Skip to content

Commit dc6f120

Browse files
comcalvicomcalvi
authored
fix(batch): Allow ECS JobDefinition Containers to pass Secrets as Environment Variables & Enable Kubernetes Secret Volumes (#26126)
Changes the type of `secrets` from `ISecret[]` to `{ [key: string]: ISecret }`. The `key` is the name of the environment variable to expose to the container. Also enables the specification of EKS Kubernetes volumes, which our README documented but wasn't actually supported because of a CFN issue that has since been fixed. Closes #25559. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent edad593 commit dc6f120

23 files changed

+317
-167
lines changed

‎packages/@aws-cdk/aws-batch-alpha/README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,29 @@ jobDefn.container.addVolume(batch.EcsVolume.efs({
495495
}));
496496
```
497497

498+
### Secrets
499+
500+
You can expose SecretsManager Secret ARNs to your container as environment variables.
501+
The following example defines the `MY_SECRET_ENV_VAR` environment variable that contains the
502+
ARN of the Secret defined by `mySecret`:
503+
504+
```ts
505+
import * as cdk from 'aws-cdk-lib';
506+
507+
declare const mySecret: secretsmanager.ISecret;
508+
509+
const jobDefn = new batch.EcsJobDefinition(this, 'JobDefn', {
510+
container: new batch.EcsEc2ContainerDefinition(this, 'containerDefn', {
511+
image: ecs.ContainerImage.fromRegistry('public.ecr.aws/amazonlinux/amazonlinux:latest'),
512+
memory: cdk.Size.mebibytes(2048),
513+
cpu: 256,
514+
secrets: {
515+
MY_SECRET_ENV_VAR: mySecret,
516+
}
517+
}),
518+
});
519+
```
520+
498521
### Running Kubernetes Workflows
499522

500523
Batch also supports running workflows on EKS. The following example creates a `JobDefinition` that runs on EKS:

‎packages/@aws-cdk/aws-batch-alpha/lib/ecs-container-definition.ts‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -342,13 +342,14 @@ export interface IEcsContainerDefinition extends IConstruct {
342342
readonly readonlyRootFilesystem?: boolean;
343343

344344
/**
345-
* The secrets for the container. Can be referenced in your job definition.
345+
* A map from environment variable names to the secrets for the container. Allows your job definitions
346+
* to reference the secret by the environment variable name defined in this property.
346347
*
347348
* @see https://docs.aws.amazon.com/batch/latest/userguide/specifying-sensitive-data.html
348349
*
349350
* @default - no secrets
350351
*/
351-
readonly secrets?: secretsmanager.ISecret[];
352+
readonly secrets?: { [envVarName: string]: secretsmanager.ISecret };
352353

353354
/**
354355
* The user name to use inside the container
@@ -458,13 +459,14 @@ export interface EcsContainerDefinitionProps {
458459
readonly readonlyRootFilesystem?: boolean;
459460

460461
/**
461-
* The secrets for the container. Can be referenced in your job definition.
462+
* A map from environment variable names to the secrets for the container. Allows your job definitions
463+
* to reference the secret by the environment variable name defined in this property.
462464
*
463465
* @see https://docs.aws.amazon.com/batch/latest/userguide/specifying-sensitive-data.html
464466
*
465467
* @default - no secrets
466468
*/
467-
readonly secrets?: secretsmanager.ISecret[];
469+
readonly secrets?: { [envVarName: string]: secretsmanager.ISecret };
468470

469471
/**
470472
* The user name to use inside the container
@@ -495,7 +497,7 @@ abstract class EcsContainerDefinitionBase extends Construct implements IEcsConta
495497
public readonly linuxParameters?: LinuxParameters;
496498
public readonly logDriverConfig?: ecs.LogDriverConfig;
