Fargate
EKS에서 DataPalne을 Fargate를 통해 관리하면 관리형 워커노드와는 달리 AWS에 직접관리하여 관리부담을 줄일 수 있습니다.
- EKS(컨트롤 플레인) + Fargate(데이터 플레인)의 완전한 서버리스화(=AWS 관리형)
- Cluster Autoscaler 불필요, VM 수준의 격리 가능(VM isolation at Pod Level)
구성은 Fargate Profile 을 만들고, 관심갖는 대상 POD에 대해 설정하면 됩니다.
- 파게이트 프로파일(파드가 사용할 서브넷, 네임스페이스, 레이블 조건)을 생성하여 지정한 파드가 파게이트에서 동작하게 함
EKS 는 스케줄러가 특정 조건을 기준으로 어느 노드에 파드를 동작시킬지 결정, 혹은 특정 설정으로 특정 노드에 파드가 동작하게 가능함
- 컨트롤플레인에 Fargate 용 스케쥴러가 따로 존재합니다.
- Fargate Profile에 매치되면 Fargate 스케쥴러가 Fargete VPC에 POD를 배치합니다.
Fargate를 이용하여 POD 가 스케쥴링되면 AWS가 관리하는 EC2에 컨테이너를 생성합니다. 아래 그램에서 Managed 되는 부분을 상세하게 보시면 됩니다.
Farget는 VM 레벨 수준의 안전한 격리를 위해 FireCracker를 내부적으로 사용합니다.
GitHub - firecracker-microvm/firecracker: Secure and fast microVMs for serverless computing.
Secure and fast microVMs for serverless computing. - firecracker-microvm/firecracker
github.com
- [KVM](https://en.wikipedia.org/wiki/Kernel-based_Virtual_Machine)을 사용하는 새로운 가상화 기술인 [Firecracker](https://firecracker-microvm.github.io/)를 여러분에게 소개하고자 합니다. Firecracker를 통해 여러분은 가상화되지 않은 환경에서 1초도 되지 않는 시간 안에 경량 microVM(마이크로 가상 머신)을 시작할 수 있고, 컨테이너를 통해 제공하는 리소스 효율성과 기존 VM에서 제공하는 워크로드 격리 및 보안의 혜택을 그대로 활용할 수 있습니다.
- 보안 – 항상 가장 중요한 우선순위입니다! Firecracker는 여러 수준의 격리와 보호를 사용하며, 공격 노출 영역을 최소화합니다.
- 고성능 – 현 시점 기준으로 125밀리초 안에 microVM을 시작할 수 있으며(2019년에는 더 빨라질 예정), 단기간 또는 일시적인 워크로드를 비롯한 여러 유형의 워크로드에 적합합니다.
- 검증된 실적 – Firecracker는 실전에서 검증되어 있습니다. 이미 [AWS Lambda](https://aws.amazon.com/lambda/)및 [AWS Fargate](https://aws.amazon.com/fargate/)를 비롯한 사용량이 많은 여러 AWS 서비스가 Firecracker를 사용하고 있습니다.
- 낮은 오버헤드 – Firecracker는 microVM당 약 5MiB의 메모리를 사용합니다. 그리고 동일한 인스턴스에서 다양한 vCPU 및 메모리 구성 사양을 갖춘 안전한 수천 개의 VM을 실행할 수 있습니다.
- 오픈 소스 – Firecracker는 현재 진행 중인 [오픈 소스 프로젝트](https://github.com/firecracker-microvm/firecracker)입니다. 이미 검토와 PR(Pull Request)을 수락할 준비가 되었으며, 전 세계 기고자들과 협업할 수 있기를 기대하고 있습니다.
- Firecracker는 미니멀리즘에 기반하여 제작되었습니다. [crosvm](https://chromium.googlesource.com/chromiumos/platform/crosvm/)에서 시작하여 오버헤드를 줄이고 안전한 멀티 테넌시를 활용하도록 최소 디바이스 모델을 설정했습니다. Firecracker는 스레드 보안을 보장하고 보안 취약성을 야기할 수 있는 여러 유형의 버퍼 오버런 오류를 방지하는 최신 프로그래밍 언어인 Rust로 작성되었습니다.
- 단순한 게스트 모델 – Firecracker 게스트는 공격 영역을 최소화하기 위해 가상화된 단순한 디바이스 모델로 제시됩니다(예: 네트워크 디바이스, 블록 I/O 디바이스, PIT(Programmable Interval Timer), KVM 클럭, 직렬 콘솔, 부분 키보드(VM을 재설정할 수 있을 정도의 기능)).
- 잠금(Jail) 처리 – Firecracker 프로세스는 [cgroups](https://en.wikipedia.org/wiki/Cgroups)및 [seccomp BPF](https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html)를 사용하여 잠기며(Jail), 매우 제한된 소량의 시스템 호출 목록에 액세스합니다.
- 정적 연결 – `firecracker` 프로세스는 정적으로 연결되며, 잠금자(Jailer)에서 시작하여 가능한 안전하고 클린한 상태의 호스트 환경을 보장합니다.
FireCracker를 이용한 MicroVM 1대에 POD 1개가 스케쥴링되므로 보안이 우수해집니다.
(참고) Fargate Dataplane 참고 자료
AWS EKS Fargate 아키텍처
아래 실습에서 사용할 아키텍처입니다.
- 사용자에게 보이지 않지만, Fargate Scheduler(Controller 추정)가 EKS Control Plane 에서 동작.
- fargate Scheduler(controller) 에 필요한 IAM Role(Policy)는 AWS에서 알아서 관리 하는 것으로 보임. 설치 시에 별도 설정 없음.
- Fargate 에 의해서 배포된 파드(노드 당 1개 파드)에 ENI는 사용자의 VPC 영역 내에 속하여, Fargate-Owned ENI 로 추정.
- 파드(노드)에 필요 IAM Role(Policy)는 Fargate 설치 시에 설정 필요함. 필요 시 파드에 IRSA 추가 설정 가능.
- 파드가 외부 통신 시에는 → NATGW(공인 IP로 SNAT) ⇒ IGW(외부 인터넷)
- 만약 파드가 퍼블릭 서브넷이 있을 경우 공인IP 비용 부과 및 외부 침입 시도가 빈번할듯..
- 외부에서 파드 내부로 인입 요청 시에는 → ALB/NLB ⇒ Fargate-Owned ENI 에 연결된 Fargate 파드(노드)로 전달
- firecracker-containerd 를 통하여 MicroVM(Application 컨테이너)를 배포.
- VMM을 통해서 MicroVM을 배포하고, FC Snapshotter 를 통해서 Application Container 의 이미지를 구현.
- MicroVM 마다 ‘Kubelet, Kube-proxy, Containerd’ 가 동작하여, 256 RAM 반드시 필요.
- 사용자에의 VPC에 보이는 ENI는 Application Containter 와 직접 매핑되어 있는 것으로 추정.
(실습) EKS Faragte
실습을 테라폼을 이용합니다. 아래 링크의 Amazon EKS Blueprints for Terraform 을 이용합니다.
Amazon EKS Blueprints for Terraform
Amazon EKS Blueprints for Terraform Welcome to Amazon EKS Blueprints for Terraform! This project contains a collection of Amazon EKS cluster patterns implemented in Terraform that demonstrate how fast and easy it is for customers to adopt Amazon EKS. The p
aws-ia.github.io
| # terraform-aws-eks-blueprints 깃 클론 [yu3papa@iworks ~]$ git clone https://github.com/aws-ia/terraform-aws-eks-blueprints [yu3papa@iworks ~]$ cd terraform-aws-eks-blueprints/patterns/fargate-serverless |
| # main.tf 수정 : 리전 등 일부 실습 편리를 위해 수정, Sample App 배포 부분 삭제 [yu3papa@iworks fargate-serverless]$ vi main.tf |
|
provider "aws" {
region = local.region
}
provider "kubernetes" {
host = module.eks.cluster_endpoint
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
exec {
api_version = "client.authentication.k8s.io/v1beta1"
command = "aws"
# This requires the awscli to be installed locally where Terraform is executed
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
}
}
provider "helm" {
kubernetes {
host = module.eks.cluster_endpoint
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
exec {
api_version = "client.authentication.k8s.io/v1beta1"
command = "aws"
# This requires the awscli to be installed locally where Terraform is executed
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name]
}
}
}
data "aws_availability_zones" "available" {
# Do not include local zones
filter {
name = "opt-in-status"
values = ["opt-in-not-required"]
}
}
locals {
name = basename(path.cwd)
region = "ap-northeast-2"
vpc_cidr = "10.10.0.0/16"
azs = slice(data.aws_availability_zones.available.names, 0, 3)
tags = {
Blueprint = local.name
GithubRepo = "github.com/aws-ia/terraform-aws-eks-blueprints"
}
}
################################################################################
# Cluster
################################################################################
module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "~> 20.11"
cluster_name = local.name
cluster_version = "1.30"
cluster_endpoint_public_access = true
# Give the Terraform identity admin access to the cluster
# which will allow resources to be deployed into the cluster
enable_cluster_creator_admin_permissions = true
vpc_id = module.vpc.vpc_id
subnet_ids = module.vpc.private_subnets
# Fargate profiles use the cluster primary security group so these are not utilized
create_cluster_security_group = false
create_node_security_group = false
fargate_profiles = {
study_wildcard = {
selectors = [
{ namespace = "study-*" }
]
}
kube_system = {
name = "kube-system"
selectors = [
{ namespace = "kube-system" }
]
}
}
fargate_profile_defaults = {
iam_role_additional_policies = {
additional = module.eks_blueprints_addons.fargate_fluentbit.iam_policy[0].arn
}
}
tags = local.tags
}
################################################################################
# EKS Blueprints Addons
################################################################################
module "eks_blueprints_addons" {
source = "aws-ia/eks-blueprints-addons/aws"
version = "~> 1.16"
cluster_name = module.eks.cluster_name
cluster_endpoint = module.eks.cluster_endpoint
cluster_version = module.eks.cluster_version
oidc_provider_arn = module.eks.oidc_provider_arn
# We want to wait for the Fargate profiles to be deployed first
create_delay_dependencies = [for prof in module.eks.fargate_profiles : prof.fargate_profile_arn]
# EKS Add-ons
eks_addons = {
coredns = {
configuration_values = jsonencode({
computeType = "Fargate"
