Deploy and Manage Business Process Automation Applications on Amazon EKS: a Practical Guide

Abstract

This paper presents a comprehensive guide on deploying and managing Business Process Automation (BPA) applications using Amazon Elastic Kubernetes Service (EKS). It outlines the prerequisites, highlights the benefits of utilizing EKS, and provides step-by-step instructions for setting up an EKS cluster, Amazon RDS database, and MongoDB Atlas. Additionally, the paper delves into the deployment architecture and specifies the environment requirements, offering a thorough resource for organizations aiming to leverage EKS for their containerized BPA applications.

Keywords

Amazon EKS, Kubernetes, AWS, RDS, MongoDB Atlas, DevOps, Cloud Computing, Business Process Automation.

Introduction

BPA

In today's digital era, enterprises seek to streamline and automate complex business processes across a diverse range of IT environments. Business Process Automation (BPA) has emerged as a pivotal technology, enabling organizations to enhance operational efficiency, reduce errors, and improve service delivery. BPA introduces several key innovations and enhancements aimed at advancing workflow automation, service provisioning, and off-the-shelf automation applications.

The BPA platform hosts business and IT/operational use cases and applications, such as OS upgrades, service provisioning, and integration to orchestration engines. Customers have access to a lifecycle of services and BPA capabilities including advisory, implementation, business critical services, and solution support delivered through Cisco experts, best practices, and proven techniques and methodologies that help automate their business processes and de-risk their systems.

These lifecycle capabilities can be subscription-based or customized to individual needs. Implementation services help define, integrate, and deploy tools and processes to accelerate automation. Cisco experts conduct a formal process for gathering requirements, designs and develops user stories based on agile processes and Continuous Integration and Continuous Delivery (CICD) tools, and implements flexible services with automated testing of new or existing workflows, devices, and services. With Solution Support, customers get access to 24/7, centralized support with a focus on software-centric issues coupled with multivendor and open-source support offered through Cisco’s tiered software model. Cisco solution support experts help manage your case from first call to final resolution and act as the main point of contact working with multiple vendors simultaneously. You could experience up to 44 percent fewer issues working with solution-level experts, helping you maintain business continuity and get faster return on your BPA investment.

Key technical features, such as support for FMC and Ansible-managed devices, parallel executions using the Advanced Queuing Framework (AQF), and expanded configuration compliance for NDFC and FMC devices, position BPA  as a comprehensive solution for large-scale enterprise automation. With added capabilities in SD-WAN management, device onboarding, and firewall policy governance, the release addresses critical aspects of network security and automation, catering to the demands of large-scale, multi-vendor environments.

EKS

Amazon Elastic Kubernetes Service (EKS) is a fully managed Kubernetes service provided by Amazon Web Services (AWS). Launched in 2018, EKS simplifies the process of deploying, managing, and scaling containerized applications using Kubernetes, an open-source container orchestration platform. EKS abstracts the complexities of Kubernetes cluster management, allowing developers to focus on building and running applications without the need to handle the underlying infrastructure.

Benefits of Using Amazon EKS for Application Deployment

Amazon EKS offers several benefits for application deployment, making it a popular choice for organizations leveraging containerized applications and microservices.

Key advantages include:

• Managed Kubernetes Control Plane: EKS handles the deployment, scaling, and maintenance of the Kubernetes control plane, reducing operational burden.

• Simplified Cluster Management: EKS abstracts the complexities of setting up and managing Kubernetes clusters.

• Scalability: EKS allows for easy scaling of clusters to accommodate growing workloads.

• High Availability: EKS supports multi-Availability Zone deployments, enhancing availability and fault tolerance.

• Integration with AWS Services: EKS integrates seamlessly with various AWS services.

• DevOps Automation: EKS supports continuous integration and continuous deployment (CI/CD) for containerized applications.

BPA Deployment Architecture

This image represents a high-level architecture of a cloud-based infrastructure deployed on AWS , using several key components. Here's a breakdown of the diagram:

1. Amazon EKS (Elastic Kubernetes Service): At the core of the diagram, Amazon EKS is deployed across three availability zones (AZ1, AZ2, AZ3), with Kubernetes worker nodes inside each zone. This indicates a highly available and fault-tolerant setup, as the workloads are spread across multiple availability zones.

