aws-node-termination-handler VS kops

When you are using compute you have a lot of options. One of these options is Amazon EC2. In a world where more and more workloads become serverless. You might still have this use-case that is better off on EC2. But, how do you combine EC2 with compliance and security? In this blog post we will explore how we can build a compliant and secure EC2 stack.

In this article, a WEB application using the latest version of Angular in a built Docker image will be hosted on Amazon EC2 (Elastic Compute Cloud) and deployed by Amazon ECS (Elastic Container Service) using an Amazon ECR (Elastic Container Registry) containers repository.

The single most important development in hosting since the invention of EC2 is defined by its own 3-letter acronym: k8s. Kubernetes has won the “container orchestrator” space, becoming the default way that teams across industries are managing their compute nodes and scheduling their workloads, from data pipelines to web services.

EC2

Then in 2020, I started working with AWS. My first two years with AWS were mostly interacting with the Node.js apps I've deployed in EC2 and reviewing logs since we had a DevOps engineer who managed the cloud infrastructure.

If you want to learn more about EC2 and get detailed information, I suggest you start your journey by visiting https://aws.amazon.com/ec2/. This is the best place to begin learning about EC2.

AWS - Cloud Computing AWS - EC2 Wikipedia - Cloud Computing Guru99 - Cloud Computing Cloudflare - Cloud Computing Cloudzero - Statistics Zippia - Statistics

Say that we have an application running behind a public-facing Application Load Balancer (ALB). The load balancer's target can be any supported target, including ECS containers, EC2 instances or even Lambda functions. Because the application is only available to authenticated users, we want to find a solution to identify them.

Although I'll use Lambda functions in the examples, we can transfer the concepts to other compute resources, like EC2 instances, and ECS or EKS containers.

Elastic Computer Cloud (EC2)

The general problem of patching resource definitions that are not fully under your control has also been recognized for some time. This is true of default resources created and updated by cluster maintenance tools (e.g. kOps), or by public helm charts that you use to install common services and operators (e.g. nginx-ingress, cert-manager, and so on). High quality charts will allow you to override the configuration of important components such as service account references, but some simpler charts offer much less configuration.

The kops documentation is not very clear about this.

Very fast progress and great article with lots of useful information. I found myself nodding a lot having recently seen GitLab Dedicated https://docs.gitlab.com/ee/subscriptions/gitlab_dedicated/ being developed that had my similar challenges. I wonder what other people think of Kops https://kops.sigs.k8s.io/

note: I work with kube on a daily basis. All current clusters under my care use a managed backplane service though there are a number of small (3+ years-old) clusters that I still keep an eye on that were initialized using kops.

kOps with your own instances.

Companies run their own clusters (sometimes for cost reasons), using tools like kops, and kubeadm to set up their own clusters.

curl -Lo kops https://github.com/kubernetes/kops/releases/download/$(curl -s https://api.github.com/repos/kubernetes/kops/releases/latest | grep tag_name | cut -d '"' -f 4)/kops-linux-amd64 chmod +x kops sudo mv kops /usr/local/bin/

Kops is a cluster setup and management command line tool that deploys a Kubernetes cluster to AWS. It provides configuration abstractions such as manifest YAML files that facilitate node and components configuration. And like Ansible, it will provide dry-run capabilities and ensures idempotency of changing the nodes.