# Ensure that the we fully utilize the minimum amount of resources that are supplied by
# Fargate adds 256 MB to each pod's memory reservation for the required Kubernetes
# components (kubelet, kube-proxy, and containerd). Fargate rounds up to the following
# compute configuration that most closely matches the sum of vCPU and memory requests in
# order to ensure pods always have the resources that they need to run.
resources = {
limits = {
cpu = "0.25"
# We are targeting the smallest Task size of 512Mb, so we subtract 256Mb from the
# request/limit to ensure we can fit within that task
memory = "256M"
}
requests = {
cpu = "0.25"
# We are targeting the smallest Task size of 512Mb, so we subtract 256Mb from the
# request/limit to ensure we can fit within that task
memory = "256M"
}
}
})
}
vpc-cni = {}
kube-proxy = {}
}
# Enable Fargate logging this may generate a large ammount of logs, disable it if not explicitly required
enable_fargate_fluentbit = true
fargate_fluentbit = {
flb_log_cw = true
}
enable_aws_load_balancer_controller = true
aws_load_balancer_controller = {
set = [
{
name = "vpcId"
value = module.vpc.vpc_id
},
{
name = "podDisruptionBudget.maxUnavailable"
value = 1
},
]
}
tags = local.tags
}
################################################################################
# Supporting Resources
################################################################################
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
name = local.name
cidr = local.vpc_cidr
azs = local.azs
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
enable_nat_gateway = true
single_nat_gateway = true
public_subnet_tags = {
"kubernetes.io/role/elb" = 1
}
private_subnet_tags = {
"kubernetes.io/role/internal-elb" = 1
}
tags = local.tags
}
|
| # 테라폼으로 배포 : 약 10분 이상 소요 [yu3papa@iworks fargate-serverless]$ terraform init [yu3papa@iworks fargate-serverless]$ terraform apply --auto-approve ...(생략)... Apply complete! Resources: 64 added, 0 changed, 0 destroyed. Outputs: configure_kubectl = "aws eks --region ap-northeast-2 update-kubeconfig --name fargate-serverless" # EKS 자격증명 [yu3papa@iworks ~]$ aws eks --region ap-northeast-2 update-kubeconfig --name fargate-serverless Added new context arn:aws:eks:ap-northeast-2:390402552337:cluster/fargate-serverless to /home/yu3papa/.kube/config # EKS 기본정보 확인 [yu3papa@iworks ~]$ kubectl cluster-info Kubernetes control plane is running at https://86111586DA4AC237BAE8E71FBA06099A.yl4.ap-northeast-2.eks.amazonaws.com CoreDNS is running at https://86111586DA4AC237BAE8E71FBA06099A.yl4.ap-northeast-2.eks.amazonaws.com/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. [yu3papa@iworks ~]$ kubectl get no NAME STATUS ROLES AGE VERSION fargate-ip-10-10-2-253.ap-northeast-2.compute.internal Ready <none> 38m v1.30.8-eks-2d5f260 fargate-ip-10-10-44-230.ap-northeast-2.compute.internal Ready <none> 38m v1.30.8-eks-2d5f260 fargate-ip-10-10-47-66.ap-northeast-2.compute.internal Ready <none> 38m v1.30.8-eks-2d5f260 fargate-ip-10-10-5-53.ap-northeast-2.compute.internal Ready <none> 38m v1.30.8-eks-2d5f260 [yu3papa@iworks ~]$ [yu3papa@iworks ~]$ kubectl get po -A NAMESPACE NAME READY STATUS RESTARTS AGE kube-system aws-load-balancer-controller-bcdb4d4cd-76hgg 1/1 Running 0 40m kube-system aws-load-balancer-controller-bcdb4d4cd-tqlcr 1/1 Running 0 40m kube-system coredns-64696d8b7f-lcvm5 1/1 Running 0 40m kube-system coredns-64696d8b7f-ndvvj 1/1 Running 0 40m |
기본정보 확인
| # k8s api service 확인 : ENDPOINTS 의 IP는 EKS Owned-ENI 2개 [yu3papa@iworks ~]$ kubectl get svc,ep NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/kubernetes ClusterIP 172.20.0.1 <none> 443/TCP 51m NAME ENDPOINTS AGE endpoints/kubernetes 10.10.29.215:443,10.10.44.17:443 51m # node 확인 : 노드(Micro VM) 4대 [yu3papa@iworks ~]$ kubectl get csr NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION csr-5dhcj 42m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-2-253.ap-northeast-2.compute.internal <none> Approved,Issued csr-99p9g 42m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-5-53.ap-northeast-2.compute.internal <none> Approved,Issued csr-mc428 42m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-47-66.ap-northeast-2.compute.internal <none> Approved,Issued csr-rwvjx 42m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-44-230.ap-northeast-2.compute.internal <none> Approved,Issued [yu3papa@iworks ~]$ kubectl get node -owide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME fargate-ip-10-10-2-253.ap-northeast-2.compute.internal Ready <none> 42m v1.30.8-eks-2d5f260 10.10.2.253 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 fargate-ip-10-10-44-230.ap-northeast-2.compute.internal Ready <none> 42m v1.30.8-eks-2d5f260 10.10.44.230 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 fargate-ip-10-10-47-66.ap-northeast-2.compute.internal Ready <none> 42m v1.30.8-eks-2d5f260 10.10.47.66 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 fargate-ip-10-10-5-53.ap-northeast-2.compute.internal Ready <none> 42m v1.30.8-eks-2d5f260 10.10.5.53 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 [yu3papa@iworks ~]$ kubectl describe node | grep eks.amazonaws.com/compute-type eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule # 파드 확인 : 파드의 IP와 노드의 IP가 같다! [yu3papa@iworks ~]$ kubectl get pdb -n kube-system NAME MIN AVAILABLE MAX UNAVAILABLE ALLOWED DISRUPTIONS AGE aws-load-balancer-controller N/A 1 1 43m coredns N/A 1 1 50m [yu3papa@iworks ~]$ kubectl get pod -A -owide NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES kube-system aws-load-balancer-controller-bcdb4d4cd-76hgg 1/1 Running 0 43m 10.10.5.53 fargate-ip-10-10-5-53.ap-northeast-2.compute.internal <none> <none> kube-system aws-load-balancer-controller-bcdb4d4cd-tqlcr 1/1 Running 0 43m 10.10.44.230 fargate-ip-10-10-44-230.ap-northeast-2.compute.internal <none> <none> kube-system coredns-64696d8b7f-lcvm5 1/1 Running 0 43m 10.10.2.253 fargate-ip-10-10-2-253.ap-northeast-2.compute.internal <none> <none> kube-system coredns-64696d8b7f-ndvvj 1/1 Running 0 43m 10.10.47.66 fargate-ip-10-10-47-66.ap-northeast-2.compute.internal <none> <none> # aws-load-balancer-webhook-service , eks-extension-metrics-api? [yu3papa@iworks ~]$ kubectl get svc,ep -n kube-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/aws-load-balancer-webhook-service ClusterIP 172.20.190.207 <none> 443/TCP 44m service/eks-extension-metrics-api ClusterIP 172.20.132.25 <none> 443/TCP 52m service/kube-dns ClusterIP 172.20.0.10 <none> 53/UDP,53/TCP,9153/TCP 50m NAME ENDPOINTS AGE endpoints/aws-load-balancer-webhook-service 10.10.44.230:9443,10.10.5.53:9443 44m endpoints/eks-extension-metrics-api 172.0.32.0:10443 52m endpoints/kube-dns 10.10.2.253:53,10.10.47.66:53,10.10.2.253:53 + 3 more... 50m # eks-extension-metrics-api? [yu3papa@iworks ~]$ kubectl get apiservices.apiregistration.k8s.io | grep eks v1.metrics.eks.amazonaws.com kube-system/eks-extension-metrics-api True 52m [yu3papa@iworks ~]$ kubectl get --raw "/apis/metrics.eks.amazonaws.com" | jq {
"kind": "APIGroup",
"apiVersion": "v1",
"name": "metrics.eks.amazonaws.com",
"versions": [
{
"groupVersion": "metrics.eks.amazonaws.com/v1",
"version": "v1"
}
],
"preferredVersion": {
"groupVersion": "metrics.eks.amazonaws.com/v1",
"version": "v1"
}
}
[yu3papa@iworks ~]$ kubectl get --raw "/apis/metrics.eks.amazonaws.com/v1" | jq {
"kind": "APIResourceList",
"apiVersion": "v1",
"groupVersion": "metrics.eks.amazonaws.com/v1",
"resources": [
{
"name": "kcm",
"singularName": "kcm",
"namespaced": false,
"kind": "KCM",
"verbs": []
},
{
"name": "kcm/metrics",
"singularName": "",
"namespaced": false,
"kind": "KCM",
"verbs": [
"get"
]
},
{
"name": "ksh",
"singularName": "ksh",
"namespaced": false,
"kind": "KSH",
"verbs": []
},
{
"name": "ksh/metrics",
"singularName": "",
"namespaced": false,
"kind": "KSH",
"verbs": [
"get"
]
}
]
}
