I am quite desperate with an issue very similar to the one described into this thread.

https://github.com/OpenDroneMap/opendronemap-ecs/issues/14#issuecomment-432004023

When I attach the network interface to my EC2 instance, so that my custom VPC is used instead of the default one, the EC2 instance no longer joins the ECS cluster.

This is my terraform definition.

provider "aws" {}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  enable_dns_support = true
  enable_dns_hostnames = true
  assign_generated_ipv6_cidr_block = true
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}

resource "aws_subnet" "main" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.0.0/16"
  availability_zone = "us-west-2a"
  map_public_ip_on_launch = true
}

resource "aws_route_table" "main" {
  vpc_id = aws_vpc.main.id

}

resource "aws_route_table_association" "rta1" {

  subnet_id      = aws_subnet.main.id
  route_table_id = aws_route_table.main.id
}

resource "aws_route_table_association" "rta2" {
  gateway_id     = aws_internet_gateway.main.id
  route_table_id = aws_route_table.main.id
}

resource "aws_security_group" "sg-jenkins" {
  name        = "sg_jenkins"
  description = "Allow inbound traffic for Jenkins instance"
  vpc_id      = aws_vpc.main.id

  ingress = [
    {
      description      = "inbound all"
      from_port        = 0
      to_port          = 0
      protocol         = "-1"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = ["::/0"]
      self            = null
      prefix_list_ids = null
      security_groups = null
    }
  ]

  egress = [
    {
      description      = "outbound all"
      from_port        = 0
      to_port          = 0
      protocol         = "-1"
      cidr_blocks      = ["0.0.0.0/0"]
      ipv6_cidr_blocks = ["::/0"]
      self            = null
      prefix_list_ids = null
      security_groups = null
    }
  ]

}

resource "aws_network_interface" "main" {
  subnet_id   = aws_subnet.main.id
  security_groups = [aws_security_group.sg-jenkins.id]
}

resource "aws_instance" "ec2_instance" {
  ami           = "ami-07764a7d8502d36a2"
  instance_type = "t2.micro"
  iam_instance_profile = "ecsInstanceRole"
  key_name = "fran"

  network_interface {
    device_index         = 0
    network_interface_id = aws_network_interface.main.id
  }

  user_data = <<EOF
  #!/bin/bash
  echo ECS_CLUSTER=cluster >> /etc/ecs/ecs.config
  EOF

  depends_on = [aws_internet_gateway.main]
}

### Task definition

resource "aws_ecs_task_definition" "jenkins-task" {
  family = "namespace"
  container_definitions = jsonencode([
    {
      name      = "jenkins"
      image     = "cnservices/jenkins-master"
      cpu       = 10
      memory    = 512
      essential = true
      portMappings = [
        {
          containerPort = 8080
          hostPort      = 8080
        }
      ]
    }
  ])

#  network_mode = "awsvpc"

  volume {
    name      = "service-storage"
    host_path = "/ecs/service-storage"
  }

  placement_constraints {
    type       = "memberOf"
    expression = "attribute:ecs.availability-zone in [us-west-2a]"
  }
}


### Cluster

resource "aws_ecs_cluster" "cluster" {
  name = "cluster"

  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

### Service

resource "aws_ecs_service" "jenkins-service" {
  name            = "jenkins-service"
  cluster         = aws_ecs_cluster.cluster.id
  task_definition = aws_ecs_task_definition.jenkins-task.arn
  desired_count   = 1
  #  iam_role        = aws_iam_role.foo.arn
  #  depends_on      = [aws_iam_role_policy.foo]

#  network_configuration {
#    security_groups = [aws_security_group.sg-jenkins.id]
#    subnets = [aws_subnet.main.id]
#  }

  ordered_placement_strategy {
    type  = "binpack"
    field = "cpu"
  }

  placement_constraints {
    type       = "memberOf"
    expression = "attribute:ecs.availability-zone in [us-west-2a]"
  }
}

CodePudding user response：

You haven't created a route to your IGW. Thus your instance can't connect to the ECS service to register with your cluster. So remove rta2 and add a route:

# not needed. to be removed.
# resource "aws_route_table_association" "rta2" {
#   gateway_id     = aws_internet_gateway.main.id
#   route_table_id = aws_route_table.main.id
# }

# add a missing route to the IGW
resource "aws_route" "r" {
  route_table_id              = aws_route_table.main.id
  gateway_id                  = aws_internet_gateway.main.id
  destination_cidr_block      = "0.0.0.0/0"
}