Amazon ECS & EKS

{
  "family": "my-web-app",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "cpu": "512",
  "memory": "1024",
  "runtimePlatform": {
    "cpuArchitecture": "X86_64",
    "operatingSystemFamily": "LINUX"
  },
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123456789012:role/ecsTaskRole",
  "containerDefinitions": [
    {
      "name": "web-app",
      "image": "123456789012.dkr.ecr.ap-southeast-1.amazonaws.com/my-app:latest",
      "essential": true,
      "portMappings": [
        {
          "containerPort": 8080,
          "protocol": "tcp",
          "appProtocol": "http"
        }
      ],
      "cpu": 256,
      "memory": 512,
      "memoryReservation": 256,
      "environment": [
        { "name": "NODE_ENV", "value": "production" },
        { "name": "PORT", "value": "8080" }
      ],
      "secrets": [
        {
          "name": "DB_PASSWORD",
          "valueFrom": "arn:aws:secretsmanager:ap-southeast-1:123456789012:secret:db-pass"
        },
        {
          "name": "API_KEY",
          "valueFrom": "arn:aws:ssm:ap-southeast-1:123456789012:parameter/api-key"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/my-web-app",
          "awslogs-region": "ap-southeast-1",
          "awslogs-stream-prefix": "web"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3,
        "startPeriod": 60
      },
      "mountPoints": [
        {
          "sourceVolume": "efs-data",
          "containerPath": "/app/data",
          "readOnly": false
        }
      ]
    },
    {
      "name": "log-router",
      "image": "amazon/aws-for-fluent-bit:latest",
      "essential": false,
      "cpu": 64,
      "memory": 128,
      "firelensConfiguration": {
        "type": "fluentbit"
      }
    }
  ],
  "volumes": [
    {
      "name": "efs-data",
      "efsVolumeConfiguration": {
        "fileSystemId": "fs-0123456789abcdef0",
        "rootDirectory": "/app-data",
        "transitEncryption": "ENABLED"
      }
    }
  ]
}

{
  "serviceName": "my-web-service",
  "cluster": "production",
  "taskDefinition": "my-web-app:5",
  "desiredCount": 4,
  "launchType": "FARGATE",
  "deploymentConfiguration": {
    "minimumHealthyPercent": 50,
    "maximumPercent": 200,
    "deploymentCircuitBreaker": {
      "enable": true,
      "rollback": true
    }
  },
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "subnets": ["subnet-abc123", "subnet-def456"],
      "securityGroups": ["sg-web-app"],
      "assignPublicIp": "DISABLED"
    }
  },
  "loadBalancers": [
    {
      "targetGroupArn": "arn:aws:elasticloadbalancing:...:targetgroup/my-tg/abc123",
      "containerName": "web-app",
      "containerPort": 8080
    }
  ],
  "healthCheckGracePeriodSeconds": 120,
  "serviceConnectConfiguration": {
    "enabled": true,
    "namespace": "production",
    "services": [
      {
        "portName": "http",
        "clientAliases": [{ "port": 8080, "dnsName": "web-app" }]
      }
    ]
  }
}

# Tạo Fargate Profile qua eksctl
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: my-cluster
  region: ap-southeast-1

fargateProfiles:
  - name: fp-default
    selectors:
      - namespace: default
        labels:
          compute: fargate
      - namespace: staging
    # Pods trong namespace "default" có label compute=fargate
    # HOẶC tất cả pods trong namespace "staging"
    # → sẽ chạy trên Fargate

  - name: fp-coredns
    selectors:
      - namespace: kube-system
        labels:
          k8s-app: kube-dns
    # CoreDNS cũng có thể chạy trên Fargate

aws eks create-fargate-profile \
  --cluster-name my-cluster \
  --fargate-profile-name fp-default \
  --pod-execution-role-arn arn:aws:iam::123456789012:role/eksFargatePodRole \
  --subnets subnet-abc123 subnet-def456 \
  --selectors namespace=default,labels={compute=fargate}

# Kiểm tra VPC CNI version
kubectl describe daemonset aws-node -n kube-system | grep Image

# Xem IP allocation trên node
kubectl get nodes -o wide

# Bật prefix delegation để tăng pod density
kubectl set env daemonset aws-node -n kube-system \
  ENABLE_PREFIX_DELEGATION=true \
  WARM_PREFIX_TARGET=1

