diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml index b21ecc544f..8eba6fb5b7 100644 --- a/.github/workflows/terraform.yml +++ b/.github/workflows/terraform.yml @@ -214,6 +214,7 @@ jobs: matrix: module: - modules/runners + - modules/multi-runner defaults: run: working-directory: ${{ matrix.module }} diff --git a/docs/adr/002-runner-orchestration-provider-boundary.md b/docs/adr/002-runner-orchestration-provider-boundary.md new file mode 100644 index 0000000000..dc0aedc6b2 --- /dev/null +++ b/docs/adr/002-runner-orchestration-provider-boundary.md @@ -0,0 +1,407 @@ +# ADR-002: Runner Orchestration Provider Boundary + +## Status + +Proposed + +## Date + +2026-09-03 + +## Context + +The multi-runner module currently receives workflow-job demand through a shared +GitHub webhook. A build queue invokes scale-up, schedules invoke scale-down +and the runner pool, and an optional retry queue checks queued jobs. These +components evolved together, while their settings were spread across shared +module inputs and each runner configuration. + +That layout assumes every runner configuration uses the same demand-control +model. It also makes the runner configuration responsible for webhook-specific +resources. Adding another model would require provider conditionals throughout +the module or a second copy of the common runner and compute-provider wiring. + +GitHub Actions Runner Scale Sets require a different control model. A future +implementation is expected to use the runner scale-set and agent APIs: + +- `_apis/runtime/runnerscalesets` +- `_apis/distributedtask/pools/0/agents` + +Unlike event- and schedule-driven Lambda components, a scale-set controller +maintains reconciliation state and long-lived coordination with GitHub. It may +therefore need a containerized service, with ECS as a candidate deployment +target, rather than another independent Lambda handler. + +The Terraform contract must allow that future addition without moving webhook +fields a second time. This ADR defines the boundary. It does not implement the +scale-set API client, controller, container image, or ECS resources. + +## Terminology + +- **Runner configuration**: One entry in `multi_runner_config`, + including common runner behavior, one orchestration provider, and one compute + provider. +- **Orchestration provider**: The implementation that receives or reconciles + runner demand and owns the controls that turn demand into capacity actions. +- **Compute provider**: The implementation that creates and manages runner + capacity, such as AWS EC2. It supplies capabilities to orchestration. +- **Webhook orchestration**: The existing webhook, queue, scale-up, scale-down, + pool, and job-retry implementation. +- **Scale-set orchestration**: A future stateful controller built on GitHub's + runner scale-set APIs. + +## Decision + +We will use typed orchestration-provider and compute-provider boundaries in the +experimental multi-runner interface. Every runner configuration selects +exactly one provider of each type. + +### The experimental contract uses split global variables + +The experimental interface is intentionally represented by separate Terraform +variables rather than one monolithic `experimental` object: + +- `global_config` contains common global defaults such as tags, + roles, and runner identity. +- `global_config_github` contains shared GitHub settings. +- `global_config_lambda` contains provider-neutral Lambda + substrate and the shared artifact bucket. +- `global_config_orchestration_provider` contains global webhook + defaults and shared webhook settings. +- `global_config_ssm` contains global SSM settings. +- `global_config_observability` contains logs, tracing, and + metrics defaults. +- `global_config_compute_provider` contains global compute + provider settings. +- `multi_runner_config` contains per-runner configuration + overrides and provider selections. + +For example: + +```hcl +global_config = { + tags = { + Environment = "ci" + } +} + +global_config_observability = { + metrics = { + enabled = true + metric = { + github_app_rate_limit = { enabled = true } + job_retry = { enabled = true } + } + } +} + +global_config_orchestration_provider = { + webhook = { + eventbridge = { + enabled = true + } + } +} + +multi_runner_config = { + linux_arm64 = { + orchestration_provider = { + webhook = { + runner = { + boot_time_in_minutes = 5 + ephemeral = true + jit_config_enabled = null + maximum_count = 4 + } + + github = { + organization_runners = true + } + + matcherConfig = { + labelMatchers = [["linux", "arm64"]] + } + } + } + + compute_provider = { + aws = { + ec2 = { + instance_types = ["m7g.large"] + on_demand_failover_for_errors = ["InsufficientInstanceCapacity"] + instance_termination_watcher = { + features = { + runner_deregistration = { enabled = true } + spot_termination_handler = { enabled = true } + spot_termination_notification_watcher = { enabled = true } + } + } + } + } + } + } +} +``` + +The populated provider wrapper selects the provider; selection is not based on +a string discriminator. The wrapper's nullness and every value that controls +resource shape must be known during planning. Other values inside the selected +provider may remain unknown until apply. + +### Provider selection is per runner configuration + +Every entry in `multi_runner_config` must contain exactly one +non-null typed `orchestration_provider` block and exactly one non-null typed +`compute_provider` block. In this phase the supported blocks are: + +- `orchestration_provider.webhook` +- `compute_provider.aws.ec2` + +Validation counts non-null provider blocks rather than naming one special case. +A future provider can therefore be added as a sibling without changing the +selection rule. Different runner configurations may select different +providers once more than one exists, but one runner configuration cannot combine +providers. + +### Global provider blocks provide defaults; they do not select providers + +`global_config_orchestration_provider.webhook` is the global +defaults and shared-component namespace for webhook orchestration. Its +presence does not select webhook orchestration for every runner configuration. +Selection remains under +`multi_runner_config..orchestration_provider`. + +The global webhook namespace owns queue selection, EventBridge routing, +matcher-parameter tier, repository filtering, build-queue defaults, redrive +behavior, encryption, shared webhook Lambda settings, the runner-control +artifact, and default scale-up, scale-down, and pool settings. + +Job-retry remains a per-runner webhook setting in this phase. Its typed block +supplies its own defaults rather than inheriting a global job-retry block. + +For a selected webhook provider, resolution follows: + +```text +runner configuration override > experimental global webhook default +``` + +Tag maps merge from broad to narrow. A runner-specific override affects only +that runner configuration; it does not configure a shared singleton. + +### Canonical names describe ownership and enablement + +Nested feature groups use an `enabled` field: + +- `observability.metrics.enabled` +- `observability.metrics.metric.github_app_rate_limit.enabled` +- `observability.metrics.metric.job_retry.enabled` +- `observability.metrics.metric.spot_termination_warning.enabled` +- `instance_termination_watcher.features.runner_deregistration.enabled` +- `instance_termination_watcher.features.spot_termination_handler.enabled` +- `instance_termination_watcher.features.spot_termination_notification_watcher.enabled` + +Standalone settings remain descriptive names ending in `_enabled`, for +example `managed_security_group_enabled`, `jit_config_enabled`, +`job_queued_check_enabled`, `detailed_monitoring_enabled`, and `ssm_enabled`. +The EC2 failover list is named `on_demand_failover_for_errors`. + +Runner-binary configuration is owned by the compute provider's +`runner_binaries` block. It does not publish a global `targets` map. Binary +targets are derived from the resolved runner configurations that enable binary +synchronization, so the binary module does not depend on the effective +configuration it helps produce. + +### Module ownership follows the provider boundary + +| Layer | Responsibility | +| --- | --- | +| `modules/multi-runner` | Translates stable inputs, resolves global and per-runner values, owns shared ingress and queues, and routes typed provider objects. | +| `modules/runner-config` | Composes provider-neutral runner resources, selects exactly one orchestration provider and one compute provider, and connects provider capabilities. | +| `modules/orchestration-providers/webhook` | Owns webhook orchestration composition, defaults, tag layering, and scale, pool, and retry leaf modules. | +| `modules/orchestration-providers/webhook/scale-runners` | Owns scale-up and scale-down Lambdas, schedules, queue integration, IAM, and outputs. | +| `modules/orchestration-providers/webhook/pool` | Owns optional scheduled pool resources and IAM. | +| `modules/orchestration-providers/webhook/job-retry` | Owns optional queued-job retry resources and IAM. | +| `modules/runner-config/ssm-housekeeper` | Owns provider-neutral cleanup of runner token and configuration parameters. | +| `modules/compute-providers//` | Owns provider-specific capacity resources and returns policy, environment, managed-policy, and resource capabilities. | + +Provider leaf modules live below `modules/orchestration-providers/`, +not below `modules/runner-config`. This keeps the common composition module +small and prevents provider-owned resources from becoming part of the common +contract. + +```mermaid +flowchart TD + Multi["multi-runner: translate and resolve"] --> Config["runner-config: compose one runner config"] + Config --> Orchestration{"exactly one orchestration provider"} + Orchestration --> Webhook["orchestration-providers/webhook"] + Orchestration -. future .-> ScaleSet["orchestration-providers/scale-set"] + Config --> Compute{"exactly one compute provider"} + Compute --> EC2["compute-providers/aws/ec2"] + EC2 --> Capabilities["compute capabilities"] + Capabilities --> Webhook + Webhook --> Scale["scale-runners"] + Webhook --> Pool["pool"] + Webhook --> Retry["job-retry"] +``` + +### Compute providers expose capabilities, not orchestration resources + +The selected compute provider remains independent from the selected +orchestration provider. It owns capacity resources and supplies the policy, +environment-variable, managed-policy, trust-policy, and resource capabilities +needed by the selected orchestration implementation. + +`runner-config` adapts those outputs into the capabilities consumed by webhook +orchestration. The webhook provider owns its Lambda roles and attaches the +capability fragments it needs. The compute provider does not create webhook +resources. + +This direction keeps the dependency graph one-way: + +```text +runner-config -> compute provider -> capability contract -> orchestration provider +``` + +A future scale-set controller may require a different subset or extension of +the capability contract. That extension belongs at the provider boundary; it +must not add scale-set conditionals to webhook leaves. + +### Compatibility and state are explicit + +Stable inputs are translated into the same internal canonical representation so +defaults and shared singleton values have one resolution path. The unified +`multi_runner_config` input accepts either the stable v1 entry shape or the v2 +provider-boundary entry shape. Stable entries continue to use the existing +`modules/runners` implementation when no v2 entries are present. When v2 +entries are present, `experimental_features = ["multi-runner-v2"]` is required; +the v2 path combines native v2 entries with translated v1 entries from the +same map. + +The canonical v2 output groups orchestration resources under +`orchestration_provider.webhook` and compute resources under the selected +namespace and provider, currently `provider.aws.ec2`. Compatibility aliases +may remain during the experimental transition, but new consumers must use the +canonical paths. + +This ADR does not define automatic stable-v1-to-v2 state migration. Existing +deployments remain on the stable path until that migration is separately +designed and documented. + +### Existing shared modules stay unchanged + +The orchestration-provider boundary does not change the public contracts or +resource addresses of `modules/webhook` or `modules/ssm`. + +The shared webhook remains at its existing module address. The shared SSM module +continues to create or reference the webhook secret even when no runner +configuration selects webhook orchestration. That singleton contract is +independent of per-runner exact-one provider selection. + +Any later proposal to make those shared modules conditional is a separate +compatibility and state decision. + +### Scale-set implementation is deferred + +No `scale_set` field is added in this phase. The typed object and module layout +reserve the extension point without publishing an incomplete contract. + +A follow-up design must decide the public SDK surface, authentication and API +versioning, reconciliation and persistence, controller recovery and +concurrency, container release, ECS networking and scaling, compute-provider +capabilities, and Terraform migration/coexistence behavior. + +The intended end state permits webhook and scale-set orchestration in the same +multi-runner module instance when different runner configurations select them. +It does not permit both controllers to own the same runner configuration. + +## Consequences + +### Positive + +- A future orchestration provider becomes a sibling module instead of a + cross-cutting conditional. +- Common runner settings and compute-provider configuration remain reusable. +- Provider-owned queue, Lambda, artifact, IAM, and output settings have one + discoverable namespace. +- Exact-one validation prevents ambiguous ownership of a runner configuration. +- Stable behavior and shared singleton addresses remain unchanged. + +### Negative + +- The experimental input is more deeply nested than the existing flat + interface and is split across several global variables. +- Global webhook defaults and per-runner webhook selection have similarly named + blocks with different purposes. +- Adapter objects and capability contracts require maintenance. +- A stateful provider will still require separate runtime, deployment, + observability, and failure-recovery design. + +## Alternatives Considered + +### Add a flat orchestration mode string + +A value such as `orchestration_type = "webhook"` plus flat settings would make +unrelated fields valid for every provider and require cross-field validation. + +**Decision**: Use typed nullable sibling blocks. The populated block both +selects and configures the provider. + +### Put provider conditionals directly in `runner-config` + +This would keep fewer directories initially, but every provider would add +resources, variables, IAM branches, and outputs to the common module. + +**Decision**: Keep `runner-config` as selector and composer. Put concrete +resources under `modules/orchestration-providers/`. + +### Keep webhook leaves under `runner-config` + +Scale, pool, and retry are webhook orchestration behavior. Leaving them under +the common module would blur ownership and make a future provider appear to +support components it does not use. + +**Decision**: Keep those leaves under the webhook provider root. + +### Add the scale-set schema and ECS service now + +Publishing placeholders would lock in names and types before the API client, +reconciliation semantics, and runtime model have been validated. + +**Decision**: Publish only the provider-neutral extension point now. + +### Make the shared webhook and webhook secret conditional + +That would alter existing singleton addresses and conflate module-level ingress +with per-runner provider selection. + +**Decision**: Leave `modules/webhook` and `modules/ssm` unchanged. + +## Migration and Verification + +Implementation and review must verify the boundary at several levels: + +- A runner configuration with exactly one provider of each type plans + successfully; zero or multiple selections fail with focused messages. +- Provider-wrapper nullness and other graph-shaping values are plan-known. +- Per-runner values override global defaults, and omitted nullable values inherit + them. +- Shared singleton resources consume global values rather than arbitrary + per-runner overrides. +- Stable inputs preserve stable resource addresses and output shape. +- Runner-config routes only the selected orchestration provider and compute + capabilities reach the correct provider component. +- Canonical nested metric and feature settings are consumed by all provider + modules. +- Existing `modules/webhook` and `modules/ssm` contracts and addresses remain + unchanged. +- Stable and experimental Terraform tests, formatting, documentation + generation, and repository checks pass. + +Before an existing experimental deployment adopts a module rename, operators +must migrate affected state explicitly and confirm that the plan contains no +unintended replacements. Stable deployments must not enable v2 until a +stable-to-v2 migration procedure exists. + +## References + +- [GitHub Actions Runner Scale Set client](https://github.com/actions/scaleset) diff --git a/modules/multi-runner/README.md b/modules/multi-runner/README.md index 21fc8f441b..61a558389f 100644 --- a/modules/multi-runner/README.md +++ b/modules/multi-runner/README.md @@ -18,6 +18,8 @@ The **webhook lambda** does not participate in round-robin: it only validates in The module takes a configuration as input containing a matcher for the labels. The [webhook](https://github-aws-runners.github.io/terraform-aws-github-runner/modules/internal/webhook/) lambda is using the configuration to delegate events based on the labels in the workflow job and sent them to a dedicated queue based on the configuration. Events on each queue are processed by a dedicated lambda per configuration to scale runners. +> **Experimental v2 configuration:** Set `experimental_features = ["multi-runner-v2"]` before using the provider-boundary inputs. Their schema may change during the experimental window; the acknowledgement flag will become a deprecated no-op for one release when the feature graduates. + For each configuration: - When enabled, the [distribution syncer](https://github-aws-runners.github.io/terraform-aws-github-runner/modules/internal/runner-binaries-syncer/) is deployed for each unique combination of OS and architecture. @@ -94,6 +96,42 @@ module "multi-runner" { } ``` +### Provider-boundary v2 configuration + +The v2 form of `multi_runner_config` keeps runner, Lambda, orchestration, SSM, observability, and compute-provider settings under one configuration entry. The webhook matcher is configured under `orchestration_provider.webhook.matcherConfig`. + +```hcl +multi_runner_config = { + "linux-x64" = { + tags = { + Environment = "production" + } + + runner = { + os = "linux" + architecture = "x64" + extra_labels = ["large"] + } + + orchestration_provider = { + webhook = { + matcherConfig = { + labelMatchers = [["self-hosted", "linux", "x64", "large"]] + } + } + } + + compute_provider = { + aws = { + ec2 = { + instance_types = ["m5.large"] + } + } + } + } +} +``` + ## Requirements @@ -151,9 +189,17 @@ module "multi-runner" { | [enable\_ami\_housekeeper](#input\_enable\_ami\_housekeeper) | Option to disable the lambda to clean up old AMIs. | `bool` | `false` | no | | [enable\_managed\_runner\_security\_group](#input\_enable\_managed\_runner\_security\_group) | Enabling the default managed security group creation. Unmanaged security groups can be specified via `runner_additional_security_group_ids`. | `bool` | `true` | no | | [eventbridge](#input\_eventbridge) | Enable the use of EventBridge by the module. By enabling this feature events will be put on the EventBridge by the webhook instead of directly dispatching to queues for scaling. | 
object({
    enable        = optional(bool, true)
    accept_events = optional(list(string), [])
  })
| `{}` | no | +| [experimental\_features](#input\_experimental\_features) | Explicit acknowledgement for opt-in features whose schemas may change
while experimental. Set to ["multi-runner-v2"] when using the v2
provider-boundary configuration. This flag will become a deprecated no-op
for one release when the feature graduates. | `set(string)` | `[]` | no | | [ghes\_ssl\_verify](#input\_ghes\_ssl\_verify) | GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). | `bool` | `true` | no | | [ghes\_url](#input\_ghes\_url) | GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB. .However if you are using GitHub Enterprise Cloud with data-residency (ghe.com), set the endpoint here. Example - https://companyname.ghe.com\| | `string` | `null` | no | | [github\_app](#input\_github\_app) | GitHub app parameters, see your github app.
You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.
If you chose to provide the configuration values directly here,
please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).
Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | 
object({
    key_base64 = optional(string)
    key_base64_ssm = optional(object({
      arn  = string
      name = string
    }))
    id = optional(string)
    id_ssm = optional(object({
      arn  = string
      name = string
    }))
    webhook_secret = optional(string)
    webhook_secret_ssm = optional(object({
      arn  = string
      name = string
    }))
  })
| n/a | yes | +| [global\_config](#input\_global\_config) | Global defaults shared by all runner lanes.

global\_config = {
tags: "Tags applied to resources created for all runner lanes."
roles: {
path: "IAM path used for roles created for runner resources."
permissions\_boundary: "Optional IAM permissions boundary ARN applied to created roles."
}
runner: {
os: "Default operating system for runners."
architecture: "Default runner architecture."
disable\_default\_labels: "Whether to omit the default operating-system, architecture, and self-hosted labels."
extra\_labels: "Additional labels applied to all runners."
group\_name: "Default GitHub runner group."
name\_prefix: "Prefix for runner names."
run\_as\_root: "Whether the GitHub Actions runner executes as root."
run\_as: "User that runs the GitHub Actions agent when it is not running as root."
auto\_update\_disabled: "Whether automatic GitHub Actions runner updates are disabled."
tags: "Tags applied to runner resources."
hooks: {
job\_started: "Script executed when a job starts on a runner."
job\_completed: "Script executed when a job completes on a runner."
}
iam: {
role.arn: "Existing IAM role ARN to use for runners."
managed\_policy\_arns: "Managed policy ARNs attached to the runner IAM role."
additional\_trust\_policy\_json: "Additional trust policy JSON merged into the runner role trust policy."
path: "IAM path used for the runner role."
permissions\_boundary: "Optional IAM permissions boundary ARN for the runner role."
}
}
} | 
object({
    tags = optional(map(string), {})

    roles = optional(object({
      path                 = optional(string, null)
      permissions_boundary = optional(string, null)
    }), {})

    runner = optional(object({
      os                     = optional(string, null)
      architecture           = optional(string, null)
      disable_default_labels = optional(bool, false)
      extra_labels           = optional(list(string), [])
      group_name             = optional(string, "Default")
      name_prefix            = optional(string, "")
      run_as_root            = optional(bool, false)
      run_as                 = optional(string, "ec2-user")
      auto_update_disabled   = optional(bool, false)
      tags                   = optional(map(string), {})
      hooks = optional(object({
        job_started   = optional(string, "")
        job_completed = optional(string, "")
      }), {})
      iam = optional(object({
        role = optional(object({
          arn = string
        }), null)
        managed_policy_arns          = optional(map(string), {})
        additional_trust_policy_json = optional(string, null)
        path                         = optional(string, null)
        permissions_boundary         = optional(string, null)
      }), {})
    }), {})
  })
| `{}` | no | +| [global\_config\_compute\_provider](#input\_global\_config\_compute\_provider) | Global compute-provider configuration shared by all runner lanes.

