@rio-cloud/cdk-v2-constructs 6.0.1 → 6.2.1

package/docs/index.md

@@ -0,0 +1,105 @@
+# RIO CDK Constructs
+
+This package contains CDK2 constructs for RIO teams.
+
+> NPM: `@rio-cloud/cdk-v2-constructs`
+
+## Bootstrapping of CDK project
+
+```
+$ npx cdk init --language typescript
+```
+
+## Installation
+
+```
+$ npm install --save @rio-cloud/cdk-v2-constructs
+```
+
+## See also
+
+ * [How to contribute](./CONTRIBUTION.md)
+ * [Changelog](./CHANGELOG.md)
+ * [brief API description](./API.md)
+
+## Internal documentation for library devs
+[Documentation](./developers-readme.md)
+
+## Constructs overview (Under construction...)
+
+### Watchful
+
+Watchful constructs help generate some default monitors based on the resouces defined in your stack. Eg - If your stack contains a lambda function and you configure watchful construct, then it will create out of box metric monitors for Throttling, Lambda error and Log error monitors. The ever growing list of resources that watchful creates monitors for as of today are:
+
+- Application load balancer
+- Cloudfront
+- Documentdb
+- Dynamodb
+- Fargate
+- Lambda
+- RDS
+
+Simply add the following to your CDK stack to get started.
+```
+  import * as rio from '@rio-cloud/cdk-v2-constructs';
+    ...
+    const dw = new rio.watchfulv2.Watchful(this, 'Watchful', {
+      serviceName,
+    });
+    dw.watchScope(this); // Generates alarms for all supported resources
+    ...
+```
+
+There are options to override some defaults too. Please be aware that the library is very opinionated and is written with the most general use cases in mind. It is necessary to keep the use of the library simple enough, which means that there is only limited flexibility regarding the configuration options. Having said that, feel free to reach out to team CLAID over slack #rio-platform-support in case of feature requests.
+
+The broad classification of the monitors created by watchful are
+- Log error monitors
+- Metrics Query monitors: Basically everything other than log error monitors
+
+For Metrics query monitors, you can configure the priority (defaults as 3). For log error monitors, you can configure priority, renotification interval and can configure if the auto close of the monitor is disabled.
+```
+    ...
+    const dw = new Watchful(stack, 'Watchful2', { 
+      logErrorMonitorConfig: {
+        disableAutoClose: true, 
+        renotifyInterval: 150,
+        priority: 4,
+      },
+      queryErrorMonitorConfig: {
+        priority: 4
+      }
+    });
+    dw.watchScope(stack);
+```
+
+There is an `overrideAlarmThreshold` method which can be used to override the default watchful thresholds. Please make sure to use the method before the `watchscope` function.
+Eg -
+```
+...
+const dw = new Watchful(stack, 'Watchful', {});
+dw.overrideAlarmThreshold({
+  monitoredResourceScope: lambdaA,
+  monitorType: MonitorType.ERRORS,
+  threshold: 5,
+});
+dw.watchScope(stack);
+```
+
+### ClassifyPipelineType
+
+The pipelines can be tagged with key 'pipeline_type' to the following values:
+
+* deploy: To tag the production pipeline releasing the application
+* branch: The branch pipeline. Mostly used to test contributions / renovate updates
+* vulnerability: The vulnerability pipeline
+
+The construct `ClassifyPipelineType` can be used to tag the pipeline accordingly. This tag is also picked up by the Datadog pipeline metric used to monitor the pipelines. It is added as a tag to the metric. This gives you more flexibility with managing the monitors also. E.g. some teams don't want to get alerted for branch pipelines. You can then leverage this metric tag to filter the pipelines.
+
+Example:
+
+```typescript
+const pipeline = new pipelines.CodePipeline(this, 'Pipeline', {
+      ...
+    });
+rio.ClassifyPipelineType.apply(pipeline, rio.RioPipelineType.DEPLOY);
+```

package/lib/contributions/smart-route/gitlab-runner/autoscaling-runner.d.ts

@@ -0,0 +1,87 @@
+import { Environment, Stack } from 'aws-cdk-lib';
+import { InstanceType } from 'aws-cdk-lib/aws-ec2';
+import { IRole } from 'aws-cdk-lib/aws-iam';
+import { StringParameter } from 'aws-cdk-lib/aws-ssm';
+import { Construct } from 'constructs';
+/**
+ * The GitLabRunnerProps require the VPC ID, a defined environment of account and region, optional
+ * runner configuration and optionally the GitLab Runner Manager instance type. By default, a T3 Micro instance will be used.