497499
public readonly readonlyRootFilesystem?: boolean;
498-
public readonly secrets?: secretsmanager.ISecret[];
500+
public readonly secrets?: { [envVarName: string]: secretsmanager.ISecret };
499501
public readonly user?: string;
500502
public readonly volumes: EcsVolume[];
501503

@@ -553,12 +555,12 @@ abstract class EcsContainerDefinitionBase extends Construct implements IEcsConta
553555
logConfiguration: this.logDriverConfig,
554556
readonlyRootFilesystem: this.readonlyRootFilesystem,
555557
resourceRequirements: this._renderResourceRequirements(),
556-
secrets: this.secrets?.map((secret) => {
558+
secrets: this.secrets ? Object.entries(this.secrets).map(([name, secret]) => {
557559
return {
558-
name: secret.secretName,
560+
name,
559561
valueFrom: secret.secretArn,
560562
};
561-
}),
563+
}) : undefined,
562564
mountPoints: Lazy.any({
563565
produce: () => {
564566
if (this.volumes.length === 0) {

‎packages/@aws-cdk/aws-batch-alpha/lib/eks-container-definition.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -647,9 +647,9 @@ export interface EksVolumeOptions {
647647
readonly name: string;
648648

649649
/**
650-
* The path on the container where the container is mounted.
650+
* The path on the container where the volume is mounted.
651651
*
652-
* @default - the container is not mounted
652+
* @default - the volume is not mounted
653653
*/
654654
readonly mountPath?: string;
655655

@@ -902,7 +902,7 @@ export class SecretPathVolume extends EksVolume {
902902
constructor(options: SecretPathVolumeOptions) {
903903
super(options);
904904
this.secretName = options.secretName;
905-
this.optional = options.optional;
905+
this.optional = options.optional ?? true;
906906
}
907907
}
908908

‎packages/@aws-cdk/aws-batch-alpha/lib/eks-job-definition.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -192,14 +192,13 @@ export class EksJobDefinition extends JobDefinitionBase implements IEksJobDefini
192192
};
193193
}
194194
if (SecretPathVolume.isSecretPathVolume(volume)) {
195-
/*return {
195+
return {
196196
name: volume.name,
197197
secret: {
198198
optional: volume.optional,
199199
secretName: volume.secretName,
200200
},
201201
};
202-
*/
203202
}
204203

205204
throw new Error('unknown volume type');

‎packages/@aws-cdk/aws-batch-alpha/test/ecs-container-definition.test.ts‎

Lines changed: 4 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -255,9 +255,9 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
255255
new EcsJobDefinition(stack, 'ECSJobDefn', {
256256
container: new ContainerDefinition(stack, 'EcsContainer', {
257257
...defaultContainerProps,
258-
secrets: [
259-
new Secret(stack, 'testSecret'),
260-
],
258+
secrets: {
259+
envName: new Secret(stack, 'testSecret'),
260+
},
261261
}),
262262
});
263263

@@ -268,59 +268,7 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
268268
...pascalCaseExpectedProps.ContainerProperties,
269269
Secrets: [
270270
{
271-
Name: {
272-
'Fn::Join': [
273-
'-',
274-
[
275-
{
276-
'Fn::Select': [
277-
0,
278-
{
279-
'Fn::Split': [
280-
'-',
281-
{
282-
'Fn::Select': [
283-
6,
284-
{
285-
'Fn::Split': [
286-
':',
287-
{
288-
Ref: 'testSecretB96AD12C',
289-
},
290-
],
291-
},
292-
],
293-
},
294-
],
295-
},
296-
],
297-
},
298-
{
299-
'Fn::Select': [
300-
1,
301-
{
302-
'Fn::Split': [
303-
'-',
304-
{
305-
'Fn::Select': [
306-
6,
307-
{
308-
'Fn::Split': [
309-
':',
310-
{
311-
Ref: 'testSecretB96AD12C',
312-
},
313-
],
314-
},
315-
],
316-
},
317-
],
318-
},
319-
],
320-
},
321-
],
322-
],
323-
},
271+
Name: 'envName',
324272
ValueFrom: { Ref: 'testSecretB96AD12C' },
325273
},
326274
],

0 commit comments

Comments
 (0)