From affea44096bae3f2a936ed47ef2320b993539c7f Mon Sep 17 00:00:00 2001 From: Ethan Brouwer Date: Thu, 25 May 2023 15:14:35 -0600 Subject: [PATCH 1/4] feat: Add Support for Amazon Linux 2022 Add `runner_amazon_linux_2022` boolean variable Get rid of amazon linux 2022 config option Make PR changes even smaller Update all references to amzn2. Also bump to al2023 (latest supported version) Add the al2023 packer file curl comes shipped with al2023 --- .github/workflows/packer-build.yml | 2 +- README.md | 2 +- examples/ephemeral/main.tf | 2 +- examples/prebuilt/README.md | 8 ++++---- examples/prebuilt/variables.tf | 2 +- images/README.md | 10 +++++----- .../github_agent.linux.pkr.hcl | 9 ++++----- modules/multi-runner/README.md | 2 +- modules/multi-runner/variables.tf | 2 +- modules/runners/README.md | 2 +- modules/runners/main.tf | 2 +- modules/runners/templates/install-runner.sh | 4 ++-- modules/runners/templates/user-data.sh | 2 +- modules/runners/variables.tf | 2 +- variables.tf | 2 +- 15 files changed, 26 insertions(+), 27 deletions(-) rename images/{linux-amzn2 => linux-al2023}/github_agent.linux.pkr.hcl (94%) diff --git a/.github/workflows/packer-build.yml b/.github/workflows/packer-build.yml index e68725aad2..83dd72c064 100644 --- a/.github/workflows/packer-build.yml +++ b/.github/workflows/packer-build.yml @@ -19,7 +19,7 @@ jobs: image: index.docker.io/hashicorp/packer@sha256:297bbbbbbf3ce9e0431ac1e8f02934b20e1197613f877b55dfdb1ebfd94eb748 # ratchet:index.docker.io/hashicorp/packer:1.8.6 strategy: matrix: - image: ["linux-amzn2", "windows-core-2019", "windows-core-2022", "ubuntu-focal", "ubuntu-jammy", "ubuntu-jammy-arm64"] + image: ["linux-al2023", "windows-core-2019", "windows-core-2022", "ubuntu-focal", "ubuntu-jammy", "ubuntu-jammy-arm64"] defaults: run: working-directory: images/${{ matrix.image }} diff --git a/README.md b/README.md index 78e9c56b6e..1392ccf5bb 100644 --- a/README.md +++ b/README.md @@ -530,7 +530,7 @@ We welcome any improvement to the standard module to make the default as secure | [instance\_max\_spot\_price](#input\_instance\_max\_spot\_price) | Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet. | `string` | `null` | no | | [instance\_profile\_path](#input\_instance\_profile\_path) | The path that will be added to the instance\_profile, if not set the environment name will be used. | `string` | `null` | no | | [instance\_target\_capacity\_type](#input\_instance\_target\_capacity\_type) | Default lifecycle used for runner instances, can be either `spot` or `on-demand`. | `string` | `"spot"` | no | -| [instance\_types](#input\_instance\_types) | List of instance types for the action runner. Defaults are based on runner\_os (amzn2 for linux and Windows Server Core for win). | `list(string)` | 
[
  "m5.large",
  "c5.large"
]
| no | +| [instance\_types](#input\_instance\_types) | List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux and Windows Server Core for win). | `list(string)` | 
[
  "m5.large",
  "c5.large"
]
| no | | [job\_queue\_retention\_in\_seconds](#input\_job\_queue\_retention\_in\_seconds) | The number of seconds the job is held in the queue before it is purged. | `number` | `86400` | no | | [key\_name](#input\_key\_name) | Key pair name | `string` | `null` | no | | [kms\_key\_arn](#input\_kms\_key\_arn) | Optional CMK Key ARN to be used for Parameter Store. This key must be in the current account. | `string` | `null` | no | diff --git a/examples/ephemeral/main.tf b/examples/ephemeral/main.tf index fbbc588178..ce70375d95 100644 --- a/examples/ephemeral/main.tf +++ b/examples/ephemeral/main.tf @@ -71,7 +71,7 @@ module "runners" { # configure your pre-built AMI # enable_userdata = false - # ami_filter = { name = ["github-runner-amzn2-x86_64-*"], state = ["available"] } + # ami_filter = { name = ["github-runner-al2023-x86_64-*"], state = ["available"] } # data "aws_caller_identity" "current" {} # ami_owners = [data.aws_caller_identity.current.account_id] diff --git a/examples/prebuilt/README.md b/examples/prebuilt/README.md index b3be78f896..b213de3c41 100644 --- a/examples/prebuilt/README.md +++ b/examples/prebuilt/README.md @@ -13,7 +13,7 @@ Steps for the full setup, such as creating a GitHub app can be found in the root | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [ami\_filter](#input\_ami\_filter) | The amis to search. Use the default for the provided amazon linux image, `github-runner-windows-core-2019-*` for the provided Windows image | `string` | `github-runner-amzn2-x86_64-2021*` | no | +| [ami\_filter](#input\_ami\_filter) | The amis to search. Use the default for the provided amazon linux image, `github-runner-windows-core-2019-*` for the provided Windows image | `string` | `github-runner-al2023-x86_64-2023*` | no | | [github\_app\_key\_base64](#input\_github\_app\_key\_base64) | The base64 encoded private key you downloaded from GitHub when