use AWS ECS service per VPC for DB service #47842
Open
+16
−22
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GavinFrazar
added
aws
GavinFrazar
added
backport/branch/v16
no-changelog
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
Originally, single db enrollment deployed a DB service for an entire AWS region. This behavior was recently changed to deploy the DB service for a specific VPC in a region. So now the AWS ECS service must be named after the VPC it is deployed to for single db enrollment.
GavinFrazar
force-pushed
the
gavinfrazar/update-db-ecs-deployment
branch
from
f1f3f16
to
368c2c8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The Problem
Without this change, you are only able to have the db agent deployed in one VPC at a time, because the ECS service can only be in one VPC at a time and our deployment will always update the existing ECS service if it exists.
Background
Originally, single db enrollment deployed a DB service for an entire AWS region. This behavior was recently changed to deploy the DB service for a specific VPC in a region.
So now the AWS ECS service must be named after the VPC it is deployed to for single db enrollment.
We already have an endpoint that deploys database service by VPC - it was used for discovery service because we used to deploy a db service for each VPC when doing the auto-discovery enrollment flow.
All this PR does is align the single db enrollment flow and auto-discovery flow to deploy the DB service in the same way - ECS service named after the VPC.
This screenshot might help to illustrate the effect of this change:
old deployments:
gavin-leaf_cloud_gravitational_io-teleport-database-service(can only be in one VPC at a time)
new deployments:
database-service-vpc-082b35328b1fd4a56database-service-vpc-0e2541caa0a269def(can deploy to multiple VPCs)