global\_config\_compute\_provider = {
selections: "Compute-provider selections keyed by namespace."
selections.namespace: "Provider namespace used to resolve a compute implementation."
selections.type: "Compute-provider type selected for the namespace."
aws.ec2.vpc\_id: "Default VPC for EC2 runners."
aws.ec2.subnet\_ids: "Default subnets for EC2 runners."
aws.ec2.managed\_security\_group\_enabled: "Whether the module manages the default runner security group."
aws.ec2.egress\_rules: "Egress rules for the managed runner security group."
aws.ec2.egress\_rules.cidr\_blocks: "IPv4 CIDR blocks allowed by an egress rule."
aws.ec2.egress\_rules.ipv6\_cidr\_blocks: "IPv6 CIDR blocks allowed by an egress rule."
aws.ec2.egress\_rules.prefix\_list\_ids: "AWS prefix lists allowed by an egress rule."
aws.ec2.egress\_rules.from\_port: "Start of the egress port range."
aws.ec2.egress\_rules.protocol: "Protocol for the egress rule."
aws.ec2.egress\_rules.security\_groups: "Referenced security groups allowed by an egress rule."
aws.ec2.egress\_rules.self: "Whether the security group itself is allowed by an egress rule."
aws.ec2.egress\_rules.to\_port: "End of the egress port range."
aws.ec2.egress\_rules.description: "Description of the egress rule."
aws.ec2.additional\_security\_group\_ids: "Additional security groups attached to EC2 runners."
aws.ec2.cloudwatch\_agent.config: "CloudWatch Agent configuration for EC2 runners."
aws.ec2.instance\_profile\_path: "IAM path used for the EC2 instance profile."
aws.ec2.key\_name: "EC2 key pair name assigned to runner instances."
aws.ec2.associate\_public\_ipv4\_address: "Whether runner instances receive a public IPv4 address."
aws.ec2.tags: "Tags applied to EC2 runner resources."
aws.ec2.ami.housekeeper.enabled: "Whether AMI cleanup is enabled."
aws.ec2.ami.housekeeper.cleanup\_config.maxItems: "Maximum number of AMIs retained by cleanup."
aws.ec2.ami.housekeeper.cleanup\_config.minimumDaysOld: "Minimum AMI age in days before cleanup."
aws.ec2.ami.housekeeper.cleanup\_config.amiFilters: "AMI filters used to select AMIs for cleanup."
aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Name: "AMI filter name."
aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Values: "Values matched by the AMI filter."
aws.ec2.ami.housekeeper.cleanup\_config.launchTemplateNames: "Launch template names associated with AMIs eligible for cleanup."
aws.ec2.ami.housekeeper.cleanup\_config.ssmParameterNames: "SSM parameter names associated with AMIs eligible for cleanup."
aws.ec2.ami.housekeeper.cleanup\_config.dryRun: "Whether AMI cleanup reports changes without deleting AMIs."
aws.ec2.ami.housekeeper.artifact.zip: "Local ZIP artifact used for the AMI housekeeper Lambda."
aws.ec2.ami.housekeeper.artifact.s3.key: "S3 object key for the AMI housekeeper Lambda artifact."
aws.ec2.ami.housekeeper.artifact.s3.object\_version: "Optional S3 object version for the AMI housekeeper artifact."
aws.ec2.ami.housekeeper.lambda.memory\_size: "Memory allocated to the AMI housekeeper Lambda."
aws.ec2.ami.housekeeper.lambda.timeout: "Timeout in seconds for the AMI housekeeper Lambda."
aws.ec2.ami.housekeeper.schedule.expression: "Schedule expression for AMI cleanup."
aws.ec2.instance\_termination\_watcher.enabled: "Whether the instance termination watcher is enabled."
aws.ec2.instance\_termination\_watcher.features.runner\_deregistration.enabled: "Whether terminated runners are deregistered."
aws.ec2.instance\_termination\_watcher.features.spot\_termination\_handler.enabled: "Whether spot termination events trigger runner handling."
aws.ec2.instance\_termination\_watcher.features.spot\_termination\_notification\_watcher.enabled: "Whether spot termination notification monitoring is enabled."
aws.ec2.instance\_termination\_watcher.environment\_variables: "Environment variables passed to the termination watcher."
aws.ec2.instance\_termination\_watcher.artifact.zip: "Local ZIP artifact used for the termination watcher Lambda."
aws.ec2.instance\_termination\_watcher.artifact.s3.key: "S3 object key for the termination watcher Lambda artifact."
aws.ec2.instance\_termination\_watcher.artifact.s3.object\_version: "Optional S3 object version for the termination watcher artifact."
aws.ec2.instance\_termination\_watcher.lambda.memory\_size: "Memory allocated to the termination watcher Lambda."
aws.ec2.instance\_termination\_watcher.lambda.timeout: "Timeout in seconds for the termination watcher Lambda."
aws.ec2.runner\_binaries.enabled: "Whether runner binary synchronization is enabled."
aws.ec2.runner\_binaries.s3.encryption.enabled: "Whether runner-binary S3 encryption is enabled."
aws.ec2.runner\_binaries.s3.encryption.bucket\_key\_enabled: "Whether an S3 bucket key is used for KMS encryption."
aws.ec2.runner\_binaries.s3.encryption.sse\_algorithm: "S3 server-side encryption algorithm."
aws.ec2.runner\_binaries.s3.encryption.kms\_master\_key\_id: "KMS key ID used for runner-binary S3 encryption."
aws.ec2.runner\_binaries.s3.tags: "Tags applied to the runner-binary S3 bucket."
aws.ec2.runner\_binaries.s3.versioning: "S3 versioning state for the runner-binary bucket."
aws.ec2.runner\_binaries.s3.logging.bucket: "S3 bucket receiving runner-binary access logs."
aws.ec2.runner\_binaries.s3.logging.prefix: "Prefix for runner-binary S3 access logs."
aws.ec2.runner\_binaries.syncer.artifact.zip: "Local ZIP artifact used for the runner-binary syncer Lambda."
aws.ec2.runner\_binaries.syncer.artifact.s3.key: "S3 object key for the runner-binary syncer artifact."
aws.ec2.runner\_binaries.syncer.artifact.s3.object\_version: "Optional S3 object version for the runner-binary syncer artifact."
aws.ec2.runner\_binaries.syncer.lambda.memory\_size: "Memory allocated to the runner-binary syncer Lambda."
aws.ec2.runner\_binaries.syncer.lambda.timeout: "Timeout in seconds for the runner-binary syncer Lambda."
aws.ec2.runner\_binaries.syncer.schedule.expression: "Schedule expression for runner-binary synchronization."
aws.ec2.runner\_binaries.syncer.schedule.state: "EventBridge rule state for runner-binary synchronization."
} | 
object({
    selections = optional(map(object({
      namespace = string
      type      = string
    })), null)
    aws = optional(object({
      ec2 = optional(object({
        vpc_id                         = optional(string, null)
        subnet_ids                     = optional(list(string), null)
        managed_security_group_enabled = optional(bool, true)
        egress_rules = optional(list(object({
          cidr_blocks      = list(string)
          ipv6_cidr_blocks = list(string)
          prefix_list_ids  = list(string)
          from_port        = number
          protocol         = string
          security_groups  = list(string)
          self             = bool
          to_port          = number
          description      = string
          })), [{
          cidr_blocks      = ["0.0.0.0/0"]
          ipv6_cidr_blocks = ["::/0"]
          prefix_list_ids  = null
          from_port        = 0
          protocol         = "-1"
          security_groups  = null
          self             = null
          to_port          = 0
          description      = null
        }])
        additional_security_group_ids = optional(list(string), [])
        cloudwatch_agent = optional(object({
          config = optional(string, null)
        }), {})
        instance_profile_path         = optional(string, null)
        key_name                      = optional(string, null)
        associate_public_ipv4_address = optional(bool, false)
        tags                          = optional(map(string), {})
        ami = optional(object({
          housekeeper = optional(object({
            enabled = optional(bool, false)
            cleanup_config = optional(object({
              maxItems       = optional(number)
              minimumDaysOld = optional(number)
              amiFilters = optional(list(object({
                Name   = string
                Values = list(string)
              })))
              launchTemplateNames = optional(list(string))
              ssmParameterNames   = optional(list(string))
              dryRun              = optional(bool)
            }), {})
            artifact = optional(object({
              zip = optional(string, null)
              s3 = optional(object({
                key            = string
                object_version = optional(string, null)
              }), null)
            }), {})
            lambda = optional(object({
              memory_size = optional(number, 256)
              timeout     = optional(number, 300)
            }), {})
            schedule = optional(object({
              expression = optional(string, "cron(11 7 * * ? *)")
            }), {})
          }), {})
        }), {})
        instance_termination_watcher = optional(object({
          enabled = optional(bool, false)
          features = optional(object({
            runner_deregistration = optional(object({
              enabled = optional(bool, true)
            }), {})
            spot_termination_handler = optional(object({
              enabled = optional(bool, true)
            }), {})
            spot_termination_notification_watcher = optional(object({
              enabled = optional(bool, true)
            }), {})
          }), {})
          environment_variables = optional(map(string), {})
          artifact = optional(object({
            zip = optional(string, null)
            s3 = optional(object({
              key            = string
              object_version = optional(string, null)
            }), null)
          }), {})
          lambda = optional(object({
            memory_size = optional(number, null)
            timeout     = optional(number, null)
          }), {})
        }), {})
        runner_binaries = optional(object({
          enabled = optional(bool, true)
          s3 = optional(object({
            encryption = optional(object({
              enabled            = optional(bool, true)
              bucket_key_enabled = optional(bool, null)
              sse_algorithm      = optional(string, "AES256")
              kms_master_key_id  = optional(string, null)
            }), {})
            tags       = optional(map(string), {})
            versioning = optional(string, "Disabled")
            logging = optional(object({
              bucket = optional(string, null)
              prefix = optional(string, null)
            }), {})
          }), {})
          syncer = optional(object({
            artifact = optional(object({
              zip = optional(string, null)
              s3 = optional(object({
                key            = string
                object_version = optional(string, null)
              }), null)
            }), {})
            lambda = optional(object({
              memory_size = optional(number, 256)
              timeout     = optional(number, 300)
            }), {})
            schedule = optional(object({
              expression = optional(string, "cron(27 * * * ? *)")
              state      = optional(string, "ENABLED")
            }), {})
          }), {})
        }), {})
      }), {})
    }), {})
  })
| `{}` | no | +| [global\_config\_github](#input\_global\_config\_github) | Global GitHub configuration shared by all runner lanes.

global\_config\_github = {
app: {
key\_base64: "Base64-encoded GitHub App private key."
key\_base64\_ssm: "SSM parameter containing the Base64-encoded GitHub App private key."
key\_base64\_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key."
key\_base64\_ssm.name: "Name of the SSM parameter containing the GitHub App private key."
id: "GitHub App ID."
id\_ssm: "SSM parameter containing the GitHub App ID."
id\_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."
id\_ssm.name: "Name of the SSM parameter containing the GitHub App ID."
webhook\_secret: "GitHub App webhook secret."
webhook\_secret\_ssm: "SSM parameter containing the GitHub App webhook secret."
webhook\_secret\_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."
webhook\_secret\_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret."
}
additional\_apps: "Additional GitHub Apps used to distribute GitHub API requests."
additional\_apps.key\_base64: "Base64-encoded private key for an additional GitHub App."
additional\_apps.key\_base64\_ssm: "SSM parameter containing an additional App private key."
additional\_apps.key\_base64\_ssm.arn: "ARN of the SSM parameter containing an additional App private key."
additional\_apps.key\_base64\_ssm.name: "Name of the SSM parameter containing an additional App private key."
additional\_apps.id: "ID of an additional GitHub App."
additional\_apps.id\_ssm: "SSM parameter containing an additional GitHub App ID."
additional\_apps.id\_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID."
additional\_apps.id\_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID."
additional\_apps.installation\_id: "Optional installation ID for an additional GitHub App."
additional\_apps.installation\_id\_ssm: "SSM parameter containing an additional App installation ID."
additional\_apps.installation\_id\_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID."
additional\_apps.installation\_id\_ssm.name: "Name of the SSM parameter containing an additional App installation ID."
enterprise\_server.url: "GitHub Enterprise Server URL."
enterprise\_server.ssl\_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."
user\_agent: "User-Agent value sent with GitHub API requests."
} | 
object({
    app = optional(object({
      key_base64 = optional(string)
      key_base64_ssm = optional(object({
        arn  = string
        name = string
      }))
      id = optional(string)
      id_ssm = optional(object({
        arn  = string
        name = string
      }))
      webhook_secret = optional(string)
      webhook_secret_ssm = optional(object({
        arn  = string
        name = string
      }))
    }), null)
    additional_apps = optional(list(object({
      key_base64          = optional(string)
      key_base64_ssm      = optional(object({ arn = string, name = string }))
      id                  = optional(string)
      id_ssm              = optional(object({ arn = string, name = string }))
      installation_id     = optional(string)
      installation_id_ssm = optional(object({ arn = string, name = string }))
    })), [])
    enterprise_server = optional(object({
      url        = optional(string, null)
      ssl_verify = optional(bool, true)
    }), {})
    user_agent = optional(string, "github-aws-runners")
  })
| `{}` | no | +| [global\_config\_lambda](#input\_global\_config\_lambda) | Global Lambda configuration shared by all runner lanes.

global\_config\_lambda = {
artifact.s3.bucket: "S3 bucket containing Lambda deployment artifacts."
runtime: "Default Lambda runtime."
architecture: "Default Lambda instruction-set architecture."
principals: "Additional AWS principals allowed to invoke the Lambda functions."
principals.type: "Principal type, such as AWS account, service, or organization."
principals.identifiers: "Identifiers allowed for the principal type."
subnet\_ids: "Subnets used by Lambda functions."
security\_group\_ids: "Security groups attached to Lambda functions."
tags: "Tags applied to Lambda functions and related resources."
role.path: "IAM path used for Lambda execution roles."
role.permissions\_boundary: "Optional IAM permissions boundary ARN for Lambda execution roles."
} | 
object({
    artifact = optional(object({
      s3 = optional(object({
        bucket = optional(string, null)
      }), {})
    }), {})
    runtime      = optional(string, "nodejs24.x")
    architecture = optional(string, "arm64")
    principals = optional(list(object({
      type        = string
      identifiers = list(string)
    })), [])
    subnet_ids         = optional(list(string), [])
    security_group_ids = optional(list(string), [])
    tags               = optional(map(string), {})
    role = optional(object({
      path                 = optional(string, null)
      permissions_boundary = optional(string, null)
    }), {})
  })
| `{}` | no | +| [global\_config\_observability](#input\_global\_config\_observability) | Global observability configuration shared by all runner lanes.

global\_config\_observability = {
logs.level: "Log level for module resources."
logs.retention\_in\_days: "CloudWatch log retention period in days."
logs.kms\_key\_id: "KMS key ID used to encrypt CloudWatch log groups."
logs.class: "CloudWatch log group class."
logs.tags: "Tags applied to CloudWatch log groups."
tracing.mode: "Tracing mode used by instrumented resources."
tracing.capture\_http\_requests: "Whether HTTP requests are captured by tracing."
tracing.capture\_error: "Whether errors are captured by tracing."
metrics.enabled: "Whether module metrics are enabled."
metrics.namespace: "CloudWatch namespace used for module metrics."
metrics.metric.github\_app\_rate\_limit.enabled: "Whether GitHub App rate-limit metrics are emitted."
metrics.metric.job\_retry.enabled: "Whether job-retry metrics are emitted."
metrics.metric.spot\_termination\_warning.enabled: "Whether spot-termination warning metrics are emitted."
} | 
object({
    logs = optional(object({
      level             = optional(string, "info")
      retention_in_days = optional(number, 180)
      kms_key_id        = optional(string, null)
      class             = optional(string, "STANDARD")
      tags              = optional(map(string), {})
    }), {})
    tracing = optional(object({
      mode                  = optional(string, null)
      capture_http_requests = optional(bool, false)
      capture_error         = optional(bool, false)
    }), {})
    metrics = optional(object({
      enabled   = optional(bool, false)
      namespace = optional(string, "GitHub Runners")
      metric = optional(object({
        github_app_rate_limit = optional(object({
          enabled = optional(bool, true)
        }), {})
        job_retry = optional(object({
          enabled = optional(bool, true)
        }), {})
        spot_termination_warning = optional(object({
          enabled = optional(bool, true)
        }), {})
      }), {})
    }), {})
  })
| `{}` | no | +| [global\_config\_orchestration\_provider](#input\_global\_config\_orchestration\_provider) | Global orchestration-provider configuration shared by all runner lanes.

global\_config\_orchestration\_provider = {
webhook: {
queue\_selection\_strategy: "Strategy used to select the build queue for a webhook event."
eventbridge.enabled: "Whether EventBridge integration is enabled for webhook events."
eventbridge.accept\_events: "Event types accepted by the EventBridge integration."
matcher\_config\_parameter\_store\_tier: "SSM Parameter Store tier used for matcher configuration."
runner.boot\_time\_in\_minutes: "Expected runner boot time used by orchestration."
runner.ephemeral: "Whether runners created by the orchestration provider are ephemeral."
runner.jit\_config\_enabled: "Whether JIT runner configuration is enabled."
runner.maximum\_count: "Maximum number of runners that orchestration may create."
github.repository\_white\_list: "Repositories allowed to use the webhook configuration."
lambda.artifact.zip: "Local ZIP artifact used for orchestration Lambda functions."
lambda.artifact.s3.key: "S3 object key for the orchestration Lambda artifact."
lambda.artifact.s3.object\_version: "Optional S3 object version for the orchestration Lambda artifact."
lambda.scale.up.memory\_size: "Memory allocated to the scale-up Lambda."
lambda.scale.up.timeout: "Timeout in seconds for the scale-up Lambda."
lambda.scale.up.reserved\_concurrent\_executions: "Reserved concurrent executions for the scale-up Lambda."
lambda.scale.up.job\_queued\_check\_enabled: "Whether the scale-up Lambda checks queued jobs."
lambda.scale.up.event\_source\_mapping.batch\_size: "Maximum records passed to one scale-up Lambda invocation."
lambda.scale.up.event\_source\_mapping.maximum\_batching\_window\_in\_seconds: "Maximum time to batch records before invoking the scale-up Lambda."
lambda.scale.up.tags: "Tags applied to the scale-up Lambda."
lambda.scale.down.memory\_size: "Memory allocated to the scale-down Lambda."
lambda.scale.down.timeout: "Timeout in seconds for the scale-down Lambda."
lambda.scale.down.schedule\_expression: "Schedule expression for scale-down processing."
lambda.scale.down.minimum\_running\_time\_in\_minutes: "Minimum runner lifetime before scale-down."
lambda.scale.down.idle\_config: "Scheduled minimum idle-runner pool settings."
lambda.scale.down.idle\_config.cron: "Cron expression defining when the idle-runner count applies."
lambda.scale.down.idle\_config.timeZone: "Time zone used to evaluate the idle-runner schedule."
lambda.scale.down.idle\_config.idleCount: "Minimum number of idle runners maintained during the schedule."
lambda.scale.down.idle\_config.evictionStrategy: "Strategy used when evicting idle runners."
lambda.scale.down.tags: "Tags applied to the scale-down Lambda."
lambda.webhook.artifact.zip: "Local ZIP artifact used for the webhook Lambda."
lambda.webhook.artifact.s3.key: "S3 object key for the webhook Lambda artifact."
lambda.webhook.artifact.s3.object\_version: "Optional S3 object version for the webhook Lambda artifact."
lambda.webhook.api\_gateway\_access\_log\_settings: "API Gateway access-log destination and format."
lambda.webhook.api\_gateway\_access\_log\_settings.destination\_arn: "ARN of the API Gateway access-log destination."
lambda.webhook.api\_gateway\_access\_log\_settings.format: "API Gateway access-log format."
lambda.webhook.memory\_size: "Memory allocated to the webhook Lambda."
lambda.webhook.timeout: "Timeout in seconds for the webhook Lambda."
lambda.webhook.tags: "Tags applied to the webhook Lambda."
lambda.pool.memory\_size: "Memory allocated to the pool Lambda."
lambda.pool.timeout: "Timeout in seconds for the pool Lambda."
lambda.pool.reserved\_concurrent\_executions: "Reserved concurrent executions for the pool Lambda."
lambda.pool.config: "Scheduled runner-pool size configuration."
lambda.pool.config.schedule\_expression: "Schedule expression for the pool size."
lambda.pool.config.schedule\_expression\_timezone: "Time zone used to evaluate the pool schedule."
lambda.pool.config.size: "Runner pool size applied by the schedule."
lambda.pool.include\_busy\_runners: "Whether busy runners are included in pool sizing."
lambda.pool.runner\_owner: "GitHub organization that owns the runner pool."
lambda.pool.tags: "Tags applied to the pool Lambda."
queue.delay\_webhook\_event: "Seconds a webhook event remains invisible in the build queue before processing."
queue.job\_queue\_retention\_in\_seconds: "Seconds a queued job is retained before it is purged."
queue.visibility\_timeout\_seconds: "Build queue visibility timeout in seconds."
queue.redrive\_build\_queue.enabled: "Whether the build queue dead-letter queue is enabled."
queue.redrive\_build\_queue.maxReceiveCount: "Maximum receives before a message is moved to the dead-letter queue."
queue.tags: "Tags applied to build queues."
queue.encryption.kms\_data\_key\_reuse\_period\_seconds: "KMS data-key reuse period for queue encryption."
queue.encryption.kms\_master\_key\_id: "KMS key ID used for queue encryption."
queue.encryption.sqs\_managed\_sse\_enabled: "Whether SQS-managed server-side encryption is enabled."
}
} | 
object({
    webhook = optional(object({
      queue_selection_strategy = optional(string, "first")
      eventbridge = optional(object({
        enabled       = optional(bool, true)
        accept_events = optional(list(string), [])
      }), {})
      matcher_config_parameter_store_tier = optional(string, "Standard")
      runner = optional(object({
        boot_time_in_minutes = optional(number, 5)
        ephemeral            = optional(bool, false)
        jit_config_enabled   = optional(bool, null)
        maximum_count        = optional(number, null)
      }), {})

      github = optional(object({
        repository_white_list = optional(list(string), [])
      }), {})

      lambda = optional(object({
        artifact = optional(object({
          zip = optional(string, null)
          s3 = optional(object({
            key            = string
            object_version = optional(string, null)
          }), null)
        }), {})
        scale = optional(object({
          up = optional(object({
            memory_size                    = optional(number, 512)
            timeout                        = optional(number, 30)
            reserved_concurrent_executions = optional(number, 1)
            job_queued_check_enabled       = optional(bool, null)
            event_source_mapping = optional(object({
              batch_size                         = optional(number, 10)
              maximum_batching_window_in_seconds = optional(number, 0)
            }), {})
            tags = optional(map(string), {})
          }), {})
          down = optional(object({
            memory_size                     = optional(number, 512)
            timeout                         = optional(number, 60)
            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")
            minimum_running_time_in_minutes = optional(number, null)
            idle_config = optional(list(object({
              cron             = string
              timeZone         = string
              idleCount        = number
              evictionStrategy = optional(string, "oldest_first")
            })), [])
            tags = optional(map(string), {})
          }), {})
        }), {})
        webhook = optional(object({
          artifact = optional(object({
            zip = optional(string, null)
            s3 = optional(object({
              key            = string
              object_version = optional(string, null)
            }), null)
          }), {})
          api_gateway_access_log_settings = optional(object({
            destination_arn = string
            format          = string
          }), null)
          memory_size = optional(number, 256)
          timeout     = optional(number, 10)
          tags        = optional(map(string), {})
        }), {})
        pool = optional(object({
          memory_size                    = optional(number, 512)
          timeout                        = optional(number, 60)
          reserved_concurrent_executions = optional(number, 1)
          config = optional(list(object({
            schedule_expression          = string
            schedule_expression_timezone = optional(string)
            size                         = number
          })), [])
          include_busy_runners = optional(bool, false)
          runner_owner         = optional(string, null)
          tags                 = optional(map(string), {})
        }), {})
      }), {})

      queue = optional(object({
        delay_webhook_event            = optional(number, 30)
        job_queue_retention_in_seconds = optional(number, 86400)
        visibility_timeout_seconds     = optional(number, 180)
        redrive_build_queue = optional(object({
          enabled         = optional(bool, false)
          maxReceiveCount = optional(number, null)
          }), {
          enabled         = false
          maxReceiveCount = null
        })
        tags = optional(map(string), {})
        encryption = optional(object({
          kms_data_key_reuse_period_seconds = number
          kms_master_key_id                 = string
          sqs_managed_sse_enabled           = bool
          }), {
          kms_data_key_reuse_period_seconds = null
          kms_master_key_id                 = null
          sqs_managed_sse_enabled           = true
        })
      }), {})
    }), {})
  })
| `{}` | no | +| [global\_config\_ssm](#input\_global\_config\_ssm) | Global SSM configuration shared by all runner lanes.

global\_config\_ssm = {
paths.root: "Root path for SSM parameters."
paths.app: "Path segment for application parameters."
paths.webhook: "Path segment for webhook parameters."
paths.tokens: "Path segment for runner token parameters."
paths.config: "Path segment for runner configuration parameters."
kms\_key\_id: "KMS key ID used to encrypt SSM parameters."
tags: "Tags applied to SSM resources."
parameters.tags: "Tags applied to runner configuration parameters."
housekeeper.schedule\_expression: "Schedule for the SSM parameter housekeeper."
housekeeper.state: "EventBridge rule state for the SSM parameter housekeeper."
housekeeper.tags: "Tags applied to the SSM housekeeper resources."
housekeeper.lambda.artifact.zip: "Local ZIP artifact used for the SSM housekeeper Lambda."
housekeeper.lambda.artifact.s3.key: "S3 object key for the SSM housekeeper Lambda artifact."
housekeeper.lambda.artifact.s3.object\_version: "Optional S3 object version for the SSM housekeeper artifact."
housekeeper.lambda.memory\_size: "Memory allocated to the SSM housekeeper Lambda."
housekeeper.lambda.timeout: "Timeout in seconds for the SSM housekeeper Lambda."
housekeeper.config.tokenPath: "Parameter path containing runner tokens to clean up."
housekeeper.config.minimumDaysOld: "Minimum age in days before an old token is eligible for cleanup."
housekeeper.config.dryRun: "Whether the SSM housekeeper reports cleanup without deleting parameters."
} | 
object({
    paths = optional(object({
      root    = optional(string, null)
      app     = optional(string, "app")
      webhook = optional(string, "webhook")
      tokens  = optional(string, "runners/tokens")
      config  = optional(string, "runners/config")
    }), {})
    kms_key_id = optional(string, null)
    tags       = optional(map(string), {})
    parameters = optional(object({
      tags = optional(map(string), {})
    }), {})
    housekeeper = optional(object({
      schedule_expression = optional(string, "rate(1 day)")
      state               = optional(string, "ENABLED")
      tags                = optional(map(string), {})
      lambda = optional(object({
        artifact = optional(object({
          zip = optional(string, null)
          s3 = optional(object({
            key            = string
            object_version = optional(string, null)
          }), null)
        }), {})
        memory_size = optional(number, 512)
        timeout     = optional(number, 60)
      }), {})
      config = optional(object({
        tokenPath      = optional(string, null)
        minimumDaysOld = optional(number, 1)
        dryRun         = optional(bool, false)
      }), {})
    }), {})
  })
| `{}` | no | | [iam\_overrides](#input\_iam\_overrides) | This map provides the possibility to override some IAM defaults. The following attributes are supported: `instance_profile_name` overrides the instance profile name used in the launch template. `runner_role_arn` overrides the IAM role ARN used for the runner instances. | 
object({
    override_instance_profile = optional(bool, null)
    instance_profile_name     = optional(string, null)
    override_runner_role      = optional(bool, null)
    runner_role_arn           = optional(string, null)
  })
| 
{
  "instance_profile_name": null,
  "override_instance_profile": false,
  "override_runner_role": false,
  "runner_role_arn": null
}
| no | | [instance\_profile\_path](#input\_instance\_profile\_path) | The path that will be added to the instance\_profile, if not set the environment name will be used. | `string` | `null` | no | | [instance\_termination\_watcher](#input\_instance\_termination\_watcher) | Configuration for the spot termination watcher lambda function. This feature is Beta, changes will not trigger a major release as long in beta.

`enable`: Enable or disable the spot termination watcher.
`enable_runner_deregistration`: Enable or disable deregistering the runner from GitHub when its EC2 instance is terminated.
`environment_variables`: Additional environment variables to merge into the Lambda configuration.
`memory_size`: Memory size limit in MB of the lambda.
`s3_key`: S3 key for syncer lambda function. Required if using S3 bucket to specify lambdas.
`s3_object_version`: S3 object version for syncer lambda function. Useful if S3 versioning is enabled on source bucket.
`timeout`: Time out of the lambda in seconds.
`zip`: File location of the lambda zip file. | 
object({
    enable = optional(bool, false)
    features = optional(object({
      enable_spot_termination_handler              = optional(bool, true)
      enable_spot_termination_notification_watcher = optional(bool, true)
    }), {})
    enable_runner_deregistration = optional(bool, true)
    environment_variables        = optional(map(string), {})
    memory_size                  = optional(number, null)
    s3_key                       = optional(string, null)
    s3_object_version            = optional(string, null)
    timeout                      = optional(number, null)
    zip                          = optional(string, null)
  })
| `{}` | no | @@ -174,7 +220,7 @@ module "multi-runner" { | [logging\_retention\_in\_days](#input\_logging\_retention\_in\_days) | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `180` | no | | [matcher\_config\_parameter\_store\_tier](#input\_matcher\_config\_parameter\_store\_tier) | The tier of the parameter store for the matcher configuration. Valid values are `Standard`, and `Advanced`. | `string` | `"Standard"` | no | | [metrics](#input\_metrics) | Configuration for metrics created by the module, by default metrics are disabled to avoid additional costs. When metrics are enable all metrics are created unless explicit configured otherwise. | 
object({
    enable    = optional(bool, false)
    namespace = optional(string, "GitHub Runners")
    metric = optional(object({
      enable_github_app_rate_limit    = optional(bool, true)
      enable_job_retry                = optional(bool, true)
      enable_spot_termination_warning = optional(bool, true)
    }), {})
  })
| `{}` | no | -| [multi\_runner\_config](#input\_multi\_runner\_config) | multi\_runner\_config = {
runner\_config: {
runner\_os: "The EC2 Operating System type to use for action runner instances (linux, osx, windows)."
runner\_architecture: "The platform architecture of the runner instance\_type."
runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."
ami: "(Optional) AMI configuration for the action runner instances. This object allows you to specify all AMI-related settings in one place."
create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.
credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.
delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."
disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"
ebs\_optimized: "The EC2 EBS optimized configuration."
enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."
enable\_job\_queued\_check: Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT configuration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."
enable\_on\_demand\_failover\_for\_errors: "Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later."
scale\_errors: "List of AWS error codes that should trigger retry during scale up. This list replaces the module default scale-up retry errors"
enable\_organization\_runners: "Register runners to organization, instead of repo level"
enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."
enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."
enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."
instance\_allocation\_strategy: "The allocation strategy for creating instances. For spot, AWS recommends `price-capacity-optimized`; for on-demand, use `lowest-price` or `prioritized`. The AWS default is `lowest-price`."
instance\_type\_priorities: "A map of instance type to priority for the `prioritized` and `capacity-optimized-prioritized` allocation strategies. Lower numbers mean higher priority. If not provided, priorities are assigned based on the order of `instance_types`."
instance\_max\_spot\_price: "Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet."
instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."
instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux, macOS Sequoia for osx, Windows Server Core for win)."
job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"
minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."
pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."
runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."
runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."
runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."
runner\_disable\_default\_labels: "Disable default labels for the runners (os, architecture and `self-hosted`). If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM."
runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `multi_runner_config.matcherConfig.exactMatch`. GitHub read-only labels should not be provided."
runner\_group\_name: "Name of the runner group."
runner\_name\_prefix: "Prefix for the GitHub runner name."
runner\_run\_as: "Run the GitHub actions agent as user."
runners\_maximum\_count: "The maximum number of runners that will be created. Setting the variable to `-1` disables the maximum check."
scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."
scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."
lambda\_event\_source\_mapping\_batch\_size: "(Optional) Maximum number of records per Lambda invocation for this runner flavor. Overrides the module-level `lambda_event_source_mapping_batch_size` when set."
lambda\_event\_source\_mapping\_maximum\_batching\_window\_in\_seconds: "(Optional) Maximum seconds to gather records before invoking Lambda for this runner flavor. Overrides the module-level `lambda_event_source_mapping_maximum_batching_window_in_seconds` when set."
userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."
enable\_jit\_config: "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is available. In case you are upgrading from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."
enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."
enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."
cloudwatch\_config: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"
userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"
runner\_hook\_job\_started: "Script to be ran in the runner environment at the beginning of every job"
runner\_hook\_job\_completed: "Script to be ran in the runner environment at the end of every job"
runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."
runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"
vpc\_id: "The VPC for security groups of the action runners. If not set uses the value of `var.vpc_id`."
subnet\_ids: "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. If not set, uses the value of `var.subnet_ids`."
idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."
license\_specifications: "Optional EC2 License Manager license configuration ARNs for the runner launch template. Required for macOS dedicated-host runners when the host resource group uses a Mac dedicated host license configuration."
use\_dedicated\_host: "Experimental! Can be removed / changed without trigger a major release. Whether to use EC2 dedicated hosts for the runners. Needed for macos runners Note that using dedicated hosts can increase cost significantly."
runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`, `volume_initialization_rate`."
job\_retry: "Experimental! Can be removed / changed without trigger a major release. Configure job retries. The configuration enables job retries (for ephemeral runners). After creating the instances a message will be published to a job retry queue. The job retry check lambda is checking after a delay if the job is queued. If not the message will be published again on the scale-up (build queue). Using this feature can impact the rate limit of the GitHub app."
pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1. Use `schedule_expression_timezone` to override the schedule time zone (defaults to UTC)."
iam\_overrides: "Allows to (optionally) override the instance profile and runner role created by the module. Set `override_instance_profile` to true and provide the `instance_profile_name` to use an existing instance profile. Set `override_runner_role` to true and provide the `runner_role_arn` to use an existing role for the runner instances."
}
matcherConfig: {
labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"
exactMatch: "DEPRECATED: Use `bidirectionalLabelMatch` instead. If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook. Note: this only checks that workflow labels are a subset of runner labels, not the reverse."
bidirectionalLabelMatch: "If set to true, the runner labels and workflow job labels must be an exact two-way match (same set, any order, no extras or missing labels). This is stricter than `exactMatch` which only checks that workflow labels are a subset of runner labels. When false, if __any__ workflow label matches it will trigger the webhook."
priority: "If set it defines the priority of the matcher, the matcher with the lowest priority will be evaluated first. Default is 999, allowed values 0-999."
enableDynamicLabels: "Experimental! When true the dispatcher allows `ghr-*` dynamic labels for jobs routed to this runner. Default false."
awsDynamicLabelsPolicy: "Optional AWS dynamic label policy evaluated by the dispatcher. Only effective when `enableDynamicLabels = true`. Jobs whose provider dynamic labels violate every matching runner's policy are rejected with a 202 (a warning is logged). Evaluation: keys in `blocked_keys` are always rejected; keys in `restricted_keys` are allowed only when their value passes the rule; unlisted keys are allowed. Schema: `{ blocked_keys = [], restricted_keys = { = { allowed = [globs], denied = [globs], max = number|string } } }`. Keys use the dynamic label suffix, e.g. `instance-type` for `ghr-ec2-instance-type`."
}
redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."
} | 
map(object({
    runner_config = object({
      runner_os           = string
      runner_architecture = string
      runner_metadata_options = optional(map(any), {
        instance_metadata_tags      = "enabled"
        http_endpoint               = "enabled"
        http_tokens                 = "required"
        http_put_response_hop_limit = 1
      })
      ami = optional(object({
        filter               = optional(map(list(string)), { state = ["available"] })
        owners               = optional(list(string), ["amazon"])
        id_ssm_parameter_arn = optional(string, null)
        kms_key_arn          = optional(string, null)
      }), null)
      create_service_linked_role_spot      = optional(bool, false)
      credit_specification                 = optional(string, null)
      delay_webhook_event                  = optional(number, 30)
      disable_runner_autoupdate            = optional(bool, false)
      ebs_optimized                        = optional(bool, false)
      enable_ephemeral_runners             = optional(bool, false)
      enable_job_queued_check              = optional(bool, null)
      enable_on_demand_failover_for_errors = optional(list(string), [])
      scale_errors = optional(list(string), [
        "UnfulfillableCapacity",
        "MaxSpotInstanceCountExceeded",
        "TargetCapacityLimitExceededException",
        "RequestLimitExceeded",
        "ResourceLimitExceeded",
        "MaxSpotInstanceCountExceeded",
        "MaxSpotFleetRequestCountExceeded",
        "InsufficientInstanceCapacity",
        "InsufficientCapacityOnHost",
      ])
      enable_organization_runners                                    = optional(bool, false)
      enable_runner_binaries_syncer                                  = optional(bool, true)
      enable_ssm_on_runners                                          = optional(bool, false)
      enable_userdata                                                = optional(bool, true)
      instance_allocation_strategy                                   = optional(string, "lowest-price")
      instance_type_priorities                                       = optional(map(number), null)
      instance_max_spot_price                                        = optional(string, null)
      instance_target_capacity_type                                  = optional(string, "spot")
      instance_types                                                 = list(string)
      job_queue_retention_in_seconds                                 = optional(number, 86400)
      minimum_running_time_in_minutes                                = optional(number, null)
      pool_runner_owner                                              = optional(string, null)
      runner_as_root                                                 = optional(bool, false)
      runner_boot_time_in_minutes                                    = optional(number, 5)
      runner_disable_default_labels                                  = optional(bool, false)
      runner_extra_labels                                            = optional(list(string), [])
      runner_group_name                                              = optional(string, "Default")
      runner_name_prefix                                             = optional(string, "")
      runner_run_as                                                  = optional(string, "ec2-user")
      runners_maximum_count                                          = number
      runner_additional_security_group_ids                           = optional(list(string), [])
      scale_down_schedule_expression                                 = optional(string, "cron(*/5 * * * ? *)")
      scale_up_reserved_concurrent_executions                        = optional(number, 1)
      lambda_event_source_mapping_batch_size                         = optional(number, null)
      lambda_event_source_mapping_maximum_batching_window_in_seconds = optional(number, null)
      userdata_template                                              = optional(string, null)
      userdata_content                                               = optional(string, null)
      enable_jit_config                                              = optional(bool, null)
      enable_runner_detailed_monitoring                              = optional(bool, false)
      enable_cloudwatch_agent                                        = optional(bool, true)
      cloudwatch_config                                              = optional(string, null)
      userdata_pre_install                                           = optional(string, "")
      userdata_post_install                                          = optional(string, "")
      runner_hook_job_started                                        = optional(string, "")
      runner_hook_job_completed                                      = optional(string, "")
      runner_ec2_tags                                                = optional(map(string), {})
      runner_iam_role_managed_policy_arns                            = optional(list(string), [])
      vpc_id                                                         = optional(string, null)
      subnet_ids                                                     = optional(list(string), null)
      idle_config = optional(list(object({
        cron             = string
        timeZone         = string
        idleCount        = number
        evictionStrategy = optional(string, "oldest_first")
      })), [])
      cpu_options = optional(object({
        core_count            = optional(number)
        threads_per_core      = optional(number)
        amd_sev_snp           = optional(string)
        nested_virtualization = optional(string)
      }), null)
      placement = optional(object({
        affinity                = optional(string)
        availability_zone       = optional(string)
        group_id                = optional(string)
        group_name              = optional(string)
        host_id                 = optional(string)
        host_resource_group_arn = optional(string)
        spread_domain           = optional(string)
        tenancy                 = optional(string)
        partition_number        = optional(number)
      }), null)
      license_specifications = optional(list(object({
        license_configuration_arn = string
      })), [])
      use_dedicated_host = optional(bool, false)
      runner_log_files = optional(list(object({
        log_group_name   = string
        prefix_log_group = bool
        file_path        = string
        log_stream_name  = string
        log_class        = optional(string, "STANDARD")
      })), null)
      block_device_mappings = optional(list(object({
        delete_on_termination      = optional(bool, true)
        device_name                = optional(string, "/dev/xvda")
        encrypted                  = optional(bool, true)
        iops                       = optional(number)
        kms_key_id                 = optional(string)
        snapshot_id                = optional(string)
        throughput                 = optional(number)
        volume_initialization_rate = optional(number)
        volume_size                = number
        volume_type                = optional(string, "gp3")
        })), [{
        volume_size = 30
      }])
      pool_config = optional(list(object({
        schedule_expression          = string
        schedule_expression_timezone = optional(string)
        size                         = number
      })), [])
      job_retry = optional(object({
        enable             = optional(bool, false)
        delay_in_seconds   = optional(number, 300)
        delay_backoff      = optional(number, 2)
        lambda_memory_size = optional(number, 256)
        lambda_timeout     = optional(number, 30)
        max_attempts       = optional(number, 1)
      }), {})
      iam_overrides = optional(object({
        override_instance_profile = optional(bool, null)
        instance_profile_name     = optional(string, null)
        override_runner_role      = optional(bool, null)
        runner_role_arn           = optional(string, null)
        }), {
        override_instance_profile = false
        instance_profile_name     = null
        override_runner_role      = false
        runner_role_arn           = null
      })
    })
    matcherConfig = object({
      labelMatchers           = list(list(string))
      exactMatch              = optional(bool, false)
      bidirectionalLabelMatch = optional(bool, false)
      priority                = optional(number, 999)
      enableDynamicLabels     = optional(bool, false)
      awsDynamicLabelsPolicy  = optional(any, null)
    })
    redrive_build_queue = optional(object({
      enabled         = bool
      maxReceiveCount = number
      }), {
      enabled         = false
      maxReceiveCount = null
    })
  }))
| n/a | yes | +| [multi\_runner\_config](#input\_multi\_runner\_config) | Accepts either the stable v1 runner configuration shape or the provider-boundary v2 shape. Entries with `runner_config` use the v1 shape; entries without `runner_config` use the v2 shape. A v2 entry does not need matcher configuration. A v2 entry must be acknowledged with `experimental_features = ["multi-runner-v2"]`; the v2 shape is experimental and may change before graduation.

multi\_runner\_config = {
runner\_config: {
runner\_os: "The EC2 Operating System type to use for action runner instances (linux, osx, windows)."
runner\_architecture: "The platform architecture of the runner instance\_type."
runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."
ami: "(Optional) AMI configuration for the action runner instances. This object allows you to specify all AMI-related settings in one place."
create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.
credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.
delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."
disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"
ebs\_optimized: "The EC2 EBS optimized configuration."
enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."
enable\_job\_queued\_check: Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT configuration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."
enable\_on\_demand\_failover\_for\_errors: "Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later."
scale\_errors: "List of AWS error codes that should trigger retry during scale up. This list replaces the module default scale-up retry errors"
enable\_organization\_runners: "Register runners to organization, instead of repo level"
enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."
enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."
enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."
instance\_allocation\_strategy: "The allocation strategy for creating instances. For spot, AWS recommends `price-capacity-optimized`; for on-demand, use `lowest-price` or `prioritized`. The AWS default is `lowest-price`."
instance\_type\_priorities: "A map of instance type to priority for the `prioritized` and `capacity-optimized-prioritized` allocation strategies. Lower numbers mean higher priority. If not provided, priorities are assigned based on the order of `instance_types`."
instance\_max\_spot\_price: "Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet."
instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."
instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux, macOS Sequoia for osx, Windows Server Core for win)."
job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"
minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."
pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."
runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."
runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."
runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."
runner\_disable\_default\_labels: "Disable default labels for the runners (os, architecture and `self-hosted`). If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM."
runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `multi_runner_config.matcherConfig.exactMatch`. GitHub read-only labels should not be provided."
runner\_group\_name: "Name of the runner group."
runner\_name\_prefix: "Prefix for the GitHub runner name."
runner\_run\_as: "Run the GitHub actions agent as user."
runners\_maximum\_count: "The maximum number of runners that will be created. Setting the variable to `-1` disables the maximum check."
scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."
scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."
lambda\_event\_source\_mapping\_batch\_size: "(Optional) Maximum number of records per Lambda invocation for this runner flavor. Overrides the module-level `lambda_event_source_mapping_batch_size` when set."
lambda\_event\_source\_mapping\_maximum\_batching\_window\_in\_seconds: "(Optional) Maximum seconds to gather records before invoking Lambda for this runner flavor. Overrides the module-level `lambda_event_source_mapping_maximum_batching_window_in_seconds` when set."
userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."
enable\_jit\_config: "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is available. In case you are upgrading from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."
enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."
enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."
cloudwatch\_config: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"
userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"
runner\_hook\_job\_started: "Script to be ran in the runner environment at the beginning of every job"
runner\_hook\_job\_completed: "Script to be ran in the runner environment at the end of every job"
runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."
runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"
vpc\_id: "The VPC for security groups of the action runners. If not set uses the value of `var.vpc_id`."
subnet\_ids: "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. If not set, uses the value of `var.subnet_ids`."
idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."
license\_specifications: "Optional EC2 License Manager license configuration ARNs for the runner launch template. Required for macOS dedicated-host runners when the host resource group uses a Mac dedicated host license configuration."
use\_dedicated\_host: "Experimental! Can be removed / changed without trigger a major release. Whether to use EC2 dedicated hosts for the runners. Needed for macos runners Note that using dedicated hosts can increase cost significantly."
runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`, `volume_initialization_rate`."
job\_retry: "Experimental! Can be removed / changed without trigger a major release. Configure job retries. The configuration enables job retries (for ephemeral runners). After creating the instances a message will be published to a job retry queue. The job retry check lambda is checking after a delay if the job is queued. If not the message will be published again on the scale-up (build queue). Using this feature can impact the rate limit of the GitHub app."
pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1. Use `schedule_expression_timezone` to override the schedule time zone (defaults to UTC)."
iam\_overrides: "Allows to (optionally) override the instance profile and runner role created by the module. Set `override_instance_profile` to true and provide the `instance_profile_name` to use an existing instance profile. Set `override_runner_role` to true and provide the `runner_role_arn` to use an existing role for the runner instances."
}
# V2 contract
tags: "Tags applied to resources created for this runner configuration."
runner: "Runner settings such as the operating system, architecture, labels, hooks, runner group, name prefix, and IAM role configuration."
lambda: "Lambda settings such as runtime, architecture, networking, tags, and execution-role options for this runner configuration."
# Webhook, queue, and scale-up/scale-down orchestration settings.
orchestration\_provider: {
webhook: {
matcherConfig: "Label matching and dynamic-label policy used to route workflow jobs to this runner configuration."
runner: "Runner lifecycle settings including boot time, ephemeral mode, JIT configuration, and maximum runner count."
queue: "Build queue delay, retention, visibility timeout, redrive, and tags."
}
}
ssm: "SSM parameter paths, tags, and housekeeper settings for runner configuration storage."
observability: "Logging, tracing, and metric settings for the resources in this runner configuration."
# Compute settings for the runner provider.
compute\_provider: {
aws: {
ec2: "AWS EC2 runner settings, including AMI selection, instance types, capacity strategy, VPC and subnet placement, storage, user data, and runner access."
}
}
matcherConfig: {
labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"
exactMatch: "DEPRECATED: Use `bidirectionalLabelMatch` instead. If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook. Note: this only checks that workflow labels are a subset of runner labels, not the reverse."
bidirectionalLabelMatch: "If set to true, the runner labels and workflow job labels must be an exact two-way match (same set, any order, no extras or missing labels). This is stricter than `exactMatch` which only checks that workflow labels are a subset of runner labels. When false, if __any__ workflow label matches it will trigger the webhook."
priority: "If set it defines the priority of the matcher, the matcher with the lowest priority will be evaluated first. Default is 999, allowed values 0-999."
enableDynamicLabels: "Experimental! When true the dispatcher allows `ghr-*` dynamic labels for jobs routed to this runner. Default false."
awsDynamicLabelsPolicy: "Optional AWS dynamic label policy evaluated by the dispatcher. Only effective when `enableDynamicLabels = true`. Jobs whose provider dynamic labels violate every matching runner's policy are rejected with a 202 (a warning is logged). Evaluation: keys in `blocked_keys` are always rejected; keys in `restricted_keys` are allowed only when their value passes the rule; unlisted keys are allowed. Schema: `{ blocked_keys = [], restricted_keys = { = { allowed = [globs], denied = [globs], max = number|string } } }`. Keys use the dynamic label suffix, e.g. `instance-type` for `ghr-ec2-instance-type`."
}
redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."
} | 
map(object({
    # V1 contract
    runner_config = optional(object({
      runner_os           = string
      runner_architecture = string
      runner_metadata_options = optional(map(any), {
        instance_metadata_tags      = "enabled"
        http_endpoint               = "enabled"
        http_tokens                 = "required"
        http_put_response_hop_limit = 1
      })
      ami = optional(object({
        filter               = optional(map(list(string)), { state = ["available"] })
        owners               = optional(list(string), ["amazon"])
        id_ssm_parameter_arn = optional(string, null)
        kms_key_arn          = optional(string, null)
      }), null)
      create_service_linked_role_spot      = optional(bool, false)
      credit_specification                 = optional(string, null)
      delay_webhook_event                  = optional(number, 30)
      disable_runner_autoupdate            = optional(bool, false)
      ebs_optimized                        = optional(bool, false)
      enable_ephemeral_runners             = optional(bool, false)
      enable_job_queued_check              = optional(bool, null)
      enable_on_demand_failover_for_errors = optional(list(string), [])
      scale_errors = optional(list(string), [
        "UnfulfillableCapacity",
        "MaxSpotInstanceCountExceeded",
        "TargetCapacityLimitExceededException",
        "RequestLimitExceeded",
        "ResourceLimitExceeded",
        "MaxSpotInstanceCountExceeded",
        "MaxSpotFleetRequestCountExceeded",
        "InsufficientInstanceCapacity",
        "InsufficientCapacityOnHost",
      ])
      enable_organization_runners                                    = optional(bool, false)
      enable_runner_binaries_syncer                                  = optional(bool, true)
      enable_ssm_on_runners                                          = optional(bool, false)
      enable_userdata                                                = optional(bool, true)
      instance_allocation_strategy                                   = optional(string, "lowest-price")
      instance_type_priorities                                       = optional(map(number), null)
      instance_max_spot_price                                        = optional(string, null)
      instance_target_capacity_type                                  = optional(string, "spot")
      instance_types                                                 = list(string)
      job_queue_retention_in_seconds                                 = optional(number, 86400)
      minimum_running_time_in_minutes                                = optional(number, null)
      pool_runner_owner                                              = optional(string, null)
      runner_as_root                                                 = optional(bool, false)
      runner_boot_time_in_minutes                                    = optional(number, 5)
      runner_disable_default_labels                                  = optional(bool, false)
      runner_extra_labels                                            = optional(list(string), [])
      runner_group_name                                              = optional(string, "Default")
      runner_name_prefix                                             = optional(string, "")
      runner_run_as                                                  = optional(string, "ec2-user")
      runners_maximum_count                                          = number
      runner_additional_security_group_ids                           = optional(list(string), [])
      scale_down_schedule_expression                                 = optional(string, "cron(*/5 * * * ? *)")
      scale_up_reserved_concurrent_executions                        = optional(number, 1)
      lambda_event_source_mapping_batch_size                         = optional(number, null)
      lambda_event_source_mapping_maximum_batching_window_in_seconds = optional(number, null)
      userdata_template                                              = optional(string, null)
      userdata_content                                               = optional(string, null)
      enable_jit_config                                              = optional(bool, null)
      enable_runner_detailed_monitoring                              = optional(bool, false)
      enable_cloudwatch_agent                                        = optional(bool, true)
      cloudwatch_config                                              = optional(string, null)
      userdata_pre_install                                           = optional(string, "")
      userdata_post_install                                          = optional(string, "")
      runner_hook_job_started                                        = optional(string, "")
      runner_hook_job_completed                                      = optional(string, "")
      runner_ec2_tags                                                = optional(map(string), {})
      runner_iam_role_managed_policy_arns                            = optional(list(string), [])
      vpc_id                                                         = optional(string, null)
      subnet_ids                                                     = optional(list(string), null)
      idle_config = optional(list(object({
        cron             = string
        timeZone         = string
        idleCount        = number
        evictionStrategy = optional(string, "oldest_first")
      })), [])
      cpu_options = optional(object({
        core_count            = optional(number)
        threads_per_core      = optional(number)
        amd_sev_snp           = optional(string)
        nested_virtualization = optional(string)
      }), null)
      placement = optional(object({
        affinity                = optional(string)
        availability_zone       = optional(string)
        group_id                = optional(string)
        group_name              = optional(string)
        host_id                 = optional(string)
        host_resource_group_arn = optional(string)
        spread_domain           = optional(string)
        tenancy                 = optional(string)
        partition_number        = optional(number)
      }), null)
      license_specifications = optional(list(object({
        license_configuration_arn = string
      })), [])
      use_dedicated_host = optional(bool, false)
      runner_log_files = optional(list(object({
        log_group_name   = string
        prefix_log_group = bool
        file_path        = string
        log_stream_name  = string
        log_class        = optional(string, "STANDARD")
      })), null)
      block_device_mappings = optional(list(object({
        delete_on_termination      = optional(bool, true)
        device_name                = optional(string, "/dev/xvda")
        encrypted                  = optional(bool, true)
        iops                       = optional(number)
        kms_key_id                 = optional(string)
        snapshot_id                = optional(string)
        throughput                 = optional(number)
        volume_initialization_rate = optional(number)
        volume_size                = number
        volume_type                = optional(string, "gp3")
        })), [{
        volume_size = 30
      }])
      pool_config = optional(list(object({
        schedule_expression          = string
        schedule_expression_timezone = optional(string)
        size                         = number
      })), [])
      job_retry = optional(object({
        enable             = optional(bool, false)
        delay_in_seconds   = optional(number, 300)
        delay_backoff      = optional(number, 2)
        lambda_memory_size = optional(number, 256)
        lambda_timeout     = optional(number, 30)
        max_attempts       = optional(number, 1)
      }), {})
      iam_overrides = optional(object({
        override_instance_profile = optional(bool, null)
        instance_profile_name     = optional(string, null)
        override_runner_role      = optional(bool, null)
        runner_role_arn           = optional(string, null)
        }), {
        override_instance_profile = false
        instance_profile_name     = null
        override_runner_role      = false
        runner_role_arn           = null
      })
    }), null)
    matcherConfig = optional(object({
      labelMatchers           = list(list(string))
      exactMatch              = optional(bool, false)
      bidirectionalLabelMatch = optional(bool, false)
      priority                = optional(number, 999)
      enableDynamicLabels     = optional(bool, false)
      awsDynamicLabelsPolicy  = optional(any, null)
    }), null)
    redrive_build_queue = optional(object({
      enabled         = bool
      maxReceiveCount = number
      }), {
      enabled         = false
      maxReceiveCount = null
    })

