2\">\"0.47.0\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">data<\/span> <span class=\"s2\">\"aws_iam_policy_document\"<\/span> <span class=\"s2\">\"aws_loadbalancer_controller_assume_policy\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">statement<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">actions<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"sts:AssumeRoleWithWebIdentity\"<\/span><span class=\"p\">]<\/span>\r\n    <span class=\"nx\">effect<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"Allow\"<\/span>\r\n\r\n    <span class=\"nx\">condition<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">test<\/span>     <span class=\"p\">=<\/span> <span class=\"s2\">\"StringEquals\"<\/span>\r\n      <span class=\"nx\">variable<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"${replace(aws_iam_openid_connect_provider.for_eks_fargate_pod.url, \"<\/span><span class=\"nx\">https<\/span><span class=\"err\">:<\/span><span class=\"c1\">\/\/\", \"\")}:sub\"<\/span>\r\n      <span class=\"nx\">values<\/span>   <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"system:serviceaccount:kube-system:aws-load-balancer-controller\"<\/span><span class=\"p\">]<\/span>\r\n    <span class=\"p\">}<\/span>\r\n\r\n    <span class=\"nx\">condition<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">test<\/span>     <span class=\"p\">=<\/span> <span class=\"s2\">\"StringEquals\"<\/span>\r\n      <span class=\"nx\">variable<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"${replace(aws_iam_openid_connect_provider.for_eks_fargate_pod.url, \"<\/span><span class=\"nx\">https<\/span><span class=\"err\">:<\/span><span class=\"c1\">\/\/\", \"\")}:aud\"<\/span>\r\n      <span class=\"nx\">values<\/span>   <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"sts.amazonaws.com\"<\/span><span class=\"p\">]<\/span>\r\n    <span class=\"p\">}<\/span>\r\n\r\n    <span class=\"nx\">principals<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">identifiers<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">aws_iam_openid_connect_provider<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate_pod<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span><span class=\"p\">]<\/span>\r\n      <span class=\"nx\">type<\/span>        <span class=\"p\">=<\/span> <span class=\"s2\">\"Federated\"<\/span>\r\n    <span class=\"p\">}<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"aws_iam_role_policy\"<\/span> <span class=\"s2\">\"aws_loadbalancer_controller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>   <span class=\"p\">=<\/span> <span class=\"nx\">local<\/span><span class=\"p\">.<\/span><span class=\"nx\">eksawsloadbalancercontroller_policy_name<\/span>\r\n  <span class=\"nx\">role<\/span>   <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_loadbalancer_controller<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">policy<\/span> <span class=\"p\">=<\/span> <span class=\"o\">&lt;&lt;<\/span><span class=\"no\">EOF<\/span><span class=\"sh\">\r\n{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"iam:CreateServiceLinkedRole\"\r\n            ],\r\n            \"Resource\": \"*\",\r\n            \"Condition\": {\r\n                \"StringEquals\": {\r\n                    \"iam:AWSServiceName\": \"elasticloadbalancing.amazonaws.com\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"ec2:DescribeAccountAttributes\",\r\n                \"ec2:DescribeAddresses\",\r\n                \"ec2:DescribeAvailabilityZones\",\r\n                \"ec2:DescribeInternetGateways\",\r\n                \"ec2:DescribeVpcs\",\r\n                \"ec2:DescribeVpcPeeringConnections\",\r\n                \"ec2:DescribeSubnets\",\r\n                \"ec2:DescribeSecurityGroups\",\r\n                \"ec2:DescribeInstances\",\r\n                \"ec2:DescribeNetworkInterfaces\",\r\n                \"ec2:DescribeTags\",\r\n                \"ec2:GetCoipPoolUsage\",\r\n                \"ec2:DescribeCoipPools\",\r\n                \"elasticloadbalancing:DescribeLoadBalancers\",\r\n                \"elasticloadbalancing:DescribeLoadBalancerAttributes\",\r\n                \"elasticloadbalancing:DescribeListeners\",\r\n                \"elasticloadbalancing:DescribeListenerCertificates\",\r\n                \"elasticloadbalancing:DescribeSSLPolicies\",\r\n                \"elasticloadbalancing:DescribeRules\",\r\n                \"elasticloadbalancing:DescribeTargetGroups\",\r\n                \"elasticloadbalancing:DescribeTargetGroupAttributes\",\r\n                \"elasticloadbalancing:DescribeTargetHealth\",\r\n                \"elasticloadbalancing:DescribeTags\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"cognito-idp:DescribeUserPoolClient\",\r\n                \"acm:ListCertificates\",\r\n                \"acm:DescribeCertificate\",\r\n                \"iam:ListServerCertificates\",\r\n                \"iam:GetServerCertificate\",\r\n                \"waf-regional:GetWebACL\",\r\n                \"waf-regional:GetWebACLForResource\",\r\n                \"waf-regional:AssociateWebACL\",\r\n                \"waf-regional:DisassociateWebACL\",\r\n                \"wafv2:GetWebACL\",\r\n                \"wafv2:GetWebACLForResource\",\r\n                \"wafv2:AssociateWebACL\",\r\n                \"wafv2:DisassociateWebACL\",\r\n                \"shield:GetSubscriptionState\",\r\n                \"shield:DescribeProtection\",\r\n                \"shield:CreateProtection\",\r\n                \"shield:DeleteProtection\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"ec2:AuthorizeSecurityGroupIngress\",\r\n                \"ec2:RevokeSecurityGroupIngress\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"ec2:CreateSecurityGroup\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"ec2:CreateTags\"\r\n            ],\r\n            \"Resource\": \"arn:aws:ec2:*:*:security-group\/*\",\r\n            \"Condition\": {\r\n                \"StringEquals\": {\r\n                    \"ec2:CreateAction\": \"CreateSecurityGroup\"\r\n                },\r\n                \"Null\": {\r\n                    \"aws:RequestTag\/elbv2.k8s.aws\/cluster\": \"false\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"ec2:CreateTags\",\r\n                \"ec2:DeleteTags\"\r\n            ],\r\n            \"Resource\": \"arn:aws:ec2:*:*:security-group\/*\",\r\n            \"Condition\": {\r\n                \"Null\": {\r\n                    \"aws:RequestTag\/elbv2.k8s.aws\/cluster\": \"true\",\r\n                    \"aws:ResourceTag\/elbv2.k8s.aws\/cluster\": \"false\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"ec2:AuthorizeSecurityGroupIngress\",\r\n                \"ec2:RevokeSecurityGroupIngress\",\r\n                \"ec2:DeleteSecurityGroup\"\r\n            ],\r\n            \"Resource\": \"*\",\r\n            \"Condition\": {\r\n                \"Null\": {\r\n                    \"aws:ResourceTag\/elbv2.k8s.aws\/cluster\": \"false\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:CreateLoadBalancer\",\r\n                \"elasticloadbalancing:CreateTargetGroup\"\r\n            ],\r\n            \"Resource\": \"*\",\r\n            \"Condition\": {\r\n                \"Null\": {\r\n                    \"aws:RequestTag\/elbv2.k8s.aws\/cluster\": \"false\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:CreateListener\",\r\n                \"elasticloadbalancing:DeleteListener\",\r\n                \"elasticloadbalancing:CreateRule\",\r\n                \"elasticloadbalancing:DeleteRule\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:AddTags\",\r\n                \"elasticloadbalancing:RemoveTags\"\r\n            ],\r\n            \"Resource\": [\r\n                \"arn:aws:elasticloadbalancing:*:*:targetgroup\/*\/*\",\r\n                \"arn:aws:elasticloadbalancing:*:*:loadbalancer\/net\/*\/*\",\r\n                \"arn:aws:elasticloadbalancing:*:*:loadbalancer\/app\/*\/*\"\r\n            ],\r\n            \"Condition\": {\r\n                \"Null\": {\r\n                    \"aws:RequestTag\/elbv2.k8s.aws\/cluster\": \"true\",\r\n                    \"aws:ResourceTag\/elbv2.k8s.aws\/cluster\": \"false\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:AddTags\",\r\n                \"elasticloadbalancing:RemoveTags\"\r\n            ],\r\n            \"Resource\": [\r\n                \"arn:aws:elasticloadbalancing:*:*:listener\/net\/*\/*\/*\",\r\n                \"arn:aws:elasticloadbalancing:*:*:listener\/app\/*\/*\/*\",\r\n                \"arn:aws:elasticloadbalancing:*:*:listener-rule\/net\/*\/*\/*\",\r\n                \"arn:aws:elasticloadbalancing:*:*:listener-rule\/app\/*\/*\/*\"\r\n            ]\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:AddTags\"\r\n            ],\r\n            \"Resource\": [\r\n                \"arn:aws:elasticloadbalancing:*:*:targetgroup\/*\/*\",\r\n                \"arn:aws:elasticloadbalancing:*:*:loadbalancer\/net\/*\/*\",\r\n                \"arn:aws:elasticloadbalancing:*:*:loadbalancer\/app\/*\/*\"\r\n            ],\r\n            \"Condition\": {\r\n                \"StringEquals\": {\r\n                    \"elasticloadbalancing:CreateAction\": [\r\n                        \"CreateTargetGroup\",\r\n                        \"CreateLoadBalancer\"\r\n                    ]\r\n                },\r\n                \"Null\": {\r\n                    \"aws:RequestTag\/elbv2.k8s.aws\/cluster\": \"false\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:ModifyLoadBalancerAttributes\",\r\n                \"elasticloadbalancing:SetIpAddressType\",\r\n                \"elasticloadbalancing:SetSecurityGroups\",\r\n                \"elasticloadbalancing:SetSubnets\",\r\n                \"elasticloadbalancing:DeleteLoadBalancer\",\r\n                \"elasticloadbalancing:ModifyTargetGroup\",\r\n                \"elasticloadbalancing:ModifyTargetGroupAttributes\",\r\n                \"elasticloadbalancing:DeleteTargetGroup\"\r\n            ],\r\n            \"Resource\": \"*\",\r\n            \"Condition\": {\r\n                \"Null\": {\r\n                    \"aws:ResourceTag\/elbv2.k8s.aws\/cluster\": \"false\"\r\n                }\r\n            }\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:RegisterTargets\",\r\n                \"elasticloadbalancing:DeregisterTargets\"\r\n            ],\r\n            \"Resource\": \"arn:aws:elasticloadbalancing:*:*:targetgroup\/*\/*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"elasticloadbalancing:SetWebAcl\",\r\n                \"elasticloadbalancing:ModifyListener\",\r\n                \"elasticloadbalancing:AddListenerCertificates\",\r\n                \"elasticloadbalancing:RemoveListenerCertificates\",\r\n                \"elasticloadbalancing:ModifyRule\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        }\r\n    ]\r\n}\r\n<\/span><span class=\"no\">EOF\r\n<\/span><span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h2>Kubernetes\u7684ServiceAccount\u914d\u7f6e<\/h2>\n<p>\u5c06\u4e4b\u524d\u521b\u5efa\u7684IAM\u89d2\u8272\u4e0eKubernetes\u7684ServiceAccount\u8fdb\u884c\u5173\u8054\u3002<br \/>\n\u901a\u8fc7eks.amazonaws.com\/role-arn\u7684\u6ce8\u91ca\u8fdb\u884c\u5173\u8054\u3002<br \/>\n\u8bf7\u6ce8\u610f\uff0cALB\u8d1f\u8f7d\u5e73\u8861\u5668\u63a7\u5236\u5668\u7684\u547d\u540d\u7a7a\u95f4\u662fkube-system\uff0c\u800c\u4e0d\u662f\u670d\u52a1\u6240\u5728\u7684\u547d\u540d\u7a7a\u95f4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Service Account                                                              #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"kubernetes_service_account\"<\/span> <span