4 ms·

I happened to catch this on the Github daily trending list a week or so back, really cool. For similar tools (though this one is ECS + Fargate), also see: htt

I happened to catch this on the Github daily trending list a week or so back, really cool. For similar tools (though this one is ECS + Fargate), also see: https://somanymachines.com/fargate https://somanymachines.com/fargate https://github.com/awslabs/fargatecli https://github.com/awslabs/fargatecli I'm pretty particular to Pulumi, and defining infra in typed programming languages with full IDE tooling. AWS CDK is the AWS-centric equivalent, and that's a great and under-represented tool as well IMO. https://www.pulumi.com/containers/ https://www.pulumi.com/containers/ https://docs.aws.amazon.com/cdk/latest/guide/home.html https://docs.aws.amazon.com/cdk/latest/guide/home.html My issue with ECS/Fargate is that on the surface, it seems amazing. And so you deploy your container, and that's relatively easy. But now you have just a container on HTTP, on a bare IP. You probably want HTTPS and a domain name attached. So then you learn that you need to: - Create a Route53 hosted zone for the domain - Use AWS Cert Manager to provision certificates for the domain - Create a load balancer, and figure out how to attach it to the ECS/Fargate service - Wire up the LB address to the record set and configure the termination for HTTPS And to do something like change an environment variable, you have to create an entirely new "task definition", deploy the task revision, and then spin up the new service and stop the old one. This takes about 5 not-particularly-easy to find or navigate screens in the AWS console. This is what it ended up looking like, for me to deploy a Fargate service: https://gist.github.com/GavinRay97/fbedfb18fe852bf625451a4175695ad4#file-hasura-fargate-https-alb-route53-cert-pulumi-ts https://gist.github.com/GavinRay97/fbedfb18fe852bf625451a417... It's great that these tools can help reduce the burden of doing this but man is it a painful experience if you're not a wizard at DevOps. Google Cloud Run is 1-2 bash commands to deploy a containerized app on HTTPS.

kohidavez 6y ago
Copilot can also help set up HTTPS/ACM Certs/Subdomains: https://github.com/aws/copilot-cli/wiki/Applications#additional-app-configurations https://github.com/aws/copilot-cli/wiki/Applications#additio... I love the cloudrun style service too - but one thing I think is cool about running on ECS/Fargate is that once you outgrow the constraints of CloudRun style services - you can drop down to the more granular infrastructure to make tweaks and adjustments. Just my 2c :)
- gavinray 6y ago
  > Copilot can also help set up HTTPS/ACM Certs/Subdomains Oh yeah for sure! I was really excited about this for that reason when I found it because of recent Fargate pains. The irrational part of me just wishes that the "magic" from tools that AWS publishes like Copilot, Cloud Development Kit, Fargate CLI, etc could abstract it away in more of my interactions with AWS ;^) > once you outgrow the constraints of CloudRun style services - you can drop down to the more granular infrastructure to make tweaks and adjustments. Definitely, you're trading convenience for flexibility with Cloud Run vs Fargate. Cloud Run also doesn't support websocket traffic yet ( RIP =/ ). I'm a massive fanboy of Serverless Containers and think they're the best thing since sliced bread. I run services on both AWS and GCP, and think Cloud Run and Fargate are both solid. My takeaway with AWS I guess is: Don't interact with provisioning/managing infra raw, use the CDK or other tooling you publish haha.
  - phamilton 6y ago
    > Don't interact with provisioning/managing infra raw, use the CDK or other tooling you publish haha. I've moved pretty much all my sandbox exploration to CDK. A one-shot destroy when I'm done to clean everything up is great. I also appreciate the documented types in Typescript. But beyond that, I've found that there's really no easy way to manage permissions manually. Doing ` bucket.grantRead(service.taskDefinition.taskRole);` is so much simpler than any of the policy generators in the aws console.
verisimilidude 6y ago
I believe it's possible to write the ECS task definition as a JSON file, include environment variables, commit it to a repo, then use AWS CodeDeploy/CodePipeline to update ECS with a new task revision whenever the repo changes... ...which kinda proves your point. This stuff is not well documented and it's ever more complexity.
xfitm3 6y ago
Initial infrastructure setup may take a few extra steps but what really disappoints me about the Fargate platform is lack of inspection capability. Quite often I want to strace, tcpdump, etc. Cloudwatch logs is a little anemic. Want to see an adjacent line in a log search? Good luck.
cs02rm0 6y ago
It's nice that AWS services tend to do one thing. But it does sometimes mean that there's always just one more AWS service you need. One more service with a different web console UI, varied support in the different infrastructure tools... and now we have another one of those. All I seem to do these days is AWS infrastructure, sometimes as code. I'm not sure one more new tool is going to improve that.

kohidavez 6y ago

Copilot can also help set up HTTPS/ACM Certs/Subdomains: https://github.com/aws/copilot-cli/wiki/Applications#additional-app-configurations https://github.com/aws/copilot-cli/wiki/Applications#additio... I love the cloudrun style service too - but one thing I think is cool about running on ECS/Fargate is that once you outgrow the constraints of CloudRun style services - you can drop down to the more granular infrastructure to make tweaks and adjustments. Just my 2c :)

gavinray 6y ago
> Copilot can also help set up HTTPS/ACM Certs/Subdomains Oh yeah for sure! I was really excited about this for that reason when I found it because of recent Fargate pains. The irrational part of me just wishes that the "magic" from tools that AWS publishes like Copilot, Cloud Development Kit, Fargate CLI, etc could abstract it away in more of my interactions with AWS ;^) > once you outgrow the constraints of CloudRun style services - you can drop down to the more granular infrastructure to make tweaks and adjustments. Definitely, you're trading convenience for flexibility with Cloud Run vs Fargate. Cloud Run also doesn't support websocket traffic yet ( RIP =/ ). I'm a massive fanboy of Serverless Containers and think they're the best thing since sliced bread. I run services on both AWS and GCP, and think Cloud Run and Fargate are both solid. My takeaway with AWS I guess is: Don't interact with provisioning/managing infra raw, use the CDK or other tooling you publish haha.
- phamilton 6y ago
  > Don't interact with provisioning/managing infra raw, use the CDK or other tooling you publish haha. I've moved pretty much all my sandbox exploration to CDK. A one-shot destroy when I'm done to clean everything up is great. I also appreciate the documented types in Typescript. But beyond that, I've found that there's really no easy way to manage permissions manually. Doing ` bucket.grantRead(service.taskDefinition.taskRole);` is so much simpler than any of the policy generators in the aws console.

verisimilidude 6y ago

I believe it's possible to write the ECS task definition as a JSON file, include environment variables, commit it to a repo, then use AWS CodeDeploy/CodePipeline to update ECS with a new task revision whenever the repo changes... ...which kinda proves your point. This stuff is not well documented and it's ever more complexity.

xfitm3 6y ago

Initial infrastructure setup may take a few extra steps but what really disappoints me about the Fargate platform is lack of inspection capability. Quite often I want to strace, tcpdump, etc. Cloudwatch logs is a little anemic. Want to see an adjacent line in a log search? Good luck.

cs02rm0 6y ago

It's nice that AWS services tend to do one thing. But it does sometimes mean that there's always just one more AWS service you need. One more service with a different web console UI, varied support in the different infrastructure tools... and now we have another one of those. All I seem to do these days is AWS infrastructure, sometimes as code. I'm not sure one more new tool is going to improve that.