Task 5: The Infrastructure on AWS
In this task you create the place the app runs, and let the pipeline reach it.
Let GitHub Actions into AWS
- An OIDC identity provider and a role that only
mainof your repository may assume: the steps are in Pipeline Identities, Part 4. - TODO: Terraform, or the console; and where its state lives.
Estimate what the EKS cluster costs
An EKS cluster is paid for by the hour, from the moment it exists, whether the app runs or not. So the cost follows the hours it exists, not the hours you work.
The hourly price of what this project creates, in us-east-1:
| Part | Price |
|---|---|
| The EKS control plane | $0.100 |
Two worker nodes, t3.medium | $0.083 |
| One NAT gateway | $0.045 |
| One load balancer | $0.023 |
| Public IPv4 addresses: the NAT gateway's and the load balancer's, about three | $0.015 |
| The nodes' disks, 2 ร 20 GB | $0.004 |
| In all | about $0.27 an hour |
The traffic a student sends costs cents, and is left out.
For a student working 20โ30 hours a month:
- Create the cluster at the start of each session, and destroy it at its end.
- Creating takes about 15 minutes and destroying about 10, so each session adds about half an hour.
- In about 8 sessions a month, that is 4 more hours: 24โ34 hours of cluster.
- A month: 24โ34 hours ร $0.27 = about $6.50โ$9.20.
- 2โ4 months: about $13โ$37 in all.
- Left running, the same cluster costs $0.27 ร 730 hours = about $200 a month, and $6.50 for every day it is
forgotten.
- An AWS budget with an e-mail alert, at $20 a month, catches a forgotten cluster in days.
Create the target
Option 1: an EKS cluster
- The cluster and one node group: TODO: Terraform module or eksctl.
- See EKS Cluster Creation for what each step makes.
- The pipeline's role gets an access entry for one namespace: Pipeline Identities, Part 5.
- The cluster pulls the private image with a pull secret: Pipeline Identities, Part 6.
Option 2: a set of EC2 instances
- TODO: an Auto Scaling group behind a load balancer, Docker on each instance.
- TODO: how a deploy reaches them: SSM Run Command, or a new launch template and an instance refresh.
- The pipeline's role gets permission for that one action, on those instances only.
Check the target by hand
- Run the image from Task 4 on it once, by hand, and call
/healthz.