creating the app | `string` | | yes | | [github\_app\_id](#input\_github\_app\_id) | The id of the app you created on GitHub | `string` | | yes | | [region](#input\_region) | The target aws region | `string` | `eu-west-1` | no | @@ -52,13 +52,13 @@ You will need to build your image. This example deployment uses the image exampl To use your image in the terraform modules you will need to set some values on the module. -Assuming you have built the `linux-amzn2` image which has a pre-defined AMI name in the following format `github-runner-amzn2-x86_64-YYYYMMDDhhmm` you can use the following values. +Assuming you have built the `linux-al2023` image which has a pre-defined AMI name in the following format `github-runner-al2023-x86_64-YYYYMMDDhhmm` you can use the following values. ```hcl module "runners" { ... # set the name of the ami to use - ami_filter = { name = ["github-runner-amzn2-x86_64-2021*"], state = ["available"] } + ami_filter = { name = ["github-runner-al2023-x86_64-2023*"], state = ["available"] } # provide the owner id of ami_owners = [""] @@ -129,7 +129,7 @@ Be aware some shells will print some end of line character `%`. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [ami\_name\_filter](#input\_ami\_name\_filter) | n/a | `string` | `"github-runner-amzn2-x86_64-*"` | no | +| [ami\_name\_filter](#input\_ami\_name\_filter) | n/a | `string` | `"github-runner-al2023-x86_64-*"` | no | | [github\_app](#input\_github\_app) | GitHub for API usages. | 
object({
    id         = string
    key_base64 = string
  })
| n/a | yes | | [runner\_os](#input\_runner\_os) | n/a | `string` | `"linux"` | no | diff --git a/examples/prebuilt/variables.tf b/examples/prebuilt/variables.tf index 573533ad5f..424dbddf47 100644 --- a/examples/prebuilt/variables.tf +++ b/examples/prebuilt/variables.tf @@ -14,5 +14,5 @@ variable "runner_os" { variable "ami_name_filter" { type = string - default = "github-runner-amzn2-x86_64-*" + default = "github-runner-al2023-x86_64-*" } diff --git a/images/README.md b/images/README.md index 31e6f9d792..c800b0587e 100644 --- a/images/README.md +++ b/images/README.md @@ -4,14 +4,14 @@ The images inside this folder are pre-built images designed to shorten the boot These images share the same scripting as used in the user-data mechanism in `/modules/runners/templates/`. We use a `templatefile` mechanism to insert the relevant script fragments into the scripts used for provisioning the images. -The examples in `linux-amzn2` and `windows-core-2019` also upload a `start-runner` script that uses the exact same startup process as used in the user-data mechanism. This means that the image created here does not need any extra scripts injected or changes to boot up and connect to GH. +The examples in `linux-al2023` and `windows-core-2019` also upload a `start-runner` script that uses the exact same startup process as used in the user-data mechanism. This means that the image created here does not need any extra scripts injected or changes to boot up and connect to GH. ## Building your own To build these images you first need to install packer. You will also need an amazon account and to have provisioned your credentials for packer to consume. -Assuming you are building the `linux-amzn2` image. Then run the following from within the `linux-amzn2` folder +Assuming you are building the `linux-al2023` image. Then run the following from within the `linux-al2023` folder ```bash packer init . @@ -25,12 +25,12 @@ Your image will then begin to build inside AWS and when finished you will be pro To use your image in the terraform modules you will need to set some values on the module. -Assuming you have built the `linux-amzn2` image which has a pre-defined AMI name in the following format `github-runner-amzn2-x86_64-YYYYMMDDhhmm` you can use the following values. +Assuming you have built the `linux-al2023` image which has a pre-defined AMI name in the following format `github-runner-al2023-x86_64-YYYYMMDDhhmm` you can use the following values. ```hcl # set the name of the ami to use -ami_filter = { name = ["github-runner-amzn2-x86_64-2021*"] } -# provide the owner id of +ami_filter = { name = ["github-runner-al2023-x86_64-2023*"] } +# provide the owner id of ami_owners = [""] enable_userdata = false diff --git a/images/linux-amzn2/github_agent.linux.pkr.hcl b/images/linux-al2023/github_agent.linux.pkr.hcl similarity index 94% rename from images/linux-amzn2/github_agent.linux.pkr.hcl rename to images/linux-al2023/github_agent.linux.pkr.hcl index 136c2ef3f4..d0d5ed2175 100644 --- a/images/linux-amzn2/github_agent.linux.pkr.hcl +++ b/images/linux-al2023/github_agent.linux.pkr.hcl @@ -96,7 +96,7 @@ locals { } source "amazon-ebs" "githubrunner" { - ami_name = "github-runner-amzn2-x86_64-${formatdate("YYYYMMDDhhmm", timestamp())}" + ami_name = "github-runner-al2023-x86_64-${formatdate("YYYYMMDDhhmm", timestamp())}" instance_type = var.instance_type region = var.region security_group_id = var.security_group_id @@ -106,7 +106,7 @@ source "amazon-ebs" "githubrunner" { source_ami_filter { filters = { - name = "amzn2-ami-kernel-5.