+ * For larger workloads and very active teams it is recommended to use T3 Small for the manager instead.
+ */
+export interface GitLabRunnerProps {
+    readonly env: Environment;
+    readonly runnersWorkerProps?: GitlabRunnerWorkerProps[];
+    readonly managerInstanceType?: InstanceType;
+}
+/**
+ * The GitlabRunnerWorkerProps interface provides a simplified GitLab Runner worker configuration
+ * requiring a token as an SSM parameter, one of the valid gitlab URLs, instance of you choice, the desired max spot price,
+ * whether to use spot instance or not and a default role.
+ * It is recommended to use the RunnerRoles construct, and it's exposed default runner role.
+ */
+export interface GitlabRunnerWorkerProps {
+    /** The SSM StringParameter with the registered runner token  */
+    token: StringParameter;
+    /** The GitLab instance URL, either https://gitlab.cicd.man or https://gitlab.collaborationlayer-traton.com */
+    gitInstanceUrl: GitlabInstanceUrl;
+    /** The instance type for the runner worker */
+    instanceType: InstanceType;
+    /** The desired max spot price */
+    spotPrice: number;
+    /** Whether to use spot instance or not, Requires ServiceLinked Role for EC2 Spot to be deployed in the account */
+    requestSpotPrice: boolean;
+    /** The default role for the runner worker when spawned */
+    defaultWorkerRole: IRole;
+    /** The maximum number of builds for an instance before it has to be decommissioned. Default 10 */
+    maxBuilds?: number;
+    /** The maximum number of instances to keep idle for new incoming jobs. Default 5 */
+    maxIdleInstance?: number;
+    /** The maximum idle time seconds for an instance. Default 900 seconds */
+    maxIdleTime?: number;
+}
+export type GitlabInstanceUrl = 'https://gitlab.cicd.man' | 'https://gitlab.collaborationlayer-traton.com';
+/**
+ * The construct create the GitLabRunner Manager instance which will autoscale Runner instances based on the configuration.
+ * By default, the construct will create a Runner with a manager T3 Micro instance which will be enabled to spawn T3 Large Runner
+ * worker spot instance. The default runner Role has only the permissions to upload and download from the S3 runner cache.
+ *
+ * minimal configuration with runner spot instance:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'}
+ * });
+ *```
+ * recommended:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * const runnerRoles = new RunnerRoles(stack, 'RunnerRoles', {env: {account: '123456789012', region: 'eu-west-1'}});
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'},
+ *  runnersWorkerProps: [
+ *    {
+ *      token: myTokenForTaggedRunner1, // with this runner we only want to run jobs that require more power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.M7I_FLEX, InstanceSize.XLARGE), // exemplary larger runner
+ *      spotPrice: 0.2, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *    {
+ *      token: myTokenForTaggedRunner2, // with this runner we want to run all generic jobs that do not require much processing power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM), // exemplary smaller runner
+ *      spotPrice: 0.044, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *  ],
+ * });
+ * ```
+ */
+export declare class GitlabRunner extends Construct {
+    private autoscalingConfig;
+    constructor(scope: Stack, id: string, props: GitLabRunnerProps);
+    private createWorkerConfigurations;
+    private getDefaultRunnerWorkerConfig;
+}

package/lib/contributions/smart-route/gitlab-runner/autoscaling-runner.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitlabRunner = void 0;
+// eslint-disable-next-line import/no-extraneous-dependencies
+const cdk_autoscaling_gitlab_runner_1 = require("@pepperize/cdk-autoscaling-gitlab-runner");
+const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
+const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
+const constructs_1 = require("constructs");
+const rio_landing_zone_1 = require("../../../rio-landing-zone");
+/**
+ * The construct create the GitLabRunner Manager instance which will autoscale Runner instances based on the configuration.
+ * By default, the construct will create a Runner with a manager T3 Micro instance which will be enabled to spawn T3 Large Runner
+ * worker spot instance. The default runner Role has only the permissions to upload and download from the S3 runner cache.