class=\"s2\">\"awsloadbalancercontroller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">metadata<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">namespace<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kube-system\"<\/span>\r\n    <span class=\"nx\">name<\/span>      <span class=\"p\">=<\/span> <span class=\"s2\">\"aws-load-balancer-controller\"<\/span>\r\n\r\n    <span class=\"nx\">annotations<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"s2\">\"eks.amazonaws.com\/role-arn\"<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_iam_role<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_loadbalancer_controller<\/span><span class=\"p\">.<\/span><span class=\"nx\">arn<\/span>\r\n    <span class=\"p\">}<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h2>\u4f7f\u7528Helm\u6765\u542f\u52a8AWS\u8d1f\u8f7d\u5747\u8861\u5668\u63a7\u5236\u5668<\/h2>\n<p>AWS\u8d1f\u8f7d\u5747\u8861\u5668\u63a7\u5236\u5668\u4eceHelm\u521b\u5efa\u662f\u6700\u5feb\u7684\u65b9\u5f0f\u3002<br \/>\n\u6216\u8005\u8bf4\uff0c\u5355\u72ec\u5b9a\u4e49\u5b83\u76f8\u5f53\u9ebb\u70e6\uff08Manifest\u6587\u4ef6\u5927\u7ea6\u6709500\u884c\uff09\u3002<br \/>\n\u867d\u7136ServiceAccount\u53ef\u4ee5\u81ea\u52a8\u521b\u5efa\uff0c\u4f46\u4e3a\u4e86\u4e86\u89e3\u5176\u673a\u5236\uff0c\u6211\u4eec\u5c06\u5176\u8bbe\u7f6e\u4e3aFalse\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">################################################################################<\/span>\r\n<span class=\"c1\"># Helm(AWS Load Balancer Controller)                                           #<\/span>\r\n<span class=\"c1\">################################################################################<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"helm_release\"<\/span> <span class=\"s2\">\"aws_load_balancer_controller\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"nx\">kubernetes_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">awsloadbalancercontroller<\/span><span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">name<\/span>       <span class=\"p\">=<\/span> <span class=\"s2\">\"aws-load-balancer-controller\"<\/span>\r\n  <span class=\"nx\">repository<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"https:\/\/aws.github.io\/eks-charts\"<\/span>\r\n  <span class=\"nx\">chart<\/span>      <span class=\"p\">=<\/span> <span class=\"s2\">\"aws-load-balancer-controller\"<\/span>\r\n\r\n  <span class=\"nx\">namespace<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"kube-system\"<\/span>\r\n\r\n  <span class=\"nx\">wait_for_jobs<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n\r\n  <span class=\"nx\">set<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"clusterName\"<\/span> <span class=\"c1\">\/\/ EKS\u306e\u30af\u30e9\u30b9\u30bf\u540d<\/span>\r\n    <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_eks_cluster<\/span><span class=\"p\">.<\/span><span class=\"nx\">example<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"p\">}<\/span>\r\n  <span class=\"nx\">set<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"region\"<\/span> <span class=\"c1\">\/\/ EKS\u30af\u30e9\u30b9\u30bf\u3092\u8d77\u52d5\u3057\u3066\u3044\u308b\u30ea\u30fc\u30b8\u30e7\u30f3<\/span>\r\n    <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">aws_region<\/span><span class=\"p\">.<\/span><span class=\"nx\">current<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"p\">}<\/span>\r\n  <span class=\"nx\">set<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"vpcId\"<\/span> <span class=\"c1\">\/\/ EKS\u30af\u30e9\u30b9\u30bf\u3092\u8d77\u52d5\u3057\u3066\u3044\u308bVPC\u306eVPC-ID<\/span>\r\n    <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">aws_vpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">for_eks_fargate<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"p\">}<\/span>\r\n  <span class=\"nx\">set<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"serviceAccount.create\"<\/span> <span