ECS container HTTP status code

ECS container HTTP status code injects HTTP chaos that affects the request (or response) by modifying the status code (or the body or the headers) by starting a proxy server and redirecting the traffic through the proxy server on the target ECS containers.

This experiment induces chaos within a container and depends on an EC2 instance. Typically, these are prefixed with "ECS container" and involve direct interaction with the EC2 instances hosting the ECS containers.

ECS Container HTTP Modify Response

Use cases

ECS container HTTP status code:

Tests the ECS task container resilience to erroneous code HTTP responses from the application server.
Simulates unavailability of specific API services (503, 404), unavailability of specific APIs for(or from) a given microservice (TBD or Path Filter) (404).
Simulates unauthorized requests for 3rd party services (401 or 403), and API malfunction (internal server error) (50x) on ECS task container.

Prerequisites

Kubernetes >= 1.17
ECS container metadata is enabled (disabled by default). To enable it, refer to this docs. If your task is running from before, you may need to restart it to get the metadata directory.
ECS cluster running with the desired tasks and containers and familiarity with ECS service update and deployment concepts.
Access to the ECS cluster instances with the necessary permissions to update the start and stop timeouts for containers. Refer to systems manager docs.
Backup and recovery mechanisms to handle potential failures during the testing process.
You and the ECS cluster instances have a role with the required AWS access to perform the SSM and ECS operations.
Kubernetes secret with AWS Access Key ID and Secret Access Key credentials in the CHAOS_NAMESPACE. Below is the sample secret file:

apiVersion: v1
kind: Secret
metadata:
  name: cloud-secret
type: Opaque
stringData:
  cloud_config.yml: |-
    # Add the cloud AWS credentials respectively
    [default]
    aws_access_key_id = XXXXXXXXXXXXXXXXXXX
    aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

tip

HCE recommends that you use the same secret name, that is, cloud-secret. Otherwise, you will need to update the AWS_SHARED_CREDENTIALS_FILE environment variable in the fault template with the new secret name and you won't be able to use the default health check probes.

Below is an example AWS policy to execute the fault.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetDocument",
                "ssm:DescribeDocument",
                "ssm:GetParameter",
                "ssm:GetParameters",
                "ssm:SendCommand",
                "ssm:CancelCommand",
                "ssm:CreateDocument",
                "ssm:DeleteDocument",
                "ssm:GetCommandInvocation",          
                "ssm:UpdateInstanceInformation",
                "ssm:DescribeInstanceInformation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2messages:AcknowledgeMessage",
                "ec2messages:DeleteMessage",
                "ec2messages:FailMessage",
                "ec2messages:GetEndpoint",
                "ec2messages:GetMessages",
                "ec2messages:SendReply"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ECS Container:DescribeInstanceStatus",
                "ECS Container:DescribeInstances"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

note

You can pass the VM credentials as secrets or as a ChaosEngine environment variable.
The ECS container should be in a healthy state before and after introducing chaos.
Refer to the superset permission or policy to execute all AWS faults.
Refer to the common attributes to tune the common tunables for all the faults.
Refer to AWS named profile for chaos to use a different profile for AWS faults.

Mandatory tunables

Tunable	Description	Notes
REGION	The AWS region ID where the ECS Container instance has been created.	For example, `us-east-1`.
TARGET_SERVICE_PORT	Port of the service to target.	Default: port 80. For more information, go to target service port.
STATUS_CODE	Modified status code for the HTTP response. If no value is provided, a random value is selected from the list of supported values. Multiple values can be provided as comma-separated values, and a random value from the list is selected.	Supported values: [200, 201, 202, 204, 300, 301, 302, 304, 307, 400, 401, 403, 404, 500, 501, 502, 503, 504]. Default: random status code.
MODIFY_RESPONSE_BODY	Whether to modify the body as per the status code provided.	If true, then the body is replaced by a default template for the status code. Defaults to true.