avoidik

import "sockaddr"
import "strings"

#
# allow update secrets under secret/ path only to clients coming from 10.0.0.0/8 CIDR range
#

precond = rule {
    request.operation in ["update"] and
    strings.has_prefix(request.path, "secret/")

avoidik

conky.config = {
    alignment = 'top_right',
    background = false,
    border_width = 1,
    cpu_avg_samples = 2,
    default_color = 'white',
    default_outline_color = 'white',
    default_shade_color = 'white',
    draw_borders = false,
    draw_graph_borders = true,

avoidik

Prepare two K8s clusters

Context east

Create cluster on GCP

$ gcloud container clusters create multi-cluster-demo --preemptible

avoidik

How to install & configure ECR credentials helper

Download

$ sudo curl -fsSL https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login -o /usr/local/bin/docker-credential-ecr-login
$ sudo chmod +x /usr/local/bin/docker-credential-ecr-login

Configure

avoidik

DEFAULT_BOX  = 'ubuntu/focal64'
WORKER_NODES = 2

Vagrant.configure(2) do |config|
  config.vm.define 'master' do |master|
    master.vm.box = DEFAULT_BOX
    master.vm.hostname = 'master'
    master.vm.synced_folder '.', '/vagrant', type: 'virtualbox'
    master.vm.network 'private_network', ip: '192.168.0.200'
    master.vm.provider 'virtualbox' do |v|

avoidik

ECS Best Practices

• Understand and check Service Quota of ECS/Fargate and other related services
• Cluster
  • Use IaC for setting up resources eg. CloudFormation, AWS CDK, Terraform
    • Use copilot for simple setup
    • CloudFormation reference architecture template
      • https://github.com/nathanpeck/ecs-cloudformation
      • https://github.com/awslabs/aws-cloudformation-templates/tree/master/aws/services/ECS
• CDK for ECS: blog

avoidik

Please check https://aws.github.io/aws-eks-best-practices/ for more comprehensive EKS best practice!

Architecture

• Think about multi-tenancy, isolation for different environment or different workload
  • Isolation at account level using AWS organization
  • Isolation at the network layer ie. different VPC & different cluster
  • Use different Nodes Group (Node pool) for different purpose/category e.g. create dedicated node groups for Operational tools such as CI/CD tool, Monitoring tool, Centralize logging system.
  • Separate namespace for different workload

Reliability | Principles

avoidik

How to deploy Functionbeat on AWS

These notes are supplementing my another guide about Minimal Elastic monitoring stack

Forward Kibana port

We need session-manager plugin and AWS CLI packages installed:

• https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html
• https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html

avoidik

Minimal Elastic monitoring stack

You may use t3.medium AWS EC2 instance to run this stack.

Install docker runtime

$ sudo curl -fsSL https://get.docker.com -o get-docker.sh
$ sudo sh get-docker.sh
$ sudo usermod -a -G docker $USER

avoidik

# Generic, basic /usr/local/etc/telegraf.conf file for FreeBSD
# Gathers some basic metrics and transmits them to cloudwatch
# Be sure to set the region below

[agent]
  interval = "10s"
  round_interval = true
  metric_batch_size = 1000
  metric_buffer_limit = 10000
  collection_jitter = "0s"