{
  "serviceConnectConfiguration": {
    "enabled": true,
    "namespace": "production",
    "services": [
      {
        "portName": "http",
        "discoveryName": "api-service",
        "clientAliases": [
          { "port": 8080, "dnsName": "api-service" }
        ]
      }
    ],
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "/ecs/service-connect-proxy",
        "awslogs-region": "ap-southeast-1",
        "awslogs-stream-prefix": "proxy"
      }
    }
  }
}
// Các service khác gọi: http://api-service:8080

{
  "volumes": [
    {
      "name": "shared-data",
      "efsVolumeConfiguration": {
        "fileSystemId": "fs-0123456789abcdef0",
        "rootDirectory": "/",
        "transitEncryption": "ENABLED",
        "transitEncryptionPort": 2049,
        "authorizationConfig": {
          "accessPointId": "fsap-0123456789abcdef0",
          "iam": "ENABLED"
        }
      }
    }
  ],
  "containerDefinitions": [
    {
      "name": "app",
      "mountPoints": [
        {
          "sourceVolume": "shared-data",
          "containerPath": "/mnt/efs",
          "readOnly": false
        }
      ]
    }
  ]
}

# Cài đặt EBS CSI Driver (EKS Add-on)
aws eks create-addon \
  --cluster-name my-cluster \
  --addon-name aws-ebs-csi-driver \
  --service-account-role-arn arn:aws:iam::123456789012:role/EBS_CSI_DriverRole

---
# StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ebs-gp3
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  iops: "3000"
  throughput: "125"
  encrypted: "true"
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Delete

---
# PersistentVolumeClaim
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: app-data
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: ebs-gp3
  resources:
    requests:
      storage: 50Gi

# Đăng ký scalable target
aws application-autoscaling register-scalable-target \
  --service-namespace ecs \
  --resource-id service/production/my-web-service \
  --scalable-dimension ecs:service:DesiredCount \
  --min-capacity 2 \
  --max-capacity 20

# Target Tracking — CPU 70%
aws application-autoscaling put-scaling-policy \
  --service-namespace ecs \
  --resource-id service/production/my-web-service \
  --scalable-dimension ecs:service:DesiredCount \
  --policy-name cpu-target-tracking \
  --policy-type TargetTrackingScaling \
  --target-tracking-scaling-policy-configuration '{
    "TargetValue": 70.0,
    "PredefinedMetricSpecification": {
      "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
    },
    "ScaleInCooldown": 300,
    "ScaleOutCooldown": 60
  }'

# Tạo Capacity Provider
aws ecs create-capacity-provider \
  --name my-cp \
  --auto-scaling-group-provider '{
    "autoScalingGroupArn": "arn:aws:autoscaling:...:autoScalingGroup:...",
    "managedScaling": {
      "status": "ENABLED",
      "targetCapacity": 80,
      "minimumScalingStepSize": 1,
      "maximumScalingStepSize": 10
    },
    "managedTerminationProtection": "ENABLED"
  }'

# Gán Capacity Provider vào Cluster
aws ecs put-cluster-capacity-providers \
  --cluster production \
  --capacity-providers my-cp FARGATE FARGATE_SPOT \
  --default-capacity-provider-strategy '[
    {"capacityProvider": "my-cp", "weight": 1, "base": 2},
    {"capacityProvider": "FARGATE_SPOT", "weight": 1}
  ]'

apiVersion: karpenter.sh/v1beta1
kind: NodePool
metadata:
  name: default
spec:
  template:
    spec:
      requirements:
        - key: kubernetes.io/arch
          operator: In
          values: ["amd64", "arm64"]
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["spot", "on-demand"]
        - key: karpenter.k8s.aws/instance-category
          operator: In
          values: ["c", "m", "r"]
        - key: karpenter.k8s.aws/instance-generation
          operator: Gt
          values: ["5"]
      nodeClassRef:
        name: default
  limits:
    cpu: "100"
    memory: 400Gi
  disruption:
    consolidationPolicy: WhenUnderutilized
    expireAfter: 720h  # 30 ngày

---
apiVersion: karpenter.k8s.aws/v1beta1
kind: EC2NodeClass
metadata:
  name: default
spec:
  amiFamily: AL2
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: my-cluster
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: my-cluster

# 1. Tạo OIDC Provider cho cluster
eksctl utils associate-iam-oidc-provider \
  --cluster my-cluster --approve

# 2. Tạo IAM Role + Service Account
eksctl create iamserviceaccount \
  --cluster my-cluster \
  --namespace default \
  --name my-app-sa \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
  --approve

# 3. Sử dụng trong Pod spec
# serviceAccountName: my-app-sa

# Cài EKS Pod Identity Agent add-on
aws eks create-addon \
  --cluster-name my-cluster \
  --addon-name eks-pod-identity-agent

# Tạo Pod Identity Association
aws eks create-pod-identity-association \
  --cluster-name my-cluster \
  --namespace default \
  --service-account my-app-sa \
  --role-arn arn:aws:iam::123456789012:role/my-app-role

# Login vào ECR
aws ecr get-login-password --region ap-southeast-1 | \
  docker login --username AWS --password-stdin \
  123456789012.dkr.ecr.ap-southeast-1.amazonaws.com

# Build và push
docker build -t my-app:v1.0 .
docker tag my-app:v1.0 123456789012.dkr.ecr.ap-southeast-1.amazonaws.com/my-app:v1.0
docker push 123456789012.dkr.ecr.ap-southeast-1.amazonaws.com/my-app:v1.0

# Bật image scanning
aws ecr put-image-scanning-configuration \
  --repository-name my-app \
  --image-scanning-configuration scanOnPush=true

# Bật Container Insights khi tạo cluster
aws ecs create-cluster \
  --cluster-name production \
  --settings name=containerInsights,value=enabled

# Hoặc update cluster hiện có
aws ecs update-cluster-settings \
  --cluster production \
  --settings name=containerInsights,value=enabled

# Log configuration trong task definition
"logConfiguration": {
  "logDriver": "awslogs",
  "options": {
    "awslogs-group": "/ecs/my-app",
    "awslogs-region": "ap-southeast-1",
    "awslogs-stream-prefix": "app",
    "awslogs-create-group": "true"
  }
}

# Cài đặt qua Helm
helm repo add prometheus-community \
  https://prometheus-community.github.io/helm-charts
helm repo update

# Cài kube-prometheus-stack (Prometheus + Grafana + AlertManager)
helm install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace \
  --set grafana.adminPassword=your-password \
  --set prometheus.prometheusSpec.retention=30d \
  --set prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage=50Gi

# Hoặc dùng Amazon Managed Prometheus (AMP)
aws amp create-workspace --alias my-prometheus

# Và Amazon Managed Grafana (AMG)
# → Cấu hình qua AWS Console

// Trong task definition — thêm FireLens container
{
  "name": "log-router",
  "image": "amazon/aws-for-fluent-bit:stable",
  "essential": true,
  "firelensConfiguration": {
    "type": "fluentbit",
    "options": {
      "config-file-type": "file",
      "config-file-value": "/fluent-bit/configs/custom.conf"
    }
  }
}

// App container — gửi logs qua FireLens
{
  "name": "app",
  "logConfiguration": {
    "logDriver": "awsfirelens",
    "options": {
      "Name": "cloudwatch_logs",
      "region": "ap-southeast-1",
      "log_group_name": "/ecs/my-app",
      "log_stream_prefix": "app-",
      "auto_create_group": "true"
    }
  }
}

# ═══ CLUSTER ═══
# Tạo cluster
aws ecs create-cluster --cluster-name production \
  --settings name=containerInsights,value=enabled

# Liệt kê clusters
aws ecs list-clusters

# Xem chi tiết cluster
aws ecs describe-clusters --clusters production \
  --include STATISTICS ATTACHMENTS

# Xóa cluster
aws ecs delete-cluster --cluster production

# ═══ TASK DEFINITION ═══
# Đăng ký task definition
aws ecs register-task-definition --cli-input-json file://task-def.json

# Liệt kê task definitions
aws ecs list-task-definitions --family-prefix my-web-app

# Xem chi tiết
aws ecs describe-task-definition --task-definition my-web-app:5

# Deregister (không xóa, chỉ đánh dấu INACTIVE)
aws ecs deregister-task-definition --task-definition my-web-app:3

# ═══ RUN TASK (standalone) ═══
aws ecs run-task \
  --cluster production \
  --task-definition my-batch-job:1 \
  --launch-type FARGATE \
  --network-configuration '{
    "awsvpcConfiguration": {
      "subnets": ["subnet-abc123"],
      "securityGroups": ["sg-batch"],
      "assignPublicIp": "DISABLED"
    }
  }'

# Dừng task
aws ecs stop-task --cluster production --task arn:aws:ecs:...:task/abc123

# Liệt kê tasks đang chạy
aws ecs list-tasks --cluster production --service-name my-web-service

# ═══ SERVICE ═══
# Tạo service
aws ecs create-service --cli-input-json file://service.json

# Update service (deploy new task definition)
aws ecs update-service \
  --cluster production \
  --service my-web-service \
  --task-definition my-web-app:6 \
  --force-new-deployment

