카카오클라우드 - 클라우드 개발자 교육 7주차 후기

AWS VPC Terraform에 일부 코드다.

AWS VPC, SG, instance 생성하기.

#vpc.tf

data "aws_availability_zones" "available" {
  state = "available"
}

resource "aws_vpc" "yhj09-VEC-PRD-VPC" {
  cidr_block           = "10.250.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  instance_tenancy     = "default"
  tags = {
    Name = "yhj09-VEC-PRD-VPC"
  }
}

# Public Subnets
resource "aws_subnet" "yhj09-VEC-PRD-VPC-NGINX-PUB-2A" {
  vpc_id                  = aws_vpc.yhj09-VEC-PRD-VPC.id
  cidr_block              = "10.250.1.0/24"
  map_public_ip_on_launch = true
  availability_zone       = "us-east-2a"
  tags = {
    Name = "yhj09-VEC-PRD-VPCNGINX-PUB-2A"
  }
}

resource "aws_subnet" "yhj09-VEC-PRD-VPC-NGINX-PUB-2C" {
  vpc_id                  = aws_vpc.yhj09-VEC-PRD-VPC.id
  cidr_block              = "10.250.11.0/24"
  map_public_ip_on_launch = true
  availability_zone       = "us-east-2c"
  tags = {
    Name = "yhj09-VEC-PRD-VPCNGINX-PUB-2C"
  }
}

# DB Subnets (Private)
resource "aws_subnet" "yhj09-VEC-PRD-VPC-DB-PRI-2A" {
  vpc_id                  = aws_vpc.yhj09-VEC-PRD-VPC.id
  cidr_block              = "10.250.13.0/24"
  map_public_ip_on_launch = false
  availability_zone       = "us-east-2a"
  tags = {
    Name = "yhj09-VEC-PRD-VPC-DB-PRI-2A"
  }
}

resource "aws_subnet" "yhj09-VEC-PRD-VPC-DB-PRI-2C" {
  vpc_id                  = aws_vpc.yhj09-VEC-PRD-VPC.id
  cidr_block              = "10.250.12.0/24"
  map_public_ip_on_launch = false
  availability_zone       = "us-east-2c"
  tags = {
    Name = "yhj09-VEC-PRD-VPC-DB-PRI-2C"
  }
}

# Tomcat Subnets (Private)
resource "aws_subnet" "yhj09-VEC-PRD-VPC-TOMCAT-PRI-2A" {
  vpc_id                  = aws_vpc.yhj09-VEC-PRD-VPC.id
  cidr_block              = "10.250.2.0/24"
  map_public_ip_on_launch = false
  availability_zone       = "us-east-2a"
  tags = {
    Name = "yhj09-VEC-PRD-VPCTOMCAT-PRI-2A"
  }
}

resource "aws_subnet" "yhj09-VEC-PRD-VPC-TOMCAT-PRI-2C" {
  vpc_id                  = aws_vpc.yhj09-VEC-PRD-VPC.id
  cidr_block              = "10.250.4.0/24"
  map_public_ip_on_launch = false
  availability_zone       = "us-east-2c"
  tags = {
    Name = "yhj09-VEC-PRD-VPCTOMCAT-PRI-2C"
  }
}

# Internet Gateway
resource "aws_internet_gateway" "yhj09-igw" {
  vpc_id = aws_vpc.yhj09-VEC-PRD-VPC.id
  tags = {
    Name = "yhj09-VEC-PRD-IGW"
  }
}

# Public Route Table
resource "aws_route_table" "yhj09-public-rtb" {
  vpc_id = aws_vpc.yhj09-VEC-PRD-VPC.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.yhj09-igw.id
  }

  tags = {
    Name = "yhj09-VEC-PRD-PUBLIC-RTB"
  }
}

# Route Table Associations for Public Subnets
resource "aws_route_table_association" "yhj09-nginx-pub-2a" {
  subnet_id      = aws_subnet.yhj09-VEC-PRD-VPC-NGINX-PUB-2A.id
  route_table_id = aws_route_table.yhj09-public-rtb.id
}

resource "aws_route_table_association" "yhj09-nginx-pub-2c" {
  subnet_id      = aws_subnet.yhj09-VEC-PRD-VPC-NGINX-PUB-2C.id
  route_table_id = aws_route_table.yhj09-public-rtb.id
}

# Private Route Table 
resource "aws_route_table" "yhj09-private-rtb" {
  vpc_id = aws_vpc.yhj09-VEC-PRD-VPC.id

  tags = {
    Name = "yhj09-VEC-PRD-PRIVATE-RTB"
  }
}

# Route Table Associations for DB Private Subnets
resource "aws_route_table_association" "yhj09-db-pri-2a" {
  subnet_id      = aws_subnet.yhj09-VEC-PRD-VPC-DB-PRI-2A.id
  route_table_id = aws_route_table.yhj09-private-rtb.id
}

resource "aws_route_table_association" "yhj09-db-pri-2c" {
  subnet_id      = aws_subnet.yhj09-VEC-PRD-VPC-DB-PRI-2C.id
  route_table_id = aws_route_table.yhj09-private-rtb.id
}