2. ALB (Application Load Balancer): This is positioned at the front, receiving traffic from users and distributing it across the EKS cluster for handling application workloads. The load balancer ensures that the requests are evenly distributed and can handle scaling based on traffic demand.

3. Amazon RDS (Relational Database Service) - PostgreSQL: On the right side of the diagram, an Amazon RDS instance running PostgreSQL is present. This database can be accessed by applications running within the EKS cluster.

4. ECR (Elastic Container Registry): This is where Docker container images are stored and managed, which are then deployed to Amazon EKS for running the workloads.

5. MongoDB Atlas: On the left side, MongoDB Atlas is integrated into the architecture through a private endpoint. MongoDB Atlas is a cloud-hosted NoSQL database service, used here to handle document-based database requirements. The private endpoint ensures secure, private communication between the MongoDB Atlas instance and other AWS components.

6. Bastion Host: Positioned within the VPC (Virtual Private Cloud), a Bastion Host provides a secure entry point for administrators to access resources inside the VPC without directly exposing them to the internet.

Overall, this architecture provides a highly available, scalable, and secure solution for deploying and managing containerized applications using Amazon EKS, with support for both relational (PostgreSQL) and NoSQL (MongoDB) databases.

• EKS Cluster Setup
  To create an Amazon EKS cluster using the AWS CLI, the eksctl command-line utility can be used. This is an example command:

  eksctl create cluster \
    --name <my-eks-cluster> \
    --region us-west-2 \
    --nodegroup-name standard-workers \
    --node-type t3.medium \
    --nodes 4 \
    --nodes-min 4 \
    --nodes-max 6
  

• RDS Database Setup
  

  Deploying a relational database on Amazon RDS involves these steps:

  • Access the AWS Management Console and navigate to the Amazon RDS service.
  • Create a new database instance with the desired specifications.
  • Configure the security group to allow incoming connections from your Amazon EKS cluster.
    
    
  
  Using the drop-down menu, select the most recent version of PostgreSQL. In our case, it is “PostgreSQL 16.3-R1.”
  
  
  
  For this give the database instance a name and create a username and password.
  
  
  
  

  Ensure that the default settings for “DB instance size” and “Storage” are selected.

  Depending on the cluster size and data requirements, select the appropriate DB instance size and storage type.
  

  Based on our use case, we have chosen the following configuration:

  • DB Instance Size: db.m5d.2xlarge

    • 8 vCPUs
    • 32 GiB RAM
    • Network: 4,750 Mbps
    • 300 GB Instance Store
  
  
  
  Select appropriate values according to your use case. We have selected the default values.
  
  
  
  Make sure  in “Database authentication” we have selected Password authentication. Authenticates using database passwords.
  
  
  
  
  
  
  
  

  Once that is verified, we are ready to create the database.  Return to the Amazon RDS dashboard. Confirm that the instance is available for use. 
  

  
  Security Group Rules

  Update the inbound security group with the pod CIDR and node CIDR block.
  
  

  
  
  

  In RDS -> Databases -> DB-NAME, click configuration and refer the Parameter Group section and click the parameter group to view.  

  
  
  Search for “password_encryption” and change the value to md5 from blank / other value. This is needed for camunda configurations to work.
  
  
  
  Create these Databases along with users by connecting to the RDS.
  

  PG_ROOT_DATABASE=admin
  PG_INITDB_ROOT_USERNAME=admin
  PG_INITDB_ROOT_PASSWORD=Bp@Chang3d!
  AUTH_DB_NAME=kong
  AUTH_DB_USER=kong
  AUTH_DB_PASSWORD=K@ngPwdCha*g3
  WFE_DB_USER=camunda
  WFE_DB_PASSWORD=W0rkFlo#ChangeNow
  WFE_DB_NAME=process-engine​

• Password authentication

  Authenticates using database passwords.

• Atlas MongoDB Setup
  Setting up Atlas MongoDB involves:
  • Logging into Atlas MongoDB.
  • Selecting the organization and project.
  • Creating a dedicated cluster with the appropriate specifications.
    
