forked from philips-labs/terraform-aws-github-runner
-
Notifications
You must be signed in to change notification settings - Fork 0
/
variables.tf
679 lines (586 loc) · 22.8 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
variable "aws_region" {
description = "AWS region."
type = string
}
variable "vpc_id" {
description = "The VPC for security groups of the action runners."
type = string
}
variable "subnet_ids" {
description = "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`."
type = list(string)
}
variable "tags" {
description = "Map of tags that will be added to created resources. By default resources will be tagged with name and environment."
type = map(string)
default = {}
}
variable "environment" {
description = "A name that identifies the environment, used as prefix and for tagging."
type = string
default = null
validation {
condition = var.environment == null
error_message = "The \"environment\" variable is no longer used. To migrate, set the \"prefix\" variable to the original value of \"environment\" and optionally, add \"Environment\" to the \"tags\" variable map with the same value."
}
}
variable "prefix" {
description = "The prefix used for naming resources"
type = string
default = "github-actions"
}
variable "enable_organization_runners" {
description = "Register runners to organization, instead of repo level"
type = bool
default = false
}
variable "github_app" {
description = "GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`)."
type = object({
key_base64 = string
id = string
webhook_secret = string
})
}
variable "scale_down_schedule_expression" {
description = "Scheduler expression to check every x for scale down."
type = string
default = "cron(*/5 * * * ? *)"
}
variable "minimum_running_time_in_minutes" {
description = "The time an ec2 action runner should be running at minimum before terminated if not busy."
type = number
default = null
}
variable "runner_boot_time_in_minutes" {
description = "The minimum time for an EC2 runner to boot and register as a runner."
type = number
default = 5
}
variable "runner_extra_labels" {
description = "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `enable_workflow_job_labels_check`. GitHub read-only labels should not be provided."
type = string
default = ""
}
variable "runner_group_name" {
description = "Name of the runner group."
type = string
default = "Default"
}
variable "scale_up_reserved_concurrent_executions" {
description = "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."
type = number
default = 1
}
variable "webhook_lambda_zip" {
description = "File location of the webhook lambda zip file."
type = string
default = null
}
variable "webhook_lambda_timeout" {
description = "Time out of the webhook lambda in seconds."
type = number
default = 10
}
variable "runners_lambda_zip" {
description = "File location of the lambda zip file for scaling runners."
type = string
default = null
}
variable "runners_scale_up_lambda_timeout" {
description = "Time out for the scale up lambda in seconds."
type = number
default = 30
}
variable "runners_scale_down_lambda_timeout" {
description = "Time out for the scale down lambda in seconds."
type = number
default = 60
}
variable "runner_binaries_syncer_lambda_zip" {
description = "File location of the binaries sync lambda zip file."
type = string
default = null
}
variable "runner_binaries_syncer_lambda_timeout" {
description = "Time out of the binaries sync lambda in seconds."
type = number
default = 300
}
variable "runner_binaries_s3_sse_configuration" {
description = "Map containing server-side encryption configuration for runner-binaries S3 bucket."
type = any
default = {}
}
variable "role_permissions_boundary" {
description = "Permissions boundary that will be added to the created roles."
type = string
default = null
}
variable "role_path" {
description = "The path that will be added to role path for created roles, if not set the environment name will be used."
type = string
default = null
}
variable "instance_profile_path" {
description = "The path that will be added to the instance_profile, if not set the environment name will be used."
type = string
default = null
}
variable "runner_as_root" {
description = "Run the action runner under the root user. Variable `runner_run_as` will be ignored."
type = bool
default = false
}
variable "runner_run_as" {
description = "Run the GitHub actions agent as user."
type = string
default = "ec2-user"
}
variable "runners_maximum_count" {
description = "The maximum number of runners that will be created."
type = number
default = 3
}
variable "kms_key_arn" {
description = "Optional CMK Key ARN to be used for Parameter Store. This key must be in the current account."
type = string
default = null
}
variable "enable_runner_detailed_monitoring" {
description = "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."
type = bool
default = false
}
variable "enabled_userdata" {
description = "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."
type = bool
default = true
}
variable "userdata_template" {
description = "Alternative user-data template, replacing the default template. By providing your own user_data you have to take care of installing all required software, including the action runner. Variables userdata_pre/post_install are ignored."
type = string
default = null
}
variable "userdata_pre_install" {
type = string
default = ""
description = "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"
}
variable "userdata_post_install" {
type = string
default = ""
description = "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"
}
variable "idle_config" {
description = "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."
type = list(object({
cron = string
timeZone = string
idleCount = number
}))
default = []
}
variable "enable_ssm_on_runners" {
description = "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."
type = bool
default = false
}
variable "logging_retention_in_days" {
description = "Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653."
type = number
default = 180
}
variable "logging_kms_key_id" {
description = "Specifies the kms key id to encrypt the logs with"
type = string
default = null
}
variable "runner_allow_prerelease_binaries" {
description = "Allow the runners to update to prerelease binaries."
type = bool
default = false
}
variable "block_device_mappings" {
description = "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`."
