-
Notifications
You must be signed in to change notification settings - Fork 315
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[ECS] [Volumes]: Ability to create config "volume" and mount it into container as file #56
Comments
Sounds like you need the next version of Docker engine, that will have that from buildkit |
You are talking about the experimental features? That's nice, but I would like to be able to do it during the start of the container, not during the build of the image, or I understood what it does wrong. |
@trane9991 oh right 🤭 |
This is affecting the Fargate provider for virtual-kubelet as well. https://github.com/virtual-kubelet/virtual-kubelet/issues/185#issuecomment-452542691 To maintain feature parity with Kubernetes configmap/secret, an ECS API that updates |
Now that ECS Fargate seems to have native support for passing in AWS Secrets Manager secrets via environment variables, one possible workaround, for being able to mount secrets as files into an ECS task (app container): Run a secrets-holding sidecar container in the ECS task, and pass Base64-encoded Secrets Manager secrets to it via environment variables, and have that sidecar Base64-decode and save those secrets in its file system, in e.g. Pros:
Cons:
Any thoughts on this workaround and, the pros and cons, and in particular, its security implications in the ECS Fargate environment? |
We have a similar workaround to @jpalomaki, except without the sidecar. It relies on having access to a shell ( The trick is: you set your file contents as base64-encoded environment variables, then override Pros:
Cons:
Here's an example task definition JSON doing this trick for prometheus. It's an almighty hack, but until a feature like this lands, it's better than nothing. |
@philandstuff |
I like this idea a lot, would be helpful for me with ECS and EKS. I deployed a RabbitMQ image the other day - being able to mount a pre-canned config volume would be convenient. |
@philandstuff Looks like the sidecar startup race condition might be avoidable: see |
I'm trying to put the config/secret file on S3 then read it from the application. The idea comes from Aliyu Container Service, maybe ECS can internally support it. |
@abby-fuller Any updates on the progress on this one? |
How is this progressing? This is absolutely a must have to avoid having to bake in (minor) config changes to public images. |
+5 |
Any news on this? Adding side-cars or customized entrypoints to achieve this isn't great. |
An option to mount a file would also help a lot for larger config files which are now limited by the 8Kb limit for SSM Advanced Parameters and 10Kb limit for Secrets Manager. Creating files from multiple parts is... particularly terrible. |
We solved this issue with the following process: |
I actually find the side-car option rather convenient, especially using Secret Manager as the source of secrets or SSM for config. Pros:
services:
app:
volumes:
- shared:/path/to/mount:ro
deploy:
labels:
ecs.task.family: app01
depends_on:
- secret-fetcher
secret-fetcher:
secrets: [secret-01]
volumes:
- shared:/path/to/mount:rw
deploy:
labels:
ecs.task.family: app01
ecs.depends.condition: SUCCESS
volumes:
shared: {}
secrets:
secret-01:
Name: /path/to/secrets/manager
Cons. note: using ECS CLI v1 or v2 you would get two separate services etc. |
It's not a fix, but for CDK users I'd created a proof-of-concept extension for ECS that basically codifies @dw's example: https://constructs.dev/packages/@richicoder/cdk-ecs-s3volume/v/0.2.1?lang=typescript |
I've used @dw's example to make a Terraform module implementation for our ECS services with CODE_DEPLOY. But, istead of using aws-cli to fetch config from S3, in this example the config will be encoded into the task definition by Terraform, by using bash and base64. Relevant excerpt: |
Hi all! Any news about this feature request? It'll be really helpful to have a first class configuration file solution instead of using alternative solutions like sidecars or modifying the container image to download and create the configuration file |
This feature would be really helpful. I'm surprised this is actually not present for AWS ECS. |
I guess for some use-cases this newly released option for ECS on EC2 and ECS on Fargate might help: https://aws.amazon.com/about-aws/whats-new/2024/01/amazon-ecs-fargate-integrate-ebs/?nc1=h_ls
|
+1 |
+1 |
+1 |
I need this feature too. AWS, any updates? |
Files up to some sensible limit could be mounted via a dedicated ECS file upload endpoint or refer to an S3 object location I guess? |
Would love to see this as well. |
Any news on this? |
I need this feature as well. |
I need this feature as well. Using a 3rd party docker image from Snowflake for real-time postgres data ingestion, and they're wanting a couple of config files, but if I mount the whole volume from EFS, I find that they have their own files in the directory that then can't be read. |
much needed feature |
We get around this using this hack btw (not affiliated w/ HoneyBadger, but found their implementation useful) - https://www.honeybadger.io/blog/configure-docker-on-ecs/ |
Would love to get your feedback on ecs files composer Let me know |
@vibhav-ag this issue has been requested 2,017 days ago, I see that you have moved it to "Researching" wondering what is the current prioritization of this issue, and when can we expect to get an ETA? Despite being open for a while it does have a significant amount of traffic and people are still requesting this feature. |
+1 |
3 similar comments
+1 |
+1 |
+1 |
Tell us about your request
Would be very nice to be able to mount strings (secrets/configurations) defined in the task definition into the container as a file.
Which service(s) is this request for?
ECS
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
Some apps need to be configured via config file on the file system and in order to put it there, we need to build/store a custom image. This is very uncomfortable, especially in the case when the same container can be reused with just as small configuration difference. Being able to define a config file as a "volume" and mount into the container would solve the issue, actually, k8s can do that.
Additional context
This could be used for secrets as well (#8).
Kubernetes does it via ConfigMaps
The text was updated successfully, but these errors were encountered: