wip

agent/engine/ordering_integ_test.go

@@ -161,6 +161,11 @@ func TestDependencyComplete(t *testing.T) {
 // Container 'parent' depends on  container 'dependency' to START. We ensure that the 'parent' container starts only
 // after the 'dependency' container has started.
 func TestDependencyStart(t *testing.T) {
+	// Skip these tests on WS 2016 until the failures are root-caused.
+	isWindows2016, err := config.IsWindows2016()
+	if err == nil && isWindows2016 == true {
+		t.Skip()
+	}
 	taskEngine, done, _, _ := setupWithDefaultConfig(t)
 	defer done()
 

agent/engine/serviceconnect/manager_linux.go

@@ -26,6 +26,8 @@ import (
 	"github.com/pborman/uuid"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
 
 	apicontainer "github.com/aws/amazon-ecs-agent/agent/api/container"
 	apiserviceconnect "github.com/aws/amazon-ecs-agent/agent/api/serviceconnect"
@@ -200,6 +202,37 @@ func defaultMkdirAllAndChown(path string, perm fs.FileMode, uid, gid int) error
 	return nil
 }
 
+func getRegionFromContainerInstanceARN(containerInstanceARN string) string {
+	// Parse the ARN
+	parsedARN, err := arn.Parse(containerInstanceARN)
+	if err != nil {
+		return ""
+	}
+
+	// Extract the region from the parsed ARN
+	return parsedARN.Region
+}
+
+func isIsoRegion(region string) bool {
+	partition, ok := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), region)
+	if !ok {
+		// if partition is not found, assume it's iso
+		return true
+	}
+	switch partition.ID() {
+	case endpoints.AwsPartitionID:
+		return false
+	case endpoints.AwsUsGovPartitionID:
+		return false
+	case endpoints.AwsCnPartitionID:
+		return false
+	default:
+		// region partition is not 'aws', 'aws-us-gov', nor 'aws-cn', so assume it's
+		// an iso region.
+		return true
+	}
+}
+
 func (m *manager) initAgentDirectoryMounts(taskId string, container *apicontainer.Container, hostConfig *dockercontainer.HostConfig) (string, error) {
 	statusPathHost := filepath.Join(m.statusPathHostRoot, taskId)
 
@@ -213,7 +246,10 @@ func (m *manager) initAgentDirectoryMounts(taskId string, container *apicontaine
 
 	hostConfig.Binds = append(hostConfig.Binds, getBindMountMapping(statusPathHost, m.statusPathContainer))
 	hostConfig.Binds = append(hostConfig.Binds, getBindMountMapping(m.relayPathHost, m.relayPathContainer))
-	hostConfig.Binds = append(hostConfig.Binds, getBindMountMapping(hostPKIDirPath, hostPKIDirPath))
+	region := getRegionFromContainerInstanceARN(m.containerInstanceARN)
+	if isIsoRegion(region) {
+		hostConfig.Binds = append(hostConfig.Binds, getBindMountMapping(hostPKIDirPath, hostPKIDirPath))
+	}
 
 	// create logging directory and bind mount, if customer has not configured a logging driver
 	if container.GetLogDriver() == "" {