type = list(object({
delete_on_termination = bool
device_name = string
encrypted = bool
iops = number
kms_key_id = string
snapshot_id = string
throughput = number
volume_size = number
volume_type = string
}))
default = [{
delete_on_termination = true
device_name = "/dev/xvda"
encrypted = true
iops = null
kms_key_id = null
snapshot_id = null
throughput = null
volume_size = 30
volume_type = "gp3"
}]
}
variable "ami_filter" {
description = "List of maps used to create the AMI filter for the action runner AMI. By default amazon linux 2 is used."
type = map(list(string))
default = null
}
variable "ami_owners" {
description = "The list of owners used to select the AMI of action runner instances."
type = list(string)
default = ["amazon"]
}
variable "lambda_s3_bucket" {
description = "S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly."
default = null
}
variable "syncer_lambda_s3_key" {
description = "S3 key for syncer lambda function. Required if using S3 bucket to specify lambdas."
default = null
}
variable "syncer_lambda_s3_object_version" {
description = "S3 object version for syncer lambda function. Useful if S3 versioning is enabled on source bucket."
default = null
}
variable "webhook_lambda_s3_key" {
description = "S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas."
default = null
}
variable "webhook_lambda_s3_object_version" {
description = "S3 object version for webhook lambda function. Useful if S3 versioning is enabled on source bucket."
default = null
}
variable "webhook_lambda_apigateway_access_log_settings" {
type = object({
destination_arn = string
format = string
})
default = null
}
variable "runners_lambda_s3_key" {
description = "S3 key for runners lambda function. Required if using S3 bucket to specify lambdas."
default = null
}
variable "runners_lambda_s3_object_version" {
description = "S3 object version for runners lambda function. Useful if S3 versioning is enabled on source bucket."
default = null
}
variable "create_service_linked_role_spot" {
description = "(optional) create the serviced linked role for spot instances that is required by the scale-up lambda."
type = bool
default = false
}
variable "runner_iam_role_managed_policy_arns" {
description = "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"
type = list(string)
default = []
}
variable "enable_cloudwatch_agent" {
description = "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."
type = bool
default = true
}
variable "cloudwatch_config" {
description = "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
type = string
default = null
}
variable "runner_log_files" {
description = "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."
type = list(object({
log_group_name = string
prefix_log_group = bool
file_path = string
log_stream_name = string
}))
default = null
}
variable "ghes_url" {
description = "GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB"
type = string
default = null
}
variable "ghes_ssl_verify" {
description = "GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure)."
type = bool
default = true
}
variable "lambda_subnet_ids" {
description = "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`."
type = list(string)
default = []
}
variable "lambda_security_group_ids" {
description = "List of security group IDs associated with the Lambda function."
type = list(string)
default = []
}
variable "key_name" {
description = "Key pair name"
type = string
default = null
}
variable "runner_additional_security_group_ids" {
description = "(optional) List of additional security groups IDs to apply to the runner"
type = list(string)
default = []
}
variable "market_options" {
description = "DEPCRECATED: Replaced by `instance_target_capacity_type`."
type = string
default = null
validation {
condition = anytrue([var.market_options == null])
error_message = "Deprecated, replaced by `instance_target_capacity_type`."
}
}
variable "instance_target_capacity_type" {
description = "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."
type = string
default = "spot"
validation {
condition = contains(["spot", "on-demand"], var.instance_target_capacity_type)
error_message = "The instance target capacity should be either spot or on-demand."
}
}
variable "instance_allocation_strategy" {
description = "The allocation strategy for spot instances. AWS recommends to use `capacity-optimized` however the AWS default is `lowest-price`."
type = string
default = "lowest-price"
validation {
condition = contains(["lowest-price", "diversified", "capacity-optimized", "capacity-optimized-prioritized"], var.instance_allocation_strategy)
error_message = "The instance allocation strategy does not match the allowed values."
}
}
variable "instance_max_spot_price" {
description = "Max price price for spot intances per hour. This variable will be passed to the create fleet as max spot price for the fleet."
type = string
default = null
}
variable "instance_type" {
description = "[DEPRECATED] See instance_types."
type = string
default = null
validation {
condition = anytrue([var.instance_type == null])
error_message = "Deprecated, replaced by `instance_types`."
}
}
variable "instance_types" {
description = "List of instance types for the action runner. Defaults are based on runner_os (amzn2 for linux and Windows Server Core for win)."
type = list(string)
default = ["m5.large", "c5.large"]
}
variable "repository_white_list" {
description = "List of repositories allowed to use the github app"
type = list(string)
default = []
}
variable "delay_webhook_event" {
description = "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."
type = number
default = 30
}
variable "job_queue_retention_in_seconds" {
description = "The number of seconds the job is held in the queue before it is purged"
type = number
default = 86400
}
variable "runner_egress_rules" {
description = "List of egress rules for the GitHub runner instances."
type = list(object({
cidr_blocks = list(string)
ipv6_cidr_blocks = list(string)
prefix_list_ids = list(string)
from_port = number
protocol = string
security_groups = list(string)
self = bool
to_port = number
description = string
}))
default = [{
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]
prefix_list_ids = null
from_port = 0
protocol = "-1"
security_groups = null
self = null
to_port = 0
description = null
}]
}
variable "log_type" {
description = "Logging format for lambda logging. Valid values are 'json', 'pretty', 'hidden'. "
type = string
default = "pretty"
validation {
condition = anytrue([
var.log_type == "json",
var.log_type == "pretty",
var.log_type == "hidden",
])
error_message = "`log_type` value not valid. Valid values are 'json', 'pretty', 'hidden'."
