Agentic AI on EKS 実践 — Cognito認証UIとHPAでエージェント基盤を仕上げる

# ユーザープールの作成
POOL_ID=$(aws cognito-idp create-user-pool \
  --pool-name agentic-ai-on-eks \
  --admin-create-user-config AllowAdminCreateUserOnly=true \
  --query 'UserPool.Id' --output text)
 
# アプリクライアントの作成
CLIENT_OUTPUT=$(aws cognito-idp create-user-pool-client \
  --user-pool-id $POOL_ID \
  --client-name agent-ui \
  --generate-secret \
  --allowed-o-auth-flows code \
  --allowed-o-auth-scopes email openid profile \
  --callback-urls '["http://localhost:8000/callback"]' \
  --logout-urls '["http://localhost:8000/"]' \
  --supported-identity-providers COGNITO \
  --allowed-o-auth-flows-user-pool-client \
  --explicit-auth-flows ALLOW_USER_PASSWORD_AUTH)
 
CLIENT_ID=$(echo $CLIENT_OUTPUT | jq -r '.UserPoolClient.ClientId')
CLIENT_SECRET=$(echo $CLIENT_OUTPUT | jq -r '.UserPoolClient.ClientSecret')
 
# ドメインの作成
DOMAIN_PREFIX="agentic-ai-$(echo $RANDOM)"
aws cognito-idp create-user-pool-domain \
  --user-pool-id $POOL_ID --domain $DOMAIN_PREFIX
 
# テストユーザーの作成
aws cognito-idp admin-create-user \
  --user-pool-id $POOL_ID --username Alice \
  --message-action SUPPRESS
aws cognito-idp admin-create-user \
  --user-pool-id $POOL_ID --username Bob \
  --message-action SUPPRESS

# Agent UI 用 ECR リポジトリ
aws ecr create-repository --repository-name agents-on-eks/agent-ui --region $AWS_REGION
 
cd ui
tar czf /tmp/agent-ui-context.tar.gz .
aws s3 cp /tmp/agent-ui-context.tar.gz s3://kaniko-build-${ACCOUNT_ID}/build/
cd ..

apiVersion: batch/v1
kind: Job
metadata:
  name: kaniko-agent-ui
  namespace: build
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: kaniko
      containers:
      - name: kaniko
        image: gcr.io/kaniko-project/executor:latest
        args:
        - "--context=s3://kaniko-build-${ACCOUNT_ID}/build/agent-ui-context.tar.gz"
        - "--destination=${ECR_HOST}/agents-on-eks/agent-ui:latest"
      restartPolicy: Never

kubectl apply -f kaniko-ui.yaml
kubectl wait --for=condition=complete \
  job/kaniko-agent-ui -n build --timeout=600s

# Helm releases の削除
helm uninstall agent-ui -n ui
helm uninstall travel-agent -n agents
helm uninstall weather-agent -n agents
helm uninstall weather-mcp -n mcp-servers
 
# Kaniko jobs の削除
kubectl delete jobs --all -n build
 
# Namespace の削除
kubectl delete ns agents mcp-servers ui build
 
# Pod Identity Association の削除
for assoc in $(aws eks list-pod-identity-associations \
  --cluster-name $CLUSTER_NAME --region $AWS_REGION \
  --query 'associations[].associationId' --output text); do
  aws eks delete-pod-identity-association \
    --cluster-name $CLUSTER_NAME --region $AWS_REGION \
    --association-id $assoc
done
 
# IAM ロールの削除
for role in weather-agent-pod-role travel-agent-pod-role kaniko-pod-role; do
  aws iam delete-role-policy --role-name $role --policy-name bedrock-s3 2>/dev/null
  aws iam delete-role-policy --role-name $role --policy-name ecr-s3 2>/dev/null
  aws iam delete-role --role-name $role
done
 
# ECR リポジトリの削除
for repo in agents-on-eks/weather-mcp agents-on-eks/weather-agent \
            agents-on-eks/travel-agent agents-on-eks/agent-ui; do
  aws ecr delete-repository --repository-name $repo \
    --region $AWS_REGION --force
done
 
# S3 バケットの削除
for bucket in weather-agent-session-${ACCOUNT_ID} \
              travel-agent-session-${ACCOUNT_ID} \
              kaniko-build-${ACCOUNT_ID}; do
  aws s3 rb s3://$bucket --force
done
 
# Cognito ユーザープールの削除（ドメインを先に削除する必要がある）
aws cognito-idp delete-user-pool-domain \
  --user-pool-id $POOL_ID --domain $DOMAIN_PREFIX
aws cognito-idp delete-user-pool --user-pool-id $POOL_ID