Update ECS getting started page to use new daemon service support in ECS

[nathanpeck]

The ECS getting started guide says:

 Note that linkerd, consul-agent, and consul-registrator run on every ECS node.
 As of the writing of this guide, the ECS scheduler does not explicitly support this.
 Instead, we use an AWS Launch Configuration to bootstrap every ECS node with
 these three foundational services. We still boot these foundational services via an
 aws ecs start-task command, so they will be visible as running ECS containers.

ECS now supports daemon services via the DAEMON scheduling strategy: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html#service_scheduler

These docs can be updated to no longer use the launch configuration and instead use a daemon service. If I get time I'll take a stab at an initial pass to update them as it will make the linkerd daemon deployment much more stable and safe.

[grampelberg]

@nathanpeck this sounds like an awesome update. As I know absolutely nothing about ECS, would you mind taking a pass? A PR would be super, duper fantastic.

[nathanpeck]

Awesome will do!

[nathanpeck]

The first take on an update to the ECS getting started is up at https://containersonaws.com/architecture/linkerd-1x-consul-service-mesh/

Some notable changes:

• CloudFormation templates instead of manual API calls. This could be advantageous by making the ECS getting started more similar to the setup on Kubernetes (just upload a YAML file instead of a bunch of manual steps)
• Using ECS Daemons for linkerd, consul-registrator, and consul-agent instead of manually launching a task on the machine using the autoscaling groups launch script
• Gave the consul-agent a task role so it can locate the Consul server, instead of assigning the role to the EC2 instance. This better aligns with most ECS customer's desire to keep the EC2 as unprivileged as possible, and just grant the consul-agent container permissions.
• Reduced the security group permissions. Previously it was opening the relevant ports to the entire world. Now it asks for your IP address and makes the Consul, Linkerd dashboard, and Linkerd proxy available to your IP address and internal IP's only.
• Instead of running a curl loop from your localhost, I recommend running a load test task inside the cluster which can make more requests, faster, with lower latency. (Makes the Linkerd dashboard and linkerd-viz more interesting).

I'd be interested in knowing which if any of these changes you'd like to pull into the official docs. At a minimum I think the usage of ECS daemons instead of manual RunTask, and the usage of a task role instead of an EC2 role should be pulled in.

[grampelberg]

In my opinion, I'd love all of that in the official docs. It looks fantastic!

[wmorgan]

Agreed, I would happily see all of those changes in the docs.

[nathanpeck]

The following PR's address this issue:

• https://github.com/linkerd/website/pull/34
• https://github.com/linkerd/linkerd-examples/pull/240

[grampelberg]

@nathanpeck can we close this out now?

[nathanpeck]

Yep! Thanks a lot everyone!

[grampelberg]

Thank you! Awesome doc =)