}
}
variable "log_level" {
description = "Logging level for lambda logging. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'."
type = string
default = "info"
validation {
condition = anytrue([
var.log_level == "silly",
var.log_level == "trace",
var.log_level == "debug",
var.log_level == "info",
var.log_level == "warn",
var.log_level == "error",
var.log_level == "fatal",
])
error_message = "`log_level` value not valid. Valid values are 'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'."
}
}
variable "runner_enable_workflow_job_labels_check" {
description = "If set to true all labels in the workflow job even are matched against the custom labels and GitHub labels (os, architecture and `self-hosted`). When the labels are not matching the event is dropped at the webhook."
type = bool
default = false
}
variable "runner_enable_workflow_job_labels_check_all" {
description = "If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ label matches it will trigger the webhook. `runner_enable_workflow_job_labels_check` must be true for this to take effect."
type = bool
default = true
}
variable "runner_ec2_tags" {
description = "Map of tags that will be added to the launch template instance tag specifications."
type = map(string)
default = {}
}
variable "runner_metadata_options" {
description = "Metadata options for the ec2 runner instances."
type = map(any)
default = {
http_endpoint = "enabled"
http_tokens = "optional"
http_put_response_hop_limit = 1
}
}
variable "enable_ephemeral_runners" {
description = "Enable ephemeral runners, runners will only be used once."
type = bool
default = false
}
variable "enable_job_queued_check" {
description = "Only scale if the job event received by the scale up lambda is is in the state queued. By default enabled for non ephemeral runners and disabled for ephemeral. Set this variable to overwrite the default behavior."
type = bool
default = null
}
variable "enable_managed_runner_security_group" {
description = "Enabling the default managed security group creation. Unmanaged security groups can be specified via `runner_additional_security_group_ids`."
type = bool
default = true
}
variable "runner_os" {
description = "The EC2 Operating System type to use for action runner instances (linux,windows)."
type = string
default = "linux"
validation {
condition = contains(["linux", "windows"], var.runner_os)
error_message = "Valid values for runner_os are (linux, windows)."
}
}
variable "lambda_principals" {
description = "(Optional) add extra principals to the role created for execution of the lambda, e.g. for local testing."
type = list(object({
type = string
identifiers = list(string)
}))
default = []
}
variable "fifo_build_queue" {
description = "Enable a FIFO queue to remain the order of events received by the webhook. Suggest to set to true for repo level runners."
type = bool
default = false
}
variable "redrive_build_queue" {
description = "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."
type = object({
enabled = bool
maxReceiveCount = number
})
default = {
enabled = false
maxReceiveCount = null
}
validation {
condition = var.redrive_build_queue.enabled && var.redrive_build_queue.maxReceiveCount != null || !var.redrive_build_queue.enabled
error_message = "Ensure you have set the maxReceiveCount when enabled."
}
}
variable "runner_architecture" {
description = "The platform architecture of the runner instance_type."
type = string
default = "x64"
validation {
condition = contains(["x64", "arm64"], var.runner_architecture)
error_message = "`runner_architecture` value not valid, valid values are: `x64` and `arm64`."
}
}
variable "pool_lambda_timeout" {
description = "Time out for the pool lambda in seconds."
type = number
default = 60
}
variable "pool_runner_owner" {
description = "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."
type = string
default = null
}
variable "pool_lambda_reserved_concurrent_executions" {
description = "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."
type = number
default = 1
}
variable "pool_config" {
description = "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1."
type = list(object({
schedule_expression = string
size = number
}))
default = []
}
variable "aws_partition" {
description = "(optiona) partition in the arn namespace to use if not 'aws'"
type = string
default = "aws"
}
variable "disable_runner_autoupdate" {
description = "Disable the auto update of the github runner agent. Be-aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"
type = bool
default = false
}
variable "lambda_runtime" {
description = "AWS Lambda runtime."
type = string
default = "nodejs16.x"
}
variable "lambda_architecture" {
description = "AWS Lambda architecture. Lambda functions using Graviton processors ('arm64') tend to have better price/performance than 'x86_64' functions. "
type = string
default = "x86_64"
validation {
condition = contains(["arm64", "x86_64"], var.lambda_architecture)
error_message = "`lambda_architecture` value is not valid, valid values are: `arm64` and `x86_64`."
}
}
variable "enable_runner_binaries_syncer" {
description = "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."
type = bool
default = true
}