class=\"c1\">\/\/ ServiceAccount\u3092\u81ea\u52d5\u3067\u4f5c\u6210\u3059\u308b\u304b<\/span>\r\n    <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">false<\/span>\r\n  <span class=\"p\">}<\/span>\r\n  <span class=\"nx\">set<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"serviceAccount.name\"<\/span> <span class=\"c1\">\/\/ \u524d\u7bc0\u3067\u4f5c\u6210\u3057\u305fServiceAccount\u3068\u5408\u308f\u305b\u308b<\/span>\r\n    <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"aws-load-balancer-controller\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n  <span class=\"nx\">set<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"ingressClassParams.create\"<\/span> <span class=\"c1\">\/\/ IngressClass\u3092\u81ea\u52d5\u3067\u4f5c\u308b\u304b<\/span>\r\n    <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">false<\/span>\r\n  <span class=\"p\">}<\/span>\r\n  <span class=\"nx\">set<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"createIngressClassResource\"<\/span> <span class=\"c1\">\/\/ IngressClass\u3092\u81ea\u52d5\u3067\u4f5c\u308b\u304b<\/span>\r\n    <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">false<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h2>\u5c06ALB\u7eb3\u5165\u76ee\u6807\u7fa4\u4f53\u4e2d<\/h2>\n<p>\u8981\u5c06ALB\uff08Application Load Balancer\uff09\u7684\u76ee\u6807\u7ec4\u5408\u5e76\u5230\u4e00\u4e2a\u81ea\u5b9a\u4e49\u8d44\u6e90\u4e2d\uff0c\u9700\u8981\u521b\u5efa\u4e00\u4e2a\u540d\u4e3aTargetGroupBinding\u7684\u81ea\u5b9a\u4e49\u8d44\u6e90\u3002\u53ef\u4ee5\u4ece\u4ee5\u4e0bCRDS\uff08\u81ea\u5b9a\u4e49\u8d44\u6e90\u5b9a\u4e49\uff09\u7684\u6e05\u5355\u4e2d\u521b\u5efa\u8fd9\u4e2a\u8d44\u6e90\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl apply <span class=\"nt\">-k<\/span> <span class=\"s2\">\"github.com\/aws\/eks-charts\/stable\/aws-load-balancer-controller\/crds?ref=master\"<\/span>\r\n<\/code><\/pre>\n<p>\u597d\u4e86\uff0c\u73b0\u5728\u51c6\u5907\u5de5\u4f5c\u5df2\u7ecf\u5b8c\u6210\u4e86\u3002<\/p>\n<p>\u8fd9\u6b21\u6211\u4eec\u5c06\u521b\u5efa\u4ee5\u4e0b\u7684\u6e05\u5355\u6587\u4ef6\u5e76\u4f7f\u7528kubectl apply\u547d\u4ee4\u6765\u90e8\u7f72Nginx\u7684Deployment\u548cService\u8d44\u6e90\u3002\u503c\u5f97\u4e00\u63d0\u7684\u662f\uff0c\u7531\u4e8eALB\u8d1f\u8f7d\u5747\u8861\u63a7\u5236\u5668\u4ee3\u66ff\u4e86Ingress\u7684\u89d2\u8272\uff0c\u5728\u6b64\u65b9\u6cd5\u4e2d\uff0c\u4e4b\u524d\u521b\u5efa\u7684Ingress\u4e0d\u518d\u9700\u8981\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">elbv2.k8s.aws\/v1beta1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">TargetGroupBinding<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\u7d44\u307f\u8fbc\u307f\u305f\u3044\u30bf\u30fc\u30b2\u30c3\u30c8\u30b0\u30eb\u30fc\u30d7\u306e\u30bf\u30fc\u30b2\u30c3\u30c8\u30b0\u30eb\u30fc\u30d7\u540d<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Nginx\u306eDeployment, Service\u3068\u540c\u3058Namespace<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">serviceRef<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Nginx\u306eService\u3068\u540c\u3058\u540d\u524d<\/span>\r\n    <span class=\"na\">port<\/span><span class=\"pi\">:<\/span> <span class=\"m\">80<\/span>\r\n  <span class=\"na\">targetGroupARN<\/span><span class=\"pi\">:<\/span> <span class=\"s\">\u7d44\u307f\u8fbc\u307f\u305f\u3044\u30bf\u30fc\u30b2\u30c3\u30c8\u30b0\u30eb\u30fc\u30d7\u306eARN<\/span>\r\n  <span class=\"na\">targetType<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ip<\/span>\r\n<\/code><\/pre>\n<p>\u5f53\u4f60\u4f7f\u7528\u8fd9\u4e2a\u547d\u4ee4\u542f\u52a8Pod\u65f6\uff0c\u5b83\u5c06\u81ea\u52a8\u5c06\u5176\u52a0\u5165\u5230\u76ee\u6807\u7ec4\u4e2d\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9996\u5148 \u5982\u679c\u63d0\u5230\u5bb9\u5668\u7f16\u6392\u5de5\u5177\uff0c\u9664\u4e86\u516c\u5171\u4e91\u63d0\u4f9b\u5546\u63d0\u4f9b\u7684\u6258\u7ba1\u670d\u52a1\u4e4b\u5916\uff0c\u53ef\u4ee5\u8bf4 