*-hvm-*-x86_64-gp2" + name = "al2023-ami-2023.*-kernel-6.*-x86_64" root-device-type = "ebs" virtualization-type = "hvm" } @@ -118,7 +118,7 @@ source "amazon-ebs" "githubrunner" { var.global_tags, var.ami_tags, { - OS_Version = "amzn2" + OS_Version = "al2023" Release = "Latest" Base_AMI_Name = "{{ .SourceAMIName }}" }) @@ -145,8 +145,7 @@ build { environment_vars = [] inline = concat([ "sudo yum update -y", - "sudo yum install -y amazon-cloudwatch-agent curl jq git", - "sudo amazon-linux-extras install docker", + "sudo yum install -y amazon-cloudwatch-agent jq git docker", "sudo systemctl enable docker.service", "sudo systemctl enable containerd.service", "sudo service docker start", diff --git a/modules/multi-runner/README.md b/modules/multi-runner/README.md index 4446932cff..ba1423eaba 100644 --- a/modules/multi-runner/README.md +++ b/modules/multi-runner/README.md @@ -139,7 +139,7 @@ module "multi-runner" { | [log\_type](#input\_log\_type) | Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. | `string` | `null` | no | | [logging\_kms\_key\_id](#input\_logging\_kms\_key\_id) | Specifies the kms key id to encrypt the logs with | `string` | `null` | no | | [logging\_retention\_in\_days](#input\_logging\_retention\_in\_days) | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `180` | no | -| [multi\_runner\_config](#input\_multi\_runner\_config) | multi\_runner\_config = {
runner\_config: {
runner\_os: "The EC2 Operating System type to use for action runner instances (linux,windows)."
runner\_architecture: "The platform architecture of the runner instance\_type."
runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."
ami\_filter: "(Optional) List of maps used to create the AMI filter for the action runner AMI. By default amazon linux 2 is used."
ami\_owners: "(Optional) The list of owners used to select the AMI of action runner instances."
create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.
credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.
delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."
disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"
enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."
enable\_job\_queued\_check: "Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT confiugration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."
enable\_organization\_runners: "Register runners to organization, instead of repo level"
enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."
enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."
enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."
instance\_allocation\_strategy: "The allocation strategy for spot instances. AWS recommends to use `capacity-optimized` however the AWS default is `lowest-price`."
instance\_max\_spot\_price: "Max price price for spot intances per hour. This variable will be passed to the create fleet as max spot price for the fleet."
instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."
instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (amzn2 for linux and Windows Server Core for win)."
job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"
minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."
pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."
runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."
runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."
runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."
runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `enable_workflow_job_labels_check`. GitHub read-only labels should not be provided."
runner\_group\_name: "Name of the runner group."
runner\_name\_prefix: "Prefix for the GitHub runner name."
runner\_run\_as: "Run the GitHub actions agent as user."
runners\_maximum\_count: "The maximum number of runners that will be created."
scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."
scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."
userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."
enable\_jit\_config "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is avaialbe. In case you upgradeing from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."
enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."
enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."
userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"
userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"
runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."
runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"
idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."
runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`."
pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1."
