WorkerInstanceFleet
- class aws_rfdk.deadline.WorkerInstanceFleet(scope, id, *, render_queue, vpc, worker_machine_image, block_devices=None, desired_capacity=None, health_check_config=None, health_monitor=None, instance_type=None, key_name=None, log_group_props=None, max_capacity=None, min_capacity=None, role=None, security_group=None, spot_price=None, user_data=None, user_data_provider=None, vpc_subnets=None, groups=None, listener_port=None, pools=None, region=None)
Bases:
Construct
This construct reperesents a fleet of Deadline Workers.
The construct consists of an Auto Scaling Group (ASG) of instances using a provided AMI which has Deadline and any number of render applications installed. Whenever an instance in the ASG start it will connect Deadline to the desired render queue.
When the worker fleet is deployed if it has been provided a HealthMonitor the Worker fleet will register itself against the Monitor to ensure that the fleet remains healthy.
architecture diagram
Resources Deployed
An EC2 Auto Scaling Group to maintain the number of instances.
An Instance Role and corresponding IAM Policy.
An Amazon CloudWatch log group that contains the Deadline Worker, Deadline Launcher, and instance-startup logs for the instances in the fleet.
Security Considerations
The instances deployed by this construct download and run scripts from your CDK bootstrap bucket when that instance is launched. You must limit write access to your CDK bootstrap bucket to prevent an attacker from modifying the actions performed by these scripts. We strongly recommend that you either enable Amazon S3 server access logging on your CDK bootstrap bucket, or enable AWS CloudTrail on your account to assist in post-incident analysis of compromised production environments.
The data that is stored on your Worker’s local EBS volume can include temporary working files from the applications that are rendering your jobs and tasks. That data can be sensitive or privileged, so we recommend that you encrypt the data volumes of these instances using either the provided option or by using an encrypted AMI as your source.
The software on the AMI that is being used by this construct may pose a security risk. We recommend that you adopt a patching strategy to keep this software current with the latest security patches. Please see https://docs.aws.amazon.com/rfdk/latest/guide/patching-software.html for more information.
- Parameters:
scope (
Construct
) –id (
str
) –render_queue (
IRenderQueue
) – Endpoint for the RenderQueue, to which the worker fleet needs to be connected.vpc (
IVpc
) – VPC to launch the worker fleet in.worker_machine_image (
IMachineImage
) – AMI of the deadline worker to launch.block_devices (
Optional
[Sequence
[Union
[BlockDevice
,Dict
[str
,Any
]]]]) –desired_capacity (
Union
[int
,float
,None
]) – Initial amount of workers in the fleet. If this is set to a number, every deployment will reset the amount of workers to this number. It is recommended to leave this value blank. Default: minCapacity, and leave unchanged during deploymenthealth_check_config (
Union
[HealthCheckConfig
,Dict
[str
,Any
],None
]) – Properties for configuring a health check. Note: The health-check feature is supported with Deadline Client v10.1.9 and later. Default: properties of HealthCheckConfig applieshealth_monitor (
Optional
[IHealthMonitor
]) – Health Monitor component to monitor the health of instances. Note: The health-check feature is supported with Deadline Client v10.1.9 and later. Default: - Health Monitoring is turned-offinstance_type (
Optional
[InstanceType
]) – Type of instance to launch for the Workers. Default: - a T3-Large type will be used.key_name (
Optional
[str
]) – Name of SSH keypair to grant access to instance. Default: - No SSH access will be possible.log_group_props (
Union
[LogGroupFactoryProps
,Dict
[str
,Any
],None
]) – Properties for setting up the Deadline Worker’s LogGroup. Default: - LogGroup will be created with all properties’ default values and a prefix of “/renderfarm/”.max_capacity (
Union
[int
,float
,None
]) – Maximum number of instances in the fleet. Default: desiredCapacity, or minCapacity if desiredCapacity is not setmin_capacity (
Union
[int
,float
,None
]) – Minimum number of instances in the fleet. Default: 1role (
Optional
[IRole
]) – An IAM role to associate with the instance profile assigned to its resources. The role must be assumable by the service principalec2.amazonaws.com
: const role = new iam.Role(this, ‘MyRole’, { assumedBy: new iam.ServicePrincipal(‘ec2.amazonaws.com’) }); Default: - A role will automatically be created, it can be accessed via therole
propertysecurity_group (
Optional
[ISecurityGroup
]) – Security Group to assign to this fleet. Default: - create new security groupspot_price (
Union
[int
,float
,None
]) – The maximum hourly price($) to be paid for each Spot instance. min - 0.001; max - 255 Default: - launches on-demand EC2 instances.user_data (
