Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(ecs-patterns): support NLB with TLS listener and target group #30611

Merged
merged 22 commits into from
Oct 14, 2024
Merged

feat(ecs-patterns): support NLB with TLS listener and target group #30611

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
d83e8ee
feat: Add props for NLB TLS certificate
199911 Jun 19, 2024
bae669f
test: Add unit test for listenerCertificate
199911 Jun 19, 2024
dd71d68
test: Automatically set listener and target group port to 443 if cert…
199911 Jun 19, 2024
343b55d
docs: Update Readme
199911 Jun 20, 2024
d7c577f
test: Add unit test for NetworkLoadBalancedEc2Service
199911 Jun 20, 2024
13b8cfb
docs: Update Readme
199911 Jun 20, 2024
5d9b9e0
test: Add integration test for nlb with ecs
199911 Jun 20, 2024
97f742b
test: Add integration test for nlb with fargate
199911 Jun 20, 2024
0d6ec3f
fixup! test: Add integration test for nlb with ecs
199911 Jun 21, 2024
d3a847f
fixup! test: Add integration test for nlb with ecs
199911 Aug 15, 2024
1046b3e
fixup! test: Add integration test for nlb with fargate
199911 Aug 15, 2024
4cb910d
Merge branch 'main' into issue-8517-pr
199911 Aug 15, 2024
e943fe2
Merge branch 'main' into issue-8517-pr
199911 Aug 31, 2024
36736a1
Merge branch 'main' into issue-8517-pr
199911 Sep 10, 2024
e3fed8a
Speed up integration test by importing cert from arn
199911 Sep 30, 2024
eb57c44
Update fargate snapshot
199911 Sep 30, 2024
19977fe
Merge branch 'main' into issue-8517-pr
199911 Sep 30, 2024
65769ae
Update ec2 snapshot
199911 Sep 30, 2024
129043c
Add certificate set up to framework-integ/README.md
199911 Oct 11, 2024
aab64ef
Merge branch 'main' into issue-8517-pr
199911 Oct 11, 2024
303f5b1
Minor fix on README
199911 Oct 11, 2024
153b7f7
Merge branch 'main' into issue-8517-pr
mergify[bot] Oct 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Speed up integration test by importing cert from arn
  • Loading branch information
@199911
199911 committed Sep 30, 2024

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode
commit e3fed8a5cdf2e6cb2da1fd23304e2fde4bcaa1fe
29 changes: 7 additions & 22 deletions ...ework-integ/test/aws-ecs-patterns/test/ec2/integ.tls-network-load-balanced-ecs-service.ts
View file
Original file line number Diff line number Diff line change
@@ -3,21 +3,13 @@ import { Cluster, ContainerImage } from 'aws-cdk-lib/aws-ecs';
import { App, Stack } from 'aws-cdk-lib';
import * as integ from '@aws-cdk/integ-tests-alpha';
import { NetworkLoadBalancedEc2Service } from 'aws-cdk-lib/aws-ecs-patterns';
import { Certificate, CertificateValidation } from 'aws-cdk-lib/aws-certificatemanager';
import { PublicHostedZone } from 'aws-cdk-lib/aws-route53';
import { Certificate } from 'aws-cdk-lib/aws-certificatemanager';

/**
* In order to test this you need
* to have a valid public hosted zone that you can use
* to request certificates for.
*
*/
const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
* In order to test this you need prepare a certificate.
*/
const certArn = process.env.CDK_INTEG_CERT_ARN || process.env.CERT_ARN;
if (!certArn) throw new Error('For this test you must provide your own Certificate as an env var "CERT_ARN". See framework-integ/README.md for details.');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not see the environment variable CERT_ARN mentioned in the framework-integ/README.md file. Can you update this file, and add some details on how to create this certificate.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review!
I updated the README and attached a link to AWS doc.

If we need more details in README, I propose to do it in another PR.
So the ECS Fargate pattern fix can be published first.


const app = new App();
const stack = new Stack(app, 'tls-network-load-balanced-ecs-service');
@@ -29,20 +21,13 @@ cluster.addCapacity('DefaultAutoScalingGroupCapacity', {
desiredCapacity: 2,
});

const hostedZone = PublicHostedZone.fromHostedZoneAttributes(stack, 'HostedZone', {
hostedZoneId,
zoneName: hostedZoneName,
});
const validation = CertificateValidation.fromDns(hostedZone);
const listenerCertificate = Certificate.fromCertificateArn(stack, 'myCert', certArn);

// EC2 Service and NLB with TLS listener
new NetworkLoadBalancedEc2Service(stack, 'myServiceWithTls', {
cluster,
memoryLimitMiB: 256,
listenerCertificate: new Certificate(stack, 'myCert', {
domainName,
validation,
}),
listenerCertificate,
taskImageOptions: {
image: ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
},
29 changes: 7 additions & 22 deletions ...teg/test/aws-ecs-patterns/test/fargate/integ.tls-network-load-balanced-fargate-service.ts
View file
Original file line number Diff line number Diff line change
@@ -3,40 +3,25 @@ import { Cluster, ContainerImage } from 'aws-cdk-lib/aws-ecs';
import { App, Stack } from 'aws-cdk-lib';
import * as integ from '@aws-cdk/integ-tests-alpha';
import { NetworkLoadBalancedFargateService } from 'aws-cdk-lib/aws-ecs-patterns';
import { Certificate, CertificateValidation } from 'aws-cdk-lib/aws-certificatemanager';
import { PublicHostedZone } from 'aws-cdk-lib/aws-route53';
import { Certificate } from 'aws-cdk-lib/aws-certificatemanager';

/**
* In order to test this you need
* to have a valid public hosted zone that you can use
* to request certificates for.
*
*/
const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
* In order to test this you need prepare a certificate.
*/
const certArn = process.env.CDK_INTEG_CERT_ARN || process.env.CERT_ARN;
if (!certArn) throw new Error('For this test you must provide your own Certificate as an env var "CERT_ARN". See framework-integ/README.md for details.');

const app = new App();
const stack = new Stack(app, 'tls-network-load-balanced-fargate-service');
const vpc = new Vpc(stack, 'Vpc', { maxAzs: 2 });
const cluster = new Cluster(stack, 'Cluster', { vpc });

const hostedZone = PublicHostedZone.fromHostedZoneAttributes(stack, 'HostedZone', {
hostedZoneId,
zoneName: hostedZoneName,
});
const validation = CertificateValidation.fromDns(hostedZone);
const listenerCertificate = Certificate.fromCertificateArn(stack, 'myCert', certArn);

// Fargate and NLB with TLS listener
new NetworkLoadBalancedFargateService(stack, 'myServiceWithTls', {
cluster,
listenerCertificate: new Certificate(stack, 'myCert', {
domainName,
validation,
}),
listenerCertificate,
taskImageOptions: {
image: ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
},