Amazon VPC Latticeを使ってコンテナ(EKS)とLambda関数で相互通信する

kubectl get gatewayclass
> NAME                 CONTROLLER                                              ACCEPTED   AGE
> amazon-vpc-lattice   application-networking.k8s.aws/gateway-api-controller   True       75s

kubectl get pod -n aws-application-networking-system
> NAME                                      READY   STATUS    RESTARTS   AGE
> gateway-api-controller-5b5b89bd87-f29kf   2/2     Running   0          2m48s

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: sample
  annotations:
    application-networking.k8s.aws/lattice-vpc-association: "true"
spec:
  gatewayClassName: amazon-vpc-lattice
  listeners:
    - name: https
      protocol: HTTPS
      port: 443

kubectl apply -f gateway.yaml

import { Handler } from 'aws-lambda';

export const hello: Handler = async (event) => {
  return {
    statusCode: 200,
    body: 'Hello Foo Lambda!!'
  };
};

service: 'sample'
frameworkVersion: '3'
plugins: ['serverless-esbuild']
provider:
  name: 'aws'
  region: 'ap-northeast-1'
  runtime: 'nodejs18.x'
functions:
  hello:
    handler: "handler.hello"
package:
  individually: true
custom:
  esbuild:
    bundle: true
    minify: false
    sourcemap: true
    exclude: ['aws-sdk']
    target: 'node18'
    define: { 'require.resolve': undefined }
    platform: 'node'
    concurrency: 10
resources:
  Resources:
    # Lattice Service resources
    # APIを公開するサービス
    FooService:
      Type: AWS::VpcLattice::Service
      Properties:
        AuthType: NONE
        Name: foo-service
    # サービスレベルのリスナー(プロトコルやデフォルトルール)
    FooListener:
      Type: AWS::VpcLattice::Listener
      Properties:
        DefaultAction:
          Forward:
            TargetGroups:
              - TargetGroupIdentifier: !Ref FooTargetGroup
        Protocol: HTTPS
        ServiceIdentifier: !Ref FooService
    # サービスを実際に提供しているアプリケーション群
    FooTargetGroup:
      Type: AWS::VpcLattice::TargetGroup
      Properties:
        Name: foo-lambda
        Targets:
          - Id: !GetAtt HelloLambdaFunction.Arn
        Type: LAMBDA
    # サービスをService Networkに関連付けする
    FooServiceAssociation:
      Type: AWS::VpcLattice::ServiceNetworkServiceAssociation
      Properties:
        ServiceIdentifier: !Ref FooService
        # Service Network(sample)のARNを指定
        ServiceNetworkIdentifier: arn:aws:vpc-lattice:ap-northeast-1:XXXXXXXXXXXX:servicenetwork/sn-095ecd8e8bb0273d1

serverless deploy

kubectl run --image curlimages/curl --rm -it curl -- sh
curl https://foo-service-xxxxxxxxxxxxxxxxx.xxxxxxx.vpc-lattice-svcs.ap-northeast-1.on.aws
> Hello Foo Lambda!!

apiVersion: v1
kind: ConfigMap
metadata:
  name: server
data:
  index.js: |
    const http = require('http');

    const server = http.createServer((req, res) => {
      res.statusCode = 200;
      res.setHeader('Content-Type', 'text/plain');
      res.end('Hello Bar EKS Pod!!');
    });

    const hostname = '0.0.0.0';
    const port = 8080;
    server.listen(port, hostname, () => {
      console.log(`Server running at http://${hostname}:${port}/`);
    });
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: app
  template:
    metadata:
      labels:
        app: app
    spec:
      containers:
        - name: app
          image: node:18
          ports:
            - name: http
              containerPort: 8080
          command: [sh, -c, "node /opt/server/index.js"]
          volumeMounts:
            - mountPath: /opt/server
              name: server
      volumes:
        - name: server
          configMap:
            name: server
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: app
  name: app
spec:
  type: NodePort
  selector:
    app: app
  ports:
    - targetPort: 8080 # httpはNG!!
      port: 80

kubectl apply -f app.yaml

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: eks-app
spec:
  parentRefs:
    - name: sample
      sectionName: https
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /app
      backendRefs:
        - name: app
          kind: Service
          port: 80

kubectl apply -f httproutes.yaml

export const client: Handler = async (event) => {
  const res = await fetch('https://eks-app-default-xxxxxxxxxxxxxxxxx.xxxxxxx.vpc-lattice-svcs.ap-northeast-1.on.aws/app');
  return {
    statusCode: 200,
    body: `from EKS: ${await res.text()}`
  };
};

service: 'sample'
frameworkVersion: '3'
plugins: ['serverless-esbuild']
provider:
  name: 'aws'
  region: 'ap-northeast-1'
  runtime: 'nodejs18.x'
functions:
  hello:
    handler: "handler.hello"
  # 追加した関数(サービスクライアント)
  eksClient:
    handler: "handler.client"
    # VPCにアタッチ
    vpc:
      securityGroupIds:
        - !Ref LambdaSG
      subnetIds:
        - subnet-xxxxxxxxxxxxxxxxx
        - subnet-yyyyyyyyyyyyyyyyy
package:
  individually: true
custom:
  # (中略)
resources:
  Resources:
    # (中略)
    LambdaSG:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: Allow http to client host
        VpcId: vpc-zzzzzzzzzzzzzzzzz

serverless deploy

aws lambda invoke --function-name sample-dev-eksClient /dev/stdout
> {"statusCode":200,"body":"from EKS: Hello Bar EKS Pod!!"}