DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

DevOps Lab: CI/CD Deployment to AWS ECS

#aws #devops #cicd #github

Scenario

You are the DevOps Engineer.

Jules is your Software Developer.

Ask Jules to create a professional website for a product of your choice. Jules is responsible for application development. You are responsible for the entire DevOps lifecycle.

The final result must be:

https://yourdomain.com
Enter fullscreen mode Exit fullscreen mode

The browser must display the name of your product.

Part 1 — Application Development

Jules acts as the developer.

The application must have:

Professional homepage
Product name
Multiple sections
Responsive design
Working application
Enter fullscreen mode Exit fullscreen mode

Application code must eventually be stored in your own GitHub repository.

Architecture begins:

Jules
  ↓
Application Code
  ↓
GitHub Repository
Enter fullscreen mode Exit fullscreen mode

Part 2 — AWS Infrastructure

Create a production-style AWS environment.

VPC
10.0.0.0/16

├── Public Subnet — us-east-1a
├── Public Subnet — us-east-1b
│
├── Private Subnet — us-east-1a
└── Private Subnet — us-east-1b
Enter fullscreen mode Exit fullscreen mode

The architecture must support:

Internet
    ↓
Internet Gateway
    ↓
Application Load Balancer
    ↓
Public Subnets
    ↓
Target Group
    ↓
ECS
    ↓
Private Subnets
Enter fullscreen mode Exit fullscreen mode

Private workloads must have appropriate outbound connectivity.

Create:

VPC
Public/private subnets
Route tables
Internet Gateway
NAT/outbound connectivity
Security groups
ECR repository
ECS cluster
ECS task definition
ECS service
Target group
Application Load Balancer
Enter fullscreen mode Exit fullscreen mode

Part 3 — Continuous Integration (CI)

CI starts when application code changes.

Use GitHub Actions for Continuous Integration.

Developer
    ↓
git push
    ↓
GitHub
    ↓
GitHub Actions

Checkout
    ↓
Install Dependencies
    ↓
Test
    ↓
SonarQube
    ↓
Docker Build
    ↓
Trivy Scan
    ↓
Authenticate to AWS
    ↓
Push Docker Image
    ↓
Amazon ECR
Enter fullscreen mode Exit fullscreen mode

CI responsibility

CI answers:

Is this application safe and ready to deploy?

The CI pipeline must perform:

Source code checkout

Dependency installation

Application tests

SonarQube code-quality analysis

Docker image build

Trivy vulnerability scanning

Docker image tagging

AWS authentication

ECR authentication

Push image to ECR
Enter fullscreen mode Exit fullscreen mode

Use versioned/immutable image tags such as:

product-name:a83fd91
Enter fullscreen mode Exit fullscreen mode

or:

product-name:v1.0.0
Enter fullscreen mode Exit fullscreen mode

Do not depend only on:

latest
Enter fullscreen mode Exit fullscreen mode

CI finishes here 

GitHub
   ↓
GitHub Actions
   ↓
SonarQube
   ↓
Docker
   ↓
Trivy
   ↓
ECR
Enter fullscreen mode Exit fullscreen mode

Do not deploy to ECS inside the CI section.

Part 4 — Continuous Deployment (CD)

CD begins after a validated container image exists in ECR.

Use Jenkins for Continuous Deployment.

Amazon ECR
     ↓
Jenkins CD Pipeline
     ↓
New ECS Task Definition Revision
     ↓
ECS Service Update
     ↓
ECS Rolling Deployment
     ↓
Target Group Health Check
     ↓
Application Load Balancer
Enter fullscreen mode Exit fullscreen mode

CD responsibility

CD answers:

How do we safely release the approved application to the environment?

The Jenkins deployment should use the specific image produced by CI.

For example:

ECR

product-name:a83fd91
        ↓
Jenkins
        ↓
ECS Task Definition :7
        ↓
ECS Service
        ↓
Rolling Deployment
Enter fullscreen mode Exit fullscreen mode

During deployment, observe:

OLD VERSION

Task 1 → v1
Task 2 → v1


DEPLOYMENT STARTS

Task 1 → v1
Task 2 → v1
Task 3 → v2


HEALTH CHECK PASSES

Task 1 → v2
Task 2 → v2


OLD TASKS TERMINATED
Enter fullscreen mode Exit fullscreen mode

Students must observe the deployment instead of simply clicking Update and considering the lab finished.

Part 5 — ALB

The Application Load Balancer must be Internet-facing.

ALB:

Public Subnet 1A
+
Public Subnet 1B
Enter fullscreen mode Exit fullscreen mode

ECS:

Private Subnet 1A
+
Private Subnet 1B
Enter fullscreen mode Exit fullscreen mode

Traffic:

Customer
   ↓
ALB
   ↓
Listener
   ↓
Target Group
   ↓
ECS Service
   ↓
Container
Enter fullscreen mode Exit fullscreen mode

The target group must report:

Healthy
Enter fullscreen mode Exit fullscreen mode

Part 6 — Domain and HTTPS

Configure:

Domain
   ↓
DNS
   ↓
ALB
Enter fullscreen mode Exit fullscreen mode

Request/configure an SSL/TLS certificate and configure the ALB HTTPS listener.

Final traffic:

https://yourdomain.com
          ↓
        DNS
          ↓
       ALB :443
          ↓
     Target Group
          ↓
     ECS Service
          ↓
      Container
Enter fullscreen mode Exit fullscreen mode

The browser must show a valid HTTPS connection and display your product name.

Final Architecture 

                    DEVELOPER
                       │
                     Jules
                       │
                       ▼
                     GitHub
                       │
             ┌─────────▼─────────┐
             │       CI          │
             │  GitHub Actions   │
             └─────────┬─────────┘
                       │
                  SonarQube
                       │
                  Docker Build
                       │
                   Trivy Scan
                       │
                       ▼
                     ECR
                       │
            CI ENDS ───┼─── CD STARTS
                       │
                       ▼
                    Jenkins
                       │
                       ▼
               ECS Task Revision
                       │
                       ▼
                 ECS Service
                 Private Subnets
                       │
                       ▼
                  Target Group
                       │
                       ▼
                       ALB
                  Public Subnets
                       │
                       ▼
                   HTTPS :443
                       │
                       ▼
                     Domain
                       │
                       ▼
                    Customer
Enter fullscreen mode Exit fullscreen mode

Lab is successful when 

CI
GitHub push triggers GitHub Actions
SonarQube analysis passes
Docker image builds
Trivy scans the image
Versioned image reaches ECR

CD
Jenkins deploys the ECR image
New ECS task definition revision is created
ECS performs a rolling deployment
New tasks become healthy
Old tasks terminate
Target group reports healthy

PRODUCTION
ALB is public
ECS workload is private
Domain points to ALB
HTTPS works
https://yourdomain.com opens successfully
Product name appears in the browser
Enter fullscreen mode Exit fullscreen mode

The most important boundary for students to understand is:

CI = Code → tested/scanned container image in ECR

CD = ECR image → running application in ECS → ALB → HTTPS → customer.

Top comments (0)