Joget on Amazon Elastic Container Service

Disclaimer

While Joget does not officially support running on ECS, this guide act as a proof of concept to deploy Joget on ECS. Please visit AWS official documentation website for support and information.

Prerequisites

• An AWS Account
• Installed AWS CLI

Deploy Joget on ECS

Create Elastic File Storage(EFS)

Reference: https://docs.aws.amazon.com/efs/latest/ug/gs-step-two-create-efs-resources.html

Since Fargate storage is ephemeral(volatile), you will need to utilize EFS in order to persist the storage

1. Go to EFS console.
   
   
   
2. Click Create File System.
   
   
   
3. Choose the VPC you want to provision the EFS. Ensure that it is provisioned in the same VPC as the ECS Cluster.
4. Click Create.

Create ECS Task Execution Role

Reference: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html#create-task-execution-role

1. Go to Identity And Access Management(IAM) console.
2. On sidebar, click Roles.
3. Click Create Role.
   
   
   
4. Choose AWS Service under Trusted Entity Type.
   
   
   
5. Under Use Case, search and choose Elastic Container Service and choose Elastic Container Service Task and click Next.
   
   
   
6. Under Permission Policies, choose AmazonECSTaskExecutionRolePolicy and AmazonSSMFullAccess. Then click Next.
7. Enter the Role Name and Description, and review the permissions.
8. Click Create Role.

Creating ECS Cluster

Reference: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-cluster-console-v2.html

1. Go to Elastic Container Service(ECS) console.
   
   
   
2. Click Create Cluster.
   
   
   
3. Enter the Cluster Name.
4. Choose the Infrastructure (Fargate, EC2, External).
5. Click Create.

Create ECS Task Definition

Reference: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-task-definition.html#json-validate-for-create

1. On the sidebar, click Task Definition.
   
   
   
2. Click New Create Task Definition.
   
   
   
3. Enter the Task Definition name.
4. On Infrastructure Requirements, choose the launch type and specify the specs required.
   
   
   
5. Under Task Role, choose the role created in Create ECS Task Execution Role.
6. Under Task Execution Role, choose the role created in Create ECS Task Execution Role.
7. Under container, enter the container name.
8. Use jogetworkflow/joget-dx8-tomcat9 for the image.
9. Enter 8080 and 9080 for Container Port.
   
   
   
10. Add the following Environment Variable:
    1. Key: JAVA_OPTS
    2. Value: ${JAVA_OPTS_MEMORY} -Dwflow.home=${WFLOW_HOME} -Dwflow.systemkey=domain -javaagent:${LIB_HOME}/wflow-cluster.jar -javaagent:${LIB_HOME}/aspectjweaver-${ASPECTJ_VERSION}.jar -javaagent:${LIB_HOME}/glowroot/glowroot.jar "
       
       
       
11. Under Storage, click Add Volume.
    
    
    
12. Enter the volume name, and choose EFS as Volume Type.
    
13. Choose the EFS on File System ID.
    
14. Enter / as the root directory.
    
    
    
15. Under Container Mount Points, lick Add Mount Point
16. Select Container and Source Volume
17. Enter Container Path  as /opt/joget/wflow
    
    
18. Click Create.

Create ECS Service(HTTP)

Reference: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-service-console-v2.html

If you wish to setup Joget with HTTPS right away, click here

1. Click on one of the Cluster on ECS Dashboard.
   
   
   
2. Under Services tab, click Create Service.
   
   
   
3. Under Compute Options, choose one - If you are planning to use multiple Infrastructure, choose Capacity Provider Strategy. If you are using only one type of Infrastructure, choose Launch Type.
   
   
   
4. On Deployment Configuration, choose Service as Application Type.
   
   
   
5. Choose the Task Definition create above on Family dropdown.
   
6. Enter the Desired Task number, depending on the load expected(Leave at one for testing purpose).
   
   
   
7. Under networking, you may choose your own VPC if available. You can leave as default for testing(Ensure that the VPC chosen is the same as where the EFS being provisioned).
   
   
   
8. Under Load Balancing, choose Application Load Balancer.
9. Create or choose Existing Load Balancer.
   
   
   
10. Enter the Load Balancer name.
11. Enter 30 in the Health Check Grace Period .
    
    
    
12. Choose container 8080:8080.
    
13. Specify the Listener and the Target Group:
    1. Use port 8080 in when creating new Listener.
    2. Enter /jw on the Health Check path. 
       