+ *
+ * minimal configuration with runner spot instance:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'}
+ * });
+ *```
+ * recommended:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * const runnerRoles = new RunnerRoles(stack, 'RunnerRoles', {env: {account: '123456789012', region: 'eu-west-1'}});
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'},
+ *  runnersWorkerProps: [
+ *    {
+ *      token: myTokenForTaggedRunner1, // with this runner we only want to run jobs that require more power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.M7I_FLEX, InstanceSize.XLARGE), // exemplary larger runner
+ *      spotPrice: 0.2, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *    {
+ *      token: myTokenForTaggedRunner2, // with this runner we want to run all generic jobs that do not require much processing power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM), // exemplary smaller runner
+ *      spotPrice: 0.044, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *  ],
+ * });
+ * ```
+ */
+class GitlabRunner extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.autoscalingConfig = [{
+                periods: ['* * 7-24 * * mon-fri *'],
+                timezone: 'Europe/Berlin',
+            }];
+        const vpc = rio_landing_zone_1.RioLandingZone.getDefaultVpc(scope);
+        const runnerConfig = props.runnersWorkerProps ?
+            this.createWorkerConfigurations(props.runnersWorkerProps, props.env) :
+            this.getDefaultRunnerWorkerConfig(props.env);
+        const managerInstance = props.managerInstanceType ?? aws_ec2_1.InstanceType.of(aws_ec2_1.InstanceClass.T3, aws_ec2_1.InstanceSize.MICRO);
+        new cdk_autoscaling_gitlab_runner_1.GitlabRunnerAutoscaling(scope, `GLR${scope.stackName}`, {
+            runners: runnerConfig,
+            network: {
+                vpc: vpc,
+            },
+            manager: {
+                instanceType: managerInstance,
+            },
+            checkInterval: 30, // check every 30s for pending jobs
+            concurrent: 300, // Global limit of concurrent jobs,
+        });
+    }
+    createWorkerConfigurations(workerProps, env) {
+        return workerProps.map(val => ({
+            token: val.token,
+            role: val.defaultWorkerRole,
+            configuration: {
+                url: val.gitInstanceUrl,
+                machine: {
+                    autoscaling: this.autoscalingConfig,
+                    maxBuilds: val.maxBuilds ?? 10,
+                    idleCount: val.maxIdleInstance ?? 5,
+                    idleTime: val.maxIdleTime ?? 900,
+                    machineOptions: {
+                        requestSpotInstance: val.requestSpotPrice,
+                        spotPrice: val.spotPrice,
+                    },
+                },
+                environment: [
+                    'DOCKER_DRIVER=overlay2',
+                    'DOCKER_TLS_DIRCE=/certs',
+                    `DOCKER_AUTH_CONFIG={"credHelpers": { "public.ecr.aws": "ecr-login", "${env.account}.dkr.ecr.<region>.amazonaws.com": "ecr-login" } }`,
+                ],
+            },
+            instanceType: val.instanceType,
+        }));
+    }
+    getDefaultRunnerWorkerConfig(env) {
+        const gitLabRunnerTokenParameter = aws_ssm_1.StringParameter.fromStringParameterAttributes(this, 'RunnerToken', {
+            parameterName: '/config/gitlab-runner-cdk/token',
+        });
+        return [{
+                token: gitLabRunnerTokenParameter,
+                configuration: {
+                    url: 'https://gitlab.cicd.man',
+                    limit: 0,
+                    machine: {