# configmap 확인 [yu3papa@iworks ~]$ kubectl get cm -n kube-system NAME DATA AGE amazon-vpc-cni 7 51m aws-auth 1 48m aws-load-balancer-controller-leader 0 44m coredns 1 51m extension-apiserver-authentication 6 53m kube-apiserver-legacy-service-account-token-tracking 1 53m kube-proxy 1 51m kube-proxy-config 1 51m kube-root-ca.crt 1 53m # aws-auth 보다 우선해서 IAM access entry 가 있음을 참고. # 기본 관리노드 보다 system:node-proxier 그룹이 추가되어 있음. # fargate profile 이 2개인데, 그 profile 갯수만큼 있음.  [yu3papa@iworks ~]$ kubectl get cm -n kube-system aws-auth -o yaml apiVersion: v1
data:
mapRoles: |
- groups:
- system:bootstrappers
- system:nodes
- system:node-proxier
rolearn: arn:aws:iam::390402552337:role/study_wildcard-20250322114229638700000010
username: system:node:{{SessionName}}
- groups:
- system:bootstrappers
- system:nodes
- system:node-proxier
rolearn: arn:aws:iam::390402552337:role/kube-system-2025032211422963860000000f
username: system:node:{{SessionName}}
kind: ConfigMap
metadata:
creationTimestamp: "2025-03-22T11:43:11Z"
name: aws-auth
namespace: kube-system
resourceVersion: "1530"
uid: 7411380f-3e2f-4188-8766-c01e7b8186a2
[yu3papa@iworks ~]$ kubectl get cm -n kube-system amazon-vpc-cni -o yaml apiVersion: v1
data:
branch-eni-cooldown: "60"
enable-network-policy-controller: "false"
enable-windows-ipam: "false"
enable-windows-prefix-delegation: "false"
minimum-ip-target: "3"
warm-ip-target: "1"
warm-prefix-target: "0"
kind: ConfigMap
metadata:
creationTimestamp: "2025-03-22T11:40:07Z"
labels:
app.kubernetes.io/instance: aws-vpc-cni
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: aws-node
app.kubernetes.io/version: v1.19.3
helm.sh/chart: aws-vpc-cni-1.19.3
k8s-app: aws-node
name: amazon-vpc-cni
namespace: kube-system
resourceVersion: "1722"
uid: abe6098d-faf7-42b9-a033-366e34bbf89b
# coredns 설정 내용 [yu3papa@iworks ~]$ kubectl get cm -n kube-system coredns -o yaml apiVersion: v1
data:
Corefile: |
.:53 {
errors
health {
lameduck 5s
}
ready
kubernetes cluster.local in-addr.arpa ip6.arpa {
pods insecure
fallthrough in-addr.arpa ip6.arpa
}
prometheus :9153
forward . /etc/resolv.conf
cache 30
loop
reload
loadbalance
}
kind: ConfigMap
metadata:
creationTimestamp: "2025-03-22T11:40:06Z"
labels:
eks.amazonaws.com/component: coredns
k8s-app: kube-dns
name: coredns
namespace: kube-system
resourceVersion: "614"
uid: 42d6aa25-bdbb-47e3-b27b-65b18a3bf113
# 인증서 작성되어 있음 : client-ca-file , requestheader-client-ca-file [yu3papa@iworks ~]$ kubectl get cm -n kube-system extension-apiserver-authentication -o yaml apiVersion: v1
data:
client-ca-file: |
-----BEGIN CERTIFICATE-----
MIIDBTCCAe2gAwIBAgIIdJvMJ+P7wqgwDQYJKoZIhvcNAQELBQAwFTETMBEGA1UE
AxMKa3ViZXJuZXRlczAeFw0yNTAzMjIxMTMyMjZaFw0zNTAzMjAxMTM3MjZaMBUx
EzARBgNVBAMTCmt1YmVybmV0ZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDHRiFhE8gzI+Wapu2j4LGveWlLoaqbr+lt3j5EomSUkgpmQ00aVh3DBid1
ucJNKp10IAsTf722pQfeEr3J3hwSJqEv1y70QxmTEjsPxLE02cN1GtR1nlQuLNa9
4xiA/KgfWRYf6ZAnbE9UEGbr1CT17OReGi1GqCzxqjs3KYlU13C5SNt4J4sCrvOp
uj5FmqQejewewRHW5G4qRdbx+Zbo/3YB11uKRZurtXcolWHhnj3EboQwbXHCZKpk
VgM/PvhszaOtXmMguGzI86JkqsMrLkdkF3S6fvq4XcyZp/f8dxQLE+GL1JuNLSX0
dpI2SOVHVd1hw0pnpHjtZIf0EXLNAgMBAAGjWTBXMA4GA1UdDwEB/wQEAwICpDAP
BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqTYL3YzcxMHIBCgL7jlYWJrC2ljAV
BgNVHREEDjAMggprdWJlcm5ldGVzMA0GCSqGSIb3DQEBCwUAA4IBAQAqLjcM2JaJ
px3w7oVmp4O/E4645RlmpPKHiAG9eufW3rvD7GPWm5EXG69i+3N9VkW/aG/lma8s
O0lf1N/6Kobe4nM8jS5eIdzj33ayVEnMl6bT+Zc2wYyt2QlcWq/9aep2HJ+GwFkg
lLipVQGJZAONq2PHHPMc48d9V2Avkulq2hITztF1w3Wg8/5djJ5iElkHBoTll7At
3PY08H5YjIMBUADlfRxLp++DgPBT610Ufz6bIKgwsCPGcMkW+5vgu1YcBB7R0/yF
JxrNJPkok9hMLd2uem3MfdpnELbm5/LTYnX7+UghGjOeOZW0EnZA70irRAtOpdnZ
/korUMg0yUnT
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDBTCCAe2gAwIBAgIIazQVJZa2y28wDQYJKoZIhvcNAQELBQAwFTETMBEGA1UE
AxMKa3ViZXJuZXRlczAeFw0yNTAzMjIxMTM4MTVaFw0zNTAzMjAxMTQzMTVaMBUx
EzARBgNVBAMTCmt1YmVybmV0ZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC/3te6tDnv/ifEC1JK2ZJNmFXb7VOveqg8ZIKCFQfzTC4y7iCoBjM3GodK
xtEpWk4mBjgI0ql89fdySeQxLt3IyKh9tgKVvdiGmN6zC3y6sqxV/Ows+EOq8IqH
0xzo6HSROf6L+ULAS2aw9Da3Wt54QQJ8DkauQrbtS8XCAXFpDpqwKQFI5B/bBnRo
L0Lk3/okrfxnNMoEix6HS8X7UzwVIHLbU4IlZKaCsf758fTTX2CEiFHNIk4ZPbow
CNzVHSeMipT0clOZLNJeh/Bog0U7Rh9Tkgphbi3a/lmf8NRuBo+RC9/cSy4E1vC+
7vUd5K0HPy/9v8lmVqAASdX59oblAgMBAAGjWTBXMA4GA1UdDwEB/wQEAwICpDAP
BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSbpAyt8HkDLMJXXjs1Ewmp1RqlazAV
BgNVHREEDjAMggprdWJlcm5ldGVzMA0GCSqGSIb3DQEBCwUAA4IBAQCpIuKHMLWu
U2rGEMvIur39Jk+gcM6nDaQSuGn7Oka4IPgGYlYRPebNIUNzLEsU3Px8Gh8Mi0do
U1BYw7+EgZfYZnvxQTOd7LLn9HtGo48zZIYxb2CjR7xTLmjORE6iUXOV1DGHo/3v
+Azt0dhw9PQvmBGvPRQe8A6+NsKqIlXMDTBCYxe8u+bO27gDN654rftMPkHoADvH
ofmiyuzjNCzNx7DTnCHozhMUQmFRT4zIUEiH/L22d9Kwbd2qIziDMdGt+3jr8uBM
Wt9bj2uwlGGWDyupEzcnA30ADUdkxOrQWQGpfyTO+8qg5zDGNlY8WQcHodr4VnKr
kh7L4xeT6ou1
-----END CERTIFICATE-----
requestheader-allowed-names: '["front-proxy-client"]'
requestheader-client-ca-file: |
-----BEGIN CERTIFICATE-----
MIIDETCCAfmgAwIBAgIIRznoh3YGjl4wDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UE
AxMOZnJvbnQtcHJveHktY2EwHhcNMjUwMzIyMTEzMjI0WhcNMzUwMzIwMTEzNzI0
WjAZMRcwFQYDVQQDEw5mcm9udC1wcm94eS1jYTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAKlLT7KtuFziaI5/hTcInswh66wKOXRcbwNW5mX5dVR2djqQ
Ti67caq+isGyX3E20IZBMoSvQqYSVdfvLoGgrz1Q52PJHH5HG8j2xt0SWIJDKTtv
sj8XXYUyj2hwl5SWP0imeOr/19KYHbf+ndWN/G4yTyZg+2LSS+h/KNF512/I/YPl
lynnK6wVI2RvhaxEHEAt6/+6Gd0u+fKPtrlO63h2DWsL8zy5o3RTkA8/JnbjqGYT
WAE4vnsJU06imNk92rCZCOARm81rAPCdLk6jaKoYEKBwjAuSFogXvSFjanGGl8u0
bmg/+XcCkidOXnVcQHpPRTpOC5vpgbB4CbkZi+kCAwEAAaNdMFswDgYDVR0PAQH/
BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFIbewOknXQPSUpWZMtTx
P533U/SuMBkGA1UdEQQSMBCCDmZyb250LXByb3h5LWNhMA0GCSqGSIb3DQEBCwUA
A4IBAQBlnkENVsmhacNPHoTsDI3aT37fUukA7l2fHtXyEbt2tI0hw4OWPbA3ximM
huxXc3n+YL5OYUk+EMS1RjAhCxhRdMhqvJwuFPf4W4Sos8xCfREU2arb6Vq2eI3V
2TVTYzr84hq/GmbstObkAUYfLajUFuJw+z2RyCcTnm/lCX3T9qgYoAEhG9Y9HAV0
U5fFLjYRc309fLH2+GNpRTUHCHIvJDKYuLVMP/j8BWCWOiTLDcSJSyQEV8XsDqkn
Az+O8VkunOzji+o9B9ATTRt1msOBON07cBoZsHrkgB/ks2U3I8nAsaicYjGFtE5L
/p6DSFLWL2NJ+PtkcnRWU0CbN73L
-----END CERTIFICATE-----
requestheader-extra-headers-prefix: '["X-Remote-Extra-"]'
requestheader-group-headers: '["X-Remote-Group"]'
requestheader-username-headers: '["X-Remote-User"]'
kind: ConfigMap
metadata:
creationTimestamp: "2025-03-22T11:38:06Z"
name: extension-apiserver-authentication
namespace: kube-system
resourceVersion: "1231"
uid: baa1dd1f-4d45-44c9-b5ad-608d1a3a9ef3
[yu3papa@iworks ~]$ kubectl get cm -n kube-system kube-proxy -o yaml apiVersion: v1
data:
kubeconfig: |-
kind: Config
apiVersion: v1
clusters:
- cluster:
certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
name: default
contexts:
- context:
cluster: default
namespace: default
user: default
name: default
current-context: default
users:
- name: default
user:
tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
kind: ConfigMap
metadata:
creationTimestamp: "2025-03-22T11:40:05Z"
labels:
eks.amazonaws.com/component: kube-proxy
k8s-app: kube-proxy
name: kube-proxy
namespace: kube-system
resourceVersion: "605"
uid: 1451dde5-079b-404f-8fba-aa7989feafc4
[yu3papa@iworks ~]$ kubectl get cm -n kube-system kube-proxy-config -o yaml apiVersion: v1
data:
config: |-
apiVersion: kubeproxy.config.k8s.io/v1alpha1
bindAddress: 0.0.0.0
clientConnection:
acceptContentTypes: ""
burst: 10
contentType: application/vnd.kubernetes.protobuf
kubeconfig: /var/lib/kube-proxy/kubeconfig
qps: 5
clusterCIDR: ""
configSyncPeriod: 15m0s
conntrack:
maxPerCore: 32768
min: 131072
tcpCloseWaitTimeout: 1h0m0s
tcpEstablishedTimeout: 24h0m0s
enableProfiling: false
healthzBindAddress: 0.0.0.0:10256
hostnameOverride: ""
iptables:
masqueradeAll: false
masqueradeBit: 14
minSyncPeriod: 0s
syncPeriod: 30s
ipvs:
excludeCIDRs: null
minSyncPeriod: 0s
scheduler: ""
syncPeriod: 30s
kind: KubeProxyConfiguration
metricsBindAddress: 0.0.0.0:10249
mode: "iptables"
nodePortAddresses: null
oomScoreAdj: -998
portRange: ""
kind: ConfigMap
metadata:
creationTimestamp: "2025-03-22T11:40:05Z"
labels:
eks.amazonaws.com/component: kube-proxy
k8s-app: kube-proxy
name: kube-proxy-config
namespace: kube-system
resourceVersion: "606"
uid: 99eda185-2cad-48a9-b99f-52294cd3c488
|
관리콘솔 확인
Faragte는 AWS가 관리해 주기 때문에 EC2 인스턴스가 목록에 표시되지 않습니다.