}
matcherConfig: {
labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"
exactMatch: "If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook."
}
fifo: "Enable a FIFO queue to remain the order of events received by the webhook. Suggest to set to true for repo level runners."
redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."
} | 
map(object({
    runner_config = object({
      runner_os           = string
      runner_architecture = string
      runner_metadata_options = optional(map(any), {
        instance_metadata_tags      = "enabled"
        http_endpoint               = "enabled"
        http_tokens                 = "optional"
        http_put_response_hop_limit = 1
      })
      ami_filter                              = optional(map(list(string)), { state = ["available"] })
      ami_owners                              = optional(list(string), ["amazon"])
      ami_id_ssm_parameter_name               = optional(string, null)
      ami_kms_key_arn                         = optional(string, "")
      create_service_linked_role_spot         = optional(bool, false)
      credit_specification                    = optional(string, null)
      delay_webhook_event                     = optional(number, 30)
      disable_runner_autoupdate               = optional(bool, false)
      enable_ephemeral_runners                = optional(bool, false)
      enable_job_queued_check                 = optional(bool, null)
      enable_organization_runners             = optional(bool, false)
      enable_runner_binaries_syncer           = optional(bool, true)
      enable_ssm_on_runners                   = optional(bool, false)
      enable_userdata                         = optional(bool, true)
      instance_allocation_strategy            = optional(string, "lowest-price")
      instance_max_spot_price                 = optional(string, null)
      instance_target_capacity_type           = optional(string, "spot")
      instance_types                          = list(string)
      job_queue_retention_in_seconds          = optional(number, 86400)
      minimum_running_time_in_minutes         = optional(number, null)
      pool_runner_owner                       = optional(string, null)
      runner_as_root                          = optional(bool, false)
      runner_boot_time_in_minutes             = optional(number, 5)
      runner_extra_labels                     = string
      runner_group_name                       = optional(string, "Default")
      runner_name_prefix                      = optional(string, "")
      runner_run_as                           = optional(string, "ec2-user")
      runners_maximum_count                   = number
      runner_additional_security_group_ids    = optional(list(string), [])
      scale_down_schedule_expression          = optional(string, "cron(*/5 * * * ? *)")
      scale_up_reserved_concurrent_executions = optional(number, 1)
      userdata_template                       = optional(string, null)
      enable_jit_config                       = optional(bool, null)
      enable_runner_detailed_monitoring       = optional(bool, false)
      enable_cloudwatch_agent                 = optional(bool, true)
      userdata_pre_install                    = optional(string, "")
      userdata_post_install                   = optional(string, "")
      runner_ec2_tags                         = optional(map(string), {})
      runner_iam_role_managed_policy_arns     = optional(list(string), [])
      idle_config = optional(list(object({
        cron             = string
        timeZone         = string
        idleCount        = number
        evictionStrategy = optional(string, "oldest_first")
      })), [])
      runner_log_files = optional(list(object({
        log_group_name   = string
        prefix_log_group = bool
        file_path        = string
        log_stream_name  = string
      })), null)
      block_device_mappings = optional(list(object({
        delete_on_termination = bool
        device_name           = string
        encrypted             = bool
        iops                  = number
        kms_key_id            = string
        snapshot_id           = string
        throughput            = number
        volume_size           = number
        volume_type           = string
        })), [{
        delete_on_termination = true
        device_name           = "/dev/xvda"
        encrypted             = true
        iops                  = null
        kms_key_id            = null
        snapshot_id           = null
        throughput            = null
        volume_size           = 30
        volume_type           = "gp3"
      }])
      pool_config = optional(list(object({
        schedule_expression = string
        size                = number
      })), [])
    })

    matcherConfig = object({
      labelMatchers = list(list(string))
      exactMatch    = optional(bool, false)
    })
    fifo = optional(bool, false)
    redrive_build_queue = optional(object({
      enabled         = bool
      maxReceiveCount = number
      }), {
      enabled         = false
      maxReceiveCount = null
    })
  }))
| n/a | yes | +| [multi\_runner\_config](#input\_multi\_runner\_config) | multi\_runner\_config = {
runner\_config: {
runner\_os: "The EC2 Operating System type to use for action runner instances (linux,windows)."
