diff --git a/github-actions-runner-terraform/.terraform.lock.hcl b/github-actions-runner-terraform/.terraform.lock.hcl new file mode 100644 index 0000000..13b0ee1 --- /dev/null +++ b/github-actions-runner-terraform/.terraform.lock.hcl @@ -0,0 +1,25 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/aws" { + version = "5.59.0" + constraints = ">= 4.0.0" + hashes = [ + "h1:IJTtbe9kK4VbnqADXpYBcabPWwaXxdcgrt8iT8wZjDA=", + "zh:077f41a15057d01d833d7438322adf9b507d17ac0c8e1287430a305b6e609775", + "zh:130b112c85b67413bc65e95e5927188d8e41b45abd75350690b93d95771a587c", + "zh:16e97f1af67a5d4c6bf4f2df824a6a332b446be4516dd85a2e097317c959a174", + "zh:1cd7b0946eaf0fb11090710e9c774d22d90de0ca4516485253be96e332ebaf73", + "zh:2591d8a269014fb59111793cb8a175aafa12e370cd856fe2522577efbb72e5be", + "zh:3db5387ecc7da4e6a55a34877ea426ae87d10238bdbdf284a52e16b4be83302c", + "zh:78169400a85912d7f05fe99d4f3ba9a56871411442bdc133083dd657b18fae4e", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:ad93fedbf1d2694faab6d793c6697ff5732449cdebacaa49acf6452c0c8e2ea0", + "zh:b8a2884858dde9d204dc6855903e3078a1c402485ae85b41c28e667f99a2a777", + "zh:bd3d4bd51172d08c0df277673a25fb3f0818ef47ef9f491b0c41e880b1dedce3", + "zh:d8e132bcafee2e69e21173fac409e4b99d8c81d60a7d25c58c379c67067dbf36", + "zh:eee5113ff29a42c5a75c83e9853e99a9b5c0ed066e36d6fe251083b19d38c7eb", + "zh:f0d8bcdb01d0fa0c9ed2ca8c198d4f11aabfd9d42fa239286b65ddcc6f606dfd", + "zh:f8ae46d14ec54c275e20f71d052f1b6af0cf948819b0667016045a6244edf292", + ] +} diff --git a/github-actions-runner-terraform/cloudwatch.tf b/github-actions-runner-terraform/cloudwatch.tf index 982b72d..9171c6f 100644 --- a/github-actions-runner-terraform/cloudwatch.tf +++ b/github-actions-runner-terraform/cloudwatch.tf @@ -1,5 +1,5 @@ resource "aws_cloudwatch_log_group" "main" { - name = "/ecs/${var.environment}/gh-runner-${local.gh_name_hash}" + name = "/ecs/${var.environment}/gh-runner-${local.cluster_name}" retention_in_days = var.cloudwatch_log_retention kms_key_id = aws_kms_key.log_enc_key.arn @@ -11,7 +11,6 @@ resource "aws_cloudwatch_log_group" "main" { Environment = var.environment Automation = "Terraform" } - } resource "aws_kms_key" "log_enc_key" { diff --git a/github-actions-runner-terraform/container-definitions.tpl b/github-actions-runner-terraform/container-definitions.tpl index 0c206fb..315d229 100644 --- a/github-actions-runner-terraform/container-definitions.tpl +++ b/github-actions-runner-terraform/container-definitions.tpl @@ -29,4 +29,4 @@ "./entrypoint.sh" ] } -] \ No newline at end of file +] diff --git a/github-actions-runner-terraform/ecs.tf b/github-actions-runner-terraform/ecs.tf index c6fbe93..06f6475 100644 --- a/github-actions-runner-terraform/ecs.tf +++ b/github-actions-runner-terraform/ecs.tf @@ -1,5 +1,6 @@ locals { gh_name_hash = uuidv5("3505f3f5-f7e4-46df-a7b0-42f7472ebea5", "${var.environment}-${var.github_repo_owner}-${var.github_repo_name}") + cluster_name = "${var.cluster_name_prefix}-${local.gh_name_hash}" awslogs_group = split(":", aws_cloudwatch_log_group.main.arn)[6] } @@ -40,12 +41,12 @@ data "aws_iam_policy_document" "events_assume_role_policy" { # SG - ECS resource "aws_security_group" "ecs_sg" { - name = "ecs-gh-runner-${local.gh_name_hash}" - description = "gh-runner-${local.gh_name_hash} container security group" + name = "ecs-gh-runner-${local.cluster_name}" + description = "gh-runner-${local.cluster_name} container security group" vpc_id = var.ecs_vpc_id tags = { - Name = "ecs-gh-runner-${local.gh_name_hash}" + Name = "ecs-gh-runner-${local.cluster_name}" GHOwner = var.github_repo_owner GHRepo = var.github_repo_name Environment = var.environment @@ -75,7 +76,7 @@ resource "aws_security_group_rule" "allow_self" { self = true } -## ECS schedule task +# ECS schedule task # Allows CloudWatch Rule to run ECS Task @@ -92,7 +93,7 @@ data "aws_iam_policy_document" "cloudwatch_target_role_policy_doc" { } resource "aws_iam_role" "cloudwatch_target_role" { - name = "cw-target-role-${local.gh_name_hash}" + name = "cw-target-role-${local.cluster_name}" description = "Role allowing CloudWatch