refactor(multi-runner): consume effective configuration

modules/multi-runner/ami-housekeeper.tf

@@ -1,35 +1,35 @@
 
 module "ami_housekeeper" {
-  count  = var.enable_ami_housekeeper ? 1 : 0
+  count  = try(local.effective_config.compute_provider.aws.ec2.ami.housekeeper.enabled, false) ? 1 : 0
   source = "../ami-housekeeper"
 
   prefix        = var.prefix
   tags          = local.tags
   aws_partition = var.aws_partition
 
-  lambda_zip               = var.ami_housekeeper_lambda_zip
-  lambda_s3_bucket         = var.lambda_s3_bucket
-  lambda_s3_key            = var.ami_housekeeper_lambda_s3_key
-  lambda_s3_object_version = var.ami_housekeeper_lambda_s3_object_version
+  lambda_zip               = try(local.effective_config.compute_provider.aws.ec2.ami.housekeeper.artifact.zip, null)
+  lambda_s3_bucket         = try(local.effective_config.lambda.artifact.s3.bucket, null)
+  lambda_s3_key            = try(local.effective_config.compute_provider.aws.ec2.ami.housekeeper.artifact.s3.key, null)
+  lambda_s3_object_version = try(local.effective_config.compute_provider.aws.ec2.ami.housekeeper.artifact.s3.object_version, null)
 
-  lambda_architecture       = var.lambda_architecture
-  lambda_principals         = var.lambda_principals
-  lambda_runtime            = var.lambda_runtime
-  lambda_security_group_ids = var.lambda_security_group_ids
-  lambda_subnet_ids         = var.lambda_subnet_ids
-  lambda_memory_size        = var.ami_housekeeper_lambda_memory_size
-  lambda_timeout            = var.ami_housekeeper_lambda_timeout
-  lambda_tags               = var.lambda_tags
-  tracing_config            = var.tracing_config
+  lambda_architecture       = local.effective_config.lambda.architecture
+  lambda_principals         = local.effective_config.lambda.principals
+  lambda_runtime            = local.effective_config.lambda.runtime
+  lambda_security_group_ids = local.effective_config.lambda.security_group_ids
+  lambda_subnet_ids         = local.effective_config.lambda.subnet_ids
+  lambda_memory_size        = local.effective_config.compute_provider.aws.ec2.ami.housekeeper.lambda.memory_size
+  lambda_timeout            = local.effective_config.compute_provider.aws.ec2.ami.housekeeper.lambda.timeout
+  lambda_tags               = local.effective_config.lambda.tags
+  tracing_config            = local.effective_config.observability.tracing
 
-  logging_retention_in_days = var.logging_retention_in_days
-  logging_kms_key_id        = var.logging_kms_key_id
-  log_class                 = var.log_class
-  log_level                 = var.log_level
+  logging_retention_in_days = local.effective_config.observability.logs.retention_in_days
+  logging_kms_key_id        = local.effective_config.observability.logs.kms_key_id
+  log_class                 = local.effective_config.observability.logs.class
+  log_level                 = local.effective_config.observability.logs.level
 
-  role_path                 = var.role_path
-  role_permissions_boundary = var.role_permissions_boundary
+  role_path                 = local.effective_config.roles.path
+  role_permissions_boundary = local.effective_config.roles.permissions_boundary
 
-  cleanup_config             = var.ami_housekeeper_cleanup_config
-  lambda_schedule_expression = var.ami_housekeeper_lambda_schedule_expression
+  cleanup_config             = local.effective_config.compute_provider.aws.ec2.ami.housekeeper.cleanup_config
+  lambda_schedule_expression = local.effective_config.compute_provider.aws.ec2.ami.housekeeper.schedule.expression
 }

modules/multi-runner/main.tf

@@ -1,10 +1,10 @@
 locals {
-  tags = merge(var.tags, {
+  tags = merge(local.effective_config.tags, {
     "ghr:environment" = var.prefix
   })
 
