使用 Amazon CloudWatch Container Insights 轻松监控容器化应用程序

export ClusterName=managednodes-quickstart
export LogRegion=us-east-2
export FluentBitHttpPort='2020'
export FluentBitReadFromHead='Off'

[[ ${FluentBitReadFromHead} = 'On' ]] && FluentBitReadFromTail='Off'|| FluentBitReadFromTail='On'

[[ -z ${FluentBitHttpPort} ]] && FluentBitHttpServer='Off' || FluentBitHttpServer='On'

curl https://raw.githubusercontent.com/aws-samples/amazon-cloudwatch-container-insights/latest/k8s-deployment-manifest-templates/deployment-mode/daemonset/container-insights-monitoring/quickstart/cwagent-fluent-bit-quickstart.yaml | sed 's/{{cluster_name}}/'${ClusterName}'/;s/{{region_name}}/'${LogRegion}'/;s/{{http_server_toggle}}/"'${FluentBitHttpServer}'"/;s/{{http_server_port}}/"'${FluentBitHttpPort}'"/;s/{{read_from_head}}/"'${FluentBitReadFromHead}'"/;s/{{read_from_tail}}/"'${FluentBitReadFromTail}'"/'> cwagent-fluent-bit-quickstart.yaml

eksctl create iamserviceaccount --name fluent-bit \
 --namespace amazon-cloudwatch \
 --cluster ${ClusterName} --role-name fluent-bit \
 --attach-policy-arn arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy \
 --approve --region ${LogRegion} \
 --override-existing-serviceaccounts

kubectl apply -f cwagent-fluent-bit-quickstart.yaml

kubectl get pods -n amazon-cloudwatch

apiVersion: v1
kind: Namespace
metadata:
 labels:
 kubernetes.io/metadata.name: quickstart 
 name: quickstart

---
apiVersion: apps/v1
kind: Deployment
metadata:
 name: "quickstart-nginx-deployment"
 namespace: "quickstart"
spec:
 selector:
 matchLabels:
 app: "quickstart-nginx"
 replicas: 3
 template:
 metadata:
 labels:
 app: "quickstart-nginx"
 role: "backend"
 spec:
 dnsPolicy: Default 
 enableServiceLinks: false 
 automountServiceAccountToken: false
 securityContext:
 seccompProfile:
 type: RuntimeDefault 
 containers:
 - image: public.ecr.aws/nginx/nginx:latest
 imagePullPolicy: Always
 name: "quickstart-nginx"
 resources:
 requests:
 memory: "64Mi"
 cpu: "250m"
 limits:
 memory: "128Mi"
 cpu: "500m"
 securityContext:
 allowPrivilegeEscalation: false
 readOnlyRootFilesystem: true
 ports:
 - containerPort: 80
 command: ["/bin/sh"]
 args: ["-c", "echo PodName: $MY_POD_NAME NodeName: $MY_NODE_NAME podIP: $MY_POD_IP> /usr/share/nginx/html/index.html && exec nginx -g 'daemon off;'"] 
 env:
 - name: MY_NODE_NAME
 valueFrom:
 fieldRef:
 fieldPath: spec.nodeName
 - name: MY_POD_IP
 valueFrom:
 fieldRef:
 fieldPath: status.podIP
 - name: MY_POD_NAME
 valueFrom:
 fieldRef:
 fieldPath: metadata.name
 volumeMounts:
 - name: cache
 mountPath: /var/cache/nginx
 - name: usr
 mountPath: /var/run 
 - name: tmp
 mountPath: /usr/share/nginx/html 
 volumes:
 - name: cache
 emptyDir: {}
 - name: tmp
 emptyDir: {}
 - name: usr
 emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
 name: quickstart-nginx-service
 namespace: quickstart
spec:
 type: NodePort
 selector:
 app: "quickstart-nginx"
 role: "backend"
 ports:
 - port: 80
 targetPort: 80

--- 
apiVersion: v1
kind: Pod
metadata:
 name: load
 namespace: quickstart
spec:
 securityContext:
 seccompProfile:
 type: RuntimeDefault
 runAsNonRoot: true 
 runAsUser: 1000 
 runAsGroup: 1000 
 automountServiceAccountToken: false
 containers:
 - name: load
 image: public.ecr.aws/docker/library/busybox:1.36.1
 imagePullPolicy: Always
 command: ["/bin/sh"]
 args: ["-c", "while sleep 0.5; do wget -q -O- http://quickstart-nginx-service; done"]
 resources:
 requests:
 memory: "64Mi"
 cpu: "250m"
 limits:
 memory: "128Mi"
 cpu: "500m"
 securityContext:
 allowPrivilegeEscalation: false 
 readOnlyRootFilesystem: true

kubectl get all -n quickstart

fields @timestamp, kubernetes.pod_name as PodName, kubernetes.host as WorkerNode, kubernetes.namespace_name as Namespace, log
| filter PodName like 'quickstart-nginx-deployment'
| sort @timestamp desc
| limit 200

apiVersion: apps/v1
kind: Deployment
metadata:
 name: geo-api
spec:
 selector:
 matchLabels:
 run: geo-api
 replicas: 1 
 template:
 metadata:
 labels:
 run: geo-api
 spec:
 containers:
 - name: geo-api
 image: registry.k8s.io/hpa-example
 ports:
 - containerPort: 80
 resources:
 limits:
 cpu: 250m
 memory: "12Mi"
 requests:
 cpu: 125m
 memory: "10Mi"
---
apiVersion: v1
kind: Service
metadata:
 name: geo-api
 labels:
 run: geo-api
spec:
 ports:
 - port: 80
 selector:
 run: geo-api

kubectl apply -f geo-api.yaml

kubectl create deployment geo-api-load \
 --image=busybox \
 --replicas=2 -- /bin/sh -c "while sleep 0.01; do wget -q -O- http://geo-api; done" 

kubectl get pods

NAME READY STATUS RESTARTS AGE
geo-api-load-c9c7bf98c-4rrn8 0/1 ContainerCreating 0 0s
geo-api-load-c9c7bf98c-kzsjs 0/1 ContainerCreating 0 0s
geo-api-load-c9c7bf98c-4rrn8 1/1 Running 0 1s
geo-api-load-c9c7bf98c-kzsjs 1/1 Running 0 2s
geo-api-76f6dcf999-ptpz5 1/1 Running 20 (5m8s ago) 118m
geo-api-76f6dcf999-ptpz5 0/1 OOMKilled 20 (5m13s ago) 118m

kubectl get pod geo-api-76f6dcf999-ptpz5 --output=yaml | grep -i lastState -A7

lastState:
 terminated:
 containerID: containerd://4bbdfee06a3d3daca0e74f14f18f8a66ac0a415c79720eae44ea9ad4c46bcb37
 exitCode: 137
 finishedAt: "2023-08-26T12:48:37Z"
 reason: OOMKilled
 startedAt: "2023-08-26T12:47:27Z"
 name: geo-api

# Delete workloads
kubectl delete -f workload.yaml -n quickstart

kubectl delete -f geo-api.yaml

# Delete the the CloudWatch agent and Fluentbit for Container Insights
kubectl delete -f cwagent-fluent-bit-quickstart.yaml