Skip to main content
This guide walks you through packaging an AWS EKS Traefik whomami application and installing it into your AWS cloud account.
This app can be found in a GitHub repository.

​
Prerequisites

​
What You Will Create

This tutorial will walk you through creating the following:
We recommend you clone the example-app-configs repository which includes the eks-simple app versus creating each config file manually. This guide is meant to explain the concepts behind some of the config files, so you can create your own apps in the future.

​
Configure App

To configure the app, you will create several TOML config files. In each section below we will provide you with configuration snippets for the app itself as well as it’s components.

​
Create App

Clone the example-app-configs repository, cd into the eks-simple directory, and create the app in Nuon. This will create the app in app.nuon.co 
git clone https://github.com/nuonco/example-app-configs
cd example-app-configs/eks-simple
nuon auth login
nuon orgs select
nuon apps create -n eks-simple
You should see the new app in the dashboard. App List

​
Inputs

Inputs are customer-specific configs that are entered when you install the app in the customer’s cloud account. They will be displayed in the Dashboard UI. Inputs are optional. In the app root directory, create a file named inputs.toml and add the following:
inputs.toml
#:schema https://api.nuon.co/v1/general/config-schema?source=inputs
[[group]]
name         = "dns"
description  = "DNS Configrations"
display_name = "Configurations for the root domain for Route53"

[[input]]
name         = "domain"
description  = "domain for the whoami endpoint e.g., nuon.run"
default      = "nuon.run"
display_name = "Domain"
group        = "dns"

[[input]]
name         = "sub_domain"
description  = "The sub domain for the Whoami service"
default      = "whoami"
display_name = "Sub Domain"
group        = "dns"
This Input defines a domain, which will default to nuon.run and a subdomain for the Whoami service that will be deployed in the customer’s AWS account. The customer will be prompted to enter this value when they create an install of the app. The subdomain will default to whoami, but the customer can change it to whatever they want.

​
Sandbox

Nuon provides a set of Nuon Managed Sandboxes that can be used to provision the infrastructure needed for your app. The aws-eks-sandbox will provide everything you need to run an EKS, from the EKS cluster down to the VPC. Your app references these Sandboxes in the sandbox.toml file. In the app root directory, create a file named sandbox.toml and add the following:
sandbox.toml
terraform_version = "1.11.3"

[public_repo]
directory = "."
repo      = "nuonco/aws-eks-sandbox"
branch    = "main"

[vars]
cluster_name         = "n-{{.nuon.install.id}}"
enable_nuon_dns      = "true"
public_root_domain   = "{{ .nuon.install.id }}.{{.nuon.inputs.inputs.domain}}"
internal_root_domain = "internal.{{ .nuon.install.id }}.{{.nuon.inputs.inputs.domain}}"

[[var_file]]
contents = "./sandbox.tfvars"
With enable_nuon_dns set to true, the sandbox will create a Route53 DNS zone for the install, allowing you to access the services deployed in the customer’s AWS account using a Nuon-managed domain. The config uses the install id as the subdomain, which will be unique for each install. The sandbox expects variables, some of which are defined in the vars section while others are defined in the sandbox.tfvars file. In the app root directory, create a file named sandbox.tfvars and add the following:
sandbox.tfvars
maintenance_role_eks_access_entry_policy_associations = {
  eks_admin = {
    policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy"
    access_scope = {
      type = "cluster"
    }
  }
  eks_view = {
    policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
    access_scope = {
      type = "cluster"
    }
  }
}

additional_namespaces = ["whoami"]

maintenance_cluster_role_rules_override = [{
  "apiGroups" = ["*"]
  "resources" = ["*"]
  "verbs"     = ["*"]
}]

min_size = 2
max_size = 3
desired_size = 2

​
Components

Components are the building blocks of your App and where a software vendor’s application is installed on top of the Sandbox infrastructure. In this example, we will create a component to deploy Traefik’s Whoami service with Helm. Whoami is a Tiny Go webserver that prints OS information and HTTP request headers. In the app root directory, create directory called components and within it, a file named whoami.toml and add the following:
whoami.toml
#:schema https://api.nuon.co/v1/general/config-schema?type=helm
name           = "whoami"
type           = "helm_chart"
chart_name     = "whoami"
namespace      = "whoami"
storage_driver = "configmap"