runner\_architecture: "The platform architecture of the runner instance\_type."
runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."
ami\_filter: "(Optional) List of maps used to create the AMI filter for the action runner AMI. By default amazon linux 2 is used."
ami\_owners: "(Optional) The list of owners used to select the AMI of action runner instances."
create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.
credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.
delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."
disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"
enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."
enable\_job\_queued\_check: "Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT confiugration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."
enable\_organization\_runners: "Register runners to organization, instead of repo level"
enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."
enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."
enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."
instance\_allocation\_strategy: "The allocation strategy for spot instances. AWS recommends to use `capacity-optimized` however the AWS default is `lowest-price`."
instance\_max\_spot\_price: "Max price price for spot intances per hour. This variable will be passed to the create fleet as max spot price for the fleet."
instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."
instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux and Windows Server Core for win)."
job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"
minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."
pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."
runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."
runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."
runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."
runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `enable_workflow_job_labels_check`. GitHub read-only labels should not be provided."
runner\_group\_name: "Name of the runner group."
runner\_name\_prefix: "Prefix for the GitHub runner name."
runner\_run\_as: "Run the GitHub actions agent as user."
runners\_maximum\_count: "The maximum number of runners that will be created."
scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."
scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."
userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."
enable\_jit\_config "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is avaialbe. In case you upgradeing from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."
enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."
enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."
userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"
userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"
runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."
runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"
idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."
runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`."
pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1."
}
matcherConfig: {
labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"
exactMatch: "If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook."
}
fifo: "Enable a FIFO queue to remain the order of events received by the webhook. Suggest to set to true for repo level runners."
redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."
} | 
map(object({
    runner_config = object({
      runner_os           = string
      runner_architecture = string
      runner_metadata_options = optional(map(any), {
        instance_metadata_tags      = "enabled"
        http_endpoint               = "enabled"
        http_tokens                 = "optional"
        http_put_response_hop_limit = 1
      })
      ami_filter                              = optional(map(list(string)), { state = ["available"] })
      ami_owners                              = optional(list(string), ["amazon"])
      ami_id_ssm_parameter_name               = optional(string, null)
      ami_kms_key_arn                         = optional(string, "")
      create_service_linked_role_spot         = optional(bool, false)
      credit_specification                    = optional(string, null)
      delay_webhook_event                     = optional(number, 30)
      disable_runner_autoupdate               = optional(bool, false)
      enable_ephemeral_runners                = optional(bool, false)
      enable_job_queued_check                 = optional(bool, null)
      enable_organization_runners             = optional(bool, false)
