AWS におけるマルチテナント SaaS の実装パターン ~ Amazon Elastic Kubernetes Service (Amazon EKS) 編

kubectl get all -n 2b14e651-cdf3-4a77-a573-9343d0285045
NAME                          READY   STATUS    RESTARTS   AGE
pod/order-6699f75994-snlc2    1/1     Running   0          14h
pod/product-767ff9555-qvws5   1/1     Running   0          14h

NAME                      TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
service/order-service     NodePort   10.100.115.150   <none>        80:31225/TCP   14h
service/product-service   NodePort   10.100.139.85    <none>        80:31751/TCP   14h

NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/order     1/1     1            1           14h
deployment.apps/product   1/1     1            1           14h

NAME                                DESIRED   CURRENT   READY   AGE
replicaset.apps/order-6699f75994    1         1         1       14h
replicaset.apps/product-767ff9555   1         1         1       14h

kubectl get ingress -n 2b14e651-cdf3-4a77-a573-9343d0285045
NAME                      CLASS    HOSTS                                                                           ADDRESS                                                                         PORTS   AGE
order-service-ingress     <none>   ac33d4fd3e41245b5a327482f333908a-e4044c4908dfca7c.elb.us-east-1.amazonaws.com   ac33d4fd3e41245b5a327482f333908a-e4044c4908dfca7c.elb.us-east-1.amazonaws.com   80      14h
product-service-ingress   <none>   ac33d4fd3e41245b5a327482f333908a-e4044c4908dfca7c.elb.us-east-1.amazonaws.com   ac33d4fd3e41245b5a327482f333908a-e4044c4908dfca7c.elb.us-east-1.amazonaws.com   80      14h

# Provision EKS tenant.
aws codebuild start-build --project-name TenantOnboardingProject --environment-variables-override \
name=TENANT_ID,value=$tenantId,type=PLAINTEXT \
name=PLAN,value=$tier,type=PLAINTEXT \
name=COMPANY_NAME,value=$tenantName,type=PLAINTEXT \
name=ADMIN_EMAIL,value=$email,type=PLAINTEXT

const onboardingProject = new codebuild.Project(this, `TenantOnboardingProject`, {
...省略
    buildSpec: codebuild.BuildSpec.fromObject({
    version: '0.2',
    phases: {
        install: {
        commands: ['npm i'],
        },
        pre_build: {
        commands: [],
        },
        build: {
        commands: [
            'npm run cdk bootstrap',
            `npm run cdk deploy TenantStack-$TENANT_ID -- --require-approval=never ${cfnParamString}`,
        ],
        },
        post_build: {
        commands: props.applicationServiceBuildProjectNames.map(
            (x) =>
            `aws codebuild start-build --project-name ${x}TenantDeploy --environment-variables-override name=TENANT_ID,value=\"$TENANT_ID\",type=PLAINTEXT`
        ),
        },
    },
    }),
});

apiVersion: apps/v1
kind: Deployment
metadata:
  name: product
spec:
  replicas: 1
  selector:
    matchLabels:
      app: product
  template:
    metadata:
      labels:
        app: product
    spec:
      serviceAccountName: KUSTOMIZE_SVC_ACCOUNT_NAME
      automountServiceAccountToken: true
      containers:
        - name: product
          image: KUSTOMIZE_IMAGE
          ports:
            - containerPort: 5000
              name: "http"
---
apiVersion: v1
kind: Service
metadata:
  name: product-service
spec:
  selector:
    app: product
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 5000
  type: NodePort

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: product-service-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.org/mergeable-ingress-type: "minion"
spec:
  rules:
    - host: KUSTOMIZE_API_HOST
      http:
        paths:
          - path: /KUSTOMIZE_TENANT_NAME/products
            backend:
              service:
                name: product-service
                port:
                  number: 80
            pathType: Prefix

if (usingCustomDomain) {
    // add alias to existing distribution
    const tenantAppDomain = `${props.tenantid}.${props.customDomain}`;

    const hostedZone = route53.PublicHostedZone.fromHostedZoneAttributes(
    this,
    'PublicHostedZone',
    {
        hostedZoneId: props.hostedZoneId!,
        zoneName: props.customDomain!,
    }
    );

    const distribution = cloudfront.Distribution.fromDistributionAttributes(
    this,
    'CloudFrontDistribution',
    {
        distributionId: appDistributionId.valueAsString,
        domainName: distributionDomain.valueAsString,
    }
    );

    new route53.ARecord(this, `AliasRecord`, {
    zone: hostedZone,
    recordName: tenantAppDomain,
    target: route53.RecordTarget.fromAlias(new alias.CloudFrontTarget(distribution)),
    });
} else {

spec:
  rules:
    - host: KUSTOMIZE_API_HOST
      http:
        paths:
          - path: /KUSTOMIZE_TENANT_NAME/products
            backend:
              service:
                name: product-service
                port:
                  number: 80
            pathType: Prefix

// create service account for tenant
const tenantServiceAccount = cluster.addServiceAccount(`TenantServiceAccount`, {
    name: `${props.tenantid}-service-account`,
    namespace: props.tenantid,
});

// permission for order and product tables
tenantServiceAccount.addToPrincipalPolicy(
    new iam.PolicyStatement({
    actions: [
        'dynamodb:GetItem',
        'dynamodb:BatchGetItem',
        'dynamodb:Query',
        'dynamodb:PutItem',
        'dynamodb:UpdateItem',
        'dynamodb:DeleteItem',
        'dynamodb:BatchWriteItem',
        'dynamodb:Scan',
    ],
    resources: [orderTable.tableArn],
    effect: iam.Effect.ALLOW,
    })
);

// create service account for tenant
const tenantServiceAccount = cluster.addServiceAccount(`TenantServiceAccount`, {
    name: `${props.tenantid}-service-account`,
    namespace: props.tenantid,
});

// permission for order and product tables
tenantServiceAccount.addToPrincipalPolicy(
    new iam.PolicyStatement({
    actions: [
        'dynamodb:GetItem',
        'dynamodb:BatchGetItem',
        'dynamodb:Query',
        'dynamodb:PutItem',
        'dynamodb:UpdateItem',
        'dynamodb:DeleteItem',
        'dynamodb:BatchWriteItem',
        'dynamodb:Scan',
    ],
    resources: [orderTable.tableArn],
    effect: iam.Effect.ALLOW,
    })
);