Skip to content

Commit 58e145d

Browse files
npalmnpalm
committed
Merge branch 'release/v0.9.0' into master
2 parents f68d65b + 8a22915 commit 58e145d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+2322
-1516
lines changed

‎.ci/.dockerignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
node_modules

‎.ci/Dockerfile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
FROM node:12
22

3-
WORKDIR /lambda
4-
5-
COPY . /lambda
6-
73
RUN apt-get update \
84
&& apt-get install -y zip \
95
&& rm -rf /var/lib/apt/lists/*
106

7+
WORKDIR /lambda
8+
9+
COPY . /lambda
10+
1111
RUN yarn install \
1212
&& yarn run dist
1313

‎.ci/build.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
#!/usr/bin/env bash
2+
set -e
23

34
lambdaSrcDirs=("modules/runner-binaries-syncer/lambdas/runner-binaries-syncer" "modules/runners/lambdas/runners" "modules/webhook/lambdas/webhook")
45
repoRoot=$(dirname $(dirname $(realpath ${BASH_SOURCE[0]})))

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,6 @@ example/*.secrets*.tfvars
1717
*.gz
1818
*.tgz
1919
*.env
20+
.vscode
21+
22+
**/coverage/*

‎CHANGELOG.md

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [0.9.0] - 2020-12-08
11+
12+
### Added
13+
14+
- Add support for GitHub Enterprise Server (GHES) #412, #481, #467 @mcaulifn @jonico
15+
- Allow configuring additional security groups #392 @surminus
16+
17+
### Changed
18+
19+
- Log groups per type of logging #476
20+
- Copy directory *after* installing zip #444 @masterful
21+
- Update ubuntu example with rootless docker and non privileged user #433
22+
- Changed strategy in scaling. Previous the module scaled by checking for any queued workflow for the repo initiation the check_run event. Now the module scales only if the correlated check_run is still in queued state. #423
23+
24+
### Fixed
25+
26+
- Fix missing permissions for CloudWatch Agent #445 @bennettp123
27+
- Swap scale up/scale down timeout description #468 @jonico
28+
- Fix for invalid configuration #466 @jonico
29+
- Add ssm:GetParameter to runner-ssm-parameters #446 @bennettp123
30+
- Replace crypto #429
31+
- Scale up lambda deprecated attribute #410
32+
33+
### Mirgrations
34+
35+
Changes related to logging groups introduced via #476 will destroy existing logging group in AWS cloudwatch for runners log. In case you would like to keep the logging ensure you remove the log group from the state before running an apply
36+
37+
```bash
38+
export RESOURCE=$(terraform state list | grep "aws_cloudwatch_log_group.runner")
39+
terraform state rm $RESOURCE
40+
```
41+
1042
## [0.8.1] - 2020-12-08
43+
1144
### Changed
45+
1246
- Policy is missing for streaming logs to cloudwatch #388
1347

1448
## [0.8.0] - 2020-12-08
@@ -105,7 +139,8 @@ terraform import module.runners.module.webhook.aws_cloudwatch_log_group.webhook
105139

106140
- First release.
107141

108-
[unreleased]: https://github.com/philips-labs/terraform-aws-github-runner/compare/v0.8.1..HEAD
142+
[unreleased]: https://github.com/philips-labs/terraform-aws-github-runner/compare/v0.9.0..HEAD
143+
[0.9.0]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.8.1..v0.9.0
109144
[0.8.1]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.8.0..v0.8.1
110145
[0.8.0]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.7.0..v0.8.0
111146
[0.7.0]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.6.0..v0.7.0

‎README.md

Lines changed: 76 additions & 62 deletions
Large diffs are not rendered by default.

