feat: support extra variables for metadata service

README.md

@@ -113,6 +113,7 @@ resource "local_file" "metaflow_config" {
 | <a name="input_db_migrate_lambda_zip_file"></a> [db\_migrate\_lambda\_zip\_file](#input\_db\_migrate\_lambda\_zip\_file) | Output path for the zip file containing the DB migrate lambda | `string` | `null` | no |
 | <a name="input_enable_custom_batch_container_registry"></a> [enable\_custom\_batch\_container\_registry](#input\_enable\_custom\_batch\_container\_registry) | Provisions infrastructure for custom Amazon ECR container registry if enabled | `bool` | `false` | no |
 | <a name="input_enable_step_functions"></a> [enable\_step\_functions](#input\_enable\_step\_functions) | Provisions infrastructure for step functions if enabled | `bool` | n/a | yes |
+| <a name="input_extra_metadata_service_env_vars"></a> [extra\_metadata\_service\_env\_vars](#input\_extra\_metadata\_service\_env\_vars) | Additional environment variables for metadata service container | `map(string)` | `{}` | no |
 | <a name="input_extra_ui_backend_env_vars"></a> [extra\_ui\_backend\_env\_vars](#input\_extra\_ui\_backend\_env\_vars) | Additional environment variables for UI backend container | `map(string)` | `{}` | no |
 | <a name="input_extra_ui_static_env_vars"></a> [extra\_ui\_static\_env\_vars](#input\_extra\_ui\_static\_env\_vars) | Additional environment variables for UI static app | `map(string)` | `{}` | no |
 | <a name="input_force_destroy_s3_bucket"></a> [force\_destroy\_s3\_bucket](#input\_force\_destroy\_s3\_bucket) | Empty S3 bucket before destroying via terraform destroy | `bool` | `false` | no |

main.tf

@@ -42,7 +42,8 @@ module "metaflow-metadata-service" {
   vpc_cidr_blocks                  = var.vpc_cidr_blocks
   with_public_ip                   = var.with_public_ip
 
-  standard_tags = var.tags
+  extra_metadata_service_env_vars = var.extra_metadata_service_env_vars
+  standard_tags                   = var.tags
 }
 
 module "metaflow-ui" {

modules/metadata-service/README.md

@@ -23,6 +23,7 @@ If the `access_list_cidr_blocks` variable is set, only traffic originating from
 | <a name="input_db_migrate_lambda_zip_file"></a> [db\_migrate\_lambda\_zip\_file](#input\_db\_migrate\_lambda\_zip\_file) | Output path for the zip file containing the DB migrate lambda | `string` | `null` | no |
 | <a name="input_enable_api_basic_auth"></a> [enable\_api\_basic\_auth](#input\_enable\_api\_basic\_auth) | Enable basic auth for API Gateway? (requires key export) | `bool` | `true` | no |
 | <a name="input_enable_api_gateway"></a> [enable\_api\_gateway](#input\_enable\_api\_gateway) | Enable API Gateway for public metadata service endpoint | `bool` | `true` | no |
+| <a name="input_extra_metadata_service_env_vars"></a> [extra\_metadata\_service\_env\_vars](#input\_extra\_metadata\_service\_env\_vars) | Additional environment variables for metadata service container | `map(string)` | `{}` | no |
 | <a name="input_fargate_execution_role_arn"></a> [fargate\_execution\_role\_arn](#input\_fargate\_execution\_role\_arn) | The IAM role that grants access to ECS and Batch services which we'll use as our Metadata Service API's execution\_role for our Fargate instance | `string` | n/a | yes |
 | <a name="input_iam_partition"></a> [iam\_partition](#input\_iam\_partition) | IAM Partition (Select aws-us-gov for AWS GovCloud, otherwise leave as is) | `string` | `"aws"` | no |
 | <a name="input_is_gov"></a> [is\_gov](#input\_is\_gov) | Set to true if IAM partition is 'aws-us-gov' | `bool` | `false` | no |

modules/metadata-service/ecs.tf

@@ -13,42 +13,34 @@ resource "aws_ecs_cluster" "this" {
 resource "aws_ecs_task_definition" "this" {
   family = "${var.resource_prefix}service${var.resource_suffix}" # Unique name for task definition
 