Kubernetes \u5df2\u7ecf\u57fa\u672c\u6210\u4e3a\u4e8b\u5b9e [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-35907","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09 - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5eks-on-fargate\uff08\u7b2c\u4e00\u90e8\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09\" \/>\n<meta property=\"og:description\" content=\"\u9996\u5148 \u5982\u679c\u63d0\u5230\u5bb9\u5668\u7f16\u6392\u5de5\u5177\uff0c\u9664\u4e86\u516c\u5171\u4e91\u63d0\u4f9b\u5546\u63d0\u4f9b\u7684\u6258\u7ba1\u670d\u52a1\u4e4b\u5916\uff0c\u53ef\u4ee5\u8bf4 Kubernetes \u5df2\u7ecf\u57fa\u672c\u6210\u4e3a\u4e8b\u5b9e [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5eks-on-fargate\uff08\u7b2c\u4e00\u90e8\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-20T06:06:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-29T23:50:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d261d37434c4406c363d1\/54-0.png\" \/>\n<meta name=\"author\" content=\"\u6e05, \u626c\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u6e05, \u626c\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/\",\"name\":\"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09 - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-07-20T06:06:12+00:00\",\"dateModified\":\"2024-04-29T23:50:27+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\",\"name\":\"\u6e05, \u626c\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"caption\":\"\u6e05, \u626c\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09 - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5eks-on-fargate\uff08\u7b2c\u4e00\u90e8\/","og_locale":"zh_CN","og_type":"article","og_title":"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09","og_description":"\u9996\u5148 \u5982\u679c\u63d0\u5230\u5bb9\u5668\u7f16\u6392\u5de5\u5177\uff0c\u9664\u4e86\u516c\u5171\u4e91\u63d0\u4f9b\u5546\u63d0\u4f9b\u7684\u6258\u7ba1\u670d\u52a1\u4e4b\u5916\uff0c\u53ef\u4ee5\u8bf4 Kubernetes \u5df2\u7ecf\u57fa\u672c\u6210\u4e3a\u4e8b\u5b9e [&hellip;]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5eks-on-fargate\uff08\u7b2c\u4e00\u90e8\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-07-20T06:06:12+00:00","article_modified_time":"2024-04-29T23:50:27+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d261d37434c4406c363d1\/54-0.png"}],"author":"\u6e05, \u626c","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u6e05, \u626c","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"19 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/","name":"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09 - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-07-20T06:06:12+00:00","dateModified":"2024-04-29T23:50:27+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u4ece\u4eca\u5929\u5f00\u59cb\u5b66\u4e60Kubernetes\u7684\u521d\u5b66\u8005\u53ef\u4ee5\u5c1d\u8bd5EKS on Fargate\uff08\u7b2c\u4e00\u90e8\u5206\uff1a\u53d1\u5e03\u670d\u52a1\uff09"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461","name":"\u6e05, \u626c","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","caption":"\u6e05, \u626c"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%8e%e4%bb%8a%e5%a4%a9%e5%bc%80%e5%a7%8b%e5%ad%a6%e4%b9%a0kubernetes%e7%9a%84%e5%88%9d%e5%ad%a6%e8%80%85%e5%8f%af%e4%bb%a5%e5%b0%9d%e8%af%95eks-on-fargate%ef%bc%88%e7%ac%ac%e4%b8%80%e9%83%a8\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=35907"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35907\/revisions"}],"predecessor-version":[{"id":90635,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35907\/revisions\/90635"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=35907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=35907"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=35907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}