在 AWS ECS 上的 Docker 映像中运行 CloudWatch Agent 失败

Question

对于这个问题，我对 Docker 和 AWS 还比较陌生。

目标是创建一个使用基本 Laravel 应用程序运行 Apache 和 PHP 的单个 AWS ECS 实例。我想运行 CloudWatch 代理将所有日志发送到 CloudWatch（Apache 的访问和错误日​​志、PHP 的错误日志和 Laravel 日志）。

我知道这可能不是“最佳实践”（欢迎提供提示），但我现在的理念是“首先让它工作，然后让它变得漂亮”:-)

我的 Dockerfile：

FROM amazonlinux:latest

# Update/Install
RUN yum update -y && \
    # Install PHP & epel
    amazon-linux-extras install -y php7.3 epel && \
    # Install
    yum install -y \
    # Install apache
    httpd \
    # Install tools for CloudWatch
    collectd statsd \
    # Install supervisor
    supervisor \
    # Install cloudwatch agent
    https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm && \
    # Clean install data
    yum clean metadata && \
    yum -y clean all && \
    rm -rf /var/cache/yum

# PHP Settings
RUN sed -i \
    '/<Directory \"\/var\/www\/html\">/,/<\/Directory>/ s/AllowOverride None/AllowOverride All/' \
    /etc/httpd/conf/httpd.conf

# Remove default html folder
RUN rm -rf /var/www/html

# Configure supervisor
COPY supervisord.conf /etc/supervisord.conf

# Configure CloudWatch agent
COPY amazon-cloudwatch-agent.json /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json

# Add source to image
ADD . /var/www/aws

RUN chown -R apache:apache /var/www && ln -s /var/www/aws/public /var/www/html

# Expose port 80
EXPOSE 80

# Start supervisor
CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf"]

我的主管.conf

[supervisord]
nodaemon=true

[program:httpd]
priority=1
command=/usr/sbin/apachectl -D FOREGROUND
autorestart=true
username=apache

[program:php]
priority=2
command=/usr/sbin/php-fpm
autorestart=true

[program:cloudformation]
priority=10
command=/opt/aws/amazon-cloudwatch-agent/bin/start-amazon-cloudwatch-agent
autorestart=true

我的云观察配置：

{
    "agent": {
        "metrics_collection_interval": 60,
        "region": "eu-europe-1",
        "logfile": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log",
        "debug": false,
        "run_as_user": "cwagent"
    },
    "logs": {
        "logs_collected": {
            "files": {
                "collect_list": [
                    {
                        "file_path": "/var/log/php-fpm/www-error.log",
                        "log_group_name": "aws-docker",
                        "log_stream_name": "{instance_id}"
                    }
                ]
            }
        }
    }
}

基本上，这作为运行 Laravel 应用程序的 docker 镜像运行良好。我现在遇到的唯一问题是 CloudWatch 代理。它在 ECS 中的容器上启动，但无法运行并显示以下消息：

2020/02/22 13:39:28 I! 2020/02/22 13:39:28 E! ec2metadata is not available
I! Detected the instance is OnPrem
2020/02/22 13:39:28 Reading json config file path: /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json ...
Valid Json input schema.
I! Detecting runasuser...
2020/02/22 13:39:28 E! Credentials path is not set while runasuser is not root
2020/02/22 13:39:28 I! AmazonCloudWatchAgent Version 1.237768.0.
2020/02/22 13:39:28 Configuration validation first phase failed. Agent version: 1.237768.0. Verify the JSON input is only using features supported by this version.
2020/02/22 13:39:28 I! Return exit error: exit code=1
2020/02/22 13:39:28 E! Cannot translate JSON config into TOML, ERROR is exit status 1

首先我不明白为什么ec2metadata is not available会显示该消息。容器在ECS上运行，所以它应该是可用的（据我了解）。

第二条消息Configuration validation first phase failed. Agent version: 1.237768.0. Verify the JSON input is only using features supported by this version.。据我所知配置应该没问题。

我认为我的角色也可以，因为容器确实将日志发送到CloudWatch。

我究竟做错了什么？

Answer 1

以下是我如何用棍棒迫使它屈服。我们在 Docker 容器中使用非常轻量级的 Ubuntu 子集，该子集没有systemctlSystem V init，而 CloudWatch Agent 似乎就是为此而设计的。你可以start-amazon-cloudwatch-agent直接运行（正如这个答案提到的），但它不是那么顺利。

代理想要积极管理树的所有者/组/opt/aws/amazon-cloudwatch-agent。root(a) 如果您按照配置中的方式启动它"runasuser": "cwagent"，那么它会拒绝使用 AWS 配置/信用（Credentials path is not set如上所述），并且会失败。(b) 如果您以 开头cwagent，"runasuser": "cwagent"那么它会抱怨它无法更改一堆东西的所有权（即使它已经由 拥有cwagent），并且它会退出。(c) 但是如果你启动它并且cwagent在配置中不包含 a "runasuser"，它会抱怨，但它确实启动并做它的事情。

该Verify the JSON input is only using features supported by this version.消息是代理在遇到麻烦时所说的内容。它似乎与配置无关（这很好）。

以下是我的具体情况：

# Dockerfile

ADD ./files /tmp
# [...]
RUN curl -o /tmp/amazon-cloudwatch-agent.deb 'https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb' \
    && dpkg -i /tmp/amazon-cloudwatch-agent.deb \
    && rm -f /tmp/amazon-cloudwatch-agent.deb \
    && usermod -a -G www-data cwagent \
    && chgrp -R www-data /var/log/nginx \
    && chmod g+s /var/log/nginx \
    && chown -R cwagent:cwagent /opt/aws/amazon-cloudwatch-agent \
    && install -o cwagent -g cwagent -m 700 -d /home/cwagent \
    && install -o cwagent -g cwagent -m 700 -d /home/cwagent/.aws \
    && install -o cwagent -g cwagent -m 600 /tmp/cloudwatch.config /home/cwagent/.aws/config \
    && install -o cwagent -g cwagent -m 600 /tmp/cloudwatch.credentials /home/cwagent/.aws/credentials \
    && install -o cwagent -g cwagent -m 755 /tmp/cloudwatch-agent.json /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/default \
    && mv /tmp/99_cloudwatch.init /etc/my_init.d/

# /etc/my_init.d/99_cloudwatch.init

#!/bin/sh
su cwagent -c "nohup /opt/aws/amazon-cloudwatch-agent/bin/start-amazon-cloudwatch-agent >/tmp/cwagent.out 2>&1 &"
exit 0

// cloudwatch-agent.json

{
  "agent": {
    "region": "us-east-1",
    "debug": false
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/nginx/access.log",
            "log_group_name": "our-app",
            "log_stream_name": "nginx-access",
            "timestamp_format": "[%d/%b/%Y:%H:%M:%S %z]"
          },
          {
            "file_path": "/var/log/nginx/error.log",
            "log_group_name": "our-app",
            "log_stream_name": "nginx-error",
            "timezone": "UTC",
            "timestamp_format": "%Y/%m/%d %H:%M:%S"
          }
        ]
      }
    }
  }
}