Chamber exec using file backend

[kespinola]

Use Case

We run several copies of the same container on a host. They all are requesting the same secret so we started to fetch the path in a sidecar container. The sidecar then writes to a shared volume that the app container mounts. A language-specific implementation of dotenv is finally used to populate the environment for the process. For example, dotenv for ruby.

This approach was also taken because of rate-limiting by the ssm api. What 5 api calls per host reduce to a single api call.

Desire

Able to run chamber exec pointing to a file so the environment is set correctly before starting the application. This shifts environment management out of the application and into ops domain.

Command

chamber exec -b file --path /mount/path/.env /apps/some-app -- bundle exec rails s

Another option for the -b flag is host.

[nickatsegment]

Do I understand this right?

You have:

1. chamber sidecar loads from SSM, writes to /shared/creds.dotenv or whatever
2. app loads /shared/creds.dotenv in-process; there are many copies of these

You want:

1. chamber sidecar loads from SSM, writes to /shared/creds.dotenv
2. chamber loads /shared/creds.dotenv and execs app with environ from creds.dotenv

[kespinola]

"The have" is correct with a 3rd point that our application needs to include as a dependency a package for loading the env file.

"The want" is correct. This is so we can start up the application with the environment loaded to the process before the application startup command is invoked. Therefore preserving the existing behavior of chamber exec apps/some-service -- bundle exec rails s. Again this method results in each container making an api call to ssm instead of reading a shared volume.

Our ultimate goal is to reduce api calls to ssm so we avoid api limits during or blue/green deploys. For context, we recycle roughly 250 nodes per deployment.

[nickatsegment]

Right, I understand the utility of some sort of per-node SSM cache, that makes total sense.

Honestly I don't love the idea of loading from dotenv files. I see that it could be a useful workaround for your issue, but I don't see it having any sort of broad utility outside of this very narrow use case.

I'm more reluctant to do any more dotenv stuff because it's just such a poorly defined format. Docker Compose's dotenv parser famously cannot represent newlines.

I really feel like you could do this with a shell script. eval and export or something. But it's not chamber's job, sorry.

[kespinola]

Not a problem. I wasn't enthused about the idea either.

I'll explore what I can do with eval.