# Configuring Scaling Groups
source: https://docs.chalk.ai/docs/scaling-groups/configuring-scaling-groups

## Pass environment variables, secrets, and volumes to a scaling group, and find the settings it shares with other workloads.

This page covers the configuration specific to scaling groups.
These settings work the same way across workloads and have their own pages:

- Resources and GPUs
- Workload Identity
- Tags
- Autoscaling
- Readiness and Shutdown
- Authentication
- Tracing Policy

### Environment, secrets, and volumes

These use the same environment, secret, and volume configuration patterns as
sandboxes. The examples below inject an environment
variable, a secret, and a
volume. Create the secret and the volume first:

```
$ chalk secret set EXAMPLE_API_TOKEN=replace-with-your-token
$ chalk volume create chalk://example-api-data
```

Then pass them from the SDK. This example uses the app.py file from the
Quick start, saved in the same directory:

```
import chalkcompute

img = (
    chalkcompute.Image.debian_slim("3.12")
    .pip_install(["flask"])
    .add_local_file("./app.py", "/app/app.py")
    .entrypoint(["python", "/app/app.py"])
)

sg = chalkcompute.ScalingGroup(
    image=img,
    name="api",
    port=8080,
    env={"LOG_LEVEL": "INFO"},
    secrets=[chalkcompute.Secret.from_chalk_env("EXAMPLE_API_TOKEN")],
    volumes=[("example-api-data", "/data")],
    min_replicas=1,
    max_replicas=3,
).deploy()
```

Or from the CLI. This example serves the volume's files with Python's built-in
HTTP server:

```
$ chalk scaling-group create \
    --image=python:3.12-slim \
    --name=api \
    --port=8080 \
    --max-replicas=3 \
    --env=LOG_LEVEL=INFO \
    --secret=EXAMPLE_API_TOKEN \
    --volume=chalk://example-api-data=/data \
    --entrypoint="python,-m,http.server,8080,--directory,/data"
```

Repeat --env, --secret, and --volume to pass more than one. --env-file
reads KEY=VALUE lines from a file. --secret also accepts
integration:NAME[:KEY1,KEY2] to inject the secrets of a Chalk integration.
Without =/mount/path, --volume mounts the volume at /mnt/<volume-name>.

Secrets are resolved at deploy time and injected as environment variables in
every replica. Volume mounts are shared across all replicas, so use them for
read-mostly data — if multiple replicas write to the same volume path
concurrently, the last writer wins on the next sync.