Optional
[UserData
]) – The specific UserData to use. The UserData will be mutated by this construct and may be mutated afterwards as well. Default: A UserData object appropriate for the MachineImage’s Operating System is created.user_data_provider (
Optional
[IInstanceUserDataProvider
]) – An optional provider of user data commands to be injected at various points during the Worker configuration lifecycle. You can provide a subclass of InstanceUserDataProvider with the methods overridden as desired.vpc_subnets (
Union
[SubnetSelection
,Dict
[str
,Any
],None
]) – Where to place the instance within the VPC. Default: - Private subnets.groups (
Optional
[Sequence
[str
]]) – Deadline groups these workers needs to be assigned to. The group is created if it does not already exist. Default: - Worker is not assigned to any grouplistener_port (
Union
[int
,float
,None
]) – The port to configure the worker to listen on for remote commands such as requests for its log stream. If more than one worker is present on a single host, connsecutive ports will be opened, starting with the supplied port, up to the maximum number of workers defined by the WorkerInstanceFleet. Default: 56032pools (
Optional
[Sequence
[str
]]) – Deadline pools these workers needs to be assigned to. The pool is created if it does not already exist. Default: - Worker is not assigned to any pool.region (
Optional
[str
]) – Deadline region these workers needs to be assigned to. Default: - Worker is not assigned to any region
Methods
- add_security_group(security_group)
Add the security group to all workers.
- Parameters:
security_group (
ISecurityGroup
) – : The security group to add.- Return type:
None
- allow_listener_port_from(other)
Allow access to the worker’s remote command listener port (configured as a part of the WorkerConfiguration) for an IConnectable that is either in this stack, or in a stack that depends on this stack.
If this stack depends on the other stack, use allowListenerPortTo().
Common uses are:
Adding a SecurityGroup:
workerFleet.allowListenerPortFrom(securityGroup)
Adding a CIDR:
workerFleet.allowListenerPortFrom(Peer.ipv4('10.0.0.0/24').connections)
- Parameters:
other (
IConnectable
) –- Inheritdoc:
true
- Return type:
None
- allow_listener_port_to(other)
Allow access to the worker’s remote command listener port (configured as a part of the WorkerConfiguration) for an IConnectable that is either in this stack, or in a stack that this stack depends on.
If the other stack depends on this stack, use allowListenerPortFrom().
Common uses are:
Adding a SecurityGroup:
workerFleet.allowListenerPortTo(securityGroup)
Adding a CIDR:
workerFleet.allowListenerPortTo(Peer.ipv4('10.0.0.0/24').connections)
- Parameters:
other (
IConnectable
) –- Inheritdoc:
true
- Return type:
None
- to_string()
Returns a string representation of this construct.
- Return type:
str
Attributes
- SPOT_PRICE_MAX_LIMIT = 255
- SPOT_PRICE_MIN_LIMIT = 0.001
- connections
The security groups/rules used to allow network connections to the file system.
- fleet
The ASG object created by the construct.
- grant_principal
The principal to grant permissions to.
- listening_ports
The port workers listen on to share their logs.
- node
The tree node.
- target_capacity
This field implements the maximum instance count this fleet can have.
- target_capacity_metric
This field implements the base capacity metric of the fleet against which, the healthy percent will be calculated.
eg.: GroupDesiredCapacity for an ASG
- target_scope
This field implements the scope in which to create the monitoring resource like TargetGroups, Listener etc.
- target_to_monitor
This field implements the component of type INetworkLoadBalancerTarget which can be attached to Network Load Balancer for monitoring.
eg. An AutoScalingGroup
- target_update_policy
This field implements a policy which can be attached to the lambda execution role so that it is capable of suspending the fleet.
eg.: autoscaling:UpdateAutoScalingGroup permission for an ASG
Static Methods
- classmethod is_construct(x)
Checks if
x
is a construct.Use this method instead of
instanceof
to properly detectConstruct
instances, even when the construct library is symlinked.Explanation: in JavaScript, multiple copies of the
constructs
library on disk are seen as independent, completely different libraries. As a consequence, the classConstruct
in each copy of theconstructs
library is seen as a different class, and an instance of one class will not test asinstanceof
the other class.npm install
will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of theconstructs
library can be accidentally installed, andinstanceof
will behave unpredictably. It is safest to avoid usinginstanceof
, and using this type-testing method instead.- Parameters:
x (
Any
) – Any object.- Return type:
bool
- Returns:
true if
x
is an object created from a class which extendsConstruct
.