EKS 정보
fargate 에 kube-ops-view
# helm 배포 [yu3papa@iworks ~]$ helm repo add geek-cookbook https://geek-cookbook.github.io/charts/ "geek-cookbook" already exists with the same configuration, skipping [yu3papa@iworks ~]$ helm install kube-ops-view geek-cookbook/kube-ops-view --version 1.2.2 --set env.TZ="Asia/Seoul" --namespace kube-system NAME: kube-ops-view LAST DEPLOYED: Sat Mar 22 22:19:46 2025 NAMESPACE: kube-system STATUS: deployed REVISION: 1 TEST SUITE: None NOTES: 1. Get the application URL by running these commands: export POD_NAME=$(kubectl get pods --namespace kube-system -l "app.kubernetes.io/name=kube-ops-view,app.kubernetes.io/instance=kube-ops-view" -o jsonpath="{.items[0].metadata.name}") echo "Visit http://127.0.0.1:8080 to use your application" kubectl port-forward $POD_NAME 8080:8080 [yu3papa@iworks ~]$ kubectl -n kube-system get po -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES aws-load-balancer-controller-bcdb4d4cd-76hgg 1/1 Running 0 94m 10.10.5.53 fargate-ip-10-10-5-53.ap-northeast-2.compute.internal <none> <none> aws-load-balancer-controller-bcdb4d4cd-tqlcr 1/1 Running 0 94m 10.10.44.230 fargate-ip-10-10-44-230.ap-northeast-2.compute.internal <none> <none> coredns-64696d8b7f-lcvm5 1/1 Running 0 94m 10.10.2.253 fargate-ip-10-10-2-253.ap-northeast-2.compute.internal <none> <none> coredns-64696d8b7f-ndvvj 1/1 Running 0 94m 10.10.47.66 fargate-ip-10-10-47-66.ap-northeast-2.compute.internal <none> <none> kube-ops-view-796947d6dc-gdd6p 1/1 Running 0 84s 10.10.5.94 fargate-ip-10-10-5-94.ap-northeast-2.compute.internal <none> <none> # 포트 포워딩 [yu3papa@iworks ~]$ kubectl port-forward deployment/kube-ops-view -n kube-system 8080:8080 & [1] 332766 [yu3papa@iworks ~]$ Forwarding from 127.0.0.1:8080 -> 8080  # 위 그림을 보면 각 Node 마다 POD가 1개인것을 확인할 수 있습니다. # node 확인 : 노드(Micro VM) [yu3papa@iworks ~]$ kubectl get csr NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION csr-5dhcj 100m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-2-253.ap-northeast-2.compute.internal <none> Approved,Issued csr-99p9g 100m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-5-53.ap-northeast-2.compute.internal <none> Approved,Issued csr-mc428 100m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-47-66.ap-northeast-2.compute.internal <none> Approved,Issued csr-rwvjx 100m kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-44-230.ap-northeast-2.compute.internal <none> Approved,Issued csr-sgtsx 7m5s kubernetes.io/kubelet-serving system:node:fargate-ip-10-10-5-94.ap-northeast-2.compute.internal <none> Approved,Issued [yu3papa@iworks ~]$ kubectl get node -owide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME fargate-ip-10-10-2-253.ap-northeast-2.compute.internal Ready <none> 100m v1.30.8-eks-2d5f260 10.10.2.253 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 fargate-ip-10-10-44-230.ap-northeast-2.compute.internal Ready <none> 100m v1.30.8-eks-2d5f260 10.10.44.230 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 fargate-ip-10-10-47-66.ap-northeast-2.compute.internal Ready <none> 100m v1.30.8-eks-2d5f260 10.10.47.66 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 fargate-ip-10-10-5-53.ap-northeast-2.compute.internal Ready <none> 100m v1.30.8-eks-2d5f260 10.10.5.53 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Ready <none> 7m14s v1.30.8-eks-2d5f260 10.10.5.94 <none> Amazon Linux 2 5.10.234-225.910.amzn2.x86_64 containerd://1.7.25 [yu3papa@iworks ~]$ kubectl describe node | grep eks.amazonaws.com/compute-type eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule eks.amazonaws.com/compute-type=fargate Taints: eks.amazonaws.com/compute-type=fargate:NoSchedule # kube-ops-view 디플로이먼트/파드 상세 정보 확인 [yu3papa@iworks ~]$ kubectl get pod -n kube-system NAME READY STATUS RESTARTS AGE aws-load-balancer-controller-bcdb4d4cd-76hgg 1/1 Running 0 101m aws-load-balancer-controller-bcdb4d4cd-tqlcr 1/1 Running 0 101m coredns-64696d8b7f-lcvm5 1/1 Running 0 101m coredns-64696d8b7f-ndvvj 1/1 Running 0 101m kube-ops-view-796947d6dc-gdd6p 1/1 Running 0 8m24s [yu3papa@iworks ~]$ kubectl get pod -n kube-system -o jsonpath='{.items[0].metadata.annotations.CapacityProvisioned}' 0.25vCPU 0.5GB [yu3papa@iworks ~]$ kubectl get pod -n kube-system -l app.kubernetes.io/instance=kube-ops-view -o jsonpath='{.items[0].metadata.annotations.CapacityProvisioned}' 0.25vCPU 0.5GB # 디플로이먼트 상세 정보 [yu3papa@iworks ~]$ kubectl get deploy -n kube-system kube-ops-view -o yaml apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "1"
meta.helm.sh/release-name: kube-ops-view
meta.helm.sh/release-namespace: kube-system
creationTimestamp: "2025-03-22T13:19:46Z"
generation: 1
labels:
app.kubernetes.io/instance: kube-ops-view
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kube-ops-view
app.kubernetes.io/version: 20.4.0
helm.sh/chart: kube-ops-view-1.2.2
name: kube-ops-view
namespace: kube-system
resourceVersion: "26851"
uid: d1e94246-9d83-4ce6-97b8-e1153e3ef001
spec:
progressDeadlineSeconds: 600
replicas: 1
revisionHistoryLimit: 3
selector:
matchLabels:
app.kubernetes.io/instance: kube-ops-view
app.kubernetes.io/name: kube-ops-view
strategy:
type: Recreate
template:
metadata:
creationTimestamp: null
labels:
app.kubernetes.io/instance: kube-ops-view
app.kubernetes.io/name: kube-ops-view
spec:
automountServiceAccountToken: true
containers:
- env:
- name: TZ
value: Asia/Seoul
image: hjacobs/kube-ops-view:20.4.0
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
name: kube-ops-view
ports:
- containerPort: 8080
name: http
protocol: TCP
readinessProbe:
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
resources: {}
securityContext:
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
startupProbe:
failureThreshold: 30
periodSeconds: 5
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
enableServiceLinks: true
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
serviceAccount: kube-ops-view
serviceAccountName: kube-ops-view
terminationGracePeriodSeconds: 30
status:
availableReplicas: 1
conditions:
- lastTransitionTime: "2025-03-22T13:20:43Z"
lastUpdateTime: "2025-03-22T13:20:43Z"
message: Deployment has minimum availability.
reason: MinimumReplicasAvailable
status: "True"
type: Available
- lastTransitionTime: "2025-03-22T13:19:46Z"
lastUpdateTime: "2025-03-22T13:20:43Z"
message: ReplicaSet "kube-ops-view-796947d6dc" has successfully progressed.
reason: NewReplicaSetAvailable
status: "True"
type: Progressing
observedGeneration: 1
readyReplicas: 1
replicas: 1
updatedReplicas: 1
# 파드 상세 정보 : admission control 이 동작했음을 알 수 있음 [yu3papa@iworks ~]$ kubectl get pod -n kube-system -l app.kubernetes.io/instance=kube-ops-view -o yaml apiVersion: v1
items:
- apiVersion: v1
kind: Pod
metadata:
annotations:
CapacityProvisioned: 0.25vCPU 0.5GB
Logging: LoggingEnabled
creationTimestamp: "2025-03-22T13:19:47Z"
generateName: kube-ops-view-796947d6dc-
labels:
app.kubernetes.io/instance: kube-ops-view
app.kubernetes.io/name: kube-ops-view
eks.amazonaws.com/fargate-profile: kube-system
pod-template-hash: 796947d6dc
name: kube-ops-view-796947d6dc-gdd6p
namespace: kube-system
ownerReferences:
- apiVersion: apps/v1
blockOwnerDeletion: true
controller: true
kind: ReplicaSet
name: kube-ops-view-796947d6dc
uid: 1758d429-7f36-4674-b4b8-b1696754ea31
resourceVersion: "26846"
uid: 26169a37-bae2-4dd2-8af4-d34127b4e274
spec:
automountServiceAccountToken: true
containers:
- env:
- name: TZ
value: Asia/Seoul
image: hjacobs/kube-ops-view:20.4.0
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
name: kube-ops-view
ports:
- containerPort: 8080
name: http
protocol: TCP
readinessProbe:
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
resources: {}
securityContext:
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
startupProbe:
failureThreshold: 30
periodSeconds: 5
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
name: kube-api-access-2dfg7
readOnly: true
dnsPolicy: ClusterFirst
enableServiceLinks: true
nodeName: fargate-ip-10-10-5-94.ap-northeast-2.compute.internal
preemptionPolicy: PreemptLowerPriority
priority: 2000001000
priorityClassName: system-node-critical
restartPolicy: Always
schedulerName: fargate-scheduler
securityContext: {}
serviceAccount: kube-ops-view
serviceAccountName: kube-ops-view
terminationGracePeriodSeconds: 30
tolerations:
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 300
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 300
volumes:
- name: kube-api-access-2dfg7
projected:
defaultMode: 420
sources:
- serviceAccountToken:
expirationSeconds: 3607
path: token
- configMap:
items:
- key: ca.crt
path: ca.crt
name: kube-root-ca.crt
- downwardAPI:
items:
- fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
path: namespace