       
       
14. Click Create.

Modify Load Balancer Properties

Update Target Group Health Check Settings

1. Go to EC2 >  Load Balancers > Target Group > ECS Target Group.
   
   
   
2. Click on Health Check and click Edit.
   
3. Change the timeout to 30 seconds and interval to 40 seconds.
   
4. Update the healthy status code to 200-399.
   
   
   
5. Click Save Changes.

Updating Permission on Joget wflow folder

Reference: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html

Updating ECS Service to Allow execute-command

1. Open CLI/Terminal.
2. Execute the following command:

   aws ecs update-service --service <ecs-service> --cluster <cluster-name> --enable-execute-command --force-new-deployment

3. Wait until the deployment is complete before proceeding to the next step. You can view the status through AWS Console.

Accessing Container in ECS Task

1. Go to ECS Cluster and click the cluster that has been created.
2. Go to Services tab and click the service that is in use.
3. Go to Tasks tab and click copy icon beside the Task ID.
4. Open CLI/Terminal.
5. Execute the following command:

   aws ecs execute-command --cluster <cluster-name> --task <task-arn> --container <container-name> --command "/bin/bash" --interactive

    
   Note: container-name is name given to the container in Task Definition.
6. Once accessed the task, run:

   chown -R tomcat:joget /opt/joget/wflow

7. Verify the ownership of the folder by running:

   ls -l /opt/joget

   . Ensure that the owner would be tomcat instead of root.

Note: You will only need to go through the above steps once as the folder will be shared through EFS.

Accessing Joget Through Load Balancer

Once Joget has been deployed and the health check is complete, you can access the application through the load balancer DNS.

1. Go to EC2 console > Load Balancers.
   
2. On the Load Balancer page, click the copy icon under the DNS Name column.
   
   
   
3. Paste the link in the browser.

Deploy Joget on ECS Fargate with HTTPS Support

Reference: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

Request SSL Certificate from Amazon Certificate Manager(ACM)

Before requesting the SSL certificate, ensure that the domain name that will be used to request the certificate has been created beforehand as it will be used for DNS validation in the following steps.

1. Go to ACM Console.
2. Click Request.
3. Leave the selection at Request a Public Certificate.
   
   
   
4. Enter the fully qualified domain.
   
   
   
5. Use DNS validation as the Validation Method.
   
   
   
6. Click Request.
7. Click on the Certificate ID that has just been requested.
   
   
   
8. Under domains, there are information regarding the DNS validation.
1. If you are using Route 53, you can quickly create the record set by clicking on Create Records on Route 53.
2. If you are using different DNS provider, you will need to copy the CNAME Name and CNAME Value, and create a new record set with them.
   
   
   
9. Once you have created the record sets, the DNS will be validated. It may take a moment to propagate.

Create ECS Service(HTTPS)

1. Click on one of the Cluster on ECS Dashboard.
2. Under Services tab, click Create Service.
3. Under Compute Options, choose one - If you are planning to use multiple Infrastructure, choose Capacity Provider Strategy. If you are using only one type of Infrastructure, choose Launch Type.
4. On Deployment Configuration, choose Service as Application Type.
5. Choose the Task Definition create above on Family dropdown.
6. Enter the Desired Task number, depending on the load expected(Leave at one for testing purpose).
7. Under Networking, you may choose your own VPC if available. You can leave as default for testing.
8. Under Load Balancing, choose Application Load Balancer.
9. Create or choose Existing Load Balancer.
10. Enter or choose the Load Balancer name.
11. Enter 30 in the Health Check Grace Period.
12. For HTTPS, choose container 9080:9080.
13. Specify the Listener and the Target Group:
    1. Use port 9080 in when creating new Listener.
    2. Use HTTPS protocol.
    3. Choose the ACM Certificate that you have requested and validated.
    4. Enter /jw on the Health Check path.
       
        
14. Click Create.

For further deployment steps, you may continue from here.

Applying Joget License

To apply license, you may visit here.

The System Key may be different from the guide, as it is using Domain as the System Key. Regardless, the process will remain the same.