    # V2 Contract
    tags = optional(map(string), {})

    runner = optional(object({
      os                     = optional(string, null)
      architecture           = optional(string, null)
      disable_default_labels = optional(bool, null)
      extra_labels           = optional(list(string), null)
      group_name             = optional(string, null)
      name_prefix            = optional(string, null)
      run_as_root            = optional(bool, null)
      run_as                 = optional(string, null)
      auto_update_disabled   = optional(bool, null)
      tags                   = optional(map(string), {})
      hooks = optional(object({
        job_started   = optional(string, null)
        job_completed = optional(string, null)
      }), {})
      iam = optional(object({
        role = optional(object({
          arn = string
        }), null)
        managed_policy_arns          = optional(map(string), null)
        additional_trust_policy_json = optional(string, null)
        path                         = optional(string, null)
        permissions_boundary         = optional(string, null)
      }), {})
    }), {})

    lambda = optional(object({
      runtime            = optional(string, null)
      architecture       = optional(string, null)
      subnet_ids         = optional(list(string), null)
      security_group_ids = optional(list(string), null)
      tags               = optional(map(string), {})
      role = optional(object({
        path                 = optional(string, null)
        permissions_boundary = optional(string, null)
      }), {})
    }), {})

    orchestration_provider = optional(object({
      webhook = optional(object({
        runner = optional(object({
          boot_time_in_minutes = optional(number, null)
          ephemeral            = optional(bool, null)
          jit_config_enabled   = optional(bool, null)
          maximum_count        = optional(number, null)
        }), {})
        github = optional(object({
          organization_runners = optional(bool, false)
        }), {})
        matcherConfig = optional(object({
          labelMatchers           = list(list(string))
          exactMatch              = optional(bool, false)
          bidirectionalLabelMatch = optional(bool, false)
          priority                = optional(number, 999)
          dynamic_labels_enabled  = optional(bool, false)
          awsDynamicLabelsPolicy = optional(object({
            blocked_keys = optional(list(string), [])
            restricted_keys = optional(map(object({
              allowed = optional(list(string), [])
              denied  = optional(list(string), [])
              max     = optional(string, null)
            })), {})
          }), null)
        }), null)
        queue = optional(object({
          delay_webhook_event            = optional(number, null)
          job_queue_retention_in_seconds = optional(number, null)
          visibility_timeout_seconds     = optional(number, null)
          redrive_build_queue = optional(object({
            enabled         = optional(bool, null)
            maxReceiveCount = optional(number, null)
          }), null)
          tags = optional(map(string), {})
        }), {})
        lambda = optional(object({
          scale = optional(object({
            up = optional(object({
              memory_size                    = optional(number, null)
              timeout                        = optional(number, null)
              reserved_concurrent_executions = optional(number, null)
              job_queued_check_enabled       = optional(bool, null)
              event_source_mapping = optional(object({
                batch_size                         = optional(number, null)
                maximum_batching_window_in_seconds = optional(number, null)
              }), {})
              tags = optional(map(string), {})
            }), {})
            down = optional(object({
              memory_size                     = optional(number, null)
              timeout                         = optional(number, null)
              schedule_expression             = optional(string, null)
              minimum_running_time_in_minutes = optional(number, null)
              idle_config = optional(list(object({
                cron             = string
                timeZone         = string
                idleCount        = number
                evictionStrategy = optional(string, "oldest_first")
              })), null)
              tags = optional(map(string), {})
            }), {})
          }), {})
          pool = optional(object({
            memory_size                    = optional(number, null)
            timeout                        = optional(number, null)
            reserved_concurrent_executions = optional(number, null)
            config = optional(list(object({
              schedule_expression          = string
              schedule_expression_timezone = optional(string)
              size                         = number
            })), null)
            include_busy_runners = optional(bool, null)
            runner_owner         = optional(string, null)
            tags                 = optional(map(string), {})
          }), {})
        }), {})
        job_retry = optional(object({
          enabled          = optional(bool, false)
          delay_in_seconds = optional(number, 300)
          delay_backoff    = optional(number, 2)
          max_attempts     = optional(number, 1)
          tags             = optional(map(string), {})
          lambda = optional(object({
            memory_size                    = optional(number, 256)
            reserved_concurrent_executions = optional(number, 1)
            timeout                        = optional(number, 30)
          }), {})
        }), {})
      }), null)
    }), {})

    ssm = optional(object({
      paths = optional(object({
        root   = optional(string, null)
        tokens = optional(string, null)
        config = optional(string, null)
      }), {})
      tags = optional(map(string), {})
      parameters = optional(object({
        tags = optional(map(string), {})
      }), {})
      housekeeper = optional(object({
        schedule_expression = optional(string, null)
        state               = optional(string, null)
        tags                = optional(map(string), {})
        lambda = optional(object({
          artifact = optional(object({
            zip = optional(string, null)
            s3 = optional(object({
              key            = string
              object_version = optional(string, null)
            }), null)
          }), {})
          memory_size = optional(number, null)
          timeout     = optional(number, null)
        }), {})
        config = optional(object({
          tokenPath      = optional(string, null)
          minimumDaysOld = optional(number, null)
          dryRun         = optional(bool, null)
        }), {})
      }), {})
    }), {})

    observability = optional(object({
      logs = optional(object({
        level             = optional(string, null)
        retention_in_days = optional(number, null)
        kms_key_id        = optional(string, null)
        class             = optional(string, null)
        tags              = optional(map(string), {})
      }), {})
      tracing = optional(object({
        mode                  = optional(string, null)
        capture_http_requests = optional(bool, null)
        capture_error         = optional(bool, null)
      }), {})
      metrics = optional(object({
        enabled   = optional(bool, null)
        namespace = optional(string, null)
        metric = optional(object({
          github_app_rate_limit = optional(object({
            enabled = optional(bool, null)
          }), {})
          job_retry = optional(object({
            enabled = optional(bool, null)
          }), {})
          spot_termination_warning = optional(object({
            enabled = optional(bool, null)
          }), {})
        }), {})
      }), {})
    }), {})