status:
conditions:
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:20:41Z"
status: "True"
type: PodReadyToStartContainers
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:20:30Z"
status: "True"
type: Initialized
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:20:43Z"
status: "True"
type: Ready
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:20:43Z"
status: "True"
type: ContainersReady
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:20:30Z"
status: "True"
type: PodScheduled
containerStatuses:
- containerID: containerd://23a0f5178e5f17efc30551a2b9f707f7c366012d695d0858cd5ef66edab9f119
image: docker.io/hjacobs/kube-ops-view:20.4.0
imageID: docker.io/hjacobs/kube-ops-view@sha256:58221b57d4d23efe7558355c58ad7c66c8458db20b1f55ddd9f89cc9275bbc90
lastState: {}
name: kube-ops-view
ready: true
restartCount: 0
started: true
state:
running:
startedAt: "2025-03-22T13:20:41Z"
hostIP: 10.10.5.94
hostIPs:
- ip: 10.10.5.94
phase: Running
podIP: 10.10.5.94
podIPs:
- ip: 10.10.5.94
qosClass: BestEffort
startTime: "2025-03-22T13:20:30Z"
kind: List
metadata:
resourceVersion: ""
[yu3papa@iworks ~]$ kubectl describe pod -n kube-system -l app.kubernetes.io/instance=kube-ops-view | grep Events: -A10 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal LoggingEnabled 9m19s fargate-scheduler Successfully enabled logging for pod Normal Scheduled 8m37s fargate-scheduler Successfully assigned kube-system/kube-ops-view-796947d6dc-gdd6p to fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Normal Pulling 8m36s kubelet Pulling image "hjacobs/kube-ops-view:20.4.0" Normal Pulled 8m26s kubelet Successfully pulled image "hjacobs/kube-ops-view:20.4.0" in 9.927s (9.927s including waiting). Image size: 81086356 bytes. Normal Created 8m26s kubelet Created container kube-ops-view Normal Started 8m26s kubelet Started container kube-ops-view [yu3papa@iworks ~]$ |
fargate 에 netshoot 디플로이먼트(파드) 배포
|
vCPU value
|
Memory value
|
|
.25 vCPU
|
0.5 GB, 1 GB, 2 GB
|
|
.5 vCPU
|
1 GB, 2 GB, 3 GB, 4 GB
|
|
1 vCPU
|
2 GB, 3 GB, 4 GB, 5 GB, 6 GB, 7 GB, 8 GB
|
|
2 vCPU
|
Between 4 GB and 16 GB in 1-GB increments
|
|
4 vCPU
|
Between 8 GB and 30 GB in 1-GB increments
|
|
8 vCPU
|
Between 16 GB and 60 GB in 4-GB increments
|
|
16 vCPU
|
Between 32 GB and 120 GB in 8-GB increments
|
| # 네임스페이스 생성 [yu3papa@iworks ~]$ kubectl create ns study-aews namespace/study-aews created # 테스트용 파드 netshoot 디플로이먼트 생성 : 0.5vCPU 1GB 할당되어, 아래 Limit 값은 의미가 없음. 배포 시 대략 시간 측정해보자! [yu3papa@iworks ~]$ cat <<EOF | kubectl apply -f - apiVersion: apps/v1
kind: Deployment
metadata:
name: netshoot
namespace: study-aews
spec:
replicas: 1
selector:
matchLabels:
app: netshoot
template:
metadata:
labels:
app: netshoot
spec:
containers:
- name: netshoot
image: nicolaka/netshoot
command: ["tail"]
args: ["-f", "/dev/null"]
resources:
requests:
cpu: 500m
memory: 500Mi
limits:
cpu: 2
memory: 2Gi
terminationGracePeriodSeconds: 0
deployment.apps/netshoot created [yu3papa@iworks ~]$ kubectl get events -w --sort-by '.lastTimestamp' warning: --watch requested, --sort-by will be ignored for watch events received LAST SEEN TYPE REASON OBJECT MESSAGE 14m Normal Starting node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal 14m Normal Starting node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Starting kubelet. 14m Warning InvalidDiskCapacity node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal invalid capacity 0 on image filesystem 14m Normal NodeHasSufficientMemory node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Node fargate-ip-10-10-5-94.ap-northeast-2.compute.internal status is now: NodeHasSufficientMemory 14m Normal NodeHasNoDiskPressure node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Node fargate-ip-10-10-5-94.ap-northeast-2.compute.internal status is now: NodeHasNoDiskPressure 14m Normal NodeHasSufficientPID node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Node fargate-ip-10-10-5-94.ap-northeast-2.compute.internal status is now: NodeHasSufficientPID 14m Normal NodeAllocatableEnforced node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Updated Node Allocatable limit across pods 14m Normal Synced node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Node synced successfully 14m Normal NodeReady node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Node fargate-ip-10-10-5-94.ap-northeast-2.compute.internal status is now: NodeReady 14m Normal RegisteredNode node/fargate-ip-10-10-5-94.ap-northeast-2.compute.internal Node fargate-ip-10-10-5-94.ap-northeast-2.compute.internal event: Registered Node fargate-ip-10-10-5-94.ap-northeast-2.compute.internal in Controller 0s Normal Starting node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Starting kubelet. 0s Warning InvalidDiskCapacity node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal invalid capacity 0 on image filesystem 0s Normal NodeHasSufficientMemory node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal status is now: NodeHasSufficientMemory 0s Normal NodeHasNoDiskPressure node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal status is now: NodeHasNoDiskPressure 0s Normal NodeHasSufficientPID node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal status is now: NodeHasSufficientPID 0s Normal NodeAllocatableEnforced node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Updated Node Allocatable limit across pods 0s Normal NodeHasSufficientMemory node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal status is now: NodeHasSufficientMemory 0s Normal NodeHasNoDiskPressure node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal status is now: NodeHasNoDiskPressure 0s Normal NodeHasSufficientPID node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal status is now: NodeHasSufficientPID 0s Normal Synced node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node synced successfully 0s Normal NodeReady node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal status is now: NodeReady 0s Normal Starting node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal 0s Normal RegisteredNode node/fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal event: Registered Node fargate-ip-10-10-17-139.ap-northeast-2.compute.internal in Controller # 확인 : 메모리 할당 측정은 어떻게 되었는지? [yu3papa@iworks ~]$ kubectl get pod -n study-aews -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES netshoot-84558cd8d9-v4tdh 1/1 Running 0 109s 10.10.17.139 fargate-ip-10-10-17-139.ap-northeast-2.compute.internal <none> <none> [yu3papa@iworks ~]$ kubectl get pod -n study-aews -o jsonpath='{.items[0].metadata.annotations.CapacityProvisioned}' 0.5vCPU 1GB # 디플로이먼트 상세 정보 [yu3papa@iworks ~]$ kubectl get deploy -n study-aews netshoot -o yaml apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "1"
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"name":"netshoot","namespace":"study-aews"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"netshoot"}},"template":{"metadata":{"labels":{"app":"netshoot"}},"spec":{"containers":[{"args":["-f","/dev/null"],"command":["tail"],"image":"nicolaka/netshoot","name":"netshoot","resources":{"limits":{"cpu":2,"memory":"2Gi"},"requests":{"cpu":"500m","memory":"500Mi"}}}],"terminationGracePeriodSeconds":0}}}}
creationTimestamp: "2025-03-22T13:34:34Z"
generation: 1
name: netshoot
namespace: study-aews
resourceVersion: "30932"
uid: 4a3ed0b2-8e8a-41c1-97ec-38e0e120afe3
spec:
progressDeadlineSeconds: 600
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: netshoot
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
creationTimestamp: null
labels:
app: netshoot
spec:
containers:
- args:
- -f
- /dev/null
command:
- tail
image: nicolaka/netshoot
imagePullPolicy: Always
name: netshoot
resources:
limits:
cpu: "2"
memory: 2Gi
requests:
cpu: 500m
memory: 500Mi
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 0
status:
availableReplicas: 1
conditions:
- lastTransitionTime: "2025-03-22T13:35:37Z"
lastUpdateTime: "2025-03-22T13:35:37Z"
message: Deployment has minimum availability.
reason: MinimumReplicasAvailable
status: "True"
type: Available
- lastTransitionTime: "2025-03-22T13:34:34Z"
lastUpdateTime: "2025-03-22T13:35:37Z"
message: ReplicaSet "netshoot-84558cd8d9" has successfully progressed.
reason: NewReplicaSetAvailable
status: "True"
type: Progressing
observedGeneration: 1
readyReplicas: 1
replicas: 1
updatedReplicas: 1
# 파드 상세 정보 : admission control 이 동작했음을 알 수 있음 [yu3papa@iworks ~]$ kubectl get pod -n study-aews -l app=netshoot -o yaml apiVersion: v1
items:
- apiVersion: v1
kind: Pod
metadata:
annotations:
CapacityProvisioned: 0.5vCPU 1GB
Logging: LoggingEnabled
creationTimestamp: "2025-03-22T13:34:34Z"
generateName: netshoot-84558cd8d9-
