SUSE Linux Enterprise in the Public Cloud #

Creating a new ECS cluster in Amazon is accomplished by using the First Run Wizard. Alternatively you may use the aws command line tool to create the cluster, refer to create for details. In the First Run Wizard select Custom if you want to create a setup unique to your own needs. The Amazon ECS sample selection creates a pre-defined web application setup, that may be customized. By default the First Run Wizard selects the Amazon ECS AMI, we will change this later.

Note

Note that using the First Run Wizard also creates an autoscaling group. This implies that at least one instance (default setting) is always running and a new instance will be started by the autoscaling group if the running instance should be stopped or terminated.

We recommend retaining the default cluster name default. When the cluster is named default an ECS instance will automatically attach itself to the cluster without additional configuration steps. Selecting a custom name for the cluster requires the instance to be configured as outlined in Section 3.1, “Alternative cluster name”.

Use of the Amazon EC2 Container Service requires permissions that are not enabled by default in the Identity and Access Management (IAM) functionality. Therefore it is necessary to create a policy that provides users that are intended to use ECS with the proper permissions. We recommend the following policy:

{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:CreateCluster",
                  "ecs:DeregisterContainerInstance",
                  "ecs:DiscoverPollEndpoint",
                  "ecs:Poll",
                  "ecs:RegisterContainerInstance",
                  "ecs:Submit*",
                  "ecs:StartTask",
                  "ecs:DescribeTasks",
                  "ecs:StopTask",
                  "ecs:RegisterTaskDefinition",
                  "ecs:DescribeTaskDefinition",
                  "ecs:DescribeContainerInstances",
                  "ecs:StartTelemetrySession"
              ],
              "Resource": [
                  "*"
              ]
          }
      ]
    }

For additional information about IAM policies, see the Amazon documentation: IAM Policies

Once the policy is created attach it to a role named ecsInstanceRole. Details about ECS specific policies and roles can be found in the Amazon documentation: IAM Role

Note

Note that the policy given above is more permissive than the policy example provided in the Amazon documentation.

Once the cluster is up and running and your AWS account provides a permissive IAM role for ECS, you can continue to run ECS instances as follows:

The integrated ECS service requires access to Amazon S3 to download a pre-built container. This implies that if you start an ECS instance that has no route to reach Amazon S3 the initialization will fail and the container host instance will not be able to attach itself to your cluster. Should you end up in a situation where the instance does not attach itself to your default cluster, you can modify your network configuration to ensure a route to Amazon S3 and then simply log into your container instance as start the service as follows:

$ systemctl start amazon-ecs.service

SUSE Linux Enterprise Server Docker images are not available on Docker Hub. However, SUSE provides pre-built Docker images as packages in the SLE-Module-Containers12-Updates repository. Given that your launched instance has a route to the Internet and that the traffic originates with an IP address assigned by EC2 the instance will automatically register with an update server and the SLE-Module-Containers12-Updates repository will be configured. Once configured, installing a SUSE Linux Enterprise Server Docker image is simple:

$ zypper se docker-image

Install the image you are interested in, the SUSE Linux Enterprise Server 12 image for example:

$ zypper in sles12-docker-image

The SUSE Linux Enterprise Server license does not allow you to push this image to a public Docker Registry. However you can use the Amazon-hosted private Container Registry to store SUSE Linux Enterprise Server containers.

For additional details about SUSE Linux Enterprise Server Docker images see Quick Start Guide.

The SUSE Linux Enterprise Server ECS image uses Btrfs as the storage backend for Docker image storage. The image storage is self contained in the /var/lib/docker-storage.btrfs file that is mounted to /var/lib/docker. The image storage is configured to be 100 GB in size. This is thinly provisioned and thus does not actually take up 100 GB of space on the root file system. It is the users responsibility to start an instance with a sufficiently large root volume to store the Docker images.

If you store a large number of Docker images or you want to safeguard your local Docker images from accidental deletion you may consider to place the image storage onto an external Elastic Block Store device. If you format the device with Btrfs no changes to the Docker configuration are required.

Note

The device must be mounted to /var/lib/docker.

If you choose another storage backend you will need to modify /etc/sysconfig/docker to pass the appropriate configuration options to Docker Open Source Engine at start up. For information about storage configuration and storage related options, see the Docker User Guide at https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/.

If you decide that you want to clean up and shut everything down there are a few additional steps to take when compared to terminating a system that is not associated with a cluster.

To delete a cluster the tasks count of the tasks associated with the cluster must be zero.

$ aws ecs update-service \
     --service TASK_NAME \
     --desired-count 0

Where TASK_NAME is the name of the task associated with the cluster. If you used the Quick Launch Wizard and selected Amazon ECS sample the TASK_NAME is sample-webapp.

After setting the task/service count to zero as shown above you can delete the task/service as follows:

$ aws ecs delete-service --service TASK_NAME

As mentioned previously, the First Run Wizard also creates an autoscaling group. This group also needs to be deleted.

Note

Any running instances associated with the autoscaling group will be terminated when the autoscaling group is deleted.

$ aws autoscaling delete-auto-scaling-group \
     --auto-scaling-group-name GROUP_NAME

Now you are ready to delete the cluster.

$ aws ecs delete-cluster --cluster CLUSTER_NAME