Add attachment feature example (#4438)

Signed-off-by: khanhtc1202 <[email protected]>

examples/README.remote.md

@@ -69,4 +69,6 @@ A repository contains some examples for PipeCD.
 | -- | [simple](https://github.com/pipe-cd/examples/tree/master/ecs/simple) | Quick sync by rolling out the new version and switching all traffic to it. |
 | -- | [canary](https://github.com/pipe-cd/examples/tree/master/ecs/canary) | Deployment pipeline with canary strategy. |
 | -- | [bluegreen](https://github.com/pipe-cd/examples/tree/master/ecs/bluegreen) | Deployment pipeline with blue-green strategy. |
-| -- | [secret-management](https://github.com/pipe-cd/examples/tree/master/ecs/secret-management) | Demonstrate how to manage sensitive data by using [Secret Management](https://pipecd.dev/docs/user-guide/secret-management/) feature. |
+| -- | [standalone-task](https://github.com/pipe-cd/examples/tree/master/ecs/standalone-task) | Deployment pipeline for an ECS standalone task (no service required). |
+| -- | [secret-management](https://github.com/pipe-cd/examples/tree/master/ecs/secret-management) | Demonstrate how to manage sensitive data by using [Secret Management](https://pipecd.dev/docs/user-guide/managing-application/secret-management/) feature. |
+| -- | [attachment](https://github.com/pipe-cd/examples/tree/master/ecs/attachment) | Demonstrate how to manage insensitive data and import it into application manifests while deployment using [Attachment](https://pipecd.dev/docs/user-guide/managing-application/attachment/) feature. |

examples/ecs/attachment/app.pipecd.yaml

@@ -0,0 +1,27 @@
+apiVersion: pipecd.dev/v1beta1
+kind: ECSApp
+spec:
+  name: attachment
+  labels:
+    env: example
+    team: xyz
+  input:
+    serviceDefinitionFile: servicedef.yaml
+    taskDefinitionFile: taskdef.yaml
+    targetGroups:
+      primary:
+        targetGroupArn: arn:aws:elasticloadbalancing:ap-northeast-1:XXXX:targetgroup/ecs-lb/YYYY
+        containerName: web
+        containerPort: 80
+  encryption:
+    encryptedSecrets:
+      # Encrypted via the web console.
+      foo: AQClmqFuXZ10F83HgWIKHzr92YL/x8HBQyc7RUbxyJexjaKvFJ2YeYJWnqcssxBt8EAC4Kie+iZr5ABWZ2yNEQaPRSaBTTBRLetsmsJfdtDZOr1VvXj7nPEBFBajxsIs1LhFLejsR8WMDmYk2Sy4h1pP8dhYL6oNaAxU17ehdQ5PMCqo0Lv8hN5/Qhz4+KW/yotxgqgJm5eFPUnWLlvkbO6P1iyEpg+xZZNcUjqKbZ8MyU7zf7yms4kuouo+p5yoSjqI9jEEy5DJ9TdJtn5S8ENKUoDLDunsERrBip2kSIv8nxNgBMOfqLskjyKrMgMGMyGqwXGJiKPqFiLDM/6TWo2B2f2cVIPRmCNUU9uVMadHfK5DFxr3NZG6
+    decryptionTargets:
+      - servicedef.yaml
+      - config.yaml
+  attachment:
+    sources:
+      config: config.yaml
+    targets:
+      - taskdef.yaml

examples/ecs/attachment/config.yaml

@@ -0,0 +1,3 @@
+mysql:
+  rootPassword: "test"
+  database: "{{ .encryptedSecrets.foo }}"

examples/ecs/attachment/servicedef.yaml

@@ -0,0 +1,25 @@
+cluster: arn:aws:ecs:ap-northeast-1:XXXX:cluster/test-cluster
+serviceName: nginx-service
+desiredCount: 2
+deploymentConfiguration:
+  maximumPercent: 200
+  minimumHealthyPercent: 0
+schedulingStrategy: REPLICA
+# CAUTION: To enable PipeCD controls the deployment
+# DeploymentController of type EXTERNAL is required.
+deploymentController:
+  type: EXTERNAL
+enableECSManagedTags: true
+propagateTags: SERVICE
+launchType: FARGATE
+networkConfiguration:
+  awsvpcConfiguration:
+    assignPublicIp: ENABLED
+    securityGroups:
+      - sg-YYYY
+    subnets:
+      - subnet-YYYY
+      - subnet-YYYY
+tags:
+  - key: FOO
+    value: "{{ .encryptedSecrets.foo }}"

examples/ecs/attachment/taskdef.yaml

@@ -0,0 +1,20 @@
+family: nginx-service-fam
+executionRoleArn: arn:aws:iam::XXXX:role/ecsTaskExecutionRole
+containerDefinitions:
+  - command: "echo {{ .attachment.config }}"
+    cpu: 100
+    image: XXXX.dkr.ecr.ap-northeast-1.amazonaws.com/nginx:1
+    memory: 100
+    mountPoints: []
+    name: web
+    portMappings:
+      - containerPort: 80
+compatibilities:
+  - FARGATE
+requiresCompatibilities:
+  - FARGATE
+networkMode: awsvpc
+memory: 512
+cpu: 256
+pidMode: ""
+volumes: []