labels:
app: netshoot
eks.amazonaws.com/fargate-profile: study_wildcard
pod-template-hash: 84558cd8d9
name: netshoot-84558cd8d9-v4tdh
namespace: study-aews
ownerReferences:
- apiVersion: apps/v1
blockOwnerDeletion: true
controller: true
kind: ReplicaSet
name: netshoot-84558cd8d9
uid: ff68de00-7c58-4fe3-a9ab-cca08b5d4596
resourceVersion: "30930"
uid: 78013d90-bd1d-4158-ad93-651e84978156
spec:
containers:
- args:
- -f
- /dev/null
command:
- tail
image: nicolaka/netshoot
imagePullPolicy: Always
name: netshoot
resources:
limits:
cpu: "2"
memory: 2Gi
requests:
cpu: 500m
memory: 500Mi
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
name: kube-api-access-f6svx
readOnly: true
dnsPolicy: ClusterFirst
enableServiceLinks: true
nodeName: fargate-ip-10-10-17-139.ap-northeast-2.compute.internal
preemptionPolicy: PreemptLowerPriority
priority: 2000001000
priorityClassName: system-node-critical
restartPolicy: Always
schedulerName: fargate-scheduler
securityContext: {}
serviceAccount: default
serviceAccountName: default
terminationGracePeriodSeconds: 0
tolerations:
- effect: NoExecute
key: node.kubernetes.io/not-ready
operator: Exists
tolerationSeconds: 300
- effect: NoExecute
key: node.kubernetes.io/unreachable
operator: Exists
tolerationSeconds: 300
volumes:
- name: kube-api-access-f6svx
projected:
defaultMode: 420
sources:
- serviceAccountToken:
expirationSeconds: 3607
path: token
- configMap:
items:
- key: ca.crt
path: ca.crt
name: kube-root-ca.crt
- downwardAPI:
items:
- fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
path: namespace
status:
conditions:
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:35:37Z"
status: "True"
type: PodReadyToStartContainers
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:35:20Z"
status: "True"
type: Initialized
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:35:37Z"
status: "True"
type: Ready
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:35:37Z"
status: "True"
type: ContainersReady
- lastProbeTime: null
lastTransitionTime: "2025-03-22T13:35:19Z"
status: "True"
type: PodScheduled
containerStatuses:
- containerID: containerd://4191365aa427a73bd691bd4f7762db6d4a79170e77ca5b851a0b4c12ba3c3f62
image: docker.io/nicolaka/netshoot:latest
imageID: docker.io/nicolaka/netshoot@sha256:a20c2531bf35436ed3766cd6cfe89d352b050ccc4d7005ce6400adf97503da1b
lastState: {}
name: netshoot
ready: true
restartCount: 0
started: true
state:
running:
startedAt: "2025-03-22T13:35:37Z"
hostIP: 10.10.17.139
hostIPs:
- ip: 10.10.17.139
phase: Running
podIP: 10.10.17.139
podIPs:
- ip: 10.10.17.139
qosClass: Burstable
startTime: "2025-03-22T13:35:20Z"
kind: List
metadata:
resourceVersion: ""
[yu3papa@iworks ~]$ kubectl describe pod -n study-aews -l app=netshoot | grep Events: -A10 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal LoggingEnabled 2m31s fargate-scheduler Successfully enabled logging for pod Normal Scheduled 107s fargate-scheduler Successfully assigned study-aews/netshoot-84558cd8d9-v4tdh to fargate-ip-10-10-17-139.ap-northeast-2.compute.internal Normal Pulling 107s kubelet Pulling image "nicolaka/netshoot" Normal Pulled 91s kubelet Successfully pulled image "nicolaka/netshoot" in 16s (16s including waiting). Image size: 183950747 bytes. Normal Created 91s kubelet Created container netshoot Normal Started 90s kubelet Started container netshoot [yu3papa@iworks ~]$ kubectl get mutatingwebhookconfigurations.admissionregistration.k8s.io NAME WEBHOOKS AGE 0500-amazon-eks-fargate-mutation.amazonaws.com 2 112m aws-load-balancer-webhook 3 110m pod-identity-webhook 1 119m vpc-resource-mutating-webhook 1 118m [yu3papa@iworks ~]$ kubectl describe mutatingwebhookconfigurations 0500-amazon-eks-fargate-mutation.amazonaws.com Name: 0500-amazon-eks-fargate-mutation.amazonaws.com Namespace: Labels: <none> Annotations: <none> API Version: admissionregistration.k8s.io/v1 Kind: MutatingWebhookConfiguration Metadata: Creation Timestamp: 2025-03-22T11:44:17Z Generation: 1 Resource Version: 1304 UID: a6e961c2-0347-4278-9e95-138ed3aef4b3 Webhooks: Admission Review Versions: v1beta1 Client Config: Ca Bundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJU2g5dWEvNWI3OUF3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TlRBek1qSXhNVE15TWpOYUZ3MHpOVEF6TWpBeE1UTTNNak5hTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURLRENCaVFpRXNsajBkdjZtWTgxUkdyN2FFdW5RSGVpbVBuRm5YVGpnU2FmdW9zYjI2VUpRenFYSWgKcG05TWpJTExMUVVDdHJncnYzRGtuc05UaHp0RERBVWVBNVk5Q2I1VWxnbHBDbDVNNXVzcHdJK3EreThwL0JSVwpMalMxcElpTXpiNFc4TFRqSDgway9PeWhSeXFOeVB3ZXdoZ1dsb2s2eE05MGttRTc2a1doSXVCeVY2TmZHcG9MClNOei9yclNnbEZyR1dmOFRhMGdmdVJBSmQySVNBamoyQ1ZuMnRLMVVUVDlWSXRxTTRIL294d0MxbHdnWVo5RnoKU0s4ditQUmR0QzF3djlHa1hVWDVHUnA5Q0pENm1kYTZaZ2VOTEJId3EvK2VTOE5yaEZybWd2VU56azF4cFptVApLQmluMkx1OFVUU0hzNVZUK2J5cG1mYitseWU1QWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJSZzZSZmtYaTYvYUZSa1VnZlB2WEJGdlVzczlUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ2hheXJRVk11MApOZkw2Qm9PamcrZitVbm9INXdiUHZtNVl5L2FPb2puelJ4K3lTRDg2c2U3Uk8rckN6ZHc0aWdpUUk2eEh3eDFsCm44QVJxM1E5L0IwRTJyN05TMDNzSTdVRjBrZk05eDBzaUlMWkw0RkJqYmVXdmRMait4WTFISzRPNmM2YVdDUkcKTGRuRVJqU2ZBeDhCenVWV1VtQ2RoOWdaUGVMeTBjaGh4dm1EeHI2QXM5dXF0dVBBVGNYdTNlcysxME1mKzlCRApKM1hTdUE1Slp5ZUlPZHQ5SWV2Y2NYWjNqcUNoUUpBQmFGczdFejRnbXI1REc5M1JCSW1iT1FVV0xuMEV0dXplClJPRGhrdUx2dnI3Rmx5MWF5eTMzaSt1cHVOR2tvcHpMWEVleXpKakFsQ1Y3Ry9aR0dtR0Z4YUVZRzVuR0ZqbkoKWUcvRjNlQTRlRDZsCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K URL: https://127.0.0.1:23445/mutate Failure Policy: Ignore Match Policy: Equivalent Name: 0500-amazon-eks-fargate-mutation.amazonaws.com Namespace Selector: Object Selector: Reinvocation Policy: Never Rules: API Groups: * API Versions: * Operations: CREATE Resources: pods Scope: * Side Effects: None Timeout Seconds: 5 Admission Review Versions: v1beta1 Client Config: Ca Bundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJU2g5dWEvNWI3OUF3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TlRBek1qSXhNVE15TWpOYUZ3MHpOVEF6TWpBeE1UTTNNak5hTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURLRENCaVFpRXNsajBkdjZtWTgxUkdyN2FFdW5RSGVpbVBuRm5YVGpnU2FmdW9zYjI2VUpRenFYSWgKcG05TWpJTExMUVVDdHJncnYzRGtuc05UaHp0RERBVWVBNVk5Q2I1VWxnbHBDbDVNNXVzcHdJK3EreThwL0JSVwpMalMxcElpTXpiNFc4TFRqSDgway9PeWhSeXFOeVB3ZXdoZ1dsb2s2eE05MGttRTc2a1doSXVCeVY2TmZHcG9MClNOei9yclNnbEZyR1dmOFRhMGdmdVJBSmQySVNBamoyQ1ZuMnRLMVVUVDlWSXRxTTRIL294d0MxbHdnWVo5RnoKU0s4ditQUmR0QzF3djlHa1hVWDVHUnA5Q0pENm1kYTZaZ2VOTEJId3EvK2VTOE5yaEZybWd2VU56azF4cFptVApLQmluMkx1OFVUU0hzNVZUK2J5cG1mYitseWU1QWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJSZzZSZmtYaTYvYUZSa1VnZlB2WEJGdlVzczlUQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ2hheXJRVk11MApOZkw2Qm9PamcrZitVbm9INXdiUHZtNVl5L2FPb2puelJ4K3lTRDg2c2U3Uk8rckN6ZHc0aWdpUUk2eEh3eDFsCm44QVJxM1E5L0IwRTJyN05TMDNzSTdVRjBrZk05eDBzaUlMWkw0RkJqYmVXdmRMait4WTFISzRPNmM2YVdDUkcKTGRuRVJqU2ZBeDhCenVWV1VtQ2RoOWdaUGVMeTBjaGh4dm1EeHI2QXM5dXF0dVBBVGNYdTNlcysxME1mKzlCRApKM1hTdUE1Slp5ZUlPZHQ5SWV2Y2NYWjNqcUNoUUpBQmFGczdFejRnbXI1REc5M1JCSW1iT1FVV0xuMEV0dXplClJPRGhrdUx2dnI3Rmx5MWF5eTMzaSt1cHVOR2tvcHpMWEVleXpKakFsQ1Y3Ry9aR0dtR0Z4YUVZRzVuR0ZqbkoKWUcvRjNlQTRlRDZsCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K URL: https://127.0.0.1:23445/mutate Failure Policy: Ignore Match Policy: Equivalent Name: 0500-amazon-eks-fargate-configmaps-admission.amazonaws.com Namespace Selector: Match Labels: Aws - Observability: enabled Object Selector: Reinvocation Policy: Never Rules: API Groups: * API Versions: * Operations: CREATE UPDATE Resources: configmaps Scope: * Side Effects: None Timeout Seconds: 5 Events: <none> [yu3papa@iworks ~]$ kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io NAME WEBHOOKS AGE aws-load-balancer-webhook 3 110m vpc-resource-validating-webhook 2 119m # 파드 내부에 zsh 접속 후 확인 [yu3papa@iworks ~]$ kubectl exec -it deploy/netshoot -n study-aews -- zsh dP dP dP 88 88 88 88d888b. .d8888b. d8888P .d8888b. 88d888b. .d8888b. .d8888b. d8888P 88' `88 88ooood8 88 Y8ooooo. 88' `88 88' `88 88' `88 88 88 88 88. ... 88 88 88 88 88. .88 88. .88 88 dP dP `88888P' dP `88888P' dP dP `88888P' `88888P' dP Welcome to Netshoot! (github.com/nicolaka/netshoot) Version: 0.13 netshoot-84558cd8d9-v4tdh ~ ip -c a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 4: eth0@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc noqueue state UP group default qlen 1000 link/ether b6:02:86:b5:4e:67 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 10.10.17.139/20 brd 10.10.31.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::b402:86ff:feb5:4e67/64 scope link valid_lft forever preferred_lft forever netshoot-84558cd8d9-v4tdh ~ cat /etc/resolv.conf search study-aews.svc.cluster.local svc.cluster.local cluster.local ap-northeast-2.compute.internal nameserver 172.20.0.10 options ndots:5 # 출력되는 IP는 --> NAT Gateway netshoot-84558cd8d9-v4tdh ~ curl ipinfo.io/ip 3.37.218.198  netshoot-84558cd8d9-v4tdh ~ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS nvme1n1 259:0 0 30G 0 disk /etc/resolv.conf /etc/hostname nvme0n1 259:1 0 5G 0 disk ├─nvme0n1p1 259:2 0 5G 0 part └─nvme0n1p128 259:3 0 1M 0 part netshoot-84558cd8d9-v4tdh ~ df -hT / Filesystem Type Size Used Available Use% Mounted on overlay overlay 29.4G 11.8G 16.0G 43% / netshoot-84558cd8d9-v4tdh ~ cat /etc/fstab /dev/cdrom /media/cdrom iso9660 noauto,ro 0 0 /dev/usbdisk /media/usb vfat noauto,ro 0 0 netshoot-84558cd8d9-v4tdh ~ exit [yu3papa@iworks ~]$ |