‎examples/ubuntu/main.tf

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ module "runners" {
2727
webhook_secret = random_password.random.result
2828
}
2929

30-
webhook_lambda_zip = "lambdas-download/webhook.zip"
31-
runner_binaries_syncer_lambda_zip = "lambdas-download/runner-binaries-syncer.zip"
32-
runners_lambda_zip = "lambdas-download/runners.zip"
30+
# webhook_lambda_zip = "lambdas-download/webhook.zip"
31+
# runner_binaries_syncer_lambda_zip = "lambdas-download/runner-binaries-syncer.zip"
32+
# runners_lambda_zip = "lambdas-download/runners.zip"
3333

3434
enable_organization_runners = false
3535
runner_extra_labels = "ubuntu,example"
@@ -49,6 +49,17 @@ module "runners" {
4949
device_name = "/dev/sda1"
5050
}
5151

52+
runner_log_files = [
53+
{
54+
"file_path" : "/var/log/user-data.log",
55+
"log_stream_name" : "{instance_id}/user_data"
56+
},
57+
{
58+
"file_path" : "/home/runners/actions-runner/_diag/Runner_**.log",
59+
"log_stream_name" : "{instance_id}/runner"
60+
}
61+
]
62+
5263
# Uncommet idle config to have idle runners from 9 to 5 in time zone Amsterdam
5364
# idle_config = [{
5465
# cron = "* * 9-17 * * *"

‎examples/ubuntu/templates/user-data.sh

Lines changed: 49 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,63 @@
1-
#!/bin/bash -e
1+
#!/bin/bash -x
22
exec > >(tee /var/log/user-data.log | logger -t user-data -s 2>/dev/console) 2>&1
33

4+
${pre_install}
5+
46
# Install AWS CLI
57
apt-get update
6-
DEBIAN_FRONTEND=noninteractive apt-get install -y awscli jq
8+
DEBIAN_FRONTEND=noninteractive apt-get install -y awscli jq curl wget git uidmap
9+
10+
USER_NAME=runners
11+
useradd -m -s /bin/bash $USER_NAME
12+
USER_ID=$(id -ru $USER_NAME)
13+
14+
# install and configure cloudwatch logging agent
15+
wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
16+
dpkg -i -E ./amazon-cloudwatch-agent.deb
17+
amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c ssm:${ssm_key_cloudwatch_agent_config}
18+
19+
# configure systemd for running service in users accounts
20+
cat >/etc/systemd/[email protected] <<-EOF
21+
22+
[Unit]
23+
Description=User Manager for UID %i
24+
After=user-runtime-dir@%i.service
25+
Wants=user-runtime-dir@%i.service
26+
27+
[Service]
28+
LimitNOFILE=infinity
29+
LimitNPROC=infinity
30+
User=%i
31+
PAMName=systemd-user
32+
Type=notify
33+
34+
[Install]
35+
WantedBy=default.target
736
8-
# Install runner
9-
cd /home/ubuntu
10-
mkdir actions-runner && cd actions-runner
37+
EOF
1138

12-
aws s3 cp ${s3_location_runner_distribution} actions-runner.tar.gz
13-
tar xzf ./actions-runner.tar.gz
14-
rm -rf actions-runner.tar.gz
39+
echo export XDG_RUNTIME_DIR=/run/user/$USER_ID >>/home/$USER_NAME/.profile
1540

16-
INSTANCE_ID=$(wget -q -O - http://169.254.169.254/latest/meta-data/instance-id)
17-
REGION=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region)
41+
systemctl daemon-reload
42+
systemctl enable [email protected]
43+
systemctl start [email protected]
1844

19-
echo wait for configuration
20-
while [[ $(aws ssm get-parameters --names ${environment}-$INSTANCE_ID --with-decryption --region $REGION | jq -r ".Parameters | .[0] | .Value") == null ]]; do
21-
echo Waiting for configuration ...
22-
sleep 1
23-
done
24-
CONFIG=$(aws ssm get-parameters --names ${environment}-$INSTANCE_ID --with-decryption --region $REGION | jq -r ".Parameters | .[0] | .Value")
25-
aws ssm delete-parameter --name ${environment}-$INSTANCE_ID --region $REGION
45+
curl -fsSL https://get.docker.com/rootless >>/opt/rootless.sh && chmod 755 /opt/rootless.sh
46+
su -l $USER_NAME -c /opt/rootless.sh
47+
echo export DOCKER_HOST=unix:///run/user/$USER_ID/docker.sock >>/home/$USER_NAME/.profile
48+
echo export PATH=/home/$USER_NAME/bin:$PATH >>/home/$USER_NAME/.profile
2649

27-
export RUNNER_ALLOW_RUNASROOT=1
50+
# Run docker service by default
51+
loginctl enable-linger $USER_NAME
52+
su -l $USER_NAME -c "systemctl --user enable docker"
2853

