# irrigate-ecs

This cookbook provides functionality to provision ECS anywhere cluster instances; it does not presently cover EC2-based ECS instances. Additionally, the `exec` recipe configures the instance to use SSM commands and [ECS Exec](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html).

## Kitchen Testing
The ssm recipe requires activation credentials, which are stored in an encrypted data bag that is _not_ checked into SCM, due
to its dynamic nature and regular out-of-band rotation. As such, when testing locally, you will need to fetch the data bag from the NY Dev Chef server, store it locally, and configure test kitchen with the correct encryption secret. The encryption secret is stored in the `dev/lambda-create-ssm-activation/ny-dev/CHEF_ENCRYPTED_DATA_BAG_SECRET` secrets manager location. Pull this into a local file and set the `ENCRYPTED_DATA_BAG_SECRET_KEY_PATH` environment variable in a local `.env` file to its location. Run the following commands to handle these steps:

```sh
knife block use ny-dev # or whatever the name for the NY dev Chef server is in your knife block config
knife data bag show secrets ssm_activation --format json > ~/chef-repo/data_bags/secrets/ssm_activation.json
aws secretsmanager get-secret-value --secret-id dev/lambda-create-ssm-activation/CHEF_ENCRYPTED_DATA_BAG_SECRET --region us-east-1 --query 'SecretString' > ~/.chef/secret_keys/ssm_activation_encryption_secret
echo "ENCRYPTED_DATA_BAG_SECRET_KEY_PATH=~/.chef/secret_keys/ssm_activation_encryption_secret" >> .env
```

### VMware driver
Kitchen tests for this cookbook require the VMware driver for the NY Tier1 VMware cluster, which requires a Tier 1 `theorchard.local` Active Directory user. As of July 2023 this also interfaces with the Sony PAM solution, meaning that the `VCENTER_PASSWORD` variable set in `.env` should be a temporary password retrieved from this system.

### Template authentication
The VMware template (`_Templates/amazonlinux2-vmware`) used as a base image requires key-based SSH authentication, the credentials for which are found in the `Amazon Linux template initial SSH credentials` Dashlane record. Make sure `VCENTER_SSH_KEY` is set in `.env` with the path to this SSH key.

## ECS container image

This is bundled with the `amazon-ecs-init` package, which is hosted in an internal Packagecloud repository to ensure version consistency, but is available from https://s3.us-east-1.amazonaws.com/amazon-ecs-agent-us-east-1/amazon-ecs-init-${version}.${arch}.rpm, e.g. https://s3.us-east-1.amazonaws.com/amazon-ecs-agent-us-east-1/amazon-ecs-init-1.73.1-1.x86_64.rpm.