    
    
    
  • Select the Dedicated tier, Cloud Provider & Region.
    
    
    
    
  •  Select appropriate tier(we have used M30 as tier) dedicated cluster and provide appropriate cluster name and click on Create Cluster. It will initialize the Atlas monogodb cluster.
    
    
    
    
    • Setting up VPC private endpoint for the Atlas and K8S cluster.
      • Click on the Network Access Select Private Endpoint à Click on Add Private Endpoint.
        
        
        
        
      • Select Cloud Provider as AWS, select respective Region and click on Next.
        
        
        
        
      • Provide Respective PVC id and subnet ids. Once you enter the details, Copy the vpc end point creation command and execute it in aws console. You will get the vpc endpoint id as output.
        
        
        
        
      •  Click on Next to paste the VPC endpoint ID and click on Create.
        
        
        
        
      • Once it is successfully created, Endpoint status will be Available as shown in the next picture. VPC end-point must be created for pod cidr. In our case we have used "100.64.0.0/16" .
        
        
        
        
      • Add inbound rules to newly created vpc-endpoint. The vpc-endpoint will be in the parent account and a security group must be assigned to the newly created vpc-endpoint.
        
        
        
        

ECR as image registry
Creating Amazon ECR repositories and pushing Docker images into them involves several steps. These are the steps to create an ECR repository, tag a Docker image, and push it to the repository using the AWS CLI.

aws ecr create-repository --repository-name your-image-name --region your-region

Replace:

• your-image-namewith the desired name for your ECR repository.

• your-regionwith your AWS region

Configure IAM Role for EKS Nodes

Ensure that the EKS worker nodes (EC2 instances) have the necessary IAM role attached with permissions to pull images from ECR. The IAM policy required is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "*"
    }
  ]
} 

Attach this policy to the IAM role associated with your EKS worker nodes.

BPA Deployment
The deployment of BPA involves several steps, including labeling EKS worker nodes, preparing directories on nodes, copying BPA packages, and deploying BPA using Helm.

For our customer deployment, we have utilized the following versions of software and cloud services:

• BPA: 4.0.3-6
• RDS (Relational Database Service): 16.3-R2
• MongoDB Atlas: v5.0.29 
• EKS (Elastic Kubernetes Service): v1.27

These components ensure that our deployment is robust, scalable, and capable of handling the required workloads efficiently.

• Labeling EKS Worker Nodes
  

  kubectl label node <worker_node_1> name=node-1
  kubectl label node <worker_node_2> name=node-2
  kubectl label node <worker_node_3> name=node-3
  kubectl label node <worker_node_4> name=node-4

• Preparing Directories on Nodes
  Node 1:
  

  rm -rf /opt/bpa/data/
  mkdir -p /opt/bpa/data/zookeeper1
  mkdir -p /opt/bpa/data/zookeeper4
  mkdir -p /opt/bpa/data/zookeeper5
  chmod 777 /opt/bpa/data/zookeeper1
  chmod 777 /opt/bpa/data/zookeeper4
  chmod 777 /opt/bpa/data/zookeeper5
  mkdir -p /opt/bpa/data/kafka1
  chmod 777 /opt/bpa/data/kafka1
  sysctl -w vm.max_map_count=262144
  

  
  Node 2:
  

  rm -rf /opt/bpa/data
  sysctl -w vm.max_map_count=262144
  mkdir -p /opt/bpa/data/kafka2
  mkdir -p /opt/bpa/data/zookeeper2
  mkdir -p /opt/bpa/data/zookeeper4
  mkdir -p /opt/bpa/data/zookeeper5
  chmod 777 /opt/bpa/data/kafka2
  chmod 777 /opt/bpa/data/zookeeper2
  chmod 777 /opt/bpa/data/zookeeper4
  chmod 777 /opt/bpa/data/zookeeper5
  