+                        maxBuilds: 10,
+                        autoscaling: this.autoscalingConfig,
+                        idleCount: 5,
+                        idleTime: 900,
+                        machineOptions: {
+                            requestSpotInstance: true,
+                            spotPrice: 0.09,
+                        },
+                    },
+                    environment: [
+                        'DOCKER_DRIVER=overlay2',
+                        'DOCKER_TLS_DIRCE=/certs',
+                        `DOCKER_AUTH_CONFIG={"credHelpers": { "public.ecr.aws": "ecr-login", "${env.account}.dkr.ecr.<region>.amazonaws.com": "ecr-login" } }`,
+                    ],
+                },
+                instanceType: aws_ec2_1.InstanceType.of(aws_ec2_1.InstanceClass.T3, aws_ec2_1.InstanceSize.LARGE),
+            }];
+    }
+}
+exports.GitlabRunner = GitlabRunner;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0b3NjYWxpbmctcnVubmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NvbnRyaWJ1dGlvbnMvc21hcnQtcm91dGUvZ2l0bGFiLXJ1bm5lci9hdXRvc2NhbGluZy1ydW5uZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkRBQTZEO0FBQzdELDRGQUlrRDtBQUVsRCxpREFBZ0Y7QUFFaEYsaURBQXNEO0FBQ3RELDJDQUF1QztBQUN2QyxnRUFBMkQ7QUE0QzNEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXNDRztBQUNILE1BQWEsWUFBYSxTQUFRLHNCQUFTO0lBS3pDLFlBQVksS0FBWSxFQUFFLEVBQVcsRUFBRSxLQUF3QjtRQUM3RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBTFgsc0JBQWlCLEdBQStCLENBQUM7Z0JBQ3ZELE9BQU8sRUFBRSxDQUFDLHdCQUF3QixDQUFDO2dCQUNuQyxRQUFRLEVBQUUsZUFBZTthQUMxQixDQUFDLENBQUM7UUFJRCxNQUFNLEdBQUcsR0FBRyxpQ0FBYyxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUVoRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUM3QyxJQUFJLENBQUMsMEJBQTBCLENBQUMsS0FBSyxDQUFDLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3RFLElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFFL0MsTUFBTSxlQUFlLEdBQUcsS0FBSyxDQUFDLG1CQUFtQixJQUFJLHNCQUFZLENBQUMsRUFBRSxDQUFDLHVCQUFhLENBQUMsRUFBRSxFQUFFLHNCQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFM0csSUFBSSx1REFBdUIsQ0FBQyxLQUFLLEVBQUUsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLEVBQUU7WUFDMUQsT0FBTyxFQUFFLFlBQVk7WUFDckIsT0FBTyxFQUFFO2dCQUNQLEdBQUcsRUFBRSxHQUFHO2FBQ1Q7WUFDRCxPQUFPLEVBQUU7Z0JBQ1AsWUFBWSxFQUFFLGVBQWU7YUFDOUI7WUFDRCxhQUFhLEVBQUUsRUFBRSxFQUFFLG1DQUFtQztZQUN0RCxVQUFVLEVBQUUsR0FBRyxFQUFFLG1DQUFtQztTQUNyRCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sMEJBQTBCLENBQUMsV0FBc0MsRUFBRSxHQUFnQjtRQUN6RixPQUFPLFdBQVcsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUM1QjtZQUNFLEtBQUssRUFBRSxHQUFHLENBQUMsS0FBSztZQUNoQixJQUFJLEVBQUUsR0FBRyxDQUFDLGlCQUFpQjtZQUMzQixhQUFhLEVBQUU7Z0JBQ2IsR0FBRyxFQUFFLEdBQUcsQ0FBQyxjQUFjO2dCQUN2QixPQUFPLEVBQUU7b0JBQ1AsV0FBVyxFQUFFLElBQUksQ0FBQyxpQkFBaUI7b0JBQ25DLFNBQVMsRUFBRSxHQUFHLENBQUMsU0FBUyxJQUFJLEVBQUU7b0JBQzlCLFNBQVMsRUFBRSxHQUFHLENBQUMsZUFBZSxJQUFJLENBQUM7b0JBQ25DLFFBQVEsRUFBRSxHQUFHLENBQUMsV0FBVyxJQUFJLEdBQUc7b0JBQ2hDLGNBQWMsRUFBRTt3QkFDZCxtQkFBbUIsRUFBRSxHQUFHLENBQUMsZ0JBQWdCO3dCQUN6QyxTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVM7cUJBQ3pCO2lCQUNGO2dCQUNELFdBQVcsRUFBRTtvQkFDWCx3QkFBd0I7b0JBQ3hCLHlCQUF5QjtvQkFDekIsd0VBQ0UsR0FBRyxDQUFDLE9BQ04sbURBQW1EO2lCQUNwRDthQUNGO1lBQ0QsWUFBWSxFQUFFLEdBQUcsQ0FBQyxZQUFZO1NBQy9CLENBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLDRCQUE0QixDQUFDLEdBQWdCO1FBQ25ELE1BQU0sMEJBQTBCLEdBQUcseUJBQWUsQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFO1lBQ3BHLGFBQWEsRUFBRSxpQ0FBaUM7U0FDakQsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxDQUFDO2dCQUNOLEtBQUssRUFBRSwwQkFBMEI7Z0JBQ2pDLGFBQWEsRUFBRTtvQkFDYixHQUFHLEVBQUUseUJBQXlCO29CQUM5QixLQUFLLEVBQUUsQ0FBQztvQkFDUixPQUFPLEVBQUU7d0JBQ1AsU