[public_repo]
repo      = "nuonco/example-app-configs"
directory = "eks-simple/src/components/whoami"
branch    = "main"

[[values_file]]
contents = "./values/whoami.yaml"
You will also need ALB and Certificate components to expose the Whoami service to the internet. In the components directory, create a file named alb.toml and add the following:
alb.toml
#:schema https://api.nuon.co/v1/general/config-schema?type=helm

name         = "application_load_balancer"
type         = "helm_chart"
chart_name   = "application-load-balancer"
dependencies = ["whoami"]

[public_repo]
repo      = "nuonco/components"
directory = "aws/alb"
branch    = "main"

[values]
domain_certificate = "{{.nuon.components.certificate.outputs.public_domain_certificate_arn}}"
domain             = "{{.nuon.inputs.inputs.sub_domain}}.{{.nuon.install.sandbox.outputs.nuon_dns.public_domain.name}}"
https_port         = "443"
service_name       = "whoami"
service_port       = "80"
install_name       = "{{.nuon.install.id}}"
In the components directory, create a file named certificate.toml and add the following:
certificate.toml
#:schema https://api.nuon.co/v1/general/config-schema?type=terraform

name              = "certificate"
type              = "terraform_module"
terraform_version = "1.11.3"

[public_repo]
repo      = "nuonco/example-app-configs"
directory = "eks-simple/src/components/certificate"
branch    = "main"

[vars]
install_id  = "{{ .nuon.install.id }}"
region      = "{{ .nuon.install_stack.outputs.region }}"
zone_id     = "{{ .nuon.install.sandbox.outputs.nuon_dns.public_domain.zone_id }}"
domain_name = "*.{{ .nuon.install.sandbox.outputs.nuon_dns.public_domain.name }}"

​
Actions

Actions are used to perform operations on your app, such as healthchecks or running kubectl commands. In the app root directory, create directory called actions and within it, two actions. Create a file named healthcheck.toml and add the following to check the ALB status. See the eks-simple directory of the example repo for the healthcheck.sh script referenced below.
healthcheck.toml
#:schema https://api.nuon.co/v1/general/config-schema?source=action
name    = "alb_healthcheck"
timeout = "30s"

[[triggers]]
type = "manual"

[[steps]]
name    = "alb-healthcheck"
command = "./healthcheck.sh"

[steps.public_repo]
repo      = "nuonco/example-app-configs"
directory = "eks-simple/src/actions/alb"
branch    = "main"

[steps.env_vars]
INGRESS_NAME      = "{{.nuon.install.id}}-public"
INGRESS_NAMESPACE = "whoami"

​
Other Configuration Files

Look at the eks-simple app in the example-app-configs repository for the remaining and required directory structure and files. The files created above are marked in **. 
- **eks-simple**
    - **actions**
        - **healthcheck.toml**
        - **simple_action.toml**
    - **components**
        - **alb.toml**
        - **certificate.toml**
        - **whoami.toml**
    - permissions
        - deprovision_boundary.json
        - deprovision.toml
        - maintenance_boundary.json
        - maintenance.toml
        - provision_boundary.json
        - provision.toml
    - policies
        - disallow-ingress-nginx-custom-snippets.yml
        - set-karpenter-non-cpu-limits.yaml
    - src
        - components
            - whoami
                - templates
                    - deployment.yaml
                    - service.yaml
                - Chart.yaml
    - break_glass.toml
    - **inputs.toml**
    - installer.toml
    - metadata.toml
    - policies.toml
    - README.md
    - runner.toml
    - **sandbox.tfvars**
    - **sandbox.toml**
    - secrets.toml
    - stack.toml