  
  Node 3:
  

  rm -rf /opt/bpa/data
  sysctl -w vm.max_map_count=262144
  mkdir -p /opt/bpa/data/kafka3
  mkdir -p /opt/bpa/data/zookeeper3
  mkdir -p /opt/bpa/data/zookeeper4
  mkdir -p /opt/bpa/data/zookeeper5
  chmod 777 /opt/bpa/data/kafka3
  chmod 777 /opt/bpa/data/zookeeper3
  chmod 777 /opt/bpa/data/zookeeper4
  chmod 777 /opt/bpa/data/zookeeper5
  

  Node 4:
  

  mkdir -p /opt/bpa/data/elk
  mkdir -p /opt/bpa/data/metrices/prometheus
  mkdir -p /opt/bpa/data/metrices/grafana
  chmod 777 /opt/bpa/data/metrices
  chmod 777 /opt/bpa/data/metrices/prometheus
  chmod 777 /opt/bpa/data/metrices/grafana
  sysctl -w vm.max_map_count=262144

• Copying BPA Packages
  

  scp -r packages to node1:/opt/bpa/​
  scp -r packages to node2:/opt/bpa/​
  scp -r packages to node3:/opt/bpa/​
  scp -r packages to node4:/opt/bpa/​

• Deploying BPA Using Helm
  

  helm install bpa-rel --create-namespace --namespace bpa-ns /opt/EKS/bpa-helm-chart

Ingress Setup

• Enabling Ingress
  Update values.yamlto enable ingress:
  

  ingress_controller: {create: true}

• Creating a Secret Using BPA Certificate
  Navigate to the certificate directory and create a secret:
  

  cd /opt/bpa/<BPA helm chart location>/bpa/conf/common/certs/
  kubectl create secret tls bpa-certificate-ingress --cert=bap-cert.pem --key=bap-key.pem -n bpa-ns
  

• Updating Ingress Controller
  Add the newly created secret in the ingress-controller.yaml file:
  

  cd /opt/bpa/<BPA helm chart location>/templates/
  vi ingress-controller.yaml
  "- --default-ssl-certificate=$(POD_NAMESPACE)/bpa-certificate-ingress"
  

• Updating Ingress Certificate
  Perform Helm delete and install to update the ingress certificate.
  

Environment Specifications
The environment specifications include requirements for EC2 instances, load balancers, VPC endpoints, and RDS instances. Key specifications are:

EC2 Requirements:

    Storage requirements:2TB space per nodes. Mount EBS volume to /opt and add an entry in /etc/fstab for all the nodes.

    Security group inbound: 30101, 443, 0 – 65535 TCP, 22 for ssh.

    Security group outbound: All traffic must be enabled.

    DNS Resolver: EC2 must have on-prem resolvers in /etc/resolve.conf.   

Load balancer requirements:

• Listeners ports must be 443, 30101.
• VPC End point Requirements (Atlas MongoDB).
• VPC end points created for Atlas connectivity is available in the parent account(aws-5g-ndc-prod). VPC Endpoint must have security group which allows all inbound access(0 - 65535).
  
  

RDS Requirements:

    RDS Type: db.r5b.2xlarge

    Postgres Engine version: 13.7

    Security group: Inboud must allow traffic from the POD CIDR source.

Key Concepts and Components
Understanding Kubernetes fundamentals is essential for effectively deploying and managing applications using Amazon EKS.

Conclusion
This paper provides a detailed guide for deploying and managing Business Process Automation (BPA) applications using Amazon EKS. By following the outlined steps and understanding the key concepts, organizations can leverage the benefits of EKS for their containerized BPA applications.

References

• Amazon Web Services, "Amazon EKS Documentation," [Online]. Available:https://docs.aws.amazon.com/eks/
• Kubernetes, "Kubernetes Documentation," [Online]. Available:https://kubernetes.io/docs/home/
• Cisco BPA at a Glance https://www.cisco.com/c/en/us/solutions/collateral/service-provider/at-a-glance-c45-742579.html
• BPA Operations Guide https://www.cisco.com/c/dam/en/us/support/docs/bpa/v403/cisco-bpa-operations-guide-v403.pdf
• BPA Developer Guide https://www.cisco.com/c/dam/en/us/support/docs/bpa/v403/cisco-bpa-developer-guide-v403.pdf