The EKS deployment should use ServiceAccount for pods Create the CR to eks cluster Control the access to Istio ingress gateway through bind the securitygroup to pod network interface. 1apiVersion: vpcresources.k8s.aws/v1beta1 2kind: SecurityGroupPolicy 3metadata: 4 name: istio-internal-ingressgateway-sg 5 namespace: …

read more

For greater isolation and convenience, we can use farget as the run time environment for eks. Create eks farget execute role named: AmazonEKSFargatePodExecutionRole the TrustPolicy statements like following 1# trust policy 2{ 3 "Version": "2012-10-17", 4 "Statement": [ 5 { 6 "Effect": …

read more

Define pattern for log groups in cloudwatch Create filter pattern filter pattern: [action, azid, bytes, dstaddr,dstport,instanceid,protocol,srcaddr,srcport,subnetid] Metric namespaces Name for metric namespace Metric name: bytes Metric value: $bytes Unit: Bytes Dimensions: Dimension Name: dst-addr, Dimension Value: …

read more

When you develop components locally that rely on AWS, it can be cumbersome to configure authentication information, and sometimes network latency. It is important to mock with a native AWS component, which can:localstack I’m using Docker-Compose here to start a set of tools that local development depends on： The …

read more

Vpc network division According to the requirements of the product and the customer, the two services of the two types of subnets are isolated. For example, DBsubnet01 and DBsubnet02 are both internal private subnets and belong to different product segments. ​ The two major subnet types are the intranet and the …

read more