ECS container volume detach

ECS container volume detach provides a mechanism to detach and remove volumes associated with ECS task containers in an Amazon ECS (Elastic Container Service) task. This experiment primarily involves ECS Fargate and doesn’t depend on EC2 instances. They focus on altering the state or resources of ECS containers without direct container interaction.

Use cases

ECS container volume detach:

• Allows you to test and validate the behavior of your ECS tasks when volumes are detached. You can verify the resilience and performance of your application during volume detachment scenarios, ensuring that the containers continue to function as expected.
• By detaching volumes, you can safely remove the volume associations from the containers without deleting the volumes themselves.
• By detaching unnecessary volumes, you can optimize the resource utilization within your ECS tasks. This helps to free up storage space and minimize any potential performance impact associated with unused volumes.

Prerequisites

• Kubernetes >= 1.17
• ECS cluster running with the desired tasks and containers and familiarity with ECS service update and deployment concepts.
• Create a Kubernetes secret that has the AWS access configuration(key) in the CHAOS_NAMESPACE. Below is a sample secret file:

apiVersion: v1
kind: Secret
metadata:
  name: cloud-secret
type: Opaque
stringData:
  cloud_config.yml: |-
    # Add the cloud AWS credentials respectively
    [default]
    aws_access_key_id = XXXXXXXXXXXXXXXXXXX
    aws_secret_access_key = XXXXXXXXXXXXXXX

tip

HCE recommends that you use the same secret name, that is, cloud-secret. Otherwise, you will need to update the AWS_SHARED_CREDENTIALS_FILE environment variable in the fault template with the new secret name and you won't be able to use the default health check probes.

Below is an example AWS policy to execute the fault.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:DescribeTasks",
                "ecs:DescribeServices",
                "ecs:DescribeTaskDefinition",
                "ecs:RegisterTaskDefinition",
                "ecs:UpdateService",
                "ecs:ListTasks",
                "ecs:DeregisterTaskDefinition"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*"
        }
    ]
}

note

• Refer to AWS named profile for chaos to know how to use a different profile for AWS faults.
• The ECS containers should be in a healthy state before and after introducing chaos. Refer to the common attributes and AWS-specific tunables to tune the common tunables for all faults and AWS-specific tunables.
• Refer to the superset permission/policy to execute all AWS faults.

Mandatory tunables

Tunable	Description	Notes
CLUSTER_NAME	Name of the target ECS cluster	For example, cluster-1. For more information, go to cluster name.
SERVICE_NAME	Name of the ECS service under chaos	For example, nginx-svc. For more information, go to service name.
REGION	Region name of the target ECS cluster	For example, us-east-1.

Optional tunables

Tunable	Description	Notes
TOTAL_CHAOS_DURATION	Duration that you specify, through which chaos is injected into the target resource (in seconds)	Default: 30 s. For more information, go to duration of the chaos.
TASK_REPLICA_AFFECTED_PERC	Percentage of total tasks that are targeted.	Default: 100. For more information, go to ECS task replica affected percentage.
CHAOS_INTERVAL	Interval between successive instance terminations (in seconds)	Default: 30 s. For more information, go to chaos interval.
AWS_SHARED_CREDENTIALS_FILE	Path to the AWS secret credentials	Defaults to /tmp/cloud_config.yml.
RAMP_TIME	Period to wait before and after injecting chaos (in seconds)	For example, 30 s. For more information, go to ramp time.

ECS container volume detach

ECS container volume chaos will detach the volumes for specified chaos duration. Tune it by using the SERVICE_NAME and CLUSTER_NAME environment variable.

The following YAML snippet illustrates the use of this environment variable:

# Set container image for the target ECS task
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: aws-nginx
spec:
  engineState: "active"
  annotationCheck: "false"
  chaosServiceAccount: litmus-admin
  experiments:
  - name: ecs-container-volume-detach
    spec:
      components:
        env:
        - name: CLUSTER_NAME
          value: 'test-cluster'
        - name: SERVICE_NAME
          value: 'test-service'
        - name: REGION
          value: 'us-east-2'
        - name: TOTAL_CHAOS_DURATION
          VALUE: '60'

ECS task replica affected percentage

Number of tasks to target (in percentage). Tune it by using the TASK_REPLICA_AFFECTED_PERC environment variable.

The following YAML snippet illustrates the use of this environment variable:

# stop the tasks of an ECS cluster
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: engine-nginx
spec:
  engineState: "active"
  annotationCheck: "false"
  chaosServiceAccount: litmus-admin
  experiments:
  - name: ecs-task-stop
    spec:
      components:
        env:
        # provide the name of ECS cluster
        - name: CLUSTER_NAME
          value: 'demo'
        - name: SERVICE_NAME
          vale: 'test-svc'
        - name: TASK_REPLICA_AFFECTED_PERC
          vale: '100'
        - name: REGION
          value: 'us-east-1'
        - name: TOTAL_CHAOS_DURATION
          VALUE: '60'