AWS Fargate 任务未通过 ELB 运行状况检查

Question

我该如何进一步排除故障？我正在尝试运行一个简单的 nginx 容器，但负载平衡器抱怨运行状况检查失败并且任务没有响应其 ip 号，可能是因为负载平衡器出错。

我在 cloudformation 中将任务的优先级设置为 2。如果我尝试将优先级设置为 1，则 CF 堆栈将无法部署。能跟这有关系吗？

# Create a rule on the load balancer for routing traffic to the target group
  LoadBalancerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - TargetGroupArn: !Ref 'TargetGroup'
          Type: 'forward'
      Conditions:
        - Field: path-pattern
          Values: [!Ref 'Path']
      ListenerArn: 
        Fn::ImportValue: !Ref LoadBalancerListener
      Priority: !Ref 'Priority'

资源看起来像：

Resources:

  # The task definition. This is a simple metadata description of what
  # container to run, and what resource requirements it has.
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: nginx
      Cpu: 256
      Memory: 512
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ContainerDefinitions:
        - Name: nginx
          Cpu: 128
          Memory: 256
          Image: nginx
          PortMappings:
            - ContainerPort: 80

  Service:
    Type: AWS::ECS::Service
    DependsOn: LoadBalancerRule
    Properties:
      ServiceName: !Ref 'ServiceName'
      Cluster: 
        Fn::ImportValue: !Ref EcsCluster
      LaunchType: FARGATE
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 75
      DesiredCount: !Ref 'DesiredCount'
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups: 
            - !Ref EcsHostSecurityGroup
          Subnets:
            - !ImportValue core-vpc-PublicSubnet1AID
            - !ImportValue core-vpc-PublicSubnet1BID
      TaskDefinition: !Ref 'TaskDefinition'
      LoadBalancers:
        - ContainerName: !Ref 'ServiceName'
          ContainerPort: 80
          TargetGroupArn: !Ref TargetGroup

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 6
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      TargetType: ip
      Name: !Ref 'ServiceName'
      Port: !Ref 'ContainerPort'
      Protocol: HTTP
      UnhealthyThresholdCount: 2
      VpcId: !ImportValue core-vpc-VPCID



  # This security group defines who/where is allowed to access the ECS hosts directly.
  # By default we're just allowing access from the load balancer.  If you want to SSH
  # into the hosts, or expose non-load balanced services you can open their ports here.
  EcsHostSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !ImportValue core-vpc-VPCID
      GroupDescription: Access to the ECS hosts and the tasks/containers that run on them
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: "-1"
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: 138.106.0.0/16

# Create a rule on the load balancer for routing traffic to the target group
  LoadBalancerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - TargetGroupArn: !Ref 'TargetGroup'
          Type: 'forward'
      Conditions:
        - Field: path-pattern
          Values: [!Ref 'Path']
      ListenerArn: 
        Fn::ImportValue: !Ref LoadBalancerListener
      Priority: !Ref 'Priority'

Answer 1

您没有在模板中包含实际的负载均衡器。请包括这一点，以获得完整的答案。

您的问题很可能是您的负载均衡器（很可能在您的子网中有一个私有 IP 并与之通信）不允许与您的 ECS 实例通信，因为它们只允许来自138.106.0.0/16.