파드 권한과 호스트 네임스페이스 공유로 호스트 탈취 시도
- (참고 블로그) - https://dev.to/caruccio/kubernetes-hack-1d0p
| [yu3papa@iworks ~]$ kubectl apply -f - <<EOF apiVersion: v1
kind: Pod
metadata:
name: root-shell
namespace: study-aews
spec:
containers:
- command:
- /bin/cat
image: alpine:3
name: root-shell
securityContext:
privileged: true
tty: true
stdin: true
volumeMounts:
- mountPath: /host
name: hostroot
hostNetwork: true
hostPID: true
hostIPC: true
tolerations:
- effect: NoSchedule
operator: Exists
- effect: NoExecute
operator: Exists
volumes:
- hostPath:
path: /
name: hostroot
EOF pod/root-shell created [yu3papa@iworks ~]$ kubectl get pod -n study-aews root-shell -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES root-shell 0/1 Pending 0 5m55s <none> <none> <none> <none> [yu3papa@iworks ~]$ kubectl describe pod -n study-aews root-shell | grep Events: -A 10 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning FailedScheduling 7m19s fargate-scheduler Pod not supported on Fargate: fields not supported: HostNetwork, HostPID, HostIPC, volumes not supported: hostroot is of an unsupported volume Type, invalid SecurityContext fields: Privileged [yu3papa@iworks ~]$ # 삭제 [yu3papa@iworks ~]$ kubectl delete pod -n study-aews root-shell |
AWS ALB(Ingress)
| # 게임 디플로이먼트와 Service, Ingress 배포 [yu3papa@iworks ~]$ cat <<EOF | kubectl apply -f - apiVersion: apps/v1
kind: Deployment
metadata:
namespace: study-aews
name: deployment-2048
spec:
selector:
matchLabels:
app.kubernetes.io/name: app-2048
replicas: 2
template:
metadata:
labels:
app.kubernetes.io/name: app-2048
spec:
containers:
- image: public.ecr.aws/l6m2t8p7/docker-2048:latest
imagePullPolicy: Always
name: app-2048
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
namespace: study-aews
name: service-2048
spec:
ports:
- port: 80
targetPort: 80
protocol: TCP
type: ClusterIP
selector:
app.kubernetes.io/name: app-2048
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
namespace: study-aews
name: ingress-2048
annotations:
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: ip
spec:
ingressClassName: alb
rules:
- http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: service-2048
port:
number: 80
EOF deployment.apps/deployment-2048 created service/service-2048 created ingress.networking.k8s.io/ingress-2048 created # 모니터링 [yu3papa@iworks ~]$ watch -d kubectl get pod,ingress,svc,ep,endpointslices -n study-aews # 생성 확인 [yu3papa@iworks ~]$ kubectl -n study-aews get all NAME READY STATUS RESTARTS AGE pod/deployment-2048-85f8c7d69-5cm7j 1/1 Running 0 95s pod/deployment-2048-85f8c7d69-x59ns 1/1 Running 0 95s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/service-2048 ClusterIP 172.20.206.15 <none> 80/TCP 95s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/deployment-2048 2/2 2 2 95s deployment.apps/netshoot 0/1 1 0 47m NAME DESIRED CURRENT READY AGE replicaset.apps/deployment-2048-85f8c7d69 2 2 2 95s replicaset.apps/netshoot-84558cd8d9 1 1 0 47m [yu3papa@iworks ~]$ kubectl get ingress,svc,ep,pod -n study-aews NAME CLASS HOSTS ADDRESS PORTS AGE ingress.networking.k8s.io/ingress-2048 alb * k8s-studyaew-ingress2-08c53ee834-1095446684.ap-northeast-2.elb.amazonaws.com 80 104s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/service-2048 ClusterIP 172.20.206.15 <none> 80/TCP 104s NAME ENDPOINTS AGE endpoints/service-2048 10.10.25.153:80,10.10.44.193:80 104s NAME READY STATUS RESTARTS AGE pod/deployment-2048-85f8c7d69-5cm7j 1/1 Running 0 104s pod/deployment-2048-85f8c7d69-x59ns 1/1 Running 0 104s pod/netshoot-84558cd8d9-vldll 0/1 ContainerCreating 0 51s [yu3papa@iworks ~]$ kubectl get targetgroupbindings -n study-aews NAME SERVICE-NAME SERVICE-PORT TARGET-TYPE AGE k8s-studyaew-service2-66ed34b2ba service-2048 80 ip 109s # Ingress 확인 [yu3papa@iworks ~]$ kubectl describe ingress -n study-aews ingress-2048 Name: ingress-2048 Labels: <none> Namespace: study-aews Address: k8s-studyaew-ingress2-08c53ee834-1095446684.ap-northeast-2.elb.amazonaws.com Ingress Class: alb Default backend: <default> Rules: Host Path Backends ---- ---- -------- * / service-2048:80 (10.10.44.193:80,10.10.25.153:80) Annotations: alb.ingress.kubernetes.io/scheme: internet-facing alb.ingress.kubernetes.io/target-type: ip Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal SuccessfullyReconciled 2m1s ingress Successfully reconciled [yu3papa@iworks ~]$ kubectl get ingress -n study-aews ingress-2048 -o jsonpath="{.status.loadBalancer.ingress[*].hostname}{'\n'}" k8s-studyaew-ingress2-08c53ee834-1095446684.ap-northeast-2.elb.amazonaws.com   # 게임 접속 : ALB 주소로 웹 접속 [yu3papa@iworks ~]$ kubectl get ingress -n study-aews ingress-2048 -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' | awk '{ print "Game URL = http://"$1 }' Game URL = http://k8s-studyaew-ingress2-08c53ee834-1095446684.ap-northeast-2.elb.amazonaws.com  # 파드 IP 확인 [yu3papa@iworks ~]$ kubectl get pod -n study-aews -owide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES deployment-2048-85f8c7d69-5cm7j 1/1 Running 0 2m49s 10.10.25.153 fargate-ip-10-10-25-153.ap-northeast-2.compute.internal <none> <none> deployment-2048-85f8c7d69-x59ns 1/1 Running 0 2m49s 10.10.44.193 fargate-ip-10-10-44-193.ap-northeast-2.compute.internal <none> <none> netshoot-84558cd8d9-vldll 1/1 Running 0 116s 10.10.0.40 fargate-ip-10-10-0-40.ap-northeast-2.compute.internal <none> <none> # 파드 증가 [yu3papa@iworks ~]$ kubectl scale deployment -n study-aews deployment-2048 --replicas 4 deployment.apps/deployment-2048 scaled # 게임 실습 리소스 삭제 [yu3papa@iworks ~]$ kubectl delete ingress ingress-2048 -n study-aews ingress.networking.k8s.io "ingress-2048" deleted [yu3papa@iworks ~]$ kubectl delete svc service-2048 -n study-aews service "service-2048" deleted [yu3papa@iworks ~]$ kubectl delete deploy deployment-2048 -n study-aews deployment.apps "deployment-2048" deleted |
fargate job
Job을 Fargate로 사용할때 주의할점이 있습니다.
- Job으로 만든 POD가 Completed 되어도 계속 남아있게 되어 과금이 되는 부분을 주의하여야 합니다.
- 작업이 끝나면 " ttlSecondsAfterFinished: 60"으로 설정하여 POD가 삭제되도록 해야 함
| [yu3papa@iworks ~]$ cat <<EOF | kubectl apply -f - apiVersion: batch/v1
kind: Job
metadata:
name: busybox1
namespace: study-aews
spec:
template:
spec:
containers:
- name: busybox
image: busybox
command: ["/bin/sh", "-c", "sleep 10"]
restartPolicy: Never
ttlSecondsAfterFinished: 60 # <-- TTL controller
---
apiVersion: batch/v1
kind: Job
metadata:
name: busybox2
namespace: study-aews
spec:
template:
spec:
containers:
- name: busybox
image: busybox
command: ["/bin/sh", "-c", "sleep 10"]
restartPolicy: Never
EOF [yu3papa@iworks ~]$ kubectl get job,pod -n study-aews NAME STATUS COMPLETIONS DURATION AGE job.batch/busybox1 Running 0/1 11s 11s job.batch/busybox2 Running 0/1 11s 11s NAME READY STATUS RESTARTS AGE pod/busybox1-6wz5j 0/1 Pending 0 11s pod/busybox2-v9mmt 0/1 Pending 0 11s # TTL 시간 이후에 다리 리소스 조회하면 POD가 삭제된걸 확인할 수 있습니다. [yu3papa@iworks ~]$ kubectl get job,pod -n study-aews NAME STATUS COMPLETIONS DURATION AGE job.batch/busybox2 Complete 1/1 57s 4m30s # 삭제 [yu3papa@iworks ~]$ kubectl delete job -n study-aews --all job.batch "busybox2" deleted |
fargate logging
- Fargate의 Amazon EKS는 Fluent Bit 기반의 내장 로그 라우터를 제공합니다. 즉, Fluent Bit 컨테이너를 사이드카로 명시적으로 실행하지 않고 Amazon에서 실행합니다. 로그 라우터를 구성하기만 하면 됩니다.
- Amazon EKS on Fargate offers a built-in log router based on Fluent Bit. This means that you don’t explicitly run a Fluent Bit container as a sidecar, but Amazon runs it for you.
- 구성은 다음 기준을 충족해야 하는 전용 ConfigMap을 통해 이루어집니다.
- 이름 : aws-logging
- aws-observability라는 전용 네임스페이스에서 생성됨
- 5300자를 초과할 수 없습니다.
- ConfigMap을 생성하면 Fargate의 Amazon EKS가 자동으로 이를 감지하고 로그 라우터를 구성합니다. Fargate는 AWS에서 관리하는 Fluent Bit의 업스트림 호환 배포판인 Fluent Bit용 AWS 버전을 사용합니다. 자세한 내용은 GitHub의 Fluent Bit용 AWS를 참조하세요 - [Docs](https://github.com/aws/aws-for-fluent-bit)
- 로그 라우터를 사용하면 AWS의 다양한 서비스를 로그 분석 및 저장에 사용할 수 있습니다. Fargate에서 Amazon CloudWatch, Amazon OpenSearch 서비스로 로그를 직접 스트리밍할 수 있습니다. 또한 Amazon Data Firehose를 통해 Amazon S3, Amazon Kinesis 데이터 스트림 및 파트너 도구와 같은 대상으로 로그를 스트리밍할 수도 있습니다.
