Skip to content

Commit 1bedcfa

Browse files
npalmnpalm
committed
Merge branch 'release/v0.5.0' into master
2 parents 01821d6 + 1931122 commit 1bedcfa

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+2449
-1374
lines changed

‎CHANGELOG.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [0.5.0] - 2020-08-25
11+
12+
### Added
13+
14+
- feat: Manage log groups via module. When upgrading you have to import the log groups by AWS into your state. See below the example commands for the default example.
15+
16+
```bash
17+
terraform import module.runners.module.runner_binaries.aws_cloudwatch_log_group.syncer "/aws/lambda/default-syncer"
18+
terraform import module.runners.module.runners.aws_cloudwatch_log_group.scale_up "/aws/lambda/default-scale-up"
19+
terraform import module.runners.module.runners.aws_cloudwatch_log_group.scale_down "/aws/lambda/default-scale-down"
20+
terraform import module.runners.module.webhook.aws_cloudwatch_log_group.webhook "/aws/lambda/default-webhook"
21+
```
22+
23+
- feat: Added option to binaries syncer to upgrade to pre-releases, preventing any auto-updating on startup. Option `runner_allow_prerelease_binaries` is disabled by default. (#141, #165) @sjagoe
24+
25+
- feat: SSM policies are by default disabled, set `enable_ssm_on_runners` to `true` to enable access to the runner instances via SSM. (#143) @HenryNguyen5
26+
27+
- feat: Log full sqs event (#147) @HenryNguyen5
28+
1029
## [0.4.0] - 2020-08-10
1130

1231
### Added
@@ -50,7 +69,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
5069

5170
- First release.
5271

53-
[unreleased]: https://github.com/philips-labs/terraform-aws-github-runner/compare/v0.4.0..HEAD
72+
[unreleased]: https://github.com/philips-labs/terraform-aws-github-runner/compare/v0.5.0..HEAD
73+
[0.5.0]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.4.0..v0.5.0
5474
[0.4.0]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.3.0..v0.4.0
5575
[0.3.0]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.2.0..v0.3.0
5676
[0.2.0]: https://github.com/philips-labs/terraform-aws-github-runner/releases/tag/v0.1.0..v0.2.0

‎README.md‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -100,20 +100,20 @@ First you need to download the lambda releases. The lambda code is available as
100100
```terraform
101101
module "lambdas" {
102102
source = "philips-labs/github-runner/aws//modules/download-lambda"
103-
version = "0.2.0"
103+
version = "0.5.0"
104104
105105
lambdas = [
106106
{
107107
name = "webhook"
108-
tag = "v0.3.0"
108+
tag = "v0.5.0"
109109
},
110110
{
111111
name = "runners"
112-
tag = "v0.3.0"
112+
tag = "v0.5.0"
113113
},
114114
{
115115
name = "runner-binaries-syncer"
116-
tag = "v0.3.0"
116+
tag = "v0.5.0"
117117
}
118118
]
119119
}
@@ -132,7 +132,7 @@ Next create a second terraform workspace and initiate the module, see the exampl
132132
```terraform
133133
module "github-runner" {
134134
source = "philips-labs/github-runner/aws"
135-
version = "0.2.0"
135+
version = "0.5.0"
136136
137137
aws_region = "eu-west-1"
138138
vpc_id = "vpc-123"
@@ -297,10 +297,12 @@ No requirements.
297297
| instance_profile_path | The path that will be added to the instance_profile, if not set the environment name will be used. | `string` | `null` | no |
298298
| instance_type | Instance type for the action runner. | `string` | `"m5.large"` | no |
299299
| kms_key_id | Custom KMS key to encrypted lambda secrets, if not provided and `encrypt_secrets` = `true` a KMS key will be created by the module. Secrets will be encrypted with a context `Environment = var.environment`. | `string` | `null` | no |
300+
| logging_retention_in_days | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `7` | no |
300301
| manage_kms_key | Let the module manage the KMS key. | `bool` | `true` | no |
301302
| minimum_running_time_in_minutes | The time an ec2 action runner should be running at minimum before terminated if non busy. | `number` | `5` | no |
302303
| role_path | The path that will be added to role path for created roles, if not set the environment name will be used. | `string` | `null` | no |
303304
| role_permissions_boundary | Permissions boundary that will be added to the created roles. | `string` | `null` | no |
305+
| runner_allow_prerelease_binaries | Allow the runners to update to prerelease binaries. | `bool` | `false` | no |
304306
| runner_as_root | Run the action runner under the root user. | `bool` | `false` | no |
305307
| runner_binaries_syncer_lambda_timeout | Time out of the binaries sync lambda in seconds. | `number` | `300` | no |
306308
| runner_binaries_syncer_lambda_zip | File location of the binaries sync lambda zip file. | `string` | `null` | no |
@@ -317,6 +319,7 @@ No requirements.
317319
| vpc_id | The VPC for security groups of the action runners. | `string` | n/a | yes |
318320
| webhook_lambda_timeout | Time out of the webhook lambda in seconds. | `number` | `10` | no |
319321
| webhook_lambda_zip | File location of the webhook lambda zip file. | `string` | `null` | no |
322+
| enable_ssm_on_runners | Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. | `bool` | `false` | no |
320323