-  primary_app_id         = coalesce(var.github_app.id_ssm, module.ssm.parameters.github_app_id)
-  primary_app_key_base64 = coalesce(var.github_app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
+  primary_app_id         = coalesce(local.effective_config.github.app.id_ssm, module.ssm.parameters.github_app_id)
+  primary_app_key_base64 = coalesce(local.effective_config.github.app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
 
   github_app_parameters = {
     id = concat(
@@ -19,24 +19,13 @@ locals {
       [null],
       [for p in module.ssm.additional_app_parameters : p.installation_id]
     )
-    webhook_secret = coalesce(var.github_app.webhook_secret_ssm, module.ssm.parameters.github_app_webhook_secret)
+    webhook_secret = coalesce(local.effective_config.github.app.webhook_secret_ssm, module.ssm.parameters.github_app_webhook_secret)
   }
 
-  runner_extra_labels = { for k, v in var.multi_runner_config : k => sort(setunion(flatten(v.matcherConfig.labelMatchers), compact(v.runner_config.runner_extra_labels))) }
-
-  runner_config = { for k, v in var.multi_runner_config : k => merge(
-    {
-      id  = aws_sqs_queue.queued_builds[k].id
-      arn = aws_sqs_queue.queued_builds[k].arn
-      url = aws_sqs_queue.queued_builds[k].url
-    },
-    merge(v, { runner_config = merge(v.runner_config, { runner_extra_labels = local.runner_extra_labels[k] }) }),
-  ) }
-
-  tmp_distinct_list_unique_os_and_arch = distinct([for i, config in local.runner_config : { "os_type" : config.runner_config.runner_os, "architecture" : config.runner_config.runner_architecture } if config.runner_config.enable_runner_binaries_syncer])
-  unique_os_and_arch                   = { for i, v in local.tmp_distinct_list_unique_os_and_arch : "${v.os_type}_${v.architecture}" => v }
-
-  ssm_root_path = "/${var.ssm_paths.root}/${var.prefix}"
+  ssm_root_path = trimsuffix(coalesce(
+    local.effective_config.ssm.paths.root,
+    "/github-action-runners/${var.prefix}",
+  ), "/")
 }
 
 resource "random_string" "random" {

modules/multi-runner/outputs.tf

@@ -39,8 +39,8 @@ output "webhook" {
     lambda_role      = module.webhook.role
     endpoint         = "${module.webhook.gateway.api_endpoint}/${module.webhook.endpoint_relative_path}"
     webhook          = module.webhook.webhook
-    dispatcher       = var.eventbridge.enable ? module.webhook.dispatcher : null
-    eventbridge      = var.eventbridge.enable ? module.webhook.eventbridge : null
+    dispatcher       = local.effective_config.orchestration_provider.webhook.eventbridge.enabled ? module.webhook.dispatcher : null
+    eventbridge      = local.effective_config.orchestration_provider.webhook.eventbridge.enabled ? module.webhook.eventbridge : null
   }
 }
 
@@ -67,15 +67,15 @@ output "ssm_parameters" {
 }
 
 output "instance_termination_watcher" {
-  value = var.instance_termination_watcher.enable && var.instance_termination_watcher.features.enable_spot_termination_notification_watcher ? {
+  value = try(local.effective_config.compute_provider.aws.ec2.instance_termination_watcher.enabled, false) && local.effective_config.compute_provider.aws.ec2.instance_termination_watcher.features.spot_termination_notification_watcher.enabled ? {
     lambda           = module.instance_termination_watcher[0].spot_termination_notification.lambda
     lambda_log_group = module.instance_termination_watcher[0].spot_termination_notification.lambda_log_group
     lambda_role      = module.instance_termination_watcher[0].spot_termination_notification.lambda_role
   } : null
 }
 
 output "instance_termination_handler" {
-  value = var.instance_termination_watcher.enable && var.instance_termination_watcher.features.enable_spot_termination_handler ? {
+  value = try(local.effective_config.compute_provider.aws.ec2.instance_termination_watcher.enabled, false) && local.effective_config.compute_provider.aws.ec2.instance_termination_watcher.features.spot_termination_handler.enabled ? {
     lambda           = module.instance_termination_watcher[0].spot_termination_handler.lambda
     lambda_log_group = module.instance_termination_watcher[0].spot_termination_handler.lambda_log_group
     lambda_role      = module.instance_termination_watcher[0].spot_termination_handler.lambda_role

modules/multi-runner/queues.tf

@@ -27,42 +27,56 @@ data "aws_iam_policy_document" "deny_insecure_transport" {
 }
 