Events to run the task" assume_role_policy = data.aws_iam_policy_document.events_assume_role_policy.json path = var.role_path @@ -106,7 +107,7 @@ resource "aws_iam_role_policy" "cloudwatch_target_role_policy" { } resource "aws_iam_role" "task_role" { - name = "ecs-task-role-${local.gh_name_hash}" + name = "ecs-task-role-${local.cluster_name}" description = "Role allowing container definition to execute" assume_role_policy = data.aws_iam_policy_document.ecs_assume_role_policy.json path = var.role_path @@ -172,8 +173,7 @@ data "aws_iam_policy_document" "task_role_policy_doc" { # ECS task details resource "aws_ecs_cluster" "github-runner" { - - name = "gh-runner-${local.gh_name_hash}" + name = local.cluster_name tags = { Name = "github-runner" @@ -189,11 +189,11 @@ resource "aws_ecs_cluster" "github-runner" { } resource "aws_ecs_task_definition" "runner_def" { - family = "gh-runner-${local.gh_name_hash}" + family = "gh-runner-${local.cluster_name}" network_mode = "awsvpc" task_role_arn = aws_iam_role.task_role.arn - requires_compatibilities = ["FARGATE"] + requires_compatibilities = ["EC2"] cpu = var.task_cpu memory = var.task_memory execution_role_arn = aws_iam_role.task_role.arn @@ -225,15 +225,14 @@ resource "aws_ecs_task_definition" "runner_def" { } resource "aws_ecs_service" "actions-runner" { - name = "gh-runner-${local.gh_name_hash}" + name = "gh-runner-${local.cluster_name}" cluster = aws_ecs_cluster.github-runner.arn task_definition = aws_ecs_task_definition.runner_def.arn desired_count = var.ecs_desired_count - launch_type = "FARGATE" + launch_type = "EC2" network_configuration { - subnets = [for s in var.ecs_subnet_ids : s] - security_groups = [aws_security_group.ecs_sg.id] - assign_public_ip = var.assign_public_ip + subnets = var.ecs_subnet_ids + security_groups = [aws_security_group.ecs_sg.id] } tags = { diff --git a/github-actions-runner-terraform/outputs.tf b/github-actions-runner-terraform/outputs.tf index c325834..5e0e695 100644 --- a/github-actions-runner-terraform/outputs.tf +++ b/github-actions-runner-terraform/outputs.tf @@ -6,4 +6,4 @@ output "ecs_service_arn" { output "ecs_security_group_id" { description = "The security group ID of the self-hosted runner ECS service" value = aws_security_group.ecs_sg.id -} \ No newline at end of file +} diff --git a/github-actions-runner-terraform/variables.tf b/github-actions-runner-terraform/variables.tf index 56107d8..10cd3ce 100644 --- a/github-actions-runner-terraform/variables.tf +++ b/github-actions-runner-terraform/variables.tf @@ -1,15 +1,13 @@ -# ECR variables - -variable "ecr_repo_tag" { +variable "ecr_repo_url" { + description = "The URL of the ECR registry that hosts the GitHub Actions image" type = string - description = "The tag to identify and pull the image in ECR repository" - default = "latest" + default = "037370603820.dkr.ecr.us-east-1.amazonaws.com/github-actions-runner" } -variable "ecr_repo_url" { - description = "The URL of the ECR registry that hosts the github actions image" +variable "ecr_repo_tag" { + description = "The tag to identify and pull the image in ECR repository" type = string - default = "037370603820.dkr.ecr.us-east-1.amazonaws.com/github-actions-runner" + default = "latest" } variable "ecr_repository_arns" { @@ -18,8 +16,6 @@ variable "ecr_repository_arns" { default = ["arn:aws:ecr:us-east-1:037370603820:repository/github-actions-runner"] } -# ECS variables - variable "environment" { type = string description = "Environment name" @@ -41,22 +37,24 @@ variable "ecs_desired_count" { default = 0 } +variable "cluster_name_prefix" { + description = "Prefix for the ECS cluster name to make it human readable" + type = string + default = "gh-runner" +} + variable "tags" { type = map(any) description = "Additional tags to apply." default = {} } -# Cloudwatch Variables - variable "cloudwatch_log_retention" { description = "Number of days to retain logs" type = number default = 731 } -# GitHub Runner Variables - variable "personal_access_token_arn" { description = "AWS SecretsManager ARN for GitHub personal access token" type = string