#alb.tf

# Application Load Balancer 
resource "aws_lb" "nginx_alb" {
  count = var.enable_alb ? 1 : 0

  name               = "yhj09-VEC-PRD-NGINX-ALB"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.nginx_sg.id]
  subnets = [
    aws_subnet.yhj09-VEC-PRD-VPC-NGINX-PUB-2A.id,
    aws_subnet.yhj09-VEC-PRD-VPC-NGINX-PUB-2C.id
  ]

  enable_deletion_protection = false

  tags = {
    Name = "yhj09-VEC-PRD-NGINX-ALB"
  }
}

# Target Group for NGINX
resource "aws_lb_target_group" "nginx_tg" {
  count = var.enable_alb ? 1 : 0

  name     = "yhj09-VEC-PRD-NGINX-TG"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.yhj09-VEC-PRD-VPC.id

  health_check {
    enabled             = true
    healthy_threshold   = 2
    interval            = 30
    matcher             = "200"
    path                = "/"
    port                = "traffic-port"
    protocol            = "HTTP"
    timeout             = 5
    unhealthy_threshold = 2
  }

  tags = {
    Name = "yhj09-VEC-PRD-NGINX-TG"
  }
}

# Register NGINX instances to Target Group
resource "aws_lb_target_group_attachment" "nginx_2a" {
  count = var.enable_alb ? 1 : 0

  target_group_arn = aws_lb_target_group.nginx_tg[0].arn
  target_id        = aws_instance.nginx_2a.id
  port             = 80
}

resource "aws_lb_target_group_attachment" "nginx_2c" {
  count = var.enable_alb ? 1 : 0

  target_group_arn = aws_lb_target_group.nginx_tg[0].arn
  target_id        = aws_instance.nginx_2c.id
  port             = 80
}

# ALB Listener - HTTP 
resource "aws_lb_listener" "nginx_http_redirect" {
  count = var.enable_alb && var.enable_http_to_https_redirect && var.enable_https ? 1 : 0

  load_balancer_arn = aws_lb.nginx_alb[0].arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

# ALB Listener - HTTP
resource "aws_lb_listener" "nginx_http_forward" {
  count = var.enable_alb && !(var.enable_http_to_https_redirect && var.enable_https) ? 1 : 0

  load_balancer_arn = aws_lb.nginx_alb[0].arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.nginx_tg[0].arn
  }
}

# ALB Listener - HTTPS
resource "aws_lb_listener" "nginx_https" {
  count = var.enable_alb && var.enable_https && var.acm_certificate_arn != "" ? 1 : 0

  load_balancer_arn = aws_lb.nginx_alb[0].arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = var.acm_certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.nginx_tg[0].arn
  }
}

AWS 접속, NGINX로 로드벨런싱하기

 

로드벨런서중 CLB라는 classic 버전 로드벨런서를 실제로 구현해 보았다.

동작흐름이 이해되지 않았다. 내가 알던 로드밸런서의 개념과 살짝 달랐던거 같다.

로드벨런서가 TCP 트래픽 까지 처리??

그리고 EC2 기반의 단순 트래픽 분산 목적이라는 개념이 이해되지 않았는데 구현하며 깨달았고, 

이에 대한 배경 지식을 학습하고 다시 공부하니 이해가 좀 더 쉬웠다.

CLB는 단순히 트래픽만 나눠준다는것이다.

 

IaC, terraform으로 작성하려니 더욱 햇갈렸다.
아키텍쳐가 ALB에서 NGINX, 그리고 다시 새로운 ALB를 통하게 된것이다.
구조를 만들어 놓고 보니 이런 의문이 생겼다.
ALB가 외부 로드벨런싱해주고 Nginx가 리버스 프록시 서버 역할해줘야 정석인데 왜 이렇게 됐지?
리버스 프록시가 있는데 내부 로드밸런싱을 해줘야해?
리버스 프록시고 AZ 구조 인데 왜 연결을 했지?
등등..
근본적인 구조의 이해도가 있다 하더라도 머릿속에 있는 것을 코드로 바로 구현하기란 매우 어려웠다.
먼저 IaC가 말그대로 code. 반복문 사용… 변수… 이런 개념이 있다는게 신기했다. 더 흥미로웠던것같다. 왜 반복문, 변수가 있어야할까? 라는 고민을 가지고 코드를 실제로 작성해보니 퍼즐이 금방 맞춰졌다.

근데 왜 아직 DB인스턴스를 생성할때 15분 이상 걸리는지,
destroy할때 nginx subnet이 왜 15분 이상 걸리는지, ??
항상 결국에 수동으로 지워야하는 부분이 있따.

추가로 NAT가 뭔지, 동작원리, 패킷흐름,역할등등 전반적인 네트워크의 이해도가 조금더 높아지는 시간이 됐다. 평소 공부해두고 자주 사용하지 않아 까먹은부분, 두루뭉실하게 개념만 있던 부분들이 정리됐다.

 

https://github.com/yhj0904/AWS_3-Tier_Architecture_with_Terraform

 

—————————————————————————— 
본 후기는 [카카오엔터프라이즈x스나이퍼팩토리] 카카오클라우드로 배우는 AIaaS 마스터 클래스 3기(B-log) 리뷰로 작성 되었습니다.