# Scale service
aws ecs update-service \
  --cluster production \
  --service my-web-service \
  --desired-count 8

# Xem events (troubleshooting)
aws ecs describe-services \
  --cluster production \
  --services my-web-service \
  --query 'services[0].events[:10]'

# Xóa service (phải set desired-count = 0 trước)
aws ecs update-service --cluster production --service my-web-service --desired-count 0
aws ecs delete-service --cluster production --service my-web-service

# Bật ECS Exec cho service
aws ecs update-service \
  --cluster production \
  --service my-web-service \
  --enable-execute-command

# SSH vào container đang chạy
aws ecs execute-command \
  --cluster production \
  --task arn:aws:ecs:...:task/abc123 \
  --container web-app \
  --interactive \
  --command "/bin/sh"

# Login
aws ecr get-login-password --region ap-southeast-1 | \
  docker login --username AWS --password-stdin \
  123456789012.dkr.ecr.ap-southeast-1.amazonaws.com

# Tạo repository
aws ecr create-repository --repository-name my-app \
  --image-scanning-configuration scanOnPush=true \
  --encryption-configuration encryptionType=AES256

# Liệt kê images
aws ecr list-images --repository-name my-app

# Xem scan results
aws ecr describe-image-scan-findings \
  --repository-name my-app \
  --image-id imageTag=v1.0

# Lifecycle policy — giữ 10 images mới nhất
aws ecr put-lifecycle-policy --repository-name my-app \
  --lifecycle-policy-text '{
    "rules": [{
      "rulePriority": 1,
      "description": "Keep last 10 images",
      "selection": {
        "tagStatus": "any",
        "countType": "imageCountMoreThan",
        "countNumber": 10
      },
      "action": { "type": "expire" }
    }]
  }'

# ═══ CLUSTER ═══
# Tạo cluster với eksctl
eksctl create cluster \
  --name my-cluster \
  --region ap-southeast-1 \
  --version 1.29 \
  --nodegroup-name workers \
  --node-type t3.medium \
  --nodes 3 \
  --nodes-min 2 \
  --nodes-max 10 \
  --managed

# Cấu hình kubectl
aws eks update-kubeconfig --name my-cluster --region ap-southeast-1

# Kiểm tra kết nối
kubectl cluster-info
kubectl get nodes

# Xem EKS add-ons
aws eks list-addons --cluster-name my-cluster

# ═══ DEPLOYMENTS ═══
# Tạo deployment
kubectl create deployment nginx --image=nginx:1.25 --replicas=3

# Apply từ file YAML
kubectl apply -f deployment.yaml

# Scale
kubectl scale deployment nginx --replicas=5

# Rolling update
kubectl set image deployment/nginx nginx=nginx:1.26

# Xem rollout status
kubectl rollout status deployment/nginx

# Rollback
kubectl rollout undo deployment/nginx
kubectl rollout undo deployment/nginx --to-revision=2

# Xem history
kubectl rollout history deployment/nginx

# ═══ PODS ═══
# Liệt kê pods
kubectl get pods -o wide
kubectl get pods --all-namespaces

# Xem chi tiết pod
kubectl describe pod pod-name

# Xem logs
kubectl logs pod-name
kubectl logs pod-name -c container-name  # multi-container
kubectl logs pod-name --previous          # previous crash
kubectl logs -f pod-name                  # follow/stream

# Exec vào pod
kubectl exec -it pod-name -- /bin/sh

# Port forward
kubectl port-forward pod-name 8080:80
kubectl port-forward svc/my-service 8080:80

# ═══ SERVICES ═══
# Expose deployment
kubectl expose deployment nginx --port=80 --type=LoadBalancer

# Liệt kê services
kubectl get svc

# ═══ DEBUG ═══
# Xem events
kubectl get events --sort-by='.lastTimestamp'

# Top (resource usage)
kubectl top nodes
kubectl top pods

# Xem resource quotas
kubectl describe resourcequota -n my-namespace

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: my-app
    spec:
      serviceAccountName: my-app-sa
      containers:
        - name: app
          image: 123456789012.dkr.ecr.ap-southeast-1.amazonaws.com/my-app:v1.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          env:
            - name: NODE_ENV
              value: production
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: password
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: my-app

---
apiVersion: v1
kind: Service
metadata:
  name: my-app
  namespace: production
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: external
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP

---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80