321324
## Outputs
322325

‎examples/default/lambdas-download/main.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@ module "lambdas" {
33
lambdas = [
44
{
55
name = "webhook"
6-
tag = "v0.3.0"
6+
tag = "v0.5.0"
77
},
88
{
99
name = "runners"
10-
tag = "v0.3.0"
10+
tag = "v0.5.0"
1111
},
1212
{
1313
name = "runner-binaries-syncer"
14-
tag = "v0.3.0"
14+
tag = "v0.5.0"
1515
}
1616
]
1717
}

‎examples/default/main.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ module "runners" {
3333
enable_organization_runners = false
3434
runner_extra_labels = "default,example"
3535

36+
# enable access to the runners via SSM
37+
enable_ssm_on_runners = true
38+
3639
# Uncommet idle config to have idle runners from 9 to 5 in time zone Amsterdam
3740
# idle_config = [{
3841
# cron = "* * 9-17 * * *"

‎examples/permissions-boundary/lambdas-download/main.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@ module "lambdas" {
33
lambdas = [
44
{
55
name = "webhook"
6-
tag = "v0.3.0"
6+
tag = "v0.5.0"
77
},
88
{
99
name = "runners"
10-
tag = "v0.3.0"
10+
tag = "v0.5.0"
1111
},
1212
{
1313
name = "runner-binaries-syncer"
14-
tag = "v0.3.0"
14+
tag = "v0.5.0"
1515
}
1616
]
1717
}

‎main.tf‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,9 @@ module "webhook" {
3838
sqs_build_queue = aws_sqs_queue.queued_builds
3939
github_app_webhook_secret = var.github_app.webhook_secret
4040

41-
lambda_zip = var.webhook_lambda_zip
42-
lambda_timeout = var.webhook_lambda_timeout
41+
lambda_zip = var.webhook_lambda_zip
42+
lambda_timeout = var.webhook_lambda_timeout
43+
logging_retention_in_days = var.logging_retention_in_days
4344

4445
role_path = var.role_path
4546
role_permissions_boundary = var.role_permissions_boundary
@@ -75,10 +76,12 @@ module "runners" {
7576
runner_as_root = var.runner_as_root
7677
runners_maximum_count = var.runners_maximum_count
7778
idle_config = var.idle_config
79+
enable_ssm_on_runners = var.enable_ssm_on_runners
7880

7981
lambda_zip = var.runners_lambda_zip
8082
lambda_timeout_scale_up = var.runners_scale_up_lambda_timeout
8183
lambda_timeout_scale_down = var.runners_scale_down_lambda_timeout
84+
logging_retention_in_days = var.logging_retention_in_days
8285

8386
instance_profile_path = var.instance_profile_path
8487
role_path = var.role_path
@@ -97,10 +100,12 @@ module "runner_binaries" {
97100

98101
distribution_bucket_name = "${var.environment}-dist-${random_string.random.result}"
99102

100-
runner_architecture = substr(var.instance_type, 0, 2) == "a1" || substr(var.instance_type, 1, 2) == "6g" ? "arm64" : "x64"
103+
runner_architecture = substr(var.instance_type, 0, 2) == "a1" || substr(var.instance_type, 1, 2) == "6g" ? "arm64" : "x64"
104+
runner_allow_prerelease_binaries = var.runner_allow_prerelease_binaries
101105

102-
lambda_zip = var.runner_binaries_syncer_lambda_zip
103-
lambda_timeout = var.runner_binaries_syncer_lambda_timeout
106+
lambda_zip = var.runner_binaries_syncer_lambda_zip
107+
lambda_timeout = var.runner_binaries_syncer_lambda_timeout
108+
logging_retention_in_days = var.logging_retention_in_days
104109