      enable_runner_binaries_syncer           = optional(bool, true)
      enable_ssm_on_runners                   = optional(bool, false)
      enable_userdata                         = optional(bool, true)
      instance_allocation_strategy            = optional(string, "lowest-price")
      instance_max_spot_price                 = optional(string, null)
      instance_target_capacity_type           = optional(string, "spot")
      instance_types                          = list(string)
      job_queue_retention_in_seconds          = optional(number, 86400)
      minimum_running_time_in_minutes         = optional(number, null)
      pool_runner_owner                       = optional(string, null)
      runner_as_root                          = optional(bool, false)
      runner_boot_time_in_minutes             = optional(number, 5)
      runner_extra_labels                     = string
      runner_group_name                       = optional(string, "Default")
      runner_name_prefix                      = optional(string, "")
      runner_run_as                           = optional(string, "ec2-user")
      runners_maximum_count                   = number
      runner_additional_security_group_ids    = optional(list(string), [])
      scale_down_schedule_expression          = optional(string, "cron(*/5 * * * ? *)")
      scale_up_reserved_concurrent_executions = optional(number, 1)
      userdata_template                       = optional(string, null)
      enable_jit_config                       = optional(bool, null)
      enable_runner_detailed_monitoring       = optional(bool, false)
      enable_cloudwatch_agent                 = optional(bool, true)
      userdata_pre_install                    = optional(string, "")
      userdata_post_install                   = optional(string, "")
      runner_ec2_tags                         = optional(map(string), {})
      runner_iam_role_managed_policy_arns     = optional(list(string), [])
      idle_config = optional(list(object({
        cron             = string
        timeZone         = string
        idleCount        = number
        evictionStrategy = optional(string, "oldest_first")
      })), [])
      runner_log_files = optional(list(object({
        log_group_name   = string
        prefix_log_group = bool
        file_path        = string
        log_stream_name  = string
      })), null)
      block_device_mappings = optional(list(object({
        delete_on_termination = bool
        device_name           = string
        encrypted             = bool
        iops                  = number
        kms_key_id            = string
        snapshot_id           = string
        throughput            = number
        volume_size           = number
        volume_type           = string
        })), [{
        delete_on_termination = true
        device_name           = "/dev/xvda"
        encrypted             = true
        iops                  = null
        kms_key_id            = null
        snapshot_id           = null
        throughput            = null
        volume_size           = 30
        volume_type           = "gp3"
      }])
      pool_config = optional(list(object({
        schedule_expression = string
        size                = number
      })), [])
    })

    matcherConfig = object({
      labelMatchers = list(list(string))
      exactMatch    = optional(bool, false)
    })
    fifo = optional(bool, false)
    redrive_build_queue = optional(object({
      enabled         = bool
      maxReceiveCount = number
      }), {
      enabled         = false
      maxReceiveCount = null
    })
  }))
| n/a | yes | | [pool\_lambda\_reserved\_concurrent\_executions](#input\_pool\_lambda\_reserved\_concurrent\_executions) | Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. | `number` | `1` | no | | [pool\_lambda\_timeout](#input\_pool\_lambda\_timeout) | Time out for the pool lambda in seconds. | `number` | `60` | no | | [prefix](#input\_prefix) | The prefix used for naming resources | `string` | `"github-actions"` | no | diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf index 757bb7b746..cded676dd6 100644 --- a/modules/multi-runner/variables.tf +++ b/modules/multi-runner/variables.tf @@ -148,7 +148,7 @@ variable "multi_runner_config" { instance_allocation_strategy: "The allocation strategy for spot instances. AWS recommends to use `capacity-optimized` however the AWS default is `lowest-price`." instance_max_spot_price: "Max price price for spot intances per hour. This variable will be passed to the create fleet as max spot price for the fleet." instance_target_capacity_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`." - instance_types: "List of instance types for the action runner. Defaults are based on runner_os (amzn2 for linux and Windows Server Core for win)." + instance_types: "List of instance types for the action runner. Defaults are based on runner_os (al2023 for linux and Windows Server Core for win)." job_queue_retention_in_seconds: "The number of seconds the job is held in the queue before it is purged" minimum_running_time_in_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy." pool_runner_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported." diff --git a/modules/runners/README.md b/modules/runners/README.md index 63349b97ed..c57a072473 100644 --- a/modules/runners/README.md +++ b/modules/runners/README.md @@ -155,7 +155,7 @@ yarn run dist | [instance\_profile\_path](#input\_instance\_profile\_path) | The path that will be added to the instance\_profile, if not set the prefix will be used. | `string` | `null` | no | | [instance\_target\_capacity\_type](#input\_instance\_target\_capacity\_type) | Default lifecyle used runner instances, can be either `spot` or `on-demand`. | `string` | `"spot"` | no | | [instance\_type](#input\_instance\_type) | [DEPRECATED] See instance\_types. | `string` | `"m5.large"` | no | -| [instance\_types](#input\_instance\_types) | List of instance types for the action runner. Defaults are based on runner\_os (amzn2 for linux and Windows Server Core for win). | `list(string)` | `null` | no | +| [instance\_types](#input\_instance\_types) | List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux and Windows Server Core for win). | `list(string)` | `null` | no | | [key\_name](#input\_key\_name) | Key pair name | `string` | `null` | no | | [kms\_key\_arn](#input\_kms\_key\_arn) | Optional CMK Key ARN to be used for Parameter Store. | `string` | `null` | no | | [lambda\_architecture](#input\_lambda\_architecture) | AWS Lambda architecture. Lambda functions using Graviton processors ('arm64') tend to have better price/performance than 'x86\_64' functions. | `string` | `"arm64"` | no | diff --git a/modules/runners/main.tf b/modules/runners/main.tf index 1738215639..a7213e3bfd 100644 --- a/modules/runners/main.tf +++ b/modules/runners/main.tf @@ -19,7 +19,7 @@ locals { s3_location_runner_distribution = var.enable_runner_binaries_syncer ? "s3://${var.s3_runner_binaries.id}/${var.s3_runner_binaries.key}" : "" default_ami = { "windows" = { name = ["Windows_Server-2022-English-Core-ContainersLatest-*"] } - "linux" = var.runner_architecture == "arm64" ? { name = ["amzn2-ami-kernel-5.*-hvm-*-arm64-gp2"] } : { name = ["amzn2-ami-kernel-5.*-hvm-*-x86_64-gp2"] } + "linux" = var.runner_architecture == "arm64" ? { name = ["al2023-ami-2023.*-kernel-5.*-arm64"] } : { name = ["al2023-ami-2023.*-kernel-5.*-x86_64"] } } default_userdata_template = { diff --git a/modules/runners/templates/install-runner.sh b/modules/runners/templates/install-runner.sh index d960d6f45c..f9a1947f79 100644 --- a/modules/runners/templates/install-runner.sh +++ b/modules/runners/templates/install-runner.sh @@ -45,9 +45,9 @@ rm -rf $file_name os_id=$(awk -F= '/^ID/{print $2}' /etc/os-release) echo OS: $os_id -# Install libicu60 for arm64 on non-ubuntu +# Install libicu for arm64 on non-ubuntu if [[ "$architecture" == "arm64" ]] && [[ ! "$os_id" =~ ^ubuntu.* ]]; then - yum install -y libicu60 + yum install -y libicu fi # Install dependencies for ubuntu diff --git a/modules/runners/templates/user-data.sh b/modules/runners/templates/user-data.sh index 08465eba97..4b2a231299 100644 --- a/modules/runners/templates/user-data.sh +++ b/modules/runners/templates/user-data.sh @@ -18,7 +18,7 @@ ${pre_install} yum update -y # Install docker -amazon-linux-extras install docker +yum install -y docker service docker start usermod -a -G docker ec2-user diff --git a/modules/runners/variables.tf b/modules/runners/variables.tf index dea9c8c898..5e152e52f1 100644 --- a/modules/runners/variables.tf +++ b/modules/runners/variables.tf @@ -119,7 +119,7 @@ variable "instance_type" { # tflint-ignore: terraform_unused_declarations } variable "instance_types" { - description = "List of instance types for the action runner. Defaults are based on runner_os (amzn2 for linux and Windows Server Core for win)." + description = "List of instance types for the action runner. Defaults are based on runner_os (al2023 for linux and Windows Server Core for win)." type = list(string) default = null } diff --git a/variables.tf b/variables.tf index 4268314302..fb93db42c7 100644 --- a/variables.tf +++ b/variables.tf @@ -479,7 +479,7 @@ variable "instance_max_spot_price" { } variable "instance_types" { - description = "List of instance types for the action runner. Defaults are based on runner_os (amzn2 for linux and Windows Server Core for win)." + description = "List of instance types for the action runner. Defaults are based on runner_os (al2023 for linux and Windows Server Core for win)." type = list(string) default = ["m5.large", "c5.large"] } From 6f0769c4e06215ed3fcfe5ee1d08a00747ce19cb Mon Sep 17 00:00:00 2001 From: Ethan Brouwer <1647525+eabrouwer3@users.noreply.github.com> Date: Wed, 13 Sep 2023 10:05:22 -0600 Subject: [PATCH 2/4] Resolve PR comments --- modules/runners/main.tf | 2 +- modules/runners/templates/install-runner.