-  container_definitions = <<EOF
-[
-  {
-    "name": "${var.resource_prefix}service${var.resource_suffix}",
-    "image": "${var.metadata_service_container_image}",
-    "essential": true,
-    "cpu": ${var.metadata_service_cpu},
-    "memory": ${var.metadata_service_memory},
-    "portMappings": [
-      {
-        "containerPort": 8080,
-        "hostPort": 8080
-      },
-      {
-        "containerPort": 8082,
-        "hostPort": 8082
-      }
-    ],
-    "environment": [
-      {"name": "MF_METADATA_DB_HOST", "value": "${replace(var.rds_master_instance_endpoint, ":5432", "")}"},
-      {"name": "MF_METADATA_DB_NAME", "value": "${var.database_name}"},
-      {"name": "MF_METADATA_DB_PORT", "value": "5432"},
-      {"name": "MF_METADATA_DB_PSWD", "value": "${var.database_password}"},
-      {"name": "MF_METADATA_DB_USER", "value": "${var.database_username}"}
-    ],
-    "logConfiguration": {
-        "logDriver": "awslogs",
-        "options": {
-            "awslogs-group": "${aws_cloudwatch_log_group.this.name}",
-            "awslogs-region": "${data.aws_region.current.name}",
-            "awslogs-stream-prefix": "metadata"
+  container_definitions = jsonencode([
+    {
+      name      = "${var.resource_prefix}service${var.resource_suffix}"
+      image     = var.metadata_service_container_image
+      essential = true
+      cpu       = var.metadata_service_cpu
+      memory    = var.metadata_service_memory
+      portMappings = [
+        {
+          containerPort = 8080
+          hostPort      = 8080
+        },
+        {
+          containerPort = 8082
+          hostPort      = 8082
+        }
+      ]
+      environment = [for k, v in merge(local.default_metadata_service_env_vars, var.extra_metadata_service_env_vars) : { name = k, value = v }]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group" : "${aws_cloudwatch_log_group.this.name}"
+          "awslogs-region" : "${data.aws_region.current.name}"
+          "awslogs-stream-prefix" : "metadata"
         }
+      }
     }
-  }
-]
-EOF
+  ])
 
   network_mode             = "awsvpc"
   requires_compatibilities = ["FARGATE"]

modules/metadata-service/locals.tf

@@ -27,4 +27,12 @@ locals {
   lambda_ecs_execute_role_name = "${var.resource_prefix}lambda_ecs_execute${var.resource_suffix}"
 
   cloudwatch_logs_arn_prefix = "arn:${var.iam_partition}:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}"
+
+  default_metadata_service_env_vars = {
+    "MF_METADATA_DB_HOST" = "${replace(var.rds_master_instance_endpoint, ":5432", "")}"
+    "MF_METADATA_DB_NAME" = "${var.database_name}"
+    "MF_METADATA_DB_PORT" = "5432"
+    "MF_METADATA_DB_PSWD" = "${var.database_password}"
+    "MF_METADATA_DB_USER" = "${var.database_username}"
+  }
 }

modules/metadata-service/variables.tf

@@ -37,6 +37,12 @@ variable "enable_api_gateway" {
   description = "Enable API Gateway for public metadata service endpoint"
 }
 
+variable "extra_metadata_service_env_vars" {
+  type        = map(string)
+  default     = {}
+  description = "Additional environment variables for metadata service container"
+}
+
 variable "db_migrate_lambda_zip_file" {
   type        = string
   description = "Output path for the zip file containing the DB migrate lambda"

variables.tf

@@ -171,6 +171,12 @@ variable "ui_allow_list" {
   description = "List of CIDRs we want to grant access to our Metaflow UI Service. Usually this is our VPN's CIDR blocks."
 }
 
+variable "extra_metadata_service_env_vars" {
+  type        = map(string)
+  default     = {}
+  description = "Additional environment variables for metadata service container"
+}
+
 variable "extra_ui_backend_env_vars" {
   type        = map(string)
   default     = {}