 resource "aws_sqs_queue" "queued_builds" {
-  for_each                   = var.multi_runner_config
+  for_each                   = local.effective_config.multi_runner_config
   name                       = "${var.prefix}-${each.key}-queued-builds"
-  delay_seconds              = each.value.runner_config.delay_webhook_event
-  visibility_timeout_seconds = var.runners_scale_up_lambda_timeout
-  message_retention_seconds  = each.value.runner_config.job_queue_retention_in_seconds
+  delay_seconds              = each.value.orchestration_provider.webhook.queue.delay_webhook_event
+  visibility_timeout_seconds = each.value.orchestration_provider.webhook.queue.visibility_timeout_seconds
+  message_retention_seconds  = each.value.orchestration_provider.webhook.queue.job_queue_retention_in_seconds
   receive_wait_time_seconds  = 0
-  redrive_policy = each.value.redrive_build_queue.enabled ? jsonencode({
+  redrive_policy = each.value.orchestration_provider.webhook.queue.redrive_build_queue.enabled ? jsonencode({
     deadLetterTargetArn = aws_sqs_queue.queued_builds_dlq[each.key].arn,
-    maxReceiveCount     = each.value.redrive_build_queue.maxReceiveCount
+    maxReceiveCount     = each.value.orchestration_provider.webhook.queue.redrive_build_queue.maxReceiveCount
   }) : null
 
-  sqs_managed_sse_enabled           = var.queue_encryption.sqs_managed_sse_enabled
-  kms_master_key_id                 = var.queue_encryption.kms_master_key_id
-  kms_data_key_reuse_period_seconds = var.queue_encryption.kms_data_key_reuse_period_seconds
+  sqs_managed_sse_enabled           = local.effective_config.orchestration_provider.webhook.queue.encryption.sqs_managed_sse_enabled
+  kms_master_key_id                 = local.effective_config.orchestration_provider.webhook.queue.encryption.kms_master_key_id
+  kms_data_key_reuse_period_seconds = local.effective_config.orchestration_provider.webhook.queue.encryption.kms_data_key_reuse_period_seconds
 
-  tags = var.tags
+  tags = merge(
+    local.effective_config.tags,
+    each.value.tags,
+    each.value.orchestration_provider.webhook.queue.tags,
+  )
 }
 
 resource "aws_sqs_queue_policy" "build_queue_policy" {
-  for_each  = var.multi_runner_config
+  for_each  = local.effective_config.multi_runner_config
   queue_url = aws_sqs_queue.queued_builds[each.key].id
   policy    = data.aws_iam_policy_document.deny_insecure_transport.json
 }
 
 resource "aws_sqs_queue" "queued_builds_dlq" {
-  for_each = { for config, values in var.multi_runner_config : config => values if values.redrive_build_queue.enabled }
-  name     = "${var.prefix}-${each.key}-queued-builds_dead_letter"
+  for_each = {
+    for config, values in local.effective_config.multi_runner_config : config => values
+    if values.orchestration_provider.webhook.queue.redrive_build_queue.enabled
+  }
+  name = "${var.prefix}-${each.key}-queued-builds_dead_letter"
 
-  sqs_managed_sse_enabled           = var.queue_encryption.sqs_managed_sse_enabled
-  kms_master_key_id                 = var.queue_encryption.kms_master_key_id
-  kms_data_key_reuse_period_seconds = var.queue_encryption.kms_data_key_reuse_period_seconds
-  tags                              = var.tags
+  sqs_managed_sse_enabled           = local.effective_config.orchestration_provider.webhook.queue.encryption.sqs_managed_sse_enabled
+  kms_master_key_id                 = local.effective_config.orchestration_provider.webhook.queue.encryption.kms_master_key_id
+  kms_data_key_reuse_period_seconds = local.effective_config.orchestration_provider.webhook.queue.encryption.kms_data_key_reuse_period_seconds
+  tags = merge(
+    local.effective_config.tags,
+    each.value.tags,
+    each.value.orchestration_provider.webhook.queue.tags,
+  )
 }
 
 resource "aws_sqs_queue_policy" "build_queue_dlq_policy" {
-  for_each  = { for config, values in var.multi_runner_config : config => values if values.redrive_build_queue.enabled }
+  for_each = {
+    for config, values in local.effective_config.multi_runner_config : config => values
+    if values.orchestration_provider.webhook.queue.redrive_build_queue.enabled
+  }
   queue_url = aws_sqs_queue.queued_builds_dlq[each.key].id
   policy    = data.aws_iam_policy_document.deny_insecure_transport.json
 }