​
Sync App to Nuon

You now have a complete Nuon app. This is a good place to stop and sync it to Nuon. Make sure you are in the root directory of your app, then run: 
nuon apps sync
Select the app in the Dashboard, and you should now see the updated inputs, sandbox, components, and runner configuration. App

​
Create an Install

Click the Create Install button in the top right corner of the app page in the Dashboard. Give your install a name choosethe AWS Region. Notice the inputs you defined in the inputs.toml file are displayed here, allowing the customer to enter their own values. After entering the inputs, click the Create Install button at the bottom of the page to start the Workflow including the creation of an AWS CloudFormation stack link for the customer to open in their AWS account. Create Install

​
Monitoring Installs

As soon as you kick off the install provisioning, you should see the new install’s workflow in the dashboard. Install List

​
Create the CloudFormation Stack in AWS

Click or copy the CloudFormation link to open it in your AWS account. You will need to log in to your AWS account if you are not already logged in. This creates a VPC, required policies that Nuon expects, an Autoscaling Group, a VM with Docker and a container that installs the Nuon Build Runner in your AWS account, which will be used to provision the install of your app. Scroll down to the bottom of the page, accept the defaults, and click the Create Stack button. CloudFormation Stack

​
Monitor the CloudFormation Stack creation in AWS

Monitor the CloudFormation stack creation in the AWS console. This will take a few minutes to complete. You can also pull up the AWS EC2 console and see the EC2 VM appear at some point with the install id in its name. The Nuon Dashboard will not provide feedback until the runner is up and connected to Nuon. Stack Log

​
Monitor the Remainder of the Install Workflow

If plan steps require approvals, you will need to approve them in the Dashboard. You can also monitor the progress of the install in the Dashboard. Workflow In the AWS console, you can see the EKS cluster being created. Cluster In the AWS console, you can see the Application Load Balancer being created and the Target Group being created for the Whoami service. ALB

​
Inspect the Install

When the install has provisioned, and the deploys have completed, click the URL link in the install’s README.md visible on the install page in the dashboard. Alternatively, copy the link and open a terminal and curl the API to verify it’s running. 
curl https://whoami.{install_id}.nuon.run
You should see a response similar to the following: 
Hostname: whoami-78ffb6cbf9-rhtlb
IP: 127.0.0.1
IP: ::1
IP: 10.128.130.230
IP: fe80::1076:d7ff:fe3c:3bab
RemoteAddr: 10.128.0.10:11270
GET / HTTP/1.1
Host: whoami.inlgekffpkqv08yy8ayt7mxuyy.nuon.run
User-Agent: curl/8.7.1
Accept: */*
X-Amzn-Trace-Id: Root=1-6864407f-5e2b57f16533e41347ae8c8c
X-Forwarded-For: 136.49.24.124
X-Forwarded-Port: 443

​
Deprovision the Install

Nuon is mindful of your public cloud spend, so provide the following deprovisioning steps. Deprovisioning the Install is a two-step process. First, you need to deprovision the install in the Nuon Dashboard, which will deprovision the resources to install your App. Once that is completed successfully, you then need to delete the CloudFormation stack in the AWS console, which removes the Build Runner by destroying the EC2 VM, ASG, and VPC.
Be sure to back up any data you want to keep before deprovisioning the install, as this will delete all resources created by the Install.

​
Manually Deprovision the Install

If deprovisioning the install in the Dashboard fails, there is a error-destroy.sh script in the Nuon Managed Sandboxes repository that you can use to manually deprovision the install. This script will remove all resources created by the install, including the EKS cluster, ALB, certificates, and Route53 DNS records.
You still have to delete the CloudFormation stack in the AWS console after running this script to remove the runner, ASG, EC2 VM, and VPC.

​
Wrapping Up and Next Steps

Congratulations, you just deployed an app to AWS! A few suggestions for where to go next:
  • Review other example apps in the example-app-configs repository to see how to deploy a more complex app.
  • Dig into our app guide to learn how to configure more complex apps.