    compute_provider = optional(object({
      aws = optional(object({
        ec2 = optional(object({
          metadata_options = optional(object({
            instance_metadata_tags      = optional(string, "enabled")
            http_endpoint               = optional(string, "enabled")
            http_tokens                 = optional(string, "required")
            http_put_response_hop_limit = optional(number, 1)
          }), {})
          ami = optional(object({
            filter = optional(map(list(string)), { state = ["available"] })
            owners = optional(list(string), ["amazon"])
            id_ssm_parameter = optional(object({
              arn = string
            }), null)
            kms_key = optional(object({
              arn = string
            }), null)
          }), null)
          block_device_mappings = optional(list(object({
            delete_on_termination      = optional(bool, true)
            device_name                = optional(string, "/dev/xvda")
            encrypted                  = optional(bool, true)
            iops                       = optional(number)
            kms_key_id                 = optional(string)
            snapshot_id                = optional(string)
            throughput                 = optional(number)
            volume_initialization_rate = optional(number)
            volume_size                = number
            volume_type                = optional(string, "gp3")
          })), [{ volume_size = 30 }])
          create_service_linked_role_spot = optional(bool, false)
          credit_specification            = optional(string, null)
          ebs_optimized                   = optional(bool, false)
          cloudwatch_agent = optional(object({
            enabled = optional(bool, true)
            config  = optional(string, null)
          }), {})
          binaries_syncer = optional(object({
            enabled = optional(bool, null)
          }), {})
          detailed_monitoring_enabled = optional(bool, false)
          ssm_enabled                 = optional(bool, false)
          user_data = optional(object({
            enabled               = optional(bool, true)
            template              = optional(string, null)
            content               = optional(string, null)
            pre_install           = optional(string, "")
            post_install          = optional(string, "")
            debug_logging_enabled = optional(bool, false)
          }), {})
          instance_allocation_strategy   = optional(string, "lowest-price")
          instance_max_spot_price        = optional(string, null)
          instance_target_capacity_type  = optional(string, "spot")
          instance_type_priorities       = optional(map(number), null)
          instance_types                 = optional(list(string), [])
          additional_security_group_ids  = optional(list(string), null)
          managed_security_group_enabled = optional(bool, null)
          egress_rules = optional(list(object({
            cidr_blocks      = list(string)
            ipv6_cidr_blocks = list(string)
            prefix_list_ids  = list(string)
            from_port        = number
            protocol         = string
            security_groups  = list(string)
            self             = bool
            to_port          = number
            description      = string
          })), null)
          instance_profile_path         = optional(string, null)
          key_name                      = optional(string, null)
          associate_public_ipv4_address = optional(bool, null)
          instance_profile = optional(object({
            name = string
          }), null)
          on_demand_failover_for_errors = optional(list(string), [])
          scale_errors = optional(list(string), [
            "UnfulfillableCapacity",
            "MaxSpotInstanceCountExceeded",
            "TargetCapacityLimitExceededException",
            "RequestLimitExceeded",
            "ResourceLimitExceeded",
            "MaxSpotInstanceCountExceeded",
            "MaxSpotFleetRequestCountExceeded",
            "InsufficientInstanceCapacity",
            "InsufficientCapacityOnHost",
          ])
          subnet_ids = optional(list(string), null)
          vpc_id     = optional(string, null)
          cpu_options = optional(object({
            core_count            = optional(number)
            threads_per_core      = optional(number)
            amd_sev_snp           = optional(string)
            nested_virtualization = optional(string)
          }), null)
          placement = optional(object({
            affinity                = optional(string)
            availability_zone       = optional(string)
            group_id                = optional(string)
            group_name              = optional(string)
            host_id                 = optional(string)
            host_resource_group_arn = optional(string)
            spread_domain           = optional(string)
            tenancy                 = optional(string)
            partition_number        = optional(number)
          }), null)
          license_specifications = optional(list(object({
            license_configuration_arn = string
          })), [])
          use_dedicated_host = optional(bool, false)
          log_files = optional(list(object({
            log_group_name   = string
            prefix_log_group = bool
            file_path        = string
            log_stream_name  = string
            log_class        = optional(string, "STANDARD")
          })), null)
          tags = optional(map(string), {})
        }), null)
      }), {})
    }), {})
  }))
| n/a | yes | | [parameter\_store\_tags](#input\_parameter\_store\_tags) | Map of tags that will be added to all the SSM Parameter Store parameters created by the Lambda function. | `map(string)` | `{}` | no | | [pool\_lambda\_reserved\_concurrent\_executions](#input\_pool\_lambda\_reserved\_concurrent\_executions) | Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. | `number` | `1` | no | | [pool\_lambda\_timeout](#input\_pool\_lambda\_timeout) | Time out for the pool lambda in seconds. | `number` | `60` | no | diff --git a/modules/multi-runner/config.experimental.effective.tf b/modules/multi-runner/config.experimental.effective.tf new file mode 100644 index 0000000000..28831a0033 --- /dev/null +++ b/modules/multi-runner/config.experimental.effective.tf @@ -0,0 +1,59 @@ +# Assemble the resource-ready configuration after runner-binary discovery. +locals { + effective_config = merge(local.resolved_config, { + multi_runner_config = { + for k, v in local.resolved_config.multi_runner_config : k => merge(v, { + runner = merge(v.runner, { + labels = sort(setunion( + v.runner.disable_default_labels ? [] : compact([ + "self-hosted", + v.runner.os, + v.runner.architecture, + ]), + v.orchestration_provider.webhook == null ? [] : flatten(v.orchestration_provider.webhook.matcherConfig.labelMatchers), + compact(v.runner.extra_labels), + )) + }) + + github = { + enterprise_server = local.normalized_config.github.enterprise_server + user_agent = local.normalized_config.github.user_agent + } + + lambda = merge(v.lambda, { + artifact = local.normalized_config.lambda.artifact + principals = local.normalized_config.lambda.principals + }) + + orchestration_provider = { + webhook = v.orchestration_provider.webhook == null ? null : merge(v.orchestration_provider.webhook, { + queue = merge(v.orchestration_provider.webhook.queue, { + kms_key_id = local.normalized_config.orchestration_provider.webhook.queue.encryption.kms_master_key_id + }) + + lambda = merge(v.orchestration_provider.webhook.lambda, { + artifact = local.normalized_config.orchestration_provider.webhook.lambda.artifact + }) + }) + } + + ssm = merge(v.ssm, { + kms_key_id = local.normalized_config.ssm.kms_key_id + }) + + compute_provider = merge(v.compute_provider, { + aws = merge(v.compute_provider.aws, { + ec2 = v.compute_provider.aws.ec2 == null ? null : merge(v.compute_provider.aws.ec2, { + binaries_syncer = merge(v.compute_provider.aws.ec2.binaries_syncer, { + s3 = v.compute_provider.aws.ec2.binaries_syncer.enabled ? try( + local.runner_binaries_by_os_and_arch_map["${v.runner.os}_${v.runner.architecture}"], + null, + ) : null + }) + }) + }) + }) + }) + } + }) +} diff --git a/modules/multi-runner/config.experimental.resolved.tf b/modules/multi-runner/config.experimental.resolved.tf new file mode 100644 index 0000000000..b7e2e26ab0 --- /dev/null +++ b/modules/multi-runner/config.experimental.resolved.tf @@ -0,0 +1,488 @@ +# Project stable v1 inputs into the v2 schema, resolve every runner +# configuration against the v2 global defaults, and assemble the +# resource-ready configuration consumed by the multi-runner resources. +locals { + # A single public map accepts either the stable v1 lane shape or the + # provider-boundary v2 shape. Keep the two projections separate so the + # legacy resources only see legacy lanes and v2 normalization can combine + # translated legacy lanes with native v2 lanes. + legacy_multi_runner_config = { + for k, v in var.multi_runner_config : k => v + if can(v.runner_config.runner_os) + } + + v2_multi_runner_config = { + for k, v in var.multi_runner_config : k => v + if !can(v.runner_config.runner_os) + } + + # Reassemble the split experimental inputs into the canonical shape consumed + # by the translation and precedence logic below. + v2_config = { + tags = var.global_config.tags + roles = var.global_config.roles + runner = var.global_config.runner + github = var.global_config_github + lambda = var.global_config_lambda + orchestration_provider = var.global_config_orchestration_provider + ssm = var.global_config_ssm + observability = var.global_config_observability + compute_provider = var.global_config_compute_provider + multi_runner_config = merge(local.stable_to_v2_multi_runner_config, local.v2_multi_runner_config) + } + + stable_to_v2 = { + tags = local.stable_to_v2_tags + roles = local.stable_to_v2_roles + runner = local.stable_to_v2_runner + github = local.stable_to_v2_github + lambda = local.stable_to_v2_lambda + orchestration_provider = local.stable_to_v2_orchestration_provider + ssm = local.stable_to_v2_ssm + observability = local.stable_to_v2_observability + compute_provider = local.stable_to_v2_compute_provider + multi_runner_config = local.stable_to_v2_multi_runner_config + } + + use_v2_config = length(local.v2_multi_runner_config) > 0 + + normalized_config = local.use_v2_config ? local.v2_config : local.stable_to_v2 +} + +locals { + # Resolve each lane against the translated global configuration. This stage + # is used by runner-binary discovery and must not depend on its outputs. + resolved_config = merge(local.normalized_config, { + multi_runner_config = { + for k, v in local.normalized_config.multi_runner_config : k => merge(v, { + tags = merge(local.normalized_config.tags, v.tags) + + runner = merge(v.runner, { + os = try(coalesce( + v.runner.os, + local.normalized_config.runner.os, + ), null) + architecture = try(coalesce( + v.runner.architecture, + local.normalized_config.runner.architecture, + ), null) + disable_default_labels = coalesce( + v.runner.disable_default_labels, + local.normalized_config.runner.disable_default_labels, + ) + extra_labels = sort(distinct(concat( + try(flatten(v.orchestration_provider.webhook.matcherConfig.labelMatchers), []), + coalesce( + v.runner.extra_labels, + local.normalized_config.runner.extra_labels, + ), + ))) + group_name = coalesce( + v.runner.group_name, + local.normalized_config.runner.group_name, + ) + name_prefix = v.runner.name_prefix != null ? v.runner.name_prefix : local.normalized_config.runner.name_prefix + run_as_root = coalesce( + v.runner.run_as_root, + local.normalized_config.runner.run_as_root, + ) + run_as = coalesce( + v.runner.run_as, + local.normalized_config.runner.run_as, + ) + auto_update_disabled = coalesce( + v.runner.auto_update_disabled, + local.normalized_config.runner.auto_update_disabled, + ) + tags = merge(local.normalized_config.runner.tags, v.runner.tags) + hooks = { + job_started = v.runner.hooks.job_started != null ? v.runner.hooks.job_started : local.normalized_config.runner.hooks.job_started + job_completed = v.runner.hooks.job_completed != null ? v.runner.hooks.job_completed : local.normalized_config.runner.hooks.job_completed + } + iam = { + role = try(coalesce( + v.runner.iam.role, + local.normalized_config.runner.iam.role, + ), null) + managed_policy_arns = try(coalesce( + v.runner.iam.managed_policy_arns, + (v.runner.iam.role != null || local.normalized_config.runner.iam.role != null) ? {} : local.normalized_config.runner.iam.managed_policy_arns, + ), {}) + additional_trust_policy_json = try(coalesce( + v.runner.iam.additional_trust_policy_json, + (v.runner.iam.role != null || local.normalized_config.runner.iam.role != null) ? null : local.normalized_config.runner.iam.additional_trust_policy_json, + ), null) + path = try(coalesce( + v.runner.iam.path, + local.normalized_config.runner.iam.path, + local.normalized_config.roles.path, + ), null) + permissions_boundary = try(coalesce( + v.runner.iam.permissions_boundary, + local.normalized_config.runner.iam.permissions_boundary, + local.normalized_config.roles.permissions_boundary, + ), null) + } + }) + + lambda = merge(v.lambda, { + runtime = coalesce( + v.lambda.runtime, + local.normalized_config.lambda.runtime, + ) + architecture = coalesce( + v.lambda.architecture, + local.normalized_config.lambda.architecture, + ) + subnet_ids = coalesce( + v.lambda.subnet_ids, + local.normalized_config.lambda.subnet_ids, + ) + security_group_ids = coalesce( + v.lambda.security_group_ids, + local.normalized_config.lambda.security_group_ids, + ) + tags = merge(local.normalized_config.lambda.tags, v.lambda.tags) + role = { + path = try(coalesce( + v.lambda.role.path, + local.normalized_config.lambda.role.path, + local.normalized_config.roles.path, + ), null) + permissions_boundary = try(coalesce( + v.lambda.role.permissions_boundary, + local.normalized_config.lambda.role.permissions_boundary, + local.normalized_config.roles.permissions_boundary, + ), null) + } + }) + + orchestration_provider = { + webhook = v.orchestration_provider.webhook == null ? null : merge(v.orchestration_provider.webhook, { + runner = { + boot_time_in_minutes = coalesce( + v.orchestration_provider.webhook.runner.boot_time_in_minutes, + local.normalized_config.orchestration_provider.webhook.runner.boot_time_in_minutes, + ) + ephemeral = coalesce( + v.orchestration_provider.webhook.runner.ephemeral, + local.normalized_config.orchestration_provider.webhook.runner.ephemeral, + ) + jit_config_enabled = try(coalesce( + v.orchestration_provider.webhook.runner.jit_config_enabled, + local.normalized_config.orchestration_provider.webhook.runner.jit_config_enabled, + ), null) + maximum_count = try(coalesce( + v.orchestration_provider.webhook.runner.maximum_count, + local.normalized_config.orchestration_provider.webhook.runner.maximum_count, + ), null) + } + + lambda = merge(v.orchestration_provider.webhook.lambda, { + scale = merge(v.orchestration_provider.webhook.lambda.scale, { + up = merge(v.orchestration_provider.webhook.lambda.scale.up, { + memory_size = coalesce( + v.orchestration_provider.webhook.lambda.scale.up.memory_size, + local.normalized_config.orchestration_provider.webhook.lambda.scale.up.memory_size, + ) + timeout = coalesce( + v.orchestration_provider.webhook.lambda.scale.up.timeout, + local.normalized_config.orchestration_provider.webhook.lambda.scale.up.timeout, + ) + reserved_concurrent_executions = coalesce( + v.orchestration_provider.webhook.lambda.scale.up.reserved_concurrent_executions, + local.normalized_config.orchestration_provider.webhook.lambda.scale.up.reserved_concurrent_executions, + ) + job_queued_check_enabled = try(coalesce( + v.orchestration_provider.webhook.lambda.scale.up.job_queued_check_enabled, + local.normalized_config.orchestration_provider.webhook.lambda.scale.up.job_queued_check_enabled, + ), null) + event_source_mapping = { + batch_size = coalesce( + v.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.batch_size, + local.normalized_config.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.batch_size, + ) + maximum_batching_window_in_seconds = coalesce( + v.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds, + local.normalized_config.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds, + ) + } + tags = merge(local.normalized_config.orchestration_provider.webhook.lambda.scale.up.tags, v.orchestration_provider.webhook.lambda.scale.up.tags) + }) + down = merge(v.orchestration_provider.webhook.lambda.scale.down, { + memory_size = coalesce( + v.orchestration_provider.webhook.lambda.scale.down.memory_size, + local.normalized_config.orchestration_provider.webhook.lambda.scale.down.memory_size, + ) + timeout = coalesce( + v.orchestration_provider.webhook.lambda.scale.down.timeout, + local.normalized_config.orchestration_provider.webhook.lambda.scale.down.timeout, + ) + schedule_expression = coalesce( + v.orchestration_provider.webhook.lambda.scale.down.schedule_expression, + local.normalized_config.orchestration_provider.webhook.lambda.scale.down.schedule_expression, + ) + minimum_running_time_in_minutes = try(coalesce( + v.orchestration_provider.webhook.lambda.scale.down.minimum_running_time_in_minutes, + local.normalized_config.orchestration_provider.webhook.lambda.scale.down.minimum_running_time_in_minutes, + ), null) + idle_config = coalesce( + v.orchestration_provider.webhook.lambda.scale.down.idle_config, + local.normalized_config.orchestration_provider.webhook.lambda.scale.down.idle_config, + ) + tags = merge(local.normalized_config.orchestration_provider.webhook.lambda.scale.down.tags, v.orchestration_provider.webhook.lambda.scale.down.tags) + }) + }) + pool = merge(v.orchestration_provider.webhook.lambda.pool, { + memory_size = coalesce( + v.orchestration_provider.webhook.lambda.pool.memory_size, + local.normalized_config.orchestration_provider.webhook.lambda.pool.memory_size, + ) + timeout = coalesce( + v.orchestration_provider.webhook.lambda.pool.timeout, + local.normalized_config.orchestration_provider.webhook.lambda.pool.timeout, + ) + reserved_concurrent_executions = coalesce( + v.orchestration_provider.webhook.lambda.pool.reserved_concurrent_executions, + local.normalized_config.orchestration_provider.webhook.lambda.pool.reserved_concurrent_executions, + ) + config = coalesce( + v.orchestration_provider.webhook.lambda.pool.config, + local.normalized_config.orchestration_provider.webhook.lambda.pool.config, + ) + include_busy_runners = coalesce( + v.orchestration_provider.webhook.lambda.pool.include_busy_runners, + local.normalized_config.orchestration_provider.webhook.lambda.pool.include_busy_runners, + ) + runner_owner = try(coalesce( + v.orchestration_provider.webhook.lambda.pool.runner_owner, + local.normalized_config.orchestration_provider.webhook.lambda.pool.runner_owner, + ), null) + tags = merge(local.normalized_config.orchestration_provider.webhook.lambda.pool.tags, v.orchestration_provider.webhook.lambda.pool.tags) + }) + }) + + queue = merge(v.orchestration_provider.webhook.queue, { + delay_webhook_event = coalesce( + v.orchestration_provider.webhook.queue.delay_webhook_event, + local.normalized_config.orchestration_provider.webhook.queue.delay_webhook_event, + ) + job_queue_retention_in_seconds = coalesce( + v.orchestration_provider.webhook.queue.job_queue_retention_in_seconds, + local.normalized_config.orchestration_provider.webhook.queue.job_queue_retention_in_seconds, + ) + visibility_timeout_seconds = coalesce( + v.orchestration_provider.webhook.queue.visibility_timeout_seconds, + local.normalized_config.orchestration_provider.webhook.queue.visibility_timeout_seconds, + ) + redrive_build_queue = { + enabled = coalesce( + try(v.orchestration_provider.webhook.queue.redrive_build_queue.enabled, null), + local.normalized_config.orchestration_provider.webhook.queue.redrive_build_queue.enabled, + ) + maxReceiveCount = try( + coalesce( + try(v.orchestration_provider.webhook.queue.redrive_build_queue.maxReceiveCount, null), + local.normalized_config.orchestration_provider.webhook.queue.redrive_build_queue.maxReceiveCount, + ), + null, + ) + } + tags = merge(local.normalized_config.orchestration_provider.webhook.queue.tags, v.orchestration_provider.webhook.queue.tags) + }) + }) + } + + ssm = merge(v.ssm, { + paths = { + root = "${trimsuffix(coalesce( + v.ssm.paths.root, + local.normalized_config.ssm.paths.root, + "/github-action-runners/${var.prefix}", + ), "/")}/${k}" + tokens = coalesce( + v.ssm.paths.tokens, + local.normalized_config.ssm.paths.tokens, + ) + config = coalesce( + v.ssm.paths.config, + local.normalized_config.ssm.paths.config, + ) + } + tags = merge(local.normalized_config.ssm.tags, v.ssm.tags) + parameters = { + tags = merge(local.normalized_config.ssm.parameters.tags, v.ssm.parameters.tags) + } + housekeeper = { + schedule_expression = coalesce( + v.ssm.housekeeper.schedule_expression, + local.normalized_config.ssm.housekeeper.schedule_expression, + ) + state = coalesce( + v.ssm.housekeeper.state, + local.normalized_config.ssm.housekeeper.state, + ) + tags = merge(local.normalized_config.ssm.housekeeper.tags, v.ssm.housekeeper.tags) + lambda = { + # Artifact precedence: lane ZIP, lane S3, global ZIP, then global + # S3. + artifact = v.ssm.housekeeper.lambda.artifact.zip != null ? { + zip = v.ssm.housekeeper.lambda.artifact.zip + s3 = null + } : v.ssm.housekeeper.lambda.artifact.s3 != null ? { + zip = null + s3 = v.ssm.housekeeper.lambda.artifact.s3 + } : local.normalized_config.ssm.housekeeper.lambda.artifact.zip != null ? { + zip = local.normalized_config.ssm.housekeeper.lambda.artifact.zip + s3 = null + } : { + zip = null + s3 = local.normalized_config.ssm.housekeeper.lambda.artifact.s3 + } + memory_size = coalesce( + v.ssm.housekeeper.lambda.memory_size, + local.normalized_config.ssm.housekeeper.lambda.memory_size, + ) + timeout = coalesce( + v.ssm.housekeeper.lambda.timeout, + local.normalized_config.ssm.housekeeper.lambda.timeout, + ) + } + config = { + tokenPath = try(coalesce( + v.ssm.housekeeper.config.tokenPath, + local.normalized_config.ssm.housekeeper.config.tokenPath, + ), null) + minimumDaysOld = coalesce( + v.ssm.housekeeper.config.minimumDaysOld, + local.normalized_config.ssm.housekeeper.config.minimumDaysOld, + ) + dryRun = coalesce( + v.ssm.housekeeper.config.dryRun, + local.normalized_config.ssm.housekeeper.config.dryRun, + ) + } + } + }) + + observability = { + logs = { + level = coalesce( + v.observability.logs.level, + local.normalized_config.observability.logs.level, + ) + retention_in_days = coalesce( + v.observability.logs.retention_in_days, + local.normalized_config.observability.logs.retention_in_days, + ) + kms_key_id = try(coalesce( + v.observability.logs.kms_key_id, + local.normalized_config.observability.logs.kms_key_id, + ), null) + class = coalesce( + v.observability.logs.class, + local.normalized_config.observability.logs.class, + ) + tags = merge(local.normalized_config.observability.logs.tags, v.observability.logs.tags) + } + tracing = { + mode = try(coalesce( + v.observability.tracing.mode, + local.normalized_config.observability.tracing.mode, + ), null) + capture_http_requests = coalesce( + v.observability.tracing.capture_http_requests, + local.normalized_config.observability.tracing.capture_http_requests, + ) + capture_error = coalesce( + v.observability.tracing.capture_error, + local.normalized_config.observability.tracing.capture_error, + ) + } + metrics = { + enabled = coalesce( + v.observability.metrics.enabled, + local.normalized_config.observability.metrics.enabled, + ) + namespace = coalesce( + v.observability.metrics.namespace, + local.normalized_config.observability.metrics.namespace, + ) + metric = { + github_app_rate_limit = { + enabled = coalesce( + v.observability.metrics.metric.github_app_rate_limit.enabled, + local.normalized_config.observability.metrics.metric.github_app_rate_limit.enabled, + ) + } + job_retry = { + enabled = coalesce( + v.observability.metrics.metric.job_retry.enabled, + local.normalized_config.observability.metrics.metric.job_retry.enabled, + ) + } + spot_termination_warning = { + enabled = coalesce( + v.observability.metrics.metric.spot_termination_warning.enabled, + local.normalized_config.observability.metrics.metric.spot_termination_warning.enabled, + ) + } + } + } + } + + compute_provider = { + aws = { + ec2 = v.compute_provider.aws.ec2 == null ? null : merge(v.compute_provider.aws.ec2, { + vpc_id = try(coalesce( + v.compute_provider.aws.ec2.vpc_id, + local.normalized_config.compute_provider.aws.ec2.vpc_id, + ), null) + subnet_ids = try(coalesce( + v.compute_provider.aws.ec2.subnet_ids, + local.normalized_config.compute_provider.aws.ec2.subnet_ids, + ), null) + managed_security_group_enabled = coalesce( + v.compute_provider.aws.ec2.managed_security_group_enabled, + local.normalized_config.compute_provider.aws.ec2.managed_security_group_enabled, + ) + egress_rules = coalesce( + v.compute_provider.aws.ec2.egress_rules, + local.normalized_config.compute_provider.aws.ec2.egress_rules, + ) + additional_security_group_ids = coalesce( + v.compute_provider.aws.ec2.additional_security_group_ids, + local.normalized_config.compute_provider.aws.ec2.additional_security_group_ids, + ) + instance_profile_path = try(coalesce( + v.compute_provider.aws.ec2.instance_profile_path, + local.normalized_config.compute_provider.aws.ec2.instance_profile_path, + ), null) + key_name = try(coalesce( + v.compute_provider.aws.ec2.key_name, + local.normalized_config.compute_provider.aws.ec2.key_name, + ), null) + associate_public_ipv4_address = coalesce( + v.compute_provider.aws.ec2.associate_public_ipv4_address, + local.normalized_config.compute_provider.aws.ec2.associate_public_ipv4_address, + ) + cloudwatch_agent = merge(v.compute_provider.aws.ec2.cloudwatch_agent, { + config = try(coalesce( + v.compute_provider.aws.ec2.cloudwatch_agent.config, + local.normalized_config.compute_provider.aws.ec2.cloudwatch_agent.config, + ), null) + }) + binaries_syncer = { + enabled = coalesce( + v.compute_provider.aws.ec2.binaries_syncer.enabled, + local.normalized_config.compute_provider.aws.ec2.runner_binaries.enabled, + ) + } + tags = merge(local.normalized_config.compute_provider.aws.ec2.tags, v.compute_provider.aws.ec2.tags) + }) + } + } + }) + } + }) +} diff --git a/modules/multi-runner/config.experimental.translation.tf b/modules/multi-runner/config.experimental.translation.tf new file mode 100644 index 0000000000..07df28e2e7 --- /dev/null +++ b/modules/multi-runner/config.experimental.translation.tf @@ -0,0 +1,560 @@ +# Translate stable v1 inputs into the experimental v2 structure. +locals { + stable_to_v2_tags = var.tags + + stable_to_v2_roles = { + path = var.role_path + permissions_boundary = var.role_permissions_boundary + } + + stable_to_v2_runner = { + os = null + architecture = null + disable_default_labels = false + extra_labels = [] + group_name = "Default" + name_prefix = "" + run_as_root = false + run_as = "ec2-user" + auto_update_disabled = false + tags = {} + hooks = { + job_started = "" + job_completed = "" + } + iam = { + role = null + managed_policy_arns = {} + additional_trust_policy_json = null + path = null + permissions_boundary = null + } + } + + stable_to_v2_github = { + app = var.github_app + additional_apps = var.additional_github_apps + enterprise_server = { + url = var.ghes_url + ssl_verify = var.ghes_ssl_verify + } + user_agent = var.user_agent + } + + stable_to_v2_lambda = { + artifact = { + s3 = { + bucket = var.lambda_s3_bucket + } + } + runtime = var.lambda_runtime + architecture = var.lambda_architecture + principals = var.lambda_principals + subnet_ids = var.lambda_subnet_ids + security_group_ids = var.lambda_security_group_ids + tags = var.lambda_tags + role = { + path = null + permissions_boundary = null + } + } + + stable_to_v2_orchestration_provider = { + webhook = { + queue_selection_strategy = var.queue_selection_strategy + eventbridge = { + enabled = var.eventbridge.enable + accept_events = var.eventbridge.accept_events + } + matcher_config_parameter_store_tier = var.matcher_config_parameter_store_tier + runner = { + boot_time_in_minutes = 5 + ephemeral = false + jit_config_enabled = null + maximum_count = null + } + github = { + repository_white_list = var.repository_white_list + } + lambda = { + artifact = { + zip = var.lambda_s3_bucket == null ? var.runners_lambda_zip : null + s3 = var.lambda_s3_bucket == null ? null : { + key = var.runners_lambda_s3_key + object_version = var.runners_lambda_s3_object_version + } + } + scale = { + up = { + memory_size = var.scale_up_lambda_memory_size + timeout = var.runners_scale_up_lambda_timeout + reserved_concurrent_executions = 1 + job_queued_check_enabled = null + event_source_mapping = { + batch_size = var.lambda_event_source_mapping_batch_size + maximum_batching_window_in_seconds = var.lambda_event_source_mapping_maximum_batching_window_in_seconds + } + tags = {} + } + down = { + memory_size = var.scale_down_lambda_memory_size + timeout = var.runners_scale_down_lambda_timeout + schedule_expression = "cron(*/5 * * * ? *)" + minimum_running_time_in_minutes = null + idle_config = [] + tags = {} + } + } + webhook = { + artifact = { + zip = var.lambda_s3_bucket == null ? var.webhook_lambda_zip : null + s3 = var.lambda_s3_bucket == null ? null : { + key = var.webhook_lambda_s3_key + object_version = var.webhook_lambda_s3_object_version + } + } + api_gateway_access_log_settings = var.webhook_lambda_apigateway_access_log_settings + memory_size = var.webhook_lambda_memory_size + timeout = var.webhook_lambda_timeout + tags = {} + } + pool = { + memory_size = 512 + timeout = var.pool_lambda_timeout + reserved_concurrent_executions = var.pool_lambda_reserved_concurrent_executions + config = [] + include_busy_runners = false + runner_owner = null + tags = {} + } + } + queue = { + delay_webhook_event = 30 + job_queue_retention_in_seconds = 86400 + visibility_timeout_seconds = var.runners_scale_up_lambda_timeout + redrive_build_queue = { + enabled = false + maxReceiveCount = null + } + tags = {} + encryption = var.queue_encryption + } + } + } + + stable_to_v2_ssm = { + paths = { + root = "/${var.ssm_paths.root}/${var.prefix}" + app = var.ssm_paths.app + webhook = var.ssm_paths.webhook + tokens = "${var.ssm_paths.runners}/tokens" + config = "${var.ssm_paths.runners}/config" + } + kms_key_id = var.kms_key_arn + tags = {} + parameters = { + tags = var.parameter_store_tags + } + housekeeper = { + schedule_expression = var.runners_ssm_housekeeper.schedule_expression + state = var.runners_ssm_housekeeper.enabled ? "ENABLED" : "DISABLED" + tags = {} + lambda = { + artifact = { + zip = var.lambda_s3_bucket == null ? var.runners_lambda_zip : null + s3 = var.lambda_s3_bucket == null ? null : { + key = var.runners_lambda_s3_key + object_version = var.runners_lambda_s3_object_version + } + } + memory_size = var.runners_ssm_housekeeper.lambda_memory_size + timeout = var.runners_ssm_housekeeper.lambda_timeout + } + config = { + tokenPath = var.runners_ssm_housekeeper.config.tokenPath + minimumDaysOld = var.runners_ssm_housekeeper.config.minimumDaysOld + dryRun = var.runners_ssm_housekeeper.config.dryRun + } + } + } + + stable_to_v2_observability = { + logs = { + level = var.log_level + retention_in_days = var.logging_retention_in_days + kms_key_id = var.logging_kms_key_id + class = var.log_class + tags = {} + } + tracing = var.tracing_config + metrics = { + enabled = var.metrics.enable + namespace = var.metrics.namespace + metric = { + github_app_rate_limit = { + enabled = var.metrics.metric.enable_github_app_rate_limit + } + job_retry = { + enabled = var.metrics.metric.enable_job_retry + } + spot_termination_warning = { + enabled = var.metrics.metric.enable_spot_termination_warning + } + } + } + } + + stable_to_v2_compute_provider = { + selections = null + aws = { + ec2 = { + vpc_id = var.vpc_id + subnet_ids = var.subnet_ids + managed_security_group_enabled = var.enable_managed_runner_security_group + egress_rules = var.runner_egress_rules + additional_security_group_ids = var.runner_additional_security_group_ids + cloudwatch_agent = { + config = var.cloudwatch_config + } + instance_profile_path = var.instance_profile_path + key_name = var.key_name + associate_public_ipv4_address = var.associate_public_ipv4_address + tags = {} + ami = { + housekeeper = { + enabled = var.enable_ami_housekeeper + cleanup_config = var.ami_housekeeper_cleanup_config + artifact = { + zip = var.lambda_s3_bucket == null ? var.ami_housekeeper_lambda_zip : null + s3 = var.lambda_s3_bucket == null ? null : { + key = var.ami_housekeeper_lambda_s3_key + object_version = var.ami_housekeeper_lambda_s3_object_version + } + } + lambda = { + memory_size = var.ami_housekeeper_lambda_memory_size + timeout = var.ami_housekeeper_lambda_timeout + } + schedule = { + expression = var.ami_housekeeper_lambda_schedule_expression + } + } + } + instance_termination_watcher = { + enabled = var.instance_termination_watcher.enable + features = { + runner_deregistration = { + enabled = var.instance_termination_watcher.enable_runner_deregistration + } + spot_termination_handler = { + enabled = var.instance_termination_watcher.features.enable_spot_termination_handler + } + spot_termination_notification_watcher = { + enabled = var.instance_termination_watcher.features.enable_spot_termination_notification_watcher + } + } + environment_variables = var.instance_termination_watcher.environment_variables + artifact = { + zip = var.lambda_s3_bucket == null ? var.instance_termination_watcher.zip : null + s3 = var.lambda_s3_bucket == null ? null : { + key = var.instance_termination_watcher.s3_key + object_version = var.instance_termination_watcher.s3_object_version + } + } + lambda = { + memory_size = var.instance_termination_watcher.memory_size + timeout = var.instance_termination_watcher.timeout + } + } + runner_binaries = { + enabled = true + s3 = { + encryption = { + enabled = var.runner_binaries_s3_sse_configuration != null + bucket_key_enabled = try(var.runner_binaries_s3_sse_configuration.rule.bucket_key_enabled, null) + sse_algorithm = try(var.runner_binaries_s3_sse_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm, "AES256") + kms_master_key_id = try(var.runner_binaries_s3_sse_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id, null) + } + tags = var.runner_binaries_s3_tags + versioning = var.runner_binaries_s3_versioning + logging = { + bucket = null + prefix = null + } + } + syncer = { + artifact = { + zip = var.lambda_s3_bucket == null ? var.runner_binaries_syncer_lambda_zip : null + s3 = var.lambda_s3_bucket == null ? null : { + key = var.syncer_lambda_s3_key + object_version = var.syncer_lambda_s3_object_version + } + } + lambda = { + memory_size = var.runner_binaries_syncer_memory_size + timeout = var.runner_binaries_syncer_lambda_timeout + } + schedule = { + expression = "cron(27 * * * ? *)" + state = var.state_event_rule_binaries_syncer + } + } + } + } + } + } + + stable_to_v2_multi_runner_config = { + for k, v in local.legacy_multi_runner_config : k => { + tags = {} + + runner = { + os = v.runner_config.runner_os + architecture = v.runner_config.runner_architecture + disable_default_labels = v.runner_config.runner_disable_default_labels + extra_labels = v.runner_config.runner_extra_labels + group_name = v.runner_config.runner_group_name + name_prefix = v.runner_config.runner_name_prefix + run_as_root = v.runner_config.runner_as_root + run_as = v.runner_config.runner_run_as + auto_update_disabled = v.runner_config.disable_runner_autoupdate + tags = {} + hooks = { + job_started = v.runner_config.runner_hook_job_started + job_completed = v.runner_config.runner_hook_job_completed + } + iam = { + role = v.runner_config.iam_overrides.override_runner_role == true ? { + arn = v.runner_config.iam_overrides.runner_role_arn + } : null + managed_policy_arns = { + for policy_index, policy_arn in v.runner_config.runner_iam_role_managed_policy_arns : + "legacy-${policy_index}" => policy_arn + } + additional_trust_policy_json = null + path = null + permissions_boundary = null + } + } + + lambda = { + runtime = null + architecture = null + subnet_ids = null + security_group_ids = null + tags = {} + role = { + path = null + permissions_boundary = null + } + } + + orchestration_provider = { + webhook = { + runner = { + boot_time_in_minutes = v.runner_config.runner_boot_time_in_minutes + ephemeral = v.runner_config.enable_ephemeral_runners + jit_config_enabled = v.runner_config.enable_jit_config + maximum_count = v.runner_config.runners_maximum_count + } + + github = { + organization_runners = v.runner_config.enable_organization_runners + } + + matcherConfig = { + labelMatchers = v.matcherConfig.labelMatchers + exactMatch = v.matcherConfig.exactMatch + bidirectionalLabelMatch = v.matcherConfig.bidirectionalLabelMatch + priority = v.matcherConfig.priority + dynamic_labels_enabled = v.matcherConfig.enableDynamicLabels + awsDynamicLabelsPolicy = v.matcherConfig.awsDynamicLabelsPolicy + } + + lambda = { + scale = { + up = { + memory_size = null + timeout = null + reserved_concurrent_executions = v.runner_config.scale_up_reserved_concurrent_executions + job_queued_check_enabled = v.runner_config.enable_job_queued_check + event_source_mapping = { + batch_size = v.runner_config.lambda_event_source_mapping_batch_size + maximum_batching_window_in_seconds = v.runner_config.lambda_event_source_mapping_maximum_batching_window_in_seconds + } + tags = {} + } + down = { + memory_size = null + timeout = null + schedule_expression = v.runner_config.scale_down_schedule_expression + minimum_running_time_in_minutes = v.runner_config.minimum_running_time_in_minutes + idle_config = v.runner_config.idle_config + tags = {} + } + } + pool = { + memory_size = null + timeout = null + reserved_concurrent_executions = null + config = v.runner_config.pool_config + include_busy_runners = false + runner_owner = v.runner_config.pool_runner_owner + tags = {} + } + } + + queue = { + delay_webhook_event = v.runner_config.delay_webhook_event + job_queue_retention_in_seconds = v.runner_config.job_queue_retention_in_seconds + visibility_timeout_seconds = var.runners_scale_up_lambda_timeout + redrive_build_queue = v.redrive_build_queue + tags = {} + } + + job_retry = { + enabled = v.runner_config.job_retry.enable + delay_in_seconds = v.runner_config.job_retry.delay_in_seconds + delay_backoff = v.runner_config.job_retry.delay_backoff + max_attempts = v.runner_config.job_retry.max_attempts + tags = {} + lambda = { + memory_size = v.runner_config.job_retry.lambda_memory_size + reserved_concurrent_executions = 1 + timeout = v.runner_config.job_retry.lambda_timeout + } + } + } + } + + ssm = { + paths = { + root = null + tokens = null + config = null + } + tags = {} + parameters = { + tags = {} + } + housekeeper = { + schedule_expression = null + state = null + tags = {} + lambda = { + artifact = { + zip = null + s3 = null + } + memory_size = null + timeout = null + } + config = { + tokenPath = null + minimumDaysOld = null + dryRun = null + } + } + } + + observability = { + logs = { + level = null + retention_in_days = null + kms_key_id = null + class = null + tags = {} + } + tracing = { + mode = null + capture_http_requests = null + capture_error = null + } + metrics = { + enabled = null + namespace = null + metric = { + github_app_rate_limit = { + enabled = null + } + job_retry = { + enabled = null + } + spot_termination_warning = { + enabled = null + } + } + } + } + + compute_provider = { + aws = { + ec2 = { + metadata_options = { + instance_metadata_tags = tostring(v.runner_config.runner_metadata_options["instance_metadata_tags"]) + http_endpoint = tostring(v.runner_config.runner_metadata_options["http_endpoint"]) + http_tokens = tostring(v.runner_config.runner_metadata_options["http_tokens"]) + http_put_response_hop_limit = tonumber(v.runner_config.runner_metadata_options["http_put_response_hop_limit"]) + } + ami = v.runner_config.ami == null ? null : { + filter = v.runner_config.ami.filter + owners = v.runner_config.ami.owners + id_ssm_parameter = v.runner_config.ami.id_ssm_parameter_arn == null ? null : { + arn = v.runner_config.ami.id_ssm_parameter_arn + } + kms_key = v.runner_config.ami.kms_key_arn == null ? null : { + arn = v.runner_config.ami.kms_key_arn + } + } + block_device_mappings = v.runner_config.block_device_mappings + create_service_linked_role_spot = v.runner_config.create_service_linked_role_spot + credit_specification = v.runner_config.credit_specification + ebs_optimized = v.runner_config.ebs_optimized + cloudwatch_agent = { + enabled = v.runner_config.enable_cloudwatch_agent + config = v.runner_config.cloudwatch_config + } + binaries_syncer = { + enabled = v.runner_config.enable_runner_binaries_syncer + } + detailed_monitoring_enabled = v.runner_config.enable_runner_detailed_monitoring + ssm_enabled = v.runner_config.enable_ssm_on_runners + user_data = { + enabled = v.runner_config.enable_userdata + template = v.runner_config.userdata_template + content = v.runner_config.userdata_content + pre_install = v.runner_config.userdata_pre_install + post_install = v.runner_config.userdata_post_install + debug_logging_enabled = false + } + instance_allocation_strategy = v.runner_config.instance_allocation_strategy + instance_max_spot_price = v.runner_config.instance_max_spot_price + instance_target_capacity_type = v.runner_config.instance_target_capacity_type + instance_type_priorities = v.runner_config.instance_type_priorities + instance_types = v.runner_config.instance_types + additional_security_group_ids = length(v.runner_config.runner_additional_security_group_ids) == 0 ? null : v.runner_config.runner_additional_security_group_ids + managed_security_group_enabled = null + egress_rules = null + instance_profile_path = null + key_name = null + associate_public_ipv4_address = null + instance_profile = v.runner_config.iam_overrides.override_instance_profile == true ? { + name = v.runner_config.iam_overrides.instance_profile_name + } : null + on_demand_failover_for_errors = v.runner_config.enable_on_demand_failover_for_errors + scale_errors = v.runner_config.scale_errors + subnet_ids = v.runner_config.subnet_ids + vpc_id = v.runner_config.vpc_id + cpu_options = v.runner_config.cpu_options + placement = v.runner_config.placement + license_specifications = v.runner_config.license_specifications + use_dedicated_host = v.runner_config.use_dedicated_host + log_files = v.runner_config.runner_log_files + tags = v.runner_config.runner_ec2_tags + } + } + } + } + } + +} diff --git a/modules/multi-runner/main.tf b/modules/multi-runner/main.tf index bd96e30847..7f3cc88d35 100644 --- a/modules/multi-runner/main.tf +++ b/modules/multi-runner/main.tf @@ -22,9 +22,9 @@ locals { webhook_secret = coalesce(var.github_app.webhook_secret_ssm, module.ssm.parameters.github_app_webhook_secret) } - runner_extra_labels = { for k, v in var.multi_runner_config : k => sort(setunion(flatten(v.matcherConfig.labelMatchers), compact(v.runner_config.runner_extra_labels))) } + runner_extra_labels = { for k, v in local.legacy_multi_runner_config : k => sort(setunion(flatten(v.matcherConfig.labelMatchers), compact(v.runner_config.runner_extra_labels))) } - runner_config = { for k, v in var.multi_runner_config : k => merge( + runner_config = { for k, v in local.legacy_multi_runner_config : k => merge( { id = aws_sqs_queue.queued_builds[k].id arn = aws_sqs_queue.queued_builds[k].arn diff --git a/modules/multi-runner/queues.tf b/modules/multi-runner/queues.tf index bcc75f99cc..5cceaf0d63 100644 --- a/modules/multi-runner/queues.tf +++ b/modules/multi-runner/queues.tf @@ -27,7 +27,7 @@ data "aws_iam_policy_document" "deny_insecure_transport" { } resource "aws_sqs_queue" "queued_builds" { - for_each = var.multi_runner_config + for_each = local.legacy_multi_runner_config name = "${var.prefix}-${each.key}-queued-builds" delay_seconds = each.value.runner_config.delay_webhook_event visibility_timeout_seconds = var.runners_scale_up_lambda_timeout @@ -46,13 +46,13 @@ resource "aws_sqs_queue" "queued_builds" { } resource "aws_sqs_queue_policy" "build_queue_policy" { - for_each = var.multi_runner_config + for_each = local.legacy_multi_runner_config queue_url = aws_sqs_queue.queued_builds[each.key].id policy = data.aws_iam_policy_document.deny_insecure_transport.json } resource "aws_sqs_queue" "queued_builds_dlq" { - for_each = { for config, values in var.multi_runner_config : config => values if values.redrive_build_queue.enabled } + for_each = { for config, values in local.legacy_multi_runner_config : config => values if values.redrive_build_queue.enabled } name = "${var.prefix}-${each.key}-queued-builds_dead_letter" sqs_managed_sse_enabled = var.queue_encryption.sqs_managed_sse_enabled @@ -62,7 +62,7 @@ resource "aws_sqs_queue" "queued_builds_dlq" { } resource "aws_sqs_queue_policy" "build_queue_dlq_policy" { - for_each = { for config, values in var.multi_runner_config : config => values if values.redrive_build_queue.enabled } + for_each = { for config, values in local.legacy_multi_runner_config : config => values if values.redrive_build_queue.enabled } queue_url = aws_sqs_queue.queued_builds_dlq[each.key].id policy = data.aws_iam_policy_document.deny_insecure_transport.json } diff --git a/modules/multi-runner/tests/config-effective.tftest.hcl b/modules/multi-runner/tests/config-effective.tftest.hcl new file mode 100644 index 0000000000..3c21a30978 --- /dev/null +++ b/modules/multi-runner/tests/config-effective.tftest.hcl @@ -0,0 +1,214 @@ +mock_provider "aws" { + mock_data "aws_caller_identity" { + defaults = { + account_id = "123456789012" + } + } + + mock_data "aws_iam_policy_document" { + defaults = { + json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}" + } + } + + mock_resource "aws_iam_role" { + defaults = { + arn = "arn:aws:iam::123456789012:role/test-role" + } + } + + mock_resource "aws_cloudwatch_event_bus" { + defaults = { + arn = "arn:aws:events:eu-west-1:123456789012:event-bus/test" + } + } + + mock_resource "aws_cloudwatch_event_rule" { + defaults = { + arn = "arn:aws:events:eu-west-1:123456789012:rule/test" + } + } + + mock_resource "aws_lambda_function" { + defaults = { + arn = "arn:aws:lambda:eu-west-1:123456789012:function:test" + } + } + + mock_resource "aws_sqs_queue" { + defaults = { + arn = "arn:aws:sqs:eu-west-1:123456789012:test" + } + } + + mock_resource "aws_s3_bucket" { + defaults = { + arn = "arn:aws:s3:::test-runner-binaries" + id = "test-runner-binaries" + } + } + + mock_resource "aws_apigatewayv2_api" { + defaults = { + execution_arn = "arn:aws:execute-api:eu-west-1:123456789012:test" + } + } +} + +mock_provider "random" {} +mock_provider "null" {} + +variables { + aws_region = "eu-west-1" + vpc_id = "vpc-test" + subnet_ids = ["subnet-test"] + + multi_runner_config = {} + + github_app = { + key_base64_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/key" + name = "/tests/github-app/key" + } + id_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/id" + name = "/tests/github-app/id" + } + webhook_secret_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/webhook-secret" + name = "/tests/github-app/webhook-secret" + } + } + + lambda_s3_bucket = "test-lambda-artifacts" + runners_lambda_zip = "README.md" + runners_lambda_s3_key = "runners.zip" + webhook_lambda_s3_key = "webhook.zip" + syncer_lambda_s3_key = "runner-binaries-syncer.zip" +} + +run "v1_effective_config_contains_derived_runner_labels" { + command = plan + + variables { + multi_runner_config = { + stable = { + runner_config = { + runner_os = "linux" + runner_architecture = "x64" + instance_types = ["m5.large"] + runners_maximum_count = 1 + } + matcherConfig = { + labelMatchers = [["stable-label"]] + } + } + } + } + + assert { + condition = toset(local.effective_config.multi_runner_config["stable"].runner.labels) == toset([ + "linux", + "self-hosted", + "stable-label", + "x64", + ]) + error_message = "The effective v1 configuration must contain the translated runner labels." + } +} + +run "v2_effective_config_contains_derived_values" { + command = apply + + variables { + experimental_features = ["multi-runner-v2"] + + global_config = { + runner = { + os = "linux" + architecture = "x64" + } + } + + global_config_lambda = { + artifact = { + s3 = { + bucket = "global-lambda-artifacts" + } + } + } + + global_config_orchestration_provider = { + webhook = { + lambda = { + artifact = { + zip = "global-webhook.zip" + } + } + queue = { + encryption = { + kms_data_key_reuse_period_seconds = 300 + kms_master_key_id = "kms-global-queue" + sqs_managed_sse_enabled = false + } + } + } + } + + global_config_ssm = { + kms_key_id = "kms-global-ssm" + } + + global_config_compute_provider = { + aws = { + ec2 = { + runner_binaries = { + enabled = true + } + } + } + } + + multi_runner_config = { + lane = { + runner = { + extra_labels = ["lane-label"] + } + orchestration_provider = { + webhook = { + matcherConfig = { + labelMatchers = [["matcher-label"]] + } + } + } + compute_provider = { + aws = { + ec2 = { + instance_types = ["m5.large"] + binaries_syncer = { + enabled = true + } + } + } + } + } + } + } + + assert { + condition = ( + toset(local.effective_config.multi_runner_config["lane"].runner.labels) == toset([ + "lane-label", + "linux", + "matcher-label", + "self-hosted", + "x64", + ]) + && local.effective_config.multi_runner_config["lane"].lambda.artifact.s3.bucket == "global-lambda-artifacts" + && local.effective_config.multi_runner_config["lane"].orchestration_provider.webhook.lambda.artifact.zip == "global-webhook.zip" + && local.effective_config.multi_runner_config["lane"].orchestration_provider.webhook.queue.kms_key_id == "kms-global-queue" + && local.effective_config.multi_runner_config["lane"].ssm.kms_key_id == "kms-global-ssm" + ) + error_message = "The effective v2 configuration must contain global values and derived labels." + } +} diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl new file mode 100644 index 0000000000..ecc2670315 --- /dev/null +++ b/modules/multi-runner/tests/config-resolution.tftest.hcl @@ -0,0 +1,289 @@ +mock_provider "aws" { + mock_data "aws_caller_identity" { + defaults = { + account_id = "123456789012" + } + } + + mock_data "aws_iam_policy_document" { + defaults = { + json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}" + } + } + + mock_resource "aws_iam_role" { + defaults = { + arn = "arn:aws:iam::123456789012:role/test-role" + } + } + + mock_resource "aws_cloudwatch_event_bus" { + defaults = { + arn = "arn:aws:events:eu-west-1:123456789012:event-bus/test" + } + } + + mock_resource "aws_cloudwatch_event_rule" { + defaults = { + arn = "arn:aws:events:eu-west-1:123456789012:rule/test" + } + } + + mock_resource "aws_lambda_function" { + defaults = { + arn = "arn:aws:lambda:eu-west-1:123456789012:function:test" + } + } + + mock_resource "aws_sqs_queue" { + defaults = { + arn = "arn:aws:sqs:eu-west-1:123456789012:test" + } + } + + mock_resource "aws_s3_bucket" { + defaults = { + arn = "arn:aws:s3:::test-lambda-artifacts" + id = "test-lambda-artifacts" + } + } + + mock_resource "aws_apigatewayv2_api" { + defaults = { + execution_arn = "arn:aws:execute-api:eu-west-1:123456789012:test" + } + } +} + +mock_provider "random" {} +mock_provider "null" {} + +variables { + aws_region = "eu-west-1" + vpc_id = "vpc-stable" + subnet_ids = ["subnet-stable"] + + github_app = { + key_base64_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/key" + name = "/tests/github-app/key" + } + id_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/id" + name = "/tests/github-app/id" + } + webhook_secret_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/webhook-secret" + name = "/tests/github-app/webhook-secret" + } + } + + lambda_s3_bucket = "test-lambda-artifacts" + runners_lambda_zip = "README.md" + runners_lambda_s3_key = "runners.zip" + webhook_lambda_s3_key = "webhook.zip" + syncer_lambda_s3_key = "runner-binaries-syncer.zip" +} + +run "v1_stable_inputs_translate_into_effective_base" { + command = plan + + variables { + tags = { + source = "v1" + } + + global_config = { + tags = { + source = "v2-must-not-leak" + } + } + + multi_runner_config = { + stable = { + runner_config = { + runner_os = "linux" + runner_architecture = "x64" + instance_types = ["m5.large"] + runners_maximum_count = 2 + runner_group_name = "v1-lane" + } + matcherConfig = { + labelMatchers = [["self-hosted", "linux", "x64"]] + } + } + } + } + + assert { + condition = ( + !local.use_v2_config + && local.normalized_config.tags.source == "v1" + && keys(local.resolved_config.multi_runner_config) == ["stable"] + && local.resolved_config.tags.source == "v1" + && local.resolved_config.multi_runner_config["stable"].runner.os == "linux" + && local.resolved_config.multi_runner_config["stable"].runner.architecture == "x64" + && local.resolved_config.multi_runner_config["stable"].runner.group_name == "v1-lane" + && local.resolved_config.multi_runner_config["stable"].orchestration_provider.webhook.runner.maximum_count == 2 + && toset(local.resolved_config.multi_runner_config["stable"].compute_provider.aws.ec2.instance_types) == toset(["m5.large"]) + && toset(local.effective_config.multi_runner_config["stable"].runner.labels) == toset(["linux", "self-hosted", "x64"]) + ) + error_message = "Stable v1 inputs must translate into the effective experimental base without leaking v2 globals." + } +} + +run "v2_inputs_resolve_lane_over_global" { + command = plan + + variables { + experimental_features = ["multi-runner-v2"] + + tags = { + source = "v1-must-not-leak" + } + + global_config = { + tags = { + source = "v2" + } + runner = { + os = "linux" + architecture = "arm64" + group_name = "global-group" + } + } + + global_config_compute_provider = { + aws = { + ec2 = { + vpc_id = "vpc-global" + subnet_ids = ["subnet-global"] + runner_binaries = { + enabled = false + } + instance_termination_watcher = { + features = { + runner_deregistration = { + enabled = false + } + spot_termination_handler = { + enabled = false + } + spot_termination_notification_watcher = { + enabled = false + } + } + } + } + } + } + + global_config_observability = { + metrics = { + enabled = true + metric = { + github_app_rate_limit = { + enabled = false + } + job_retry = { + enabled = false + } + } + } + } + + global_config_orchestration_provider = { + webhook = { + eventbridge = { + enabled = false + } + } + } + + global_config_ssm = { + housekeeper = { + lambda = { + artifact = { + zip = "global-housekeeper.zip" + } + } + } + } + + multi_runner_config = { + lane = { + runner = { + group_name = "lane-group" + } + orchestration_provider = { + webhook = { + matcherConfig = { + labelMatchers = [["self-hosted", "linux", "arm64"]] + dynamic_labels_enabled = true + } + } + } + observability = { + metrics = { + enabled = false + metric = { + github_app_rate_limit = { + enabled = true + } + job_retry = { + enabled = true + } + } + } + } + ssm = { + housekeeper = { + lambda = { + artifact = { + s3 = { + key = "lane-housekeeper.zip" + } + } + } + } + } + compute_provider = { + aws = { + ec2 = { + instance_types = ["c7g.large"] + subnet_ids = ["subnet-lane"] + on_demand_failover_for_errors = ["InsufficientInstanceCapacity"] + } + } + } + } + } + } + + assert { + condition = ( + local.use_v2_config + && local.normalized_config.tags.source == "v2" + && toset(keys(local.resolved_config.multi_runner_config)) == toset(["lane"]) + && local.resolved_config.tags.source == "v2" + && local.resolved_config.multi_runner_config["lane"].runner.os == "linux" + && local.resolved_config.multi_runner_config["lane"].runner.architecture == "arm64" + && local.resolved_config.multi_runner_config["lane"].runner.group_name == "lane-group" + && local.resolved_config.multi_runner_config["lane"].compute_provider.aws.ec2.vpc_id == "vpc-global" + && toset(local.resolved_config.multi_runner_config["lane"].compute_provider.aws.ec2.subnet_ids) == toset(["subnet-lane"]) + && local.resolved_config.multi_runner_config["lane"].orchestration_provider.webhook.matcherConfig.dynamic_labels_enabled + && !local.resolved_config.multi_runner_config["lane"].observability.metrics.enabled + && local.resolved_config.multi_runner_config["lane"].observability.metrics.metric.github_app_rate_limit.enabled + && local.resolved_config.multi_runner_config["lane"].observability.metrics.metric.job_retry.enabled + && tolist(local.resolved_config.multi_runner_config["lane"].compute_provider.aws.ec2.on_demand_failover_for_errors) == tolist(["InsufficientInstanceCapacity"]) + && !local.resolved_config.orchestration_provider.webhook.eventbridge.enabled + && !local.resolved_config.compute_provider.aws.ec2.instance_termination_watcher.features.spot_termination_handler.enabled + && !local.resolved_config.compute_provider.aws.ec2.instance_termination_watcher.features.spot_termination_notification_watcher.enabled + && !local.resolved_config.compute_provider.aws.ec2.instance_termination_watcher.features.runner_deregistration.enabled + && local.resolved_config.multi_runner_config["lane"].ssm.housekeeper.lambda.artifact.zip == null + && local.resolved_config.multi_runner_config["lane"].ssm.housekeeper.lambda.artifact.s3.key == "lane-housekeeper.zip" + && toset(local.effective_config.multi_runner_config["lane"].runner.labels) == toset(["arm64", "linux", "self-hosted"]) + ) + error_message = "v2 inputs must resolve lane overrides before v2 global defaults." + } +} diff --git a/modules/multi-runner/tests/config-translation.tftest.hcl b/modules/multi-runner/tests/config-translation.tftest.hcl new file mode 100644 index 0000000000..b71d2ea67b --- /dev/null +++ b/modules/multi-runner/tests/config-translation.tftest.hcl @@ -0,0 +1,676 @@ +mock_provider "aws" { + mock_data "aws_caller_identity" { + defaults = { + account_id = "123456789012" + } + } + + mock_data "aws_iam_policy_document" { + defaults = { + json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}" + } + } + + mock_resource "aws_iam_role" { + defaults = { + arn = "arn:aws:iam::123456789012:role/test-role" + } + } + + mock_resource "aws_cloudwatch_event_bus" { + defaults = { + arn = "arn:aws:events:eu-west-1:123456789012:event-bus/test" + } + } + + mock_resource "aws_cloudwatch_event_rule" { + defaults = { + arn = "arn:aws:events:eu-west-1:123456789012:rule/test" + } + } + + mock_resource "aws_lambda_function" { + defaults = { + arn = "arn:aws:lambda:eu-west-1:123456789012:function:test" + } + } + + mock_resource "aws_sqs_queue" { + defaults = { + arn = "arn:aws:sqs:eu-west-1:123456789012:test" + } + } + + mock_resource "aws_s3_bucket" { + defaults = { + arn = "arn:aws:s3:::test-runner-binaries" + id = "test-runner-binaries" + } + } + + mock_resource "aws_apigatewayv2_api" { + defaults = { + execution_arn = "arn:aws:execute-api:eu-west-1:123456789012:test" + } + } +} + +mock_provider "random" {} +mock_provider "null" {} + +variables { + aws_region = "eu-west-1" + vpc_id = "vpc-stable" + subnet_ids = ["subnet-stable"] + + github_app = { + key_base64_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/key" + name = "/tests/github-app/key" + } + id_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/id" + name = "/tests/github-app/id" + } + webhook_secret_ssm = { + arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/tests/github-app/webhook-secret" + name = "/tests/github-app/webhook-secret" + } + } + + multi_runner_config = {} + + lambda_s3_bucket = "test-lambda-artifacts" + runners_lambda_zip = "README.md" + runners_lambda_s3_key = "runners.zip" + webhook_lambda_s3_key = "webhook.zip" + syncer_lambda_s3_key = "runner-binaries-syncer.zip" +} + +run "empty_v2_map_translates_stable_inputs" { + command = plan + + variables { + tags = { + source = "stable" + } + + role_path = "/stable/" + role_permissions_boundary = "arn:aws:iam::123456789012:policy/stable-boundary" + queue_selection_strategy = "random" + repository_white_list = ["example/repository"] + additional_github_apps = [{ + id = "additional-app-id" + key_base64 = "additional-app-key" + installation_id = "additional-installation-id" + }] + ghes_url = "https://github.example.test" + ghes_ssl_verify = false + user_agent = "stable-test-agent" + eventbridge = { enable = false, accept_events = ["workflow_job"] } + matcher_config_parameter_store_tier = "Advanced" + scale_up_lambda_memory_size = 1024 + runners_scale_up_lambda_timeout = 45 + scale_down_lambda_memory_size = 768 + runners_scale_down_lambda_timeout = 75 + webhook_lambda_memory_size = 384 + webhook_lambda_timeout = 20 + pool_lambda_timeout = 90 + pool_lambda_reserved_concurrent_executions = 2 + lambda_event_source_mapping_batch_size = 25 + lambda_event_source_mapping_maximum_batching_window_in_seconds = 10 + webhook_lambda_apigateway_access_log_settings = { + destination_arn = "arn:aws:logs:eu-west-1:123456789012:log-group:test" + format = "$context.requestId" + } + kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/stable" + queue_encryption = { + kms_data_key_reuse_period_seconds = 300 + kms_master_key_id = "arn:aws:kms:eu-west-1:123456789012:key/queue" + sqs_managed_sse_enabled = null + } + ssm_paths = { + root = "legacy-root" + app = "legacy-app" + runners = "legacy-runners" + webhook = "legacy-webhook" + } + parameter_store_tags = { owner = "stable-test" } + runners_ssm_housekeeper = { + schedule_expression = "rate(2 days)" + enabled = false + lambda_memory_size = 640 + lambda_timeout = 70 + config = { + tokenPath = "/stable/tokens" + minimumDaysOld = 5 + dryRun = true + } + } + log_level = "debug" + logging_retention_in_days = 30 + logging_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/logs" + log_class = "INFREQUENT_ACCESS" + tracing_config = { + mode = "Active" + capture_http_requests = true + capture_error = true + } + metrics = { + enable = true + namespace = "StableTest" + metric = { + enable_github_app_rate_limit = false + enable_job_retry = false + enable_spot_termination_warning = false + } + } + enable_managed_runner_security_group = false + runner_egress_rules = [{ + cidr_blocks = ["10.0.0.0/8"] + ipv6_cidr_blocks = [] + prefix_list_ids = [] + from_port = 443 + protocol = "tcp" + security_groups = [] + self = false + to_port = 443 + description = "stable-test" + }] + runner_additional_security_group_ids = ["sg-stable"] + cloudwatch_config = "{\"metrics\":{}}" + instance_profile_path = "/stable/instance-profile/" + key_name = "stable-key" + associate_public_ipv4_address = true + instance_termination_watcher = { + enable = true + enable_runner_deregistration = false + environment_variables = { MODE = "stable-test" } + memory_size = 256 + timeout = 40 + zip = "watcher.zip" + s3_key = "watcher.zip" + s3_object_version = "watcher-version" + } + runner_binaries_s3_sse_configuration = { + rule = { + bucket_key_enabled = true + apply_server_side_encryption_by_default = { + sse_algorithm = "aws:kms" + kms_master_key_id = "arn:aws:kms:eu-west-1:123456789012:key/binaries" + } + } + } + runner_binaries_s3_tags = { component = "stable-test" } + runner_binaries_s3_versioning = "Enabled" + state_event_rule_binaries_syncer = "DISABLED" + + global_config = { + tags = { + source = "experimental-ignored" + } + roles = { + path = "/experimental-ignored/" + } + } + + global_config_github = { + user_agent = "experimental-ignored" + } + + global_config_lambda = { + runtime = "nodejs22.x" + } + + global_config_orchestration_provider = { + webhook = { + queue_selection_strategy = "first" + github = { + repository_white_list = ["ignored/repository"] + } + } + } + + global_config_compute_provider = { + aws = { + ec2 = { + vpc_id = "vpc-experimental-ignored" + subnet_ids = ["subnet-experimental-ignored"] + } + } + } + + multi_runner_config = { + stable = { + runner_config = { + runner_os = "linux" + runner_architecture = "x64" + instance_types = ["m5.large"] + runners_maximum_count = 2 + runner_group_name = "stable-group" + runner_iam_role_managed_policy_arns = [ + "arn:aws:iam::123456789012:policy/stable-runner", + ] + } + matcherConfig = { + labelMatchers = [["self-hosted", "linux", "x64"]] + } + } + } + } + + assert { + condition = ( + !local.use_v2_config + && toset(keys(local.normalized_config.multi_runner_config)) == toset(["stable"]) + && tomap(local.normalized_config.tags) == tomap(var.tags) + && local.normalized_config.roles.path == var.role_path + && local.normalized_config.roles.permissions_boundary == var.role_permissions_boundary + && local.normalized_config.github.app.key_base64_ssm == var.github_app.key_base64_ssm + && local.normalized_config.github.app.id_ssm == var.github_app.id_ssm + && local.normalized_config.github.app.webhook_secret_ssm == var.github_app.webhook_secret_ssm + && local.normalized_config.github.user_agent == var.user_agent + && jsonencode(local.normalized_config.github.additional_apps) == jsonencode(var.additional_github_apps) + && local.normalized_config.github.enterprise_server.url == var.ghes_url + && local.normalized_config.github.enterprise_server.ssl_verify == var.ghes_ssl_verify + && local.normalized_config.lambda.runtime == var.lambda_runtime + && local.normalized_config.lambda.artifact.s3.bucket == var.lambda_s3_bucket + && local.normalized_config.lambda.architecture == var.lambda_architecture + && local.normalized_config.orchestration_provider.webhook.queue_selection_strategy == var.queue_selection_strategy + && local.normalized_config.orchestration_provider.webhook.eventbridge.enabled == var.eventbridge.enable + && tolist(local.normalized_config.orchestration_provider.webhook.eventbridge.accept_events) == tolist(var.eventbridge.accept_events) + && local.normalized_config.orchestration_provider.webhook.matcher_config_parameter_store_tier == var.matcher_config_parameter_store_tier + && tolist(local.normalized_config.orchestration_provider.webhook.github.repository_white_list) == tolist(var.repository_white_list) + && local.normalized_config.orchestration_provider.webhook.lambda.scale.up.memory_size == var.scale_up_lambda_memory_size + && local.normalized_config.orchestration_provider.webhook.lambda.scale.down.timeout == var.runners_scale_down_lambda_timeout + && local.normalized_config.orchestration_provider.webhook.lambda.webhook.memory_size == var.webhook_lambda_memory_size + && local.normalized_config.orchestration_provider.webhook.lambda.pool.timeout == var.pool_lambda_timeout + && jsonencode(local.normalized_config.orchestration_provider.webhook.queue.encryption) == jsonencode(var.queue_encryption) + && local.normalized_config.ssm.paths.root == "/${var.ssm_paths.root}/${var.prefix}" + && local.normalized_config.ssm.paths.tokens == "${var.ssm_paths.runners}/tokens" + && local.normalized_config.ssm.kms_key_id == var.kms_key_arn + && local.normalized_config.ssm.housekeeper.state == "DISABLED" + && local.normalized_config.ssm.housekeeper.config.minimumDaysOld == var.runners_ssm_housekeeper.config.minimumDaysOld + && local.normalized_config.observability.logs.level == var.log_level + && local.normalized_config.observability.logs.retention_in_days == var.logging_retention_in_days + && local.normalized_config.observability.logs.kms_key_id == var.logging_kms_key_id + && jsonencode(local.normalized_config.observability.tracing) == jsonencode(var.tracing_config) + && local.normalized_config.observability.metrics.namespace == var.metrics.namespace + && local.normalized_config.compute_provider.aws.ec2.vpc_id == var.vpc_id + && tolist(local.normalized_config.compute_provider.aws.ec2.subnet_ids) == tolist(var.subnet_ids) + && local.normalized_config.compute_provider.aws.ec2.managed_security_group_enabled == var.enable_managed_runner_security_group + && jsonencode(local.normalized_config.compute_provider.aws.ec2.egress_rules) == jsonencode(var.runner_egress_rules) + && jsonencode(local.normalized_config.compute_provider.aws.ec2.additional_security_group_ids) == jsonencode(var.runner_additional_security_group_ids) + && local.normalized_config.compute_provider.aws.ec2.cloudwatch_agent.config == var.cloudwatch_config + && local.normalized_config.compute_provider.aws.ec2.instance_profile_path == var.instance_profile_path + && local.normalized_config.compute_provider.aws.ec2.key_name == var.key_name + && local.normalized_config.compute_provider.aws.ec2.associate_public_ipv4_address == var.associate_public_ipv4_address + ) + error_message = "An empty v2 runner map must translate stable global inputs across every canonical section." + } + + assert { + condition = ( + local.stable_to_v2.tags.source == var.tags.source + && local.stable_to_v2.roles.path == var.role_path + && local.stable_to_v2.github.user_agent == var.user_agent + && local.stable_to_v2.lambda.artifact.s3.bucket == var.lambda_s3_bucket + && local.stable_to_v2.orchestration_provider.webhook.lambda.scale.up.event_source_mapping.batch_size == var.lambda_event_source_mapping_batch_size + && local.stable_to_v2.orchestration_provider.webhook.lambda.scale.down.idle_config == [] + && local.stable_to_v2.ssm.parameters.tags.owner == var.parameter_store_tags.owner + && local.stable_to_v2.ssm.housekeeper.lambda.memory_size == var.runners_ssm_housekeeper.lambda_memory_size + && local.stable_to_v2.compute_provider.aws.ec2.runner_binaries.s3.encryption.sse_algorithm == "aws:kms" + && local.stable_to_v2.compute_provider.aws.ec2.runner_binaries.s3.encryption.kms_master_key_id == "arn:aws:kms:eu-west-1:123456789012:key/binaries" + && local.stable_to_v2.compute_provider.aws.ec2.instance_termination_watcher.enabled == var.instance_termination_watcher.enable + ) + error_message = "The stable-to-experimental adapter must preserve nested legacy values without relying on the selector." + } + + assert { + condition = ( + local.normalized_config.multi_runner_config["stable"].runner.os == "linux" + && local.normalized_config.multi_runner_config["stable"].runner.architecture == "x64" + && local.normalized_config.multi_runner_config["stable"].runner.group_name == "stable-group" + && local.normalized_config.multi_runner_config["stable"].runner.iam.managed_policy_arns["legacy-0"] == "arn:aws:iam::123456789012:policy/stable-runner" + && local.normalized_config.multi_runner_config["stable"].orchestration_provider.webhook.runner.maximum_count == 2 + && jsonencode(local.normalized_config.multi_runner_config["stable"].orchestration_provider.webhook.matcherConfig.labelMatchers) == jsonencode([["self-hosted", "linux", "x64"]]) + && toset(local.normalized_config.multi_runner_config["stable"].compute_provider.aws.ec2.instance_types) == toset(["m5.large"]) + ) + error_message = "Stable runner entries must translate into the canonical runner, orchestration, and compute-provider blocks." + } +} + +run "non_empty_v2_map_is_authoritative" { + command = plan + + variables { + experimental_features = ["multi-runner-v2"] + + tags = { + source = "stable-ignored" + } + + global_config = { + tags = { + source = "experimental" + } + runner = { + os = "linux" + architecture = "arm64" + } + } + + global_config_compute_provider = { + aws = { + ec2 = { + runner_binaries = { + enabled = false + } + } + } + } + + multi_runner_config = { + experimental = { + orchestration_provider = { + webhook = { + matcherConfig = { + labelMatchers = [["experimental"]] + } + } + } + compute_provider = { + aws = { + ec2 = { + instance_types = ["c7g.large"] + } + } + } + } + } + } + + assert { + condition = ( + local.use_v2_config + && toset(keys(local.normalized_config.multi_runner_config)) == toset(["experimental"]) + && local.normalized_config.tags.source == "experimental" + && toset(local.normalized_config.multi_runner_config["experimental"].compute_provider.aws.ec2.instance_types) == toset(["c7g.large"]) + && flatten(local.normalized_config.multi_runner_config["experimental"].orchestration_provider.webhook.matcherConfig.labelMatchers) == ["experimental"] + ) + error_message = "A non-empty v2 runner map must be authoritative and must not merge stable lanes or flat defaults." + } + + assert { + condition = jsonencode(local.normalized_config) == jsonencode(local.v2_config) + error_message = "A non-empty v2 runner map must select the v2 object without leaking stable flat inputs." + } + +} + +run "v2_entry_without_matcher_config_is_authoritative" { + command = plan + + variables { + experimental_features = ["multi-runner-v2"] + + multi_runner_config = { + no_matcher = { + runner = { + os = "linux" + architecture = "x64" + } + compute_provider = { + aws = { + ec2 = { + instance_types = ["m5.large"] + } + } + } + } + } + } + + assert { + condition = ( + local.use_v2_config + && toset(keys(local.normalized_config.multi_runner_config)) == toset(["no_matcher"]) + && try(local.normalized_config.multi_runner_config["no_matcher"].orchestration_provider.webhook.matcherConfig, null) == null + ) + error_message = "A v2 runner entry must be recognized without requiring matcher configuration." + } +} + +run "lane_values_override_experimental_globals" { + command = plan + + variables { + experimental_features = ["multi-runner-v2"] + + global_config = { + tags = { + scope = "global" + precedence = "global" + } + + runner = { + os = "linux" + architecture = "x64" + group_name = "global-group" + iam = { + managed_policy_arns = { + global = "arn:aws:iam::123456789012:policy/global-runner" + } + additional_trust_policy_json = "{}" + } + } + } + + global_config_orchestration_provider = { + webhook = { + runner = { + maximum_count = 4 + } + } + } + + global_config_observability = { + logs = { + level = "debug" + retention_in_days = 30 + } + } + + global_config_ssm = { + housekeeper = { + lambda = { + artifact = { + zip = "global-housekeeper.zip" + } + } + } + } + + global_config_compute_provider = { + aws = { + ec2 = { + vpc_id = "vpc-experimental" + subnet_ids = ["subnet-global"] + runner_binaries = { + enabled = false + } + tags = { + precedence = "global" + global = "true" + } + } + } + } + + multi_runner_config = { + lane = { + tags = { + precedence = "lane" + lane = "true" + } + runner = { + group_name = "lane-group" + iam = { + role = { + arn = "arn:aws:iam::123456789012:role/external-runner" + } + } + } + orchestration_provider = { + webhook = { + runner = { + maximum_count = 7 + } + matcherConfig = { + labelMatchers = [["self-hosted", "linux", "x64", "lane"]] + } + } + } + observability = { + logs = { + level = "warn" + } + } + ssm = { + housekeeper = { + lambda = { + artifact = { + s3 = { + key = "lane-housekeeper.zip" + } + } + } + } + } + compute_provider = { + aws = { + ec2 = { + instance_types = ["m7i.large"] + subnet_ids = ["subnet-lane"] + instance_profile = { + name = "lane-runner-profile" + } + tags = { + precedence = "lane" + provider = "lane" + } + } + } + } + } + } + } + + assert { + condition = ( + local.resolved_config.multi_runner_config["lane"].runner.os == "linux" + && local.resolved_config.multi_runner_config["lane"].runner.architecture == "x64" + && local.resolved_config.multi_runner_config["lane"].runner.group_name == "lane-group" + && local.resolved_config.multi_runner_config["lane"].orchestration_provider.webhook.runner.maximum_count == 7 + && local.resolved_config.multi_runner_config["lane"].observability.logs.level == "warn" + && local.resolved_config.multi_runner_config["lane"].observability.logs.retention_in_days == 30 + && local.resolved_config.multi_runner_config["lane"].ssm.housekeeper.lambda.artifact.zip == null + && local.resolved_config.multi_runner_config["lane"].ssm.housekeeper.lambda.artifact.s3.key == "lane-housekeeper.zip" + ) + error_message = "Lane values must override v2 globals while omitted values inherit their global defaults." + } + + assert { + condition = ( + tomap(local.resolved_config.multi_runner_config["lane"].tags) == tomap({ + scope = "global" + precedence = "lane" + lane = "true" + }) + && local.resolved_config.multi_runner_config["lane"].compute_provider.aws.ec2.vpc_id == "vpc-experimental" + && toset(local.resolved_config.multi_runner_config["lane"].compute_provider.aws.ec2.subnet_ids) == toset(["subnet-lane"]) + && tomap(local.resolved_config.multi_runner_config["lane"].compute_provider.aws.ec2.tags) == tomap({ + precedence = "lane" + global = "true" + provider = "lane" + }) + ) + error_message = "Tags and EC2 defaults must merge from v2 globals with lane values taking precedence." + } + + assert { + condition = ( + local.resolved_config.multi_runner_config["lane"].runner.iam.role.arn == "arn:aws:iam::123456789012:role/external-runner" + && length(local.resolved_config.multi_runner_config["lane"].runner.iam.managed_policy_arns) == 0 + && local.resolved_config.multi_runner_config["lane"].runner.iam.additional_trust_policy_json == null + ) + error_message = "An externally managed runner role must suppress inherited managed policies and trust-policy additions." + } +} + +run "global_external_runner_role_suppresses_inherited_iam_overrides" { + command = plan + + variables { + experimental_features = ["multi-runner-v2"] + + global_config = { + runner = { + os = "linux" + architecture = "x64" + iam = { + role = { + arn = "arn:aws:iam::123456789012:role/global-external-runner" + } + managed_policy_arns = { + global = "arn:aws:iam::123456789012:policy/global-runner" + } + additional_trust_policy_json = "{\"Version\":\"2012-10-17\"}" + } + } + } + + global_config_compute_provider = { + aws = { + ec2 = { + vpc_id = "vpc-global" + subnet_ids = ["subnet-global"] + runner_binaries = { + enabled = false + } + } + } + } + + multi_runner_config = { + lane = { + orchestration_provider = { + webhook = { + matcherConfig = { + labelMatchers = [["self-hosted"]] + } + } + } + compute_provider = { + aws = { + ec2 = { + instance_types = ["m5.large"] + instance_profile = { + name = "global-runner-profile" + } + } + } + } + } + } + } + + assert { + condition = ( + local.resolved_config.multi_runner_config["lane"].runner.iam.role.arn == "arn:aws:iam::123456789012:role/global-external-runner" + && length(local.resolved_config.multi_runner_config["lane"].runner.iam.managed_policy_arns) == 0 + && local.resolved_config.multi_runner_config["lane"].runner.iam.additional_trust_policy_json == null + ) + error_message = "A global external runner role must suppress inherited managed policies and trust-policy additions." + } +} diff --git a/modules/multi-runner/variables.experimental.compute-provider.tf b/modules/multi-runner/variables.experimental.compute-provider.tf new file mode 100644 index 0000000000..4780a156c3 --- /dev/null +++ b/modules/multi-runner/variables.experimental.compute-provider.tf @@ -0,0 +1,205 @@ +# Global compute-provider configuration. +variable "global_config_compute_provider" { + description = <<-EOT + Global compute-provider configuration shared by all runner lanes. + + global_config_compute_provider = { + selections: "Compute-provider selections keyed by namespace." + selections.namespace: "Provider namespace used to resolve a compute implementation." + selections.type: "Compute-provider type selected for the namespace." + aws.ec2.vpc_id: "Default VPC for EC2 runners." + aws.ec2.subnet_ids: "Default subnets for EC2 runners." + aws.ec2.managed_security_group_enabled: "Whether the module manages the default runner security group." + aws.ec2.egress_rules: "Egress rules for the managed runner security group." + aws.ec2.egress_rules.cidr_blocks: "IPv4 CIDR blocks allowed by an egress rule." + aws.ec2.egress_rules.ipv6_cidr_blocks: "IPv6 CIDR blocks allowed by an egress rule." + aws.ec2.egress_rules.prefix_list_ids: "AWS prefix lists allowed by an egress rule." + aws.ec2.egress_rules.from_port: "Start of the egress port range." + aws.ec2.egress_rules.protocol: "Protocol for the egress rule." + aws.ec2.egress_rules.security_groups: "Referenced security groups allowed by an egress rule." + aws.ec2.egress_rules.self: "Whether the security group itself is allowed by an egress rule." + aws.ec2.egress_rules.to_port: "End of the egress port range." + aws.ec2.egress_rules.description: "Description of the egress rule." + aws.ec2.additional_security_group_ids: "Additional security groups attached to EC2 runners." + aws.ec2.cloudwatch_agent.config: "CloudWatch Agent configuration for EC2 runners." + aws.ec2.instance_profile_path: "IAM path used for the EC2 instance profile." + aws.ec2.key_name: "EC2 key pair name assigned to runner instances." + aws.ec2.associate_public_ipv4_address: "Whether runner instances receive a public IPv4 address." + aws.ec2.tags: "Tags applied to EC2 runner resources." + aws.ec2.ami.housekeeper.enabled: "Whether AMI cleanup is enabled." + aws.ec2.ami.housekeeper.cleanup_config.maxItems: "Maximum number of AMIs retained by cleanup." + aws.ec2.ami.housekeeper.cleanup_config.minimumDaysOld: "Minimum AMI age in days before cleanup." + aws.ec2.ami.housekeeper.cleanup_config.amiFilters: "AMI filters used to select AMIs for cleanup." + aws.ec2.ami.housekeeper.cleanup_config.amiFilters.Name: "AMI filter name." + aws.ec2.ami.housekeeper.cleanup_config.amiFilters.Values: "Values matched by the AMI filter." + aws.ec2.ami.housekeeper.cleanup_config.launchTemplateNames: "Launch template names associated with AMIs eligible for cleanup." + aws.ec2.ami.housekeeper.cleanup_config.ssmParameterNames: "SSM parameter names associated with AMIs eligible for cleanup." + aws.ec2.ami.housekeeper.cleanup_config.dryRun: "Whether AMI cleanup reports changes without deleting AMIs." + aws.ec2.ami.housekeeper.artifact.zip: "Local ZIP artifact used for the AMI housekeeper Lambda." + aws.ec2.ami.housekeeper.artifact.s3.key: "S3 object key for the AMI housekeeper Lambda artifact." + aws.ec2.ami.housekeeper.artifact.s3.object_version: "Optional S3 object version for the AMI housekeeper artifact." + aws.ec2.ami.housekeeper.lambda.memory_size: "Memory allocated to the AMI housekeeper Lambda." + aws.ec2.ami.housekeeper.lambda.timeout: "Timeout in seconds for the AMI housekeeper Lambda." + aws.ec2.ami.housekeeper.schedule.expression: "Schedule expression for AMI cleanup." + aws.ec2.instance_termination_watcher.enabled: "Whether the instance termination watcher is enabled." + aws.ec2.instance_termination_watcher.features.runner_deregistration.enabled: "Whether terminated runners are deregistered." + aws.ec2.instance_termination_watcher.features.spot_termination_handler.enabled: "Whether spot termination events trigger runner handling." + aws.ec2.instance_termination_watcher.features.spot_termination_notification_watcher.enabled: "Whether spot termination notification monitoring is enabled." + aws.ec2.instance_termination_watcher.environment_variables: "Environment variables passed to the termination watcher." + aws.ec2.instance_termination_watcher.artifact.zip: "Local ZIP artifact used for the termination watcher Lambda." + aws.ec2.instance_termination_watcher.artifact.s3.key: "S3 object key for the termination watcher Lambda artifact." + aws.ec2.instance_termination_watcher.artifact.s3.object_version: "Optional S3 object version for the termination watcher artifact." + aws.ec2.instance_termination_watcher.lambda.memory_size: "Memory allocated to the termination watcher Lambda." + aws.ec2.instance_termination_watcher.lambda.timeout: "Timeout in seconds for the termination watcher Lambda." + aws.ec2.runner_binaries.enabled: "Whether runner binary synchronization is enabled." + aws.ec2.runner_binaries.s3.encryption.enabled: "Whether runner-binary S3 encryption is enabled." + aws.ec2.runner_binaries.s3.encryption.bucket_key_enabled: "Whether an S3 bucket key is used for KMS encryption." + aws.ec2.runner_binaries.s3.encryption.sse_algorithm: "S3 server-side encryption algorithm." + aws.ec2.runner_binaries.s3.encryption.kms_master_key_id: "KMS key ID used for runner-binary S3 encryption." + aws.ec2.runner_binaries.s3.tags: "Tags applied to the runner-binary S3 bucket." + aws.ec2.runner_binaries.s3.versioning: "S3 versioning state for the runner-binary bucket." + aws.ec2.runner_binaries.s3.logging.bucket: "S3 bucket receiving runner-binary access logs." + aws.ec2.runner_binaries.s3.logging.prefix: "Prefix for runner-binary S3 access logs." + aws.ec2.runner_binaries.syncer.artifact.zip: "Local ZIP artifact used for the runner-binary syncer Lambda." + aws.ec2.runner_binaries.syncer.artifact.s3.key: "S3 object key for the runner-binary syncer artifact." + aws.ec2.runner_binaries.syncer.artifact.s3.object_version: "Optional S3 object version for the runner-binary syncer artifact." + aws.ec2.runner_binaries.syncer.lambda.memory_size: "Memory allocated to the runner-binary syncer Lambda." + aws.ec2.runner_binaries.syncer.lambda.timeout: "Timeout in seconds for the runner-binary syncer Lambda." + aws.ec2.runner_binaries.syncer.schedule.expression: "Schedule expression for runner-binary synchronization." + aws.ec2.runner_binaries.syncer.schedule.state: "EventBridge rule state for runner-binary synchronization." + } + EOT + type = object({ + selections = optional(map(object({ + namespace = string + type = string + })), null) + aws = optional(object({ + ec2 = optional(object({ + vpc_id = optional(string, null) + subnet_ids = optional(list(string), null) + managed_security_group_enabled = optional(bool, true) + egress_rules = optional(list(object({ + cidr_blocks = list(string) + ipv6_cidr_blocks = list(string) + prefix_list_ids = list(string) + from_port = number + protocol = string + security_groups = list(string) + self = bool + to_port = number + description = string + })), [{ + cidr_blocks = ["0.0.0.0/0"] + ipv6_cidr_blocks = ["::/0"] + prefix_list_ids = null + from_port = 0 + protocol = "-1" + security_groups = null + self = null + to_port = 0 + description = null + }]) + additional_security_group_ids = optional(list(string), []) + cloudwatch_agent = optional(object({ + config = optional(string, null) + }), {}) + instance_profile_path = optional(string, null) + key_name = optional(string, null) + associate_public_ipv4_address = optional(bool, false) + tags = optional(map(string), {}) + ami = optional(object({ + housekeeper = optional(object({ + enabled = optional(bool, false) + cleanup_config = optional(object({ + maxItems = optional(number) + minimumDaysOld = optional(number) + amiFilters = optional(list(object({ + Name = string + Values = list(string) + }))) + launchTemplateNames = optional(list(string)) + ssmParameterNames = optional(list(string)) + dryRun = optional(bool) + }), {}) + artifact = optional(object({ + zip = optional(string, null) + s3 = optional(object({ + key = string + object_version = optional(string, null) + }), null) + }), {}) + lambda = optional(object({ + memory_size = optional(number, 256) + timeout = optional(number, 300) + }), {}) + schedule = optional(object({ + expression = optional(string, "cron(11 7 * * ? *)") + }), {}) + }), {}) + }), {}) + instance_termination_watcher = optional(object({ + enabled = optional(bool, false) + features = optional(object({ + runner_deregistration = optional(object({ + enabled = optional(bool, true) + }), {}) + spot_termination_handler = optional(object({ + enabled = optional(bool, true) + }), {}) + spot_termination_notification_watcher = optional(object({ + enabled = optional(bool, true) + }), {}) + }), {}) + environment_variables = optional(map(string), {}) + artifact = optional(object({ + zip = optional(string, null) + s3 = optional(object({ + key = string + object_version = optional(string, null) + }), null) + }), {}) + lambda = optional(object({ + memory_size = optional(number, null) + timeout = optional(number, null) + }), {}) + }), {}) + runner_binaries = optional(object({ + enabled = optional(bool, true) + s3 = optional(object({ + encryption = optional(object({ + enabled = optional(bool, true) + bucket_key_enabled = optional(bool, null) + sse_algorithm = optional(string, "AES256") + kms_master_key_id = optional(string, null) + }), {}) + tags = optional(map(string), {}) + versioning = optional(string, "Disabled") + logging = optional(object({ + bucket = optional(string, null) + prefix = optional(string, null) + }), {}) + }), {}) + syncer = optional(object({ + artifact = optional(object({ + zip = optional(string, null) + s3 = optional(object({ + key = string + object_version = optional(string, null) + }), null) + }), {}) + lambda = optional(object({ + memory_size = optional(number, 256) + timeout = optional(number, 300) + }), {}) + schedule = optional(object({ + expression = optional(string, "cron(27 * * * ? *)") + state = optional(string, "ENABLED") + }), {}) + }), {}) + }), {}) + }), {}) + }), {}) + }) + default = {} +} diff --git a/modules/multi-runner/variables.experimental.github.tf b/modules/multi-runner/variables.experimental.github.tf new file mode 100644 index 0000000000..6a783f7d59 --- /dev/null +++ b/modules/multi-runner/variables.experimental.github.tf @@ -0,0 +1,72 @@ +# Global GitHub configuration. +variable "global_config_github" { + description = <<-EOT + Global GitHub configuration shared by all runner lanes. + + global_config_github = { + app: { + key_base64: "Base64-encoded GitHub App private key." + key_base64_ssm: "SSM parameter containing the Base64-encoded GitHub App private key." + key_base64_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key." + key_base64_ssm.name: "Name of the SSM parameter containing the GitHub App private key." + id: "GitHub App ID." + id_ssm: "SSM parameter containing the GitHub App ID." + id_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID." + id_ssm.name: "Name of the SSM parameter containing the GitHub App ID." + webhook_secret: "GitHub App webhook secret." + webhook_secret_ssm: "SSM parameter containing the GitHub App webhook secret." + webhook_secret_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret." + webhook_secret_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret." + } + additional_apps: "Additional GitHub Apps used to distribute GitHub API requests." + additional_apps.key_base64: "Base64-encoded private key for an additional GitHub App." + additional_apps.key_base64_ssm: "SSM parameter containing an additional App private key." + additional_apps.key_base64_ssm.arn: "ARN of the SSM parameter containing an additional App private key." + additional_apps.key_base64_ssm.name: "Name of the SSM parameter containing an additional App private key." + additional_apps.id: "ID of an additional GitHub App." + additional_apps.id_ssm: "SSM parameter containing an additional GitHub App ID." + additional_apps.id_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID." + additional_apps.id_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID." + additional_apps.installation_id: "Optional installation ID for an additional GitHub App." + additional_apps.installation_id_ssm: "SSM parameter containing an additional App installation ID." + additional_apps.installation_id_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID." + additional_apps.installation_id_ssm.name: "Name of the SSM parameter containing an additional App installation ID." + enterprise_server.url: "GitHub Enterprise Server URL." + enterprise_server.ssl_verify: "Whether to verify the GitHub Enterprise Server TLS certificate." + user_agent: "User-Agent value sent with GitHub API requests." + } + EOT + type = object({ + app = optional(object({ + key_base64 = optional(string) + key_base64_ssm = optional(object({ + arn = string + name = string + })) + id = optional(string) + id_ssm = optional(object({ + arn = string + name = string + })) + webhook_secret = optional(string) + webhook_secret_ssm = optional(object({ + arn = string + name = string + })) + }), null) + additional_apps = optional(list(object({ + key_base64 = optional(string) + key_base64_ssm = optional(object({ arn = string, name = string })) + id = optional(string) + id_ssm = optional(object({ arn = string, name = string })) + installation_id = optional(string) + installation_id_ssm = optional(object({ arn = string, name = string })) + })), []) + enterprise_server = optional(object({ + url = optional(string, null) + ssl_verify = optional(bool, true) + }), {}) + user_agent = optional(string, "github-aws-runners") + }) + default = {} +} diff --git a/modules/multi-runner/variables.experimental.global.tf b/modules/multi-runner/variables.experimental.global.tf new file mode 100644 index 0000000000..de1def09cf --- /dev/null +++ b/modules/multi-runner/variables.experimental.global.tf @@ -0,0 +1,72 @@ +# Global defaults shared by all runner lanes. +variable "global_config" { + description = <<-EOT + Global defaults shared by all runner lanes. + + global_config = { + tags: "Tags applied to resources created for all runner lanes." + roles: { + path: "IAM path used for roles created for runner resources." + permissions_boundary: "Optional IAM permissions boundary ARN applied to created roles." + } + runner: { + os: "Default operating system for runners." + architecture: "Default runner architecture." + disable_default_labels: "Whether to omit the default operating-system, architecture, and self-hosted labels." + extra_labels: "Additional labels applied to all runners." + group_name: "Default GitHub runner group." + name_prefix: "Prefix for runner names." + run_as_root: "Whether the GitHub Actions runner executes as root." + run_as: "User that runs the GitHub Actions agent when it is not running as root." + auto_update_disabled: "Whether automatic GitHub Actions runner updates are disabled." + tags: "Tags applied to runner resources." + hooks: { + job_started: "Script executed when a job starts on a runner." + job_completed: "Script executed when a job completes on a runner." + } + iam: { + role.arn: "Existing IAM role ARN to use for runners." + managed_policy_arns: "Managed policy ARNs attached to the runner IAM role." + additional_trust_policy_json: "Additional trust policy JSON merged into the runner role trust policy." + path: "IAM path used for the runner role." + permissions_boundary: "Optional IAM permissions boundary ARN for the runner role." + } + } + } + EOT + type = object({ + tags = optional(map(string), {}) + + roles = optional(object({ + path = optional(string, null) + permissions_boundary = optional(string, null) + }), {}) + + runner = optional(object({ + os = optional(string, null) + architecture = optional(string, null) + disable_default_labels = optional(bool, false) + extra_labels = optional(list(string), []) + group_name = optional(string, "Default") + name_prefix = optional(string, "") + run_as_root = optional(bool, false) + run_as = optional(string, "ec2-user") + auto_update_disabled = optional(bool, false) + tags = optional(map(string), {}) + hooks = optional(object({ + job_started = optional(string, "") + job_completed = optional(string, "") + }), {}) + iam = optional(object({ + role = optional(object({ + arn = string + }), null) + managed_policy_arns = optional(map(string), {}) + additional_trust_policy_json = optional(string, null) + path = optional(string, null) + permissions_boundary = optional(string, null) + }), {}) + }), {}) + }) + default = {} +} diff --git a/modules/multi-runner/variables.experimental.lambda.tf b/modules/multi-runner/variables.experimental.lambda.tf new file mode 100644 index 0000000000..7438b53f95 --- /dev/null +++ b/modules/multi-runner/variables.experimental.lambda.tf @@ -0,0 +1,41 @@ +# Global Lambda configuration. +variable "global_config_lambda" { + description = <<-EOT + Global Lambda configuration shared by all runner lanes. + + global_config_lambda = { + artifact.s3.bucket: "S3 bucket containing Lambda deployment artifacts." + runtime: "Default Lambda runtime." + architecture: "Default Lambda instruction-set architecture." + principals: "Additional AWS principals allowed to invoke the Lambda functions." + principals.type: "Principal type, such as AWS account, service, or organization." + principals.identifiers: "Identifiers allowed for the principal type." + subnet_ids: "Subnets used by Lambda functions." + security_group_ids: "Security groups attached to Lambda functions." + tags: "Tags applied to Lambda functions and related resources." + role.path: "IAM path used for Lambda execution roles." + role.permissions_boundary: "Optional IAM permissions boundary ARN for Lambda execution roles." + } + EOT + type = object({ + artifact = optional(object({ + s3 = optional(object({ + bucket = optional(string, null) + }), {}) + }), {}) + runtime = optional(string, "nodejs24.x") + architecture = optional(string, "arm64") + principals = optional(list(object({ + type = string + identifiers = list(string) + })), []) + subnet_ids = optional(list(string), []) + security_group_ids = optional(list(string), []) + tags = optional(map(string), {}) + role = optional(object({ + path = optional(string, null) + permissions_boundary = optional(string, null) + }), {}) + }) + default = {} +} diff --git a/modules/multi-runner/variables.experimental.observability.tf b/modules/multi-runner/variables.experimental.observability.tf new file mode 100644 index 0000000000..bc4d68100a --- /dev/null +++ b/modules/multi-runner/variables.experimental.observability.tf @@ -0,0 +1,52 @@ +# Global observability configuration. +variable "global_config_observability" { + description = <<-EOT + Global observability configuration shared by all runner lanes. + + global_config_observability = { + logs.level: "Log level for module resources." + logs.retention_in_days: "CloudWatch log retention period in days." + logs.kms_key_id: "KMS key ID used to encrypt CloudWatch log groups." + logs.class: "CloudWatch log group class." + logs.tags: "Tags applied to CloudWatch log groups." + tracing.mode: "Tracing mode used by instrumented resources." + tracing.capture_http_requests: "Whether HTTP requests are captured by tracing." + tracing.capture_error: "Whether errors are captured by tracing." + metrics.enabled: "Whether module metrics are enabled." + metrics.namespace: "CloudWatch namespace used for module metrics." + metrics.metric.github_app_rate_limit.enabled: "Whether GitHub App rate-limit metrics are emitted." + metrics.metric.job_retry.enabled: "Whether job-retry metrics are emitted." + metrics.metric.spot_termination_warning.enabled: "Whether spot-termination warning metrics are emitted." + } + EOT + type = object({ + logs = optional(object({ + level = optional(string, "info") + retention_in_days = optional(number, 180) + kms_key_id = optional(string, null) + class = optional(string, "STANDARD") + tags = optional(map(string), {}) + }), {}) + tracing = optional(object({ + mode = optional(string, null) + capture_http_requests = optional(bool, false) + capture_error = optional(bool, false) + }), {}) + metrics = optional(object({ + enabled = optional(bool, false) + namespace = optional(string, "GitHub Runners") + metric = optional(object({ + github_app_rate_limit = optional(object({ + enabled = optional(bool, true) + }), {}) + job_retry = optional(object({ + enabled = optional(bool, true) + }), {}) + spot_termination_warning = optional(object({ + enabled = optional(bool, true) + }), {}) + }), {}) + }), {}) + }) + default = {} +} diff --git a/modules/multi-runner/variables.experimental.orchestration-provider.tf b/modules/multi-runner/variables.experimental.orchestration-provider.tf new file mode 100644 index 0000000000..fd962f9632 --- /dev/null +++ b/modules/multi-runner/variables.experimental.orchestration-provider.tf @@ -0,0 +1,177 @@ +# Global orchestration-provider configuration. +variable "global_config_orchestration_provider" { + description = <<-EOT + Global orchestration-provider configuration shared by all runner lanes. + + global_config_orchestration_provider = { + webhook: { + queue_selection_strategy: "Strategy used to select the build queue for a webhook event." + eventbridge.enabled: "Whether EventBridge integration is enabled for webhook events." + eventbridge.accept_events: "Event types accepted by the EventBridge integration." + matcher_config_parameter_store_tier: "SSM Parameter Store tier used for matcher configuration." + runner.boot_time_in_minutes: "Expected runner boot time used by orchestration." + runner.ephemeral: "Whether runners created by the orchestration provider are ephemeral." + runner.jit_config_enabled: "Whether JIT runner configuration is enabled." + runner.maximum_count: "Maximum number of runners that orchestration may create." + github.repository_white_list: "Repositories allowed to use the webhook configuration." + lambda.artifact.zip: "Local ZIP artifact used for orchestration Lambda functions." + lambda.artifact.s3.key: "S3 object key for the orchestration Lambda artifact." + lambda.artifact.s3.object_version: "Optional S3 object version for the orchestration Lambda artifact." + lambda.scale.up.memory_size: "Memory allocated to the scale-up Lambda." + lambda.scale.up.timeout: "Timeout in seconds for the scale-up Lambda." + lambda.scale.up.reserved_concurrent_executions: "Reserved concurrent executions for the scale-up Lambda." + lambda.scale.up.job_queued_check_enabled: "Whether the scale-up Lambda checks queued jobs." + lambda.scale.up.event_source_mapping.batch_size: "Maximum records passed to one scale-up Lambda invocation." + lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds: "Maximum time to batch records before invoking the scale-up Lambda." + lambda.scale.up.tags: "Tags applied to the scale-up Lambda." + lambda.scale.down.memory_size: "Memory allocated to the scale-down Lambda." + lambda.scale.down.timeout: "Timeout in seconds for the scale-down Lambda." + lambda.scale.down.schedule_expression: "Schedule expression for scale-down processing." + lambda.scale.down.minimum_running_time_in_minutes: "Minimum runner lifetime before scale-down." + lambda.scale.down.idle_config: "Scheduled minimum idle-runner pool settings." + lambda.scale.down.idle_config.cron: "Cron expression defining when the idle-runner count applies." + lambda.scale.down.idle_config.timeZone: "Time zone used to evaluate the idle-runner schedule." + lambda.scale.down.idle_config.idleCount: "Minimum number of idle runners maintained during the schedule." + lambda.scale.down.idle_config.evictionStrategy: "Strategy used when evicting idle runners." + lambda.scale.down.tags: "Tags applied to the scale-down Lambda." + lambda.webhook.artifact.zip: "Local ZIP artifact used for the webhook Lambda." + lambda.webhook.artifact.s3.key: "S3 object key for the webhook Lambda artifact." + lambda.webhook.artifact.s3.object_version: "Optional S3 object version for the webhook Lambda artifact." + lambda.webhook.api_gateway_access_log_settings: "API Gateway access-log destination and format." + lambda.webhook.api_gateway_access_log_settings.destination_arn: "ARN of the API Gateway access-log destination." + lambda.webhook.api_gateway_access_log_settings.format: "API Gateway access-log format." + lambda.webhook.memory_size: "Memory allocated to the webhook Lambda." + lambda.webhook.timeout: "Timeout in seconds for the webhook Lambda." + lambda.webhook.tags: "Tags applied to the webhook Lambda." + lambda.pool.memory_size: "Memory allocated to the pool Lambda." + lambda.pool.timeout: "Timeout in seconds for the pool Lambda." + lambda.pool.reserved_concurrent_executions: "Reserved concurrent executions for the pool Lambda." + lambda.pool.config: "Scheduled runner-pool size configuration." + lambda.pool.config.schedule_expression: "Schedule expression for the pool size." + lambda.pool.config.schedule_expression_timezone: "Time zone used to evaluate the pool schedule." + lambda.pool.config.size: "Runner pool size applied by the schedule." + lambda.pool.include_busy_runners: "Whether busy runners are included in pool sizing." + lambda.pool.runner_owner: "GitHub organization that owns the runner pool." + lambda.pool.tags: "Tags applied to the pool Lambda." + queue.delay_webhook_event: "Seconds a webhook event remains invisible in the build queue before processing." + queue.job_queue_retention_in_seconds: "Seconds a queued job is retained before it is purged." + queue.visibility_timeout_seconds: "Build queue visibility timeout in seconds." + queue.redrive_build_queue.enabled: "Whether the build queue dead-letter queue is enabled." + queue.redrive_build_queue.maxReceiveCount: "Maximum receives before a message is moved to the dead-letter queue." + queue.tags: "Tags applied to build queues." + queue.encryption.kms_data_key_reuse_period_seconds: "KMS data-key reuse period for queue encryption." + queue.encryption.kms_master_key_id: "KMS key ID used for queue encryption." + queue.encryption.sqs_managed_sse_enabled: "Whether SQS-managed server-side encryption is enabled." + } + } + EOT + type = object({ + webhook = optional(object({ + queue_selection_strategy = optional(string, "first") + eventbridge = optional(object({ + enabled = optional(bool, true) + accept_events = optional(list(string), []) + }), {}) + matcher_config_parameter_store_tier = optional(string, "Standard") + runner = optional(object({ + boot_time_in_minutes = optional(number, 5) + ephemeral = optional(bool, false) + jit_config_enabled = optional(bool, null) + maximum_count = optional(number, null) + }), {}) + + github = optional(object({ + repository_white_list = optional(list(string), []) + }), {}) + + lambda = optional(object({ + artifact = optional(object({ + zip = optional(string, null) + s3 = optional(object({ + key = string + object_version = optional(string, null) + }), null) + }), {}) + scale = optional(object({ + up = optional(object({ + memory_size = optional(number, 512) + timeout = optional(number, 30) + reserved_concurrent_executions = optional(number, 1) + job_queued_check_enabled = optional(bool, null) + event_source_mapping = optional(object({ + batch_size = optional(number, 10) + maximum_batching_window_in_seconds = optional(number, 0) + }), {}) + tags = optional(map(string), {}) + }), {}) + down = optional(object({ + memory_size = optional(number, 512) + timeout = optional(number, 60) + schedule_expression = optional(string, "cron(*/5 * * * ? *)") + minimum_running_time_in_minutes = optional(number, null) + idle_config = optional(list(object({ + cron = string + timeZone = string + idleCount = number + evictionStrategy = optional(string, "oldest_first") + })), []) + tags = optional(map(string), {}) + }), {}) + }), {}) + webhook = optional(object({ + artifact = optional(object({ + zip = optional(string, null) + s3 = optional(object({ + key = string + object_version = optional(string, null) + }), null) + }), {}) + api_gateway_access_log_settings = optional(object({ + destination_arn = string + format = string + }), null) + memory_size = optional(number, 256) + timeout = optional(number, 10) + tags = optional(map(string), {}) + }), {}) + pool = optional(object({ + memory_size = optional(number, 512) + timeout = optional(number, 60) + reserved_concurrent_executions = optional(number, 1) + config = optional(list(object({ + schedule_expression = string + schedule_expression_timezone = optional(string) + size = number + })), []) + include_busy_runners = optional(bool, false) + runner_owner = optional(string, null) + tags = optional(map(string), {}) + }), {}) + }), {}) + + queue = optional(object({ + delay_webhook_event = optional(number, 30) + job_queue_retention_in_seconds = optional(number, 86400) + visibility_timeout_seconds = optional(number, 180) + redrive_build_queue = optional(object({ + enabled = optional(bool, false) + maxReceiveCount = optional(number, null) + }), { + enabled = false + maxReceiveCount = null + }) + tags = optional(map(string), {}) + encryption = optional(object({ + kms_data_key_reuse_period_seconds = number + kms_master_key_id = string + sqs_managed_sse_enabled = bool + }), { + kms_data_key_reuse_period_seconds = null + kms_master_key_id = null + sqs_managed_sse_enabled = true + }) + }), {}) + }), {}) + }) + default = {} +} diff --git a/modules/multi-runner/variables.experimental.ssm.tf b/modules/multi-runner/variables.experimental.ssm.tf new file mode 100644 index 0000000000..586ae7fe3c --- /dev/null +++ b/modules/multi-runner/variables.experimental.ssm.tf @@ -0,0 +1,64 @@ +# Global SSM configuration. +variable "global_config_ssm" { + description = <<-EOT + Global SSM configuration shared by all runner lanes. + + global_config_ssm = { + paths.root: "Root path for SSM parameters." + paths.app: "Path segment for application parameters." + paths.webhook: "Path segment for webhook parameters." + paths.tokens: "Path segment for runner token parameters." + paths.config: "Path segment for runner configuration parameters." + kms_key_id: "KMS key ID used to encrypt SSM parameters." + tags: "Tags applied to SSM resources." + parameters.tags: "Tags applied to runner configuration parameters." + housekeeper.schedule_expression: "Schedule for the SSM parameter housekeeper." + housekeeper.state: "EventBridge rule state for the SSM parameter housekeeper." + housekeeper.tags: "Tags applied to the SSM housekeeper resources." + housekeeper.lambda.artifact.zip: "Local ZIP artifact used for the SSM housekeeper Lambda." + housekeeper.lambda.artifact.s3.key: "S3 object key for the SSM housekeeper Lambda artifact." + housekeeper.lambda.artifact.s3.object_version: "Optional S3 object version for the SSM housekeeper artifact." + housekeeper.lambda.memory_size: "Memory allocated to the SSM housekeeper Lambda." + housekeeper.lambda.timeout: "Timeout in seconds for the SSM housekeeper Lambda." + housekeeper.config.tokenPath: "Parameter path containing runner tokens to clean up." + housekeeper.config.minimumDaysOld: "Minimum age in days before an old token is eligible for cleanup." + housekeeper.config.dryRun: "Whether the SSM housekeeper reports cleanup without deleting parameters." + } + EOT + type = object({ + paths = optional(object({ + root = optional(string, null) + app = optional(string, "app") + webhook = optional(string, "webhook") + tokens = optional(string, "runners/tokens") + config = optional(string, "runners/config") + }), {}) + kms_key_id = optional(string, null) + tags = optional(map(string), {}) + parameters = optional(object({ + tags = optional(map(string), {}) + }), {}) + housekeeper = optional(object({ + schedule_expression = optional(string, "rate(1 day)") + state = optional(string, "ENABLED") + tags = optional(map(string), {}) + lambda = optional(object({ + artifact = optional(object({ + zip = optional(string, null) + s3 = optional(object({ + key = string + object_version = optional(string, null) + }), null) + }), {}) + memory_size = optional(number, 512) + timeout = optional(number, 60) + }), {}) + config = optional(object({ + tokenPath = optional(string, null) + minimumDaysOld = optional(number, 1) + dryRun = optional(bool, false) + }), {}) + }), {}) + }) + default = {} +} diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf index a47cd2a83c..bddc0873b4 100644 --- a/modules/multi-runner/variables.tf +++ b/modules/multi-runner/variables.tf @@ -86,9 +86,26 @@ variable "tags" { default = {} } +variable "experimental_features" { + description = <<-EOT + Explicit acknowledgement for opt-in features whose schemas may change + while experimental. Set to ["multi-runner-v2"] when using the v2 + provider-boundary configuration. This flag will become a deprecated no-op + for one release when the feature graduates. + EOT + type = set(string) + default = [] + + validation { + condition = alltrue([for feature in var.experimental_features : feature == "multi-runner-v2"]) + error_message = "experimental_features contains an unsupported feature. The only supported value is \"multi-runner-v2\"." + } +} + variable "multi_runner_config" { type = map(object({ - runner_config = object({ + # V1 contract + runner_config = optional(object({ runner_os = string runner_architecture = string runner_metadata_options = optional(map(any), { @@ -233,15 +250,15 @@ variable "multi_runner_config" { override_runner_role = false runner_role_arn = null }) - }) - matcherConfig = object({ + }), null) + matcherConfig = optional(object({ labelMatchers = list(list(string)) exactMatch = optional(bool, false) bidirectionalLabelMatch = optional(bool, false) priority = optional(number, 999) enableDynamicLabels = optional(bool, false) awsDynamicLabelsPolicy = optional(any, null) - }) + }), null) redrive_build_queue = optional(object({ enabled = bool maxReceiveCount = number @@ -249,8 +266,328 @@ variable "multi_runner_config" { enabled = false maxReceiveCount = null }) + + # V2 Contract + tags = optional(map(string), {}) + + runner = optional(object({ + os = optional(string, null) + architecture = optional(string, null) + disable_default_labels = optional(bool, null) + extra_labels = optional(list(string), null) + group_name = optional(string, null) + name_prefix = optional(string, null) + run_as_root = optional(bool, null) + run_as = optional(string, null) + auto_update_disabled = optional(bool, null) + tags = optional(map(string), {}) + hooks = optional(object({ + job_started = optional(string, null) + job_completed = optional(string, null) + }), {}) + iam = optional(object({ + role = optional(object({ + arn = string + }), null) + managed_policy_arns = optional(map(string), null) + additional_trust_policy_json = optional(string, null) + path = optional(string, null) + permissions_boundary = optional(string, null) + }), {}) + }), {}) + + lambda = optional(object({ + runtime = optional(string, null) + architecture = optional(string, null) + subnet_ids = optional(list(string), null) + security_group_ids = optional(list(string), null) + tags = optional(map(string), {}) + role = optional(object({ + path = optional(string, null) + permissions_boundary = optional(string, null) + }), {}) + }), {}) + + orchestration_provider = optional(object({ + webhook = optional(object({ + runner = optional(object({ + boot_time_in_minutes = optional(number, null) + ephemeral = optional(bool, null) + jit_config_enabled = optional(bool, null) + maximum_count = optional(number, null) + }), {}) + github = optional(object({ + organization_runners = optional(bool, false) + }), {}) + matcherConfig = optional(object({ + labelMatchers = list(list(string)) + exactMatch = optional(bool, false) + bidirectionalLabelMatch = optional(bool, false) + priority = optional(number, 999) + dynamic_labels_enabled = optional(bool, false) + awsDynamicLabelsPolicy = optional(object({ + blocked_keys = optional(list(string), []) + restricted_keys = optional(map(object({ + allowed = optional(list(string), []) + denied = optional(list(string), []) + max = optional(string, null) + })), {}) + }), null) + }), null) + queue = optional(object({ + delay_webhook_event = optional(number, null) + job_queue_retention_in_seconds = optional(number, null) + visibility_timeout_seconds = optional(number, null) + redrive_build_queue = optional(object({ + enabled = optional(bool, null) + maxReceiveCount = optional(number, null) + }), null) + tags = optional(map(string), {}) + }), {}) + lambda = optional(object({ + scale = optional(object({ + up = optional(object({ + memory_size = optional(number, null) + timeout = optional(number, null) + reserved_concurrent_executions = optional(number, null) + job_queued_check_enabled = optional(bool, null) + event_source_mapping = optional(object({ + batch_size = optional(number, null) + maximum_batching_window_in_seconds = optional(number, null) + }), {}) + tags = optional(map(string), {}) + }), {}) + down = optional(object({ + memory_size = optional(number, null) + timeout = optional(number, null) + schedule_expression = optional(string, null) + minimum_running_time_in_minutes = optional(number, null) + idle_config = optional(list(object({ + cron = string + timeZone = string + idleCount = number + evictionStrategy = optional(string, "oldest_first") + })), null) + tags = optional(map(string), {}) + }), {}) + }), {}) + pool = optional(object({ + memory_size = optional(number, null) + timeout = optional(number, null) + reserved_concurrent_executions = optional(number, null) + config = optional(list(object({ + schedule_expression = string + schedule_expression_timezone = optional(string) + size = number + })), null) + include_busy_runners = optional(bool, null) + runner_owner = optional(string, null) + tags = optional(map(string), {}) + }), {}) + }), {}) + job_retry = optional(object({ + enabled = optional(bool, false) + delay_in_seconds = optional(number, 300) + delay_backoff = optional(number, 2) + max_attempts = optional(number, 1) + tags = optional(map(string), {}) + lambda = optional(object({ + memory_size = optional(number, 256) + reserved_concurrent_executions = optional(number, 1) + timeout = optional(number, 30) + }), {}) + }), {}) + }), null) + }), {}) + + ssm = optional(object({ + paths = optional(object({ + root = optional(string, null) + tokens = optional(string, null) + config = optional(string, null) + }), {}) + tags = optional(map(string), {}) + parameters = optional(object({ + tags = optional(map(string), {}) + }), {}) + housekeeper = optional(object({ + schedule_expression = optional(string, null) + state = optional(string, null) + tags = optional(map(string), {}) + lambda = optional(object({ + artifact = optional(object({ + zip = optional(string, null) + s3 = optional(object({ + key = string + object_version = optional(string, null) + }), null) + }), {}) + memory_size = optional(number, null) + timeout = optional(number, null) + }), {}) + config = optional(object({ + tokenPath = optional(string, null) + minimumDaysOld = optional(number, null) + dryRun = optional(bool, null) + }), {}) + }), {}) + }), {}) + + observability = optional(object({ + logs = optional(object({ + level = optional(string, null) + retention_in_days = optional(number, null) + kms_key_id = optional(string, null) + class = optional(string, null) + tags = optional(map(string), {}) + }), {}) + tracing = optional(object({ + mode = optional(string, null) + capture_http_requests = optional(bool, null) + capture_error = optional(bool, null) + }), {}) + metrics = optional(object({ + enabled = optional(bool, null) + namespace = optional(string, null) + metric = optional(object({ + github_app_rate_limit = optional(object({ + enabled = optional(bool, null) + }), {}) + job_retry = optional(object({ + enabled = optional(bool, null) + }), {}) + spot_termination_warning = optional(object({ + enabled = optional(bool, null) + }), {}) + }), {}) + }), {}) + }), {}) + + compute_provider = optional(object({ + aws = optional(object({ + ec2 = optional(object({ + metadata_options = optional(object({ + instance_metadata_tags = optional(string, "enabled") + http_endpoint = optional(string, "enabled") + http_tokens = optional(string, "required") + http_put_response_hop_limit = optional(number, 1) + }), {}) + ami = optional(object({ + filter = optional(map(list(string)), { state = ["available"] }) + owners = optional(list(string), ["amazon"]) + id_ssm_parameter = optional(object({ + arn = string + }), null) + kms_key = optional(object({ + arn = string + }), null) + }), null) + block_device_mappings = optional(list(object({ + delete_on_termination = optional(bool, true) + device_name = optional(string, "/dev/xvda") + encrypted = optional(bool, true) + iops = optional(number) + kms_key_id = optional(string) + snapshot_id = optional(string) + throughput = optional(number) + volume_initialization_rate = optional(number) + volume_size = number + volume_type = optional(string, "gp3") + })), [{ volume_size = 30 }]) + create_service_linked_role_spot = optional(bool, false) + credit_specification = optional(string, null) + ebs_optimized = optional(bool, false) + cloudwatch_agent = optional(object({ + enabled = optional(bool, true) + config = optional(string, null) + }), {}) + binaries_syncer = optional(object({ + enabled = optional(bool, null) + }), {}) + detailed_monitoring_enabled = optional(bool, false) + ssm_enabled = optional(bool, false) + user_data = optional(object({ + enabled = optional(bool, true) + template = optional(string, null) + content = optional(string, null) + pre_install = optional(string, "") + post_install = optional(string, "") + debug_logging_enabled = optional(bool, false) + }), {}) + instance_allocation_strategy = optional(string, "lowest-price") + instance_max_spot_price = optional(string, null) + instance_target_capacity_type = optional(string, "spot") + instance_type_priorities = optional(map(number), null) + instance_types = optional(list(string), []) + additional_security_group_ids = optional(list(string), null) + managed_security_group_enabled = optional(bool, null) + egress_rules = optional(list(object({ + cidr_blocks = list(string) + ipv6_cidr_blocks = list(string) + prefix_list_ids = list(string) + from_port = number + protocol = string + security_groups = list(string) + self = bool + to_port = number + description = string + })), null) + instance_profile_path = optional(string, null) + key_name = optional(string, null) + associate_public_ipv4_address = optional(bool, null) + instance_profile = optional(object({ + name = string + }), null) + on_demand_failover_for_errors = optional(list(string), []) + scale_errors = optional(list(string), [ + "UnfulfillableCapacity", + "MaxSpotInstanceCountExceeded", + "TargetCapacityLimitExceededException", + "RequestLimitExceeded", + "ResourceLimitExceeded", + "MaxSpotInstanceCountExceeded", + "MaxSpotFleetRequestCountExceeded", + "InsufficientInstanceCapacity", + "InsufficientCapacityOnHost", + ]) + subnet_ids = optional(list(string), null) + vpc_id = optional(string, null) + cpu_options = optional(object({ + core_count = optional(number) + threads_per_core = optional(number) + amd_sev_snp = optional(string) + nested_virtualization = optional(string) + }), null) + placement = optional(object({ + affinity = optional(string) + availability_zone = optional(string) + group_id = optional(string) + group_name = optional(string) + host_id = optional(string) + host_resource_group_arn = optional(string) + spread_domain = optional(string) + tenancy = optional(string) + partition_number = optional(number) + }), null) + license_specifications = optional(list(object({ + license_configuration_arn = string + })), []) + use_dedicated_host = optional(bool, false) + log_files = optional(list(object({ + log_group_name = string + prefix_log_group = bool + file_path = string + log_stream_name = string + log_class = optional(string, "STANDARD") + })), null) + tags = optional(map(string), {}) + }), null) + }), {}) + }), {}) })) description = <