Repository: cdklabs/cdk-ecs-service-extensions (language: python)

Issue:
Add secrets to container
Add the ability to set secrets via `Container`. Currently you have to add a mutating hook to do this.


Discussion / hints:

Fix patch:
diff --git a/src/extensions/container.ts b/src/extensions/container.ts
index 329b56b8..802aa157 100644
--- a/src/extensions/container.ts
+++ b/src/extensions/container.ts
@@ -42,6 +42,22 @@ export interface ContainerExtensionProps {
     [key: string]: string;
   };
 
+  /**
+   * The environment files to pass to the container.
+   *
+   * @see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/taskdef-envfiles.html
+   *
+   * @default - No environment files.
+   */
+  readonly environmentFiles?: ecs.EnvironmentFile[];
+
+  /**
+   * The secret environment variables to pass to the container.
+   *
+   * @default - No secret environment variables.
+   */
+  readonly secrets?: { [key: string]: ecs.Secret };
+
   /**
    * The log group into which application container logs should be routed.
    *
@@ -100,6 +116,8 @@ export class Container extends ServiceExtension {
       cpu: Number(this.props.cpu),
       memoryLimitMiB: Number(this.props.memoryMiB),
       environment: this.props.environment,
+      environmentFiles: this.props.environmentFiles,
+      secrets: this.props.secrets,
     } as ecs.ContainerDefinitionOptions;
 
     // Let other extensions mutate the container definition. This is


Test patch:
diff --git a/test/container.test.ts b/test/container.test.ts
index 3741ec3f..ffb70ea2 100644
--- a/test/container.test.ts
+++ b/test/container.test.ts
@@ -5,6 +5,7 @@ import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as ecs from 'aws-cdk-lib/aws-ecs';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as awslogs from 'aws-cdk-lib/aws-logs';
+import * as secrets from 'aws-cdk-lib/aws-secretsmanager';
 import * as cxapi from 'aws-cdk-lib/cx-api';
 import { Container, Environment, EnvironmentCapacityType, FireLensExtension, Service, ServiceDescription } from '../lib';
 
@@ -31,12 +32,17 @@ describe('container', () => {
     const taskRole = new iam.Role(stack, 'CustomTaskRole', {
       assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
     });
-
+    const secret = new secrets.Secret(stack, 'secret', {
+      secretName: 'secret',
+    });
     serviceDescription.add(new Container({
       cpu: 256,
       memoryMiB: 512,
       trafficPort: 80,
       image: ecs.ContainerImage.fromRegistry('nathanpeck/name'),
+      secrets: {
+        'my-secret': ecs.Secret.fromSecretsManager(secret),
+      },
     }));
 
     new Service(stack, 'my-service', {
@@ -69,6 +75,14 @@ describe('container', () => {
               SoftLimit: 1024000,
             },
           ],
+          Secrets: [
+            {
+              Name: 'my-secret',
+              ValueFrom: {
+                Ref: 'secret4DA88516',
+              },
+            },
+          ],
         },
       ],
       Cpu: '256',