105110
role_path = var.role_path
106111
role_permissions_boundary = var.role_permissions_boundary

‎modules/download-lambda/README.md‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,33 +10,42 @@ module "lambdas" {
1010
lambdas = [
1111
{
1212
name = "webhook"
13-
tag = "v0.3.0"
13+
tag = "v0.5.0"
1414
},
1515
{
1616
name = "runners"
17-
tag = "v0.3.0"
17+
tag = "v0.5.0"
1818
},
1919
{
2020
name = "runner-binaries-syncer"
21-
tag = "v0.3.0"
21+
tag = "v0.5.0"
2222
}
2323
]
2424
}
2525
```
2626

2727
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
28+
## Requirements
29+
30+
No requirements.
31+
32+
## Providers
33+
34+
| Name | Version |
35+
| ---- | ------- |
36+
| null | n/a |
2837

2938
## Inputs
3039

31-
| Name | Description | Type | Default | Required |
32-
| ------- | ------------------------------------- | :----: | :-----: | :------: |
33-
| lambdas | Name and tag for lambdas to download. | object | n/a | yes |
40+
| Name | Description | Type | Default | Required |
41+
| ------- | ------------------------------------- | --------------------------------------------------------------------------- | ------- | :------: |
42+
| lambdas | Name and tag for lambdas to download. | <pre>list(object({<br> name = string<br> tag = string<br> }))</pre> | n/a | yes |
3443

3544
## Outputs
3645

3746
| Name | Description |
3847
| ----- | ----------- |
39-
| files | |
48+
| files | n/a |
4049

4150
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4251

‎modules/runner-binaries-syncer/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,10 @@ No requirements.
5454
| lambda\_schedule\_expression | Scheduler expression for action runner binary syncer. | `string` | `"cron(27 * * * ? *)"` | no |
5555
| lambda\_timeout | Time out of the lambda in seconds. | `number` | `300` | no |
5656
| lambda\_zip | File location of the lambda zip file. | `string` | `null` | no |
57+
| logging\_retention\_in\_days | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `7` | no |
5758
| role\_path | The path that will be added to the role, if not set the environment name will be used. | `string` | `null` | no |
5859
| role\_permissions\_boundary | Permissions boundary that will be added to the created role for the lambda. | `string` | `null` | no |
60+
| runner\_allow\_prerelease\_binaries | Allow the runners to update to prerelease binaries. | `bool` | `false` | no |
5961
| runner\_architecture | The platform architecture for the runner instance (x64, arm64), defaults to 'x64' | `string` | `"x64"` | no |
6062
| tags | Map of tags that will be added to created resources. By default resources will be tagged with name and environment. | `map(string)` | `{}` | no |
6163

‎modules/runner-binaries-syncer/lambdas/runner-binaries-syncer/package.json‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,19 @@
1515
"devDependencies": {
1616
"@octokit/rest": "^18.0.3",
1717
"@types/jest": "^26.0.9",
18-
"@types/node": "^14.0.27",
18+
"@types/node": "^14.6.0",
1919
"@types/request": "^2.48.4",
20-
"@typescript-eslint/eslint-plugin": "^2.30.0",
21-
"@typescript-eslint/parser": "^2.30.0",
20+
"@typescript-eslint/eslint-plugin": "^3.10.0",
21+
"@typescript-eslint/parser": "^3.9.0",
2222
"@zeit/ncc": "^0.22.1",
23-
"aws-sdk": "^2.729.0",
23+
"aws-sdk": "^2.739.0",
2424
"eslint": "^6.8.0",
25-
"jest": "^26.1.0",
26-
"ts-jest": "^26.1.2",
27-
"ts-node-dev": "^1.0.0-pre.51",
25+
"jest": "^26.4.2",
26+
"ts-jest": "^26.2.0",
27+
"ts-node-dev": "^1.0.0-pre.60",
2828
"typescript": "^3.9.6"
29+
},
30+
"dependencies": {
31+
"yn": "^4.0.0"
2932
}
3033
}

‎modules/runner-binaries-syncer/lambdas/runner-binaries-syncer/src/lambda.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import { handle } from './syncer/handler';
22

3+
// eslint-disable-next-line
34
module.exports.handler = async (event: any, context: any, callback: any): Promise<any> => {
45
await handle();
56
return callback();

0 commit comments

Comments
 (0)