agent/engine/serviceconnect/manager_linux_test.go

@@ -182,3 +182,130 @@ func TestGetSupportedAppnetInterfaceVerToCapabilities(t *testing.T) {
 		})
 	}
 }
+
+func TestGetRegionFromContainerInstanceARN(t *testing.T) {
+	tests := []struct {
+		name                 string
+		containerInstanceARN string
+		expectedRegion       string
+	}{
+		{
+			name:                 "Valid ARN - US West 2",
+			containerInstanceARN: "arn:aws:ecs:us-west-2:123456789012:container-instance/12345678-1234-1234-1234-123456789012",
+			expectedRegion:       "us-west-2",
+		},
+		{
+			name:                 "Valid ARN - EU Central 1",
+			containerInstanceARN: "arn:aws:ecs:eu-central-1:123456789012:container-instance/87654321-4321-4321-4321-210987654321",
+			expectedRegion:       "eu-central-1",
+		},
+		{
+			name:                 "Valid ARN - AP Southeast 1",
+			containerInstanceARN: "arn:aws:ecs:ap-southeast-1:123456789012:container-instance/11223344-5566-7788-9900-112233445566",
+			expectedRegion:       "ap-southeast-1",
+		},
+		{
+			name:                 "Valid ARN - US Gov West 1",
+			containerInstanceARN: "arn:aws-us-gov:ecs:us-gov-west-1:123456789012:container-instance/98765432-1234-5678-9012-123456789012",
+			expectedRegion:       "us-gov-west-1",
+		},
+		{
+			name:                 "Valid ARN - CN North 1",
+			containerInstanceARN: "arn:aws-cn:ecs:cn-north-1:123456789012:container-instance/11223344-5566-7788-9900-112233445566",
+			expectedRegion:       "cn-north-1",
+		},
+		{
+			name:                 "Invalid ARN - Missing Region",
+			containerInstanceARN: "arn:aws:ecs::123456789012:container-instance/12345678-1234-1234-1234-123456789012",
+			expectedRegion:       "",
+		},
+		{
+			name:                 "Invalid ARN - Wrong Service",
+			containerInstanceARN: "arn:aws:ec2:us-west-2:123456789012:instance/i-1234567890abcdef0",
+			expectedRegion:       "us-west-2",
+		},
+		{
+			name:                 "Invalid ARN Format",
+			containerInstanceARN: "invalid:arn:format",
+			expectedRegion:       "",
+		},
+		{
+			name:                 "Empty ARN",
+			containerInstanceARN: "",
+			expectedRegion:       "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := getRegionFromContainerInstanceARN(tt.containerInstanceARN)
+			assert.Equal(t, tt.expectedRegion, result, "Unexpected region for ARN: %s", tt.containerInstanceARN)
+		})
+	}
+}
+
+func TestIsIsoRegion(t *testing.T) {
+	tests := []struct {
+		name           string
+		region         string
+		expectedResult bool
+	}{
+		{
+			name:           "AWS Standard Region - US West 2",
+			region:         "us-west-2",
+			expectedResult: false,
+		},
+		{
+			name:           "AWS Standard Region - EU Central 1",
+			region:         "eu-central-1",
+			expectedResult: false,
+		},
+		{
+			name:           "AWS GovCloud Region - US Gov West 1",
+			region:         "us-gov-west-1",
+			expectedResult: false,
+		},
+		{
+			name:           "AWS GovCloud Region - US Gov East 1",
+			region:         "us-gov-east-1",
+			expectedResult: false,
+		},
+		{
+			name:           "AWS China Region - CN North 1",
+			region:         "cn-north-1",
+			expectedResult: false,
+		},
+		{
+			name:           "AWS China Region - CN Northwest 1",
+			region:         "cn-northwest-1",
+			expectedResult: false,
+		},
+		{
+			name:           "ISO Region - US ISO East 1",
+			region:         "us-iso-east-1",
+			expectedResult: true,
+		},
+		{
+			name:           "ISO Region - US ISOB East 1",
+			region:         "us-isob-east-1",
+			expectedResult: true,
+		},
+		{
+			name:           "Unknown Region",
+			region:         "unknown-region",
+			expectedResult: true,
+		},
+		{
+			name:           "Empty Region",
+			region:         "",
+			expectedResult: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isIsoRegion(tt.region)
+			assert.Equal(t, tt.expectedResult, result, "Unexpected result for region: %s", tt.region)
+		})
+	}
+}

agent/engine/serviceconnect/manager_linux_test_common.go

@@ -147,6 +147,7 @@ func testAgentContainerModificationsForServiceConnect(t *testing.T, privilegedMo
 		expectedBinds        []string
 		expectedBindDirPerm  string
 		expectedBindDirOwner uint32
+		containerInstanceARN string
 	}
 	testcases := []testCase{
 		{
@@ -156,6 +157,16 @@ func testAgentContainerModificationsForServiceConnect(t *testing.T, privilegedMo
 			expectedBinds:        expectedBinds,
 			expectedBindDirPerm:  fs.FileMode(0700).String(),
 			expectedBindDirOwner: serviceconnect.AppNetUID,
+			containerInstanceARN: "arn:aws:ecs:us-west-2:123456789012:container-instance/12345678-1234-1234-1234-123456789012",
+		},
+		{
+			name:                 "Service connect container has extra binds/ENV",
+			container:            serviceConnectContainer,
+			expectedENV:          expectedENVs,
+			expectedBinds:        expectedBinds,
+			expectedBindDirPerm:  fs.FileMode(0700).String(),
+			expectedBindDirOwner: serviceconnect.AppNetUID,
+			containerInstanceARN: "arn:aws:ecs:us-iso-east-1:123456789012:container-instance/12345678-1234-1234-1234-123456789012",
 		},
 	}
 	// Add test cases for other containers expecting no modifications
@@ -179,14 +190,14 @@ func testAgentContainerModificationsForServiceConnect(t *testing.T, privilegedMo
 		agentContainerImageName: "container",
 		appnetInterfaceVersion:  "v1",
 
-		containerInstanceARN: "fake_container_instance",
-		logPathContainer:     "/some/other/log",
-		logPathHostRoot:      filepath.Join(tempDir, "log"),
+		logPathContainer: "/some/other/log",
+		logPathHostRoot:  filepath.Join(tempDir, "log"),
 	}
 
 	for _, tc := range testcases {
 		t.Run(tc.name, func(t *testing.T) {
 			hostConfig := &dockercontainer.HostConfig{}
+			scManager.containerInstanceARN = tc.containerInstanceARN
 			err := scManager.AugmentTaskContainer(scTask, tc.container, hostConfig)
 			if err != nil {
 				t.Fatal(err)