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/runners/main.tf b/modules/runners/main.tf index d915d36bf9..77cc7b6884 100644 --- a/modules/runners/main.tf +++ b/modules/runners/main.tf @@ -19,7 +19,7 @@ locals { s3_location_runner_distribution = var.enable_runner_binaries_syncer ? "s3://${var.s3_runner_binaries.id}/${var.s3_runner_binaries.key}" : "" default_ami = { "windows" = { name = ["Windows_Server-2022-English-Full-ECS_Optimized-*"] } - "linux" = var.runner_architecture == "arm64" ? { name = ["al2023-ami-2023.*-kernel-5.*-arm64"] } : { name = ["al2023-ami-2023.*-kernel-5.*-x86_64"] } + "linux" = var.runner_architecture == "arm64" ? { name = ["al2023-ami-2023.*-kernel-6.*-arm64"] } : { name = ["al2023-ami-2023.*-kernel-6.*-x86_64"] } } default_userdata_template = { diff --git a/modules/runners/templates/install-runner.sh b/modules/runners/templates/install-runner.sh index f9a1947f79..0fb0264c21 100644 --- a/modules/runners/templates/install-runner.sh +++ b/modules/runners/templates/install-runner.sh @@ -45,8 +45,8 @@ rm -rf $file_name os_id=$(awk -F= '/^ID/{print $2}' /etc/os-release) echo OS: $os_id -# Install libicu for arm64 on non-ubuntu -if [[ "$architecture" == "arm64" ]] && [[ ! "$os_id" =~ ^ubuntu.* ]]; then +# Install libicu on non-ubuntu +if [[ ! "$os_id" =~ ^ubuntu.* ]]; then yum install -y libicu fi From 956542802c51b024c49c1fe4ec11ad2a42e49538 Mon Sep 17 00:00:00 2001 From: Ethan Brouwer <1647525+eabrouwer3@users.noreply.github.com> Date: Tue, 19 Sep 2023 09:40:50 -0600 Subject: [PATCH 3/4] Remove `curl` install --- modules/runners/templates/user-data.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/runners/templates/user-data.sh b/modules/runners/templates/user-data.sh index 4b2a231299..29839cfffb 100644 --- a/modules/runners/templates/user-data.sh +++ b/modules/runners/templates/user-data.sh @@ -22,7 +22,7 @@ yum install -y docker service docker start usermod -a -G docker ec2-user -yum install -y amazon-cloudwatch-agent curl jq git +yum install -y amazon-cloudwatch-agent jq git user_name=ec2-user From d6b876dbb08dfe8835a4756633cf4ec60592f7c9 Mon Sep 17 00:00:00 2001 From: Ethan Brouwer <1647525+eabrouwer3@users.noreply.github.com> Date: Thu, 28 Sep 2023 13:40:36 -0600 Subject: [PATCH 4/4] Update yum to dnf everywhere --- images/linux-al2023/github_agent.linux.pkr.hcl | 5 +++-- modules/runners/templates/install-runner.sh | 2 +- modules/runners/templates/user-data.sh | 7 ++++--- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/images/linux-al2023/github_agent.linux.pkr.hcl b/images/linux-al2023/github_agent.linux.pkr.hcl index d0d5ed2175..ac8c4dff40 100644 --- a/images/linux-al2023/github_agent.linux.pkr.hcl +++ b/images/linux-al2023/github_agent.linux.pkr.hcl @@ -144,8 +144,9 @@ build { provisioner "shell" { environment_vars = [] inline = concat([ - "sudo yum update -y", - "sudo yum install -y amazon-cloudwatch-agent jq git docker", + "sudo dnf upgrade-minimal -y", + "sudo dnf install -y amazon-cloudwatch-agent jq git docker", + "sudo dnf install -y --allowerasing curl", "sudo systemctl enable docker.service", "sudo systemctl enable containerd.service", "sudo service docker start", diff --git a/modules/runners/templates/install-runner.sh b/modules/runners/templates/install-runner.sh index 0fb0264c21..f793730fc4 100644 --- a/modules/runners/templates/install-runner.sh +++ b/modules/runners/templates/install-runner.sh @@ -47,7 +47,7 @@ echo OS: $os_id # Install libicu on non-ubuntu if [[ ! "$os_id" =~ ^ubuntu.* ]]; then - yum install -y libicu + dnf install -y libicu fi # Install dependencies for ubuntu diff --git a/modules/runners/templates/user-data.sh b/modules/runners/templates/user-data.sh index 29839cfffb..3de7f41273 100644 --- a/modules/runners/templates/user-data.sh +++ b/modules/runners/templates/user-data.sh @@ -15,14 +15,15 @@ set -x ${pre_install} -yum update -y +dnf upgrade-minimal -y # Install docker -yum install -y docker +dnf install -y docker service docker start usermod -a -G docker ec2-user -yum install -y amazon-cloudwatch-agent jq git +dnf install -y amazon-cloudwatch-agent jq git +dnf install -y --allowerasing curl user_name=ec2-user