29-
sudo -u ubuntu mkdir /home/ubuntu/work
54+
${install_config_runner}
3055

31-
./bin/installdependencies.sh
32-
./config.sh --unattended --name $INSTANCE_ID --work "/home/ubuntu/work" $CONFIG
56+
# config runner for rootless docker
57+
cd /home/$USER_NAME/actions-runner/
58+
echo DOCKER_HOST=unix:///run/user/$USER_ID/docker.sock >>.env
59+
echo PATH=/home/$USER_NAME/bin:$PATH >>.env
3360

34-
chown -R ubuntu:ubuntu .
35-
./svc.sh install ubuntu
61+
${post_install}
3662

3763
./svc.sh start

‎main.tf

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ resource "random_string" "random" {
1818
resource "aws_sqs_queue" "queued_builds" {
1919
name = "${var.environment}-queued-builds.fifo"
2020
delay_seconds = 30
21-
visibility_timeout_seconds = 60
21+
visibility_timeout_seconds = var.runners_scale_up_lambda_timeout
2222
fifo_queue = true
2323
receive_wait_time_seconds = 10
2424
content_based_deduplication = true
@@ -74,23 +74,26 @@ module "runners" {
7474
ami_filter = local.ami_filter
7575
ami_owners = var.ami_owners
7676

77-
sqs_build_queue = aws_sqs_queue.queued_builds
78-
github_app = var.github_app
79-
enable_organization_runners = var.enable_organization_runners
80-
scale_down_schedule_expression = var.scale_down_schedule_expression
81-
minimum_running_time_in_minutes = var.minimum_running_time_in_minutes
82-
runner_extra_labels = var.runner_extra_labels
83-
runner_as_root = var.runner_as_root
84-
runners_maximum_count = var.runners_maximum_count
85-
idle_config = var.idle_config
86-
enable_ssm_on_runners = var.enable_ssm_on_runners
77+
sqs_build_queue = aws_sqs_queue.queued_builds
78+
github_app = var.github_app
79+
enable_organization_runners = var.enable_organization_runners
80+
scale_down_schedule_expression = var.scale_down_schedule_expression
81+
minimum_running_time_in_minutes = var.minimum_running_time_in_minutes
82+
runner_extra_labels = var.runner_extra_labels
83+
runner_as_root = var.runner_as_root
84+
runners_maximum_count = var.runners_maximum_count
85+
idle_config = var.idle_config
86+
enable_ssm_on_runners = var.enable_ssm_on_runners
87+
runner_additional_security_group_ids = var.runner_additional_security_group_ids
8788

8889
lambda_s3_bucket = var.lambda_s3_bucket
8990
runners_lambda_s3_key = var.runners_lambda_s3_key
9091
runners_lambda_s3_object_version = var.runners_lambda_s3_object_version
9192
lambda_zip = var.runners_lambda_zip
9293
lambda_timeout_scale_up = var.runners_scale_up_lambda_timeout
9394
lambda_timeout_scale_down = var.runners_scale_down_lambda_timeout
95+
lambda_subnet_ids = var.lambda_subnet_ids
96+
lambda_security_group_ids = var.lambda_security_group_ids
9497
logging_retention_in_days = var.logging_retention_in_days
9598
enable_cloudwatch_agent = var.enable_cloudwatch_agent
9699
cloudwatch_config = var.cloudwatch_config
@@ -103,10 +106,13 @@ module "runners" {
103106
userdata_template = var.userdata_template
104107
userdata_pre_install = var.userdata_pre_install
105108
userdata_post_install = var.userdata_post_install
109+
key_name = var.key_name
106110

107111
create_service_linked_role_spot = var.create_service_linked_role_spot
108112

109113
runner_iam_role_managed_policy_arns = var.runner_iam_role_managed_policy_arns
114+
115+
ghes_url = var.ghes_url
110116
}
111117

112118
module "runner_binaries" {
@@ -118,7 +124,7 @@ module "runner_binaries" {
118124

119125
distribution_bucket_name = "${var.environment}-dist-${random_string.random.result}"
120126

