DEV Community: ahn4

Apply Kubernetes resources to AWS EKS Cluster - Bitbucket Pipeline

ahn4 — Mon, 11 Jul 2022 02:16:03 +0000

Apply k8s Deployment.

Official

We'll use this one in the pipeline.

The following is needed.

AWS IAM.
Role/ClusterRole and Binding.

AWS IAM

Simply create one of User. This user will not access to Console. We configure this user's key and token to BitBucket.

The user should have the following policy at least.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eks:DescribeCluster"
            ],
            "Resource": "*"
        }
    ]
}

Role/ClusterRole and Binding.

2 Resources are needed to be applied.

ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: bitbucket-cicd
rules:
- apiGroups:
  - ""
  resources:
  - nodes
  - pods
  - services
  verbs:
  - get
  - list
  - update
  - patch
- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - statefulsets
  - replicasets
  verbs:
  - get
  - list
  - update
  - patch
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - get
  - list
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: bitbucket-cicd-binding
subjects:
- kind: Group
  name: bitbucket-group
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: bitbucket-cicd
  apiGroup: rbac.authorization.k8s.io

apiGroups: apiVersion is specified when we create k8s manifest. apiGroups is string up to the first slash in this version. The version should be ignored. If group name was v1 only for example, apiGroups will be empty string, We can get all of api groups, use the command kubectl api-resources.

verbes: All of verbes are here.

ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: bitbucket-cicd-binding
subjects:
- kind: Group
  name: bitbucket-group
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: bitbucket-cicd
  apiGroup: rbac.authorization.k8s.io

subjects

Specify User, Group, or ServiceAccount to which the role is tied in this field.

kind: Will be User / Group / ServiceAccount.

name: Resource name of the kind.

Edit `aws-auth`

Map ClusterRoleBinding and IAM User.

kubectl edit -n kube-system configmap/aws-auth

Mapping data will be like this...

apiVersion: v1
data:
  mapAccounts: |
    []  
  mapRoles: |
    - "userarn": "arn:aws:iam::{account id}:user/{IAM name}"
      "username": "bitbucket-cicd-user" # Name you like
      "groups":
      - "bitbucket-group" # Group name you specified in ClusterRoleBinding
-- omit.....

[ECS] Service launch Error - "the role being passed has the proper trust relationship and permissions"?

ahn4 — Sat, 25 Jun 2022 13:17:48 +0000

Error

I got the following error when applied terraform.

service xxxxx failed to launch a task with (error ECS was unable to assume the role 'xxxxx' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.).

How to fix

Added the assign_public_ip in terraform

resource "aws_ecs_service" "ecs" {
  name = var.ecs_service_name
  cluster = var.ecs_cluster_name
  launch_type = "FARGATE"
  desired_count = "1"
  task_definition = xxxxx

  network_configuration {
    subnets         = [xxxxx]
    security_groups = [xxxxx]

    # NEW
    assign_public_ip = true
  }
}

Push Docker Image to AWS ECR - Bitbucket Pipeline

ahn4 — Tue, 05 Apr 2022 01:54:39 +0000

We'll do the following

Create Bitbucket repository
Push Docker image to ECR from Bitbucket
Configure Bitbucket pipeline.

Create Bitbucket repository

1: Created ssh key.



ssh-keygen -t rsa -C aaa@example.com

2: Add pub key to bitbucket.

3: set remote but... password is needed?



git remote add origin git@bitbucket.org:xxx/yyy.git
git push origin master

Password for 'https://aaa@bitbucket.org': 
# ????

4: Get remote URL



git config --get remote.origin.url

https://aaa@bitbucket.org/bbb/ccc.git

5: This should not be https... should be git.



git remote set-url origin git@bitbucket.org:xxxx/yyyy.git

error..

6: Specify ssh key

https://qiita.com/sonots/items/826b90b085f294f93acf

Push Docker image to ECR from Bitbucket

We have to create the IAM Role of OIDC.

Get identity provider of Bitbucket.

You can get the information from Bitbucket.

{Your repository settings} > Pipelines > OpenID Connect

Get the following.

Identity provider URL
Audience

AWS IAM Setting.

Create provider

Go to IAM > Identity providers > Add provider.
Fill in Identity provider URL and Audience.

Create policy



{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GetAuthorizationToken",
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowPushImage",
            "Effect": "Allow",
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload",
                "ecr:PutImage"
            ],
            "Resource": "arn:aws:ecr:ap-northeast-1:{AWS Account ID}:repository/*"
        }
    ]
}

Create role

Go to IAM > Role > Create role.
Select Web identity.
Select Identity provider URL and Audience created by previous step.
Choose policy created in previous step.

Configure bitbucket pipeline.

Official

Minimum configuration



image: atlassian/default-image:2

definitions:
  script: &ecrScript
    - docker build -t $REPO_NAME .
    - pipe: atlassian/aws-ecr-push-image:1.5.0
      variables:
        AWS_OIDC_ROLE_ARN: $OIDC_ROLE_ARN
        IMAGE_NAME: $IMAGE_NAME
        TAGS: "${BITBUCKET_TAG} build-$BITBUCKET_BUILD_NUMBER latest"

pipelines:
  custom:
    build-custom:
      - step:
          name: Deploy to ECR
          services:
            - docker
          oidc: true
          script: *ecrScript

NOTE

AWS_DEFAULT_REGION must be configured as Variable. Otherwise we will get the error ValueError: Invalid endpoint: https://api.ecr..amazonaws.com. Please check official document.

Kubernetes - Problem related to M1 chip Mac

ahn4 — Thu, 24 Mar 2022 16:35:55 +0000

What happened

standard_init_linux.go:228: exec user process caused: exec format error

When

When I Apply Deployment.

Why

Docker image created by M1 Chip didn't work properly.

How to resolve

# it will not work
docker build -t {tag name} .

# it will work.
docker build --platform=linux/amd64 -t {tag name} .