- Fargate 포드를 배포할 기존 Kubernetes 네임스페이스를 지정하는 기존 Fargate 프로필입니다.
| [yu3papa@iworks ~]$ cat <<EOF | kubectl apply -f - apiVersion: apps/v1
kind: Deployment
metadata:
name: sample-app
namespace: study-aews
spec:
replicas: 2
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx:latest
name: nginx
ports:
- containerPort: 80
name: http
resources:
requests:
cpu: 500m
memory: 500Mi
limits:
cpu: 2
memory: 2Gi
---
apiVersion: v1
kind: Service
metadata:
name: sample-app
namespace: study-aews
spec:
selector:
app: nginx
ports:
- port: 80
targetPort: 80
protocol: TCP
type: ClusterIP
EOF deployment.apps/sample-app created service/sample-app created # 확인 [yu3papa@iworks ~]$ kubectl get pod -n study-aews -l app=nginx NAME READY STATUS RESTARTS AGE sample-app-7596c66778-pg66c 1/1 Running 0 3m59s sample-app-7596c66778-zhgn9 1/1 Running 0 3m59s [yu3papa@iworks ~]$ kubectl describe pod -n study-aews -l app=nginx Name: sample-app-7596c66778-pg66c Namespace: study-aews Priority: 2000001000 Priority Class Name: system-node-critical Service Account: default Node: fargate-ip-10-10-41-35.ap-northeast-2.compute.internal/10.10.41.35 Start Time: Sat, 22 Mar 2025 23:49:06 +0900 Labels: app=nginx eks.amazonaws.com/fargate-profile=study_wildcard pod-template-hash=7596c66778 Annotations: CapacityProvisioned: 0.5vCPU 1GB Logging: LoggingEnabled Status: Running IP: 10.10.41.35 IPs: IP: 10.10.41.35 Controlled By: ReplicaSet/sample-app-7596c66778 Containers: nginx: Container ID: containerd://1ecd15bcc619f20b1fd8b7f6b628c4ca37fd4eed59df01443f89c1532a4bc79e Image: nginx:latest Image ID: docker.io/library/nginx@sha256:124b44bfc9ccd1f3cedf4b592d4d1e8bddb78b51ec2ed5056c52d3692baebc19 Port: 80/TCP Host Port: 0/TCP State: Running Started: Sat, 22 Mar 2025 23:49:14 +0900 Ready: True Restart Count: 0 Limits: cpu: 2 memory: 2Gi Requests: cpu: 500m memory: 500Mi Environment: <none> Mounts: /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-xwzqb (ro) Conditions: Type Status PodReadyToStartContainers True Initialized True Ready True ContainersReady True PodScheduled True Volumes: kube-api-access-xwzqb: Type: Projected (a volume that contains injected data from multiple sources) TokenExpirationSeconds: 3607 ConfigMapName: kube-root-ca.crt ConfigMapOptional: <nil> DownwardAPI: true QoS Class: Burstable Node-Selectors: <none> Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s node.kubernetes.io/unreachable:NoExecute op=Exists for 300s Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal LoggingEnabled 4m12s fargate-scheduler Successfully enabled logging for pod Normal Scheduled 3m36s fargate-scheduler Successfully assigned study-aews/sample-app-7596c66778-pg66c to fargate-ip-10-10-41-35.ap-northeast-2.compute.internal Normal Pulling 3m35s kubelet Pulling image "nginx:latest" Normal Pulled 3m27s kubelet Successfully pulled image "nginx:latest" in 8.238s (8.238s including waiting). Image size: 72180980 bytes. Normal Created 3m27s kubelet Created container nginx Normal Started 3m27s kubelet Started container nginx Name: sample-app-7596c66778-zhgn9 Namespace: study-aews Priority: 2000001000 Priority Class Name: system-node-critical Service Account: default Node: fargate-ip-10-10-28-78.ap-northeast-2.compute.internal/10.10.28.78 Start Time: Sat, 22 Mar 2025 23:49:20 +0900 Labels: app=nginx eks.amazonaws.com/fargate-profile=study_wildcard pod-template-hash=7596c66778 Annotations: CapacityProvisioned: 0.5vCPU 1GB Logging: LoggingEnabled Status: Running IP: 10.10.28.78 IPs: IP: 10.10.28.78 Controlled By: ReplicaSet/sample-app-7596c66778 Containers: nginx: Container ID: containerd://26f5249943edac576fb84d236ed46a49d1d1d798e25ac0fe9aa9888851166a9f Image: nginx:latest Image ID: docker.io/library/nginx@sha256:124b44bfc9ccd1f3cedf4b592d4d1e8bddb78b51ec2ed5056c52d3692baebc19 Port: 80/TCP Host Port: 0/TCP State: Running Started: Sat, 22 Mar 2025 23:49:29 +0900 Ready: True Restart Count: 0 Limits: cpu: 2 memory: 2Gi Requests: cpu: 500m memory: 500Mi Environment: <none> Mounts: /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-9v2x4 (ro) Conditions: Type Status PodReadyToStartContainers True Initialized True Ready True ContainersReady True PodScheduled True Volumes: kube-api-access-9v2x4: Type: Projected (a volume that contains injected data from multiple sources) TokenExpirationSeconds: 3607 ConfigMapName: kube-root-ca.crt ConfigMapOptional: <nil> DownwardAPI: true QoS Class: Burstable Node-Selectors: <none> Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s node.kubernetes.io/unreachable:NoExecute op=Exists for 300s Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal LoggingEnabled 4m12s fargate-scheduler Successfully enabled logging for pod Normal Scheduled 3m22s fargate-scheduler Successfully assigned study-aews/sample-app-7596c66778-zhgn9 to fargate-ip-10-10-28-78.ap-northeast-2.compute.internal Normal Pulling 3m21s kubelet Pulling image "nginx:latest" Normal Pulled 3m12s kubelet Successfully pulled image "nginx:latest" in 8.37s (8.37s including waiting). Image size: 72180980 bytes. Normal Created 3m12s kubelet Created container nginx Normal Started 3m12s kubelet Started container nginx # 반복 접속 [yu3papa@iworks ~]$ kubectl exec -it deploy/netshoot -n study-aews -- curl sample-app | grep title <title>Welcome to nginx!</title> [yu3papa@iworks ~]$ while true; do kubectl exec -it deploy/netshoot -n study-aews -- curl sample-app | grep title; sleep 1; echo ; date; done; <title>Welcome to nginx!</title> |
로그 설정 정보 확인
| # main.tf ... # Enable Fargate logging this may generate a large ammount of logs, disable it if not explicitly required enable_fargate_fluentbit = true fargate_fluentbit = { flb_log_cw = true } ... # aws-observability라는 이름의 전용 네임스페이스 확인 [yu3papa@iworks ~]$ kubectl get ns --show-labels NAME STATUS AGE LABELS aws-observability Active 3h16m aws-observability=enabled,kubernetes.io/metadata.name=aws-observability default Active 3h20m kubernetes.io/metadata.name=default kube-node-lease Active 3h20m kubernetes.io/metadata.name=kube-node-lease kube-public Active 3h20m kubernetes.io/metadata.name=kube-public kube-system Active 3h20m kubernetes.io/metadata.name=kube-system study-aews Active 84m kubernetes.io/metadata.name=study-aews # Fluent Conf 데이터 값이 포함된 ConfigMap : 컨테이너 로그를 목적지로 배송 설정 ## Amazon EKS Fargate 로깅은 ConfigMap의 동적 구성을 지원하지 않습니다. ## ConfigMap에 대한 모든 변경 사항은 새 포드에만 적용됩니다. 기존 포드에는 변경 사항이 적용되지 않습니다. [yu3papa@iworks ~]$ kubectl get cm -n aws-observability NAME DATA AGE aws-logging 4 3h17m kube-root-ca.crt 1 3h17m [yu3papa@iworks ~]$ kubectl get cm -n aws-observability aws-logging -o yaml apiVersion: v1
data:
filters.conf: |
[FILTER]
Name parser
Match *
Key_name log
Parser crio
[FILTER]
Name kubernetes
Match kube.*
Merge_Log On
Keep_Log Off
Buffer_Size 0
Kube_Meta_Cache_TTL 300s
flb_log_cw: "true" # Ships Fluent Bit process logs to CloudWatch.
output.conf: |+
[OUTPUT]
Name cloudwatch
Match kube.*
region ap-northeast-2
log_group_name /fargate-serverless/fargate-fluentbit-logs2025032211420077100000000c
log_stream_prefix fargate-logs-
auto_create_group true
[OUTPUT]
Name cloudwatch_logs
Match *
region ap-northeast-2
log_group_name /fargate-serverless/fargate-fluentbit-logs2025032211420077100000000c
log_stream_prefix fargate-logs-fluent-bit-
auto_create_group true
parsers.conf: |
[PARSER]
Name crio
Format Regex
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>P|F) (?<log>.*)$
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
Time_Keep On
immutable: false
kind: ConfigMap
metadata:
creationTimestamp: "2025-03-22T11:42:01Z"
name: aws-logging
namespace: aws-observability
resourceVersion: "948"
uid: 495e8fc0-b248-4f9e-9cf1-393ffc3f032b
|
수집된 파드 로그 확인
- CW Log streams 에서 nginx 로 검색 필터링(fluent-bot 포함 체크) → First event time 중 가장 최근것 클릭
| # 삭제 [yu3papa@iworks ~]$ kubectl delete deploy,svc -n study-aews sample-app deployment.apps "sample-app" deleted service "sample-app" deleted |
EKS 리소스 정리
1. 실습 배포 리소스들 먼저 삭제
| # 게임 실습 리소스 삭제 [yu3papa@iworks ~]$ kubectl delete ingress ingress-2048 -n study-aews [yu3papa@iworks ~]$ kubectl delete svc service-2048 -n study-aews [yu3papa@iworks ~]$ kubectl delete deploy deployment-2048 -n study-aews # netshoot 삭제 [yu3papa@iworks ~]$ kubectl delete deploy netshoot -n study-aews deployment.apps "netshoot" deleted # kube-ops-view 삭제 [yu3papa@iworks ~]$ helm uninstall kube-ops-view -n kube-system release "kube-ops-view" uninstalled |
2. 테라폼을 이용하여 EKS 삭제
| # 테라폼 삭제 : vpc 삭제가 잘 안될 경우 aws 콘솔에서 vpc 수동 삭제 -> vnic 등 남아 있을 경우 해당 vnic 강제 삭제 [yu3papa@iworks ~]$ cd ~/terraform-aws-eks-blueprints/patterns/fargate-serverless [yu3papa@iworks fargate-serverless]$ terraform destroy -auto-approve ...(중간생략)... module.eks.aws_iam_role_policy_attachment.this["AmazonEKSClusterPolicy"]: Destruction complete after 1s module.eks.aws_iam_role.this[0]: Destroying... [id=fargate-serverless-cluster-20250322113236351400000001] module.vpc.aws_vpc.this[0]: Destruction complete after 0s module.eks.aws_iam_role.this[0]: Destruction complete after 1s Destroy complete! Resources: 64 destroyed. # VPC 삭제 확인 [yu3papa@iworks ~]$ aws ec2 describe-vpcs --filter 'Name=isDefault,Values=false' --output yaml Vpcs: [] # kubeconfig 삭제 [yu3papa@iworks ~]$ rm -rf ~/.kube/config |
'Kubernetes' 카테고리의 다른 글
| AEWS [3기] 9주차 - EKS Upgrade (1) | 2025.04.01 |
|---|---|
| AEWS [3기] 8주차 - K8S CI/CD 와 kustomize (1) | 2025.03.29 |
| AEWS [3기] 6주차 - K8S API Server Client Certificate 인증 (0) | 2025.03.15 |
| AEWS [3기] 5주차 - EKS Autoscaling (0) | 2025.03.08 |
| AEWS [3기] 4주차 - OpenTelemetry (0) | 2025.03.01 |