121-
runner_architecture = substr(var.instance_type, 0, 2) == "a1" || substr(var.instance_type, 1, 2) == "6g" ? "arm64" : "x64"
127+
runner_architecture = local.runner_architecture
122128
runner_allow_prerelease_binaries = var.runner_allow_prerelease_binaries
123129

124130
lambda_s3_bucket = var.lambda_s3_bucket

‎modules/download-lambda/.terraform.lock.hcl

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎modules/download-lambda/README.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,20 +32,20 @@ No requirements.
3232
## Providers
3333

3434
| Name | Version |
35-
| ---- | ------- |
36-
| null | n/a |
35+
|------|---------|
36+
| null | n/a |
3737

3838
## Inputs
3939

40-
| Name | Description | Type | Default | Required |
41-
| ------- | ------------------------------------- | --------------------------------------------------------------------------- | ------- | :------: |
42-
| lambdas | Name and tag for lambdas to download. | <pre>list(object({<br> name = string<br> tag = string<br> }))</pre> | n/a | yes |
40+
| Name | Description | Type | Default | Required |
41+
|------|-------------|------|---------|:--------:|
42+
| lambdas | Name and tag for lambdas to download. | <pre>list(object({<br> name = string<br> tag = string<br> }))</pre> | n/a | yes |
4343

4444
## Outputs
4545

46-
| Name | Description |
47-
| ----- | ----------- |
48-
| files | n/a |
46+
| Name | Description |
47+
|------|-------------|
48+
| files | n/a |
4949

5050
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
5151

‎modules/runner-binaries-syncer/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ No requirements.
5353
| environment | A name that identifies the environment, used as prefix and for tagging. | `string` | n/a | yes |
5454
| lambda\_s3\_bucket | S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. | `any` | `null` | no |
5555
| lambda\_schedule\_expression | Scheduler expression for action runner binary syncer. | `string` | `"cron(27 * * * ? *)"` | no |
56+
| lambda\_security\_group\_ids | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
57+
| lambda\_subnet\_ids | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. | `list(string)` | `[]` | no |
5658
| lambda\_timeout | Time out of the lambda in seconds. | `number` | `300` | no |
5759
| lambda\_zip | File location of the lambda zip file. | `string` | `null` | no |
5860
| logging\_retention\_in\_days | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `7` | no |

‎modules/runner-binaries-syncer/lambdas/runner-binaries-syncer/.prettierrc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
{
22
"printWidth": 120,
33
"singleQuote": true,
4-
"trailingComma": "all"
4+
"trailingComma": "all",
5+
"semi": true,
56
}
7+

‎modules/runner-binaries-syncer/lambdas/runner-binaries-syncer/package.json

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,22 +10,24 @@
1010
"lint": "yarn eslint --ext ts,tsx src",
1111
"watch": "ts-node-dev --respawn --exit-child src/local.ts",
1212
"build": "ncc build src/lambda.ts -o dist",
13-
"dist": "yarn build && cd dist && zip ../runner-binaries-syncer.zip index.js"
13+
"dist": "yarn build && cd dist && zip ../runner-binaries-syncer.zip index.js",
14+
"format": "prettier --write \"**/*.ts\"",
15+
"format-check": "prettier --check \"**/*.ts\""
1416
},
1517
"devDependencies": {
1618
"@octokit/rest": "^18.0.12",
17-
"@types/jest": "^26.0.16",
18-
"@types/node": "^14.14.10",
19+
"@types/jest": "^26.0.20",
20+
"@types/node": "^14.14.21",
1921
"@types/request": "^2.48.4",
2022
"@typescript-eslint/eslint-plugin": "^4.0.0",
2123
"@typescript-eslint/parser": "^3.10.1",
2224
"@zeit/ncc": "^0.22.1",
23-
"aws-sdk": "^2.804.0",
24-
"eslint": "^7.15.0",
25+
"aws-sdk": "^2.828.0",
26+
"eslint": "^7.18.0",
2527
"jest": "^26.6.3",
2628
"ts-jest": "^26.4.4",
27-
"ts-node-dev": "^1.0.0",
28-
"typescript": "^4.1.2"
29+
"ts-node-dev": "^1.1.1",
30+
"typescript": "^4.1.3"
2931
},
3032
"dependencies": {
3133
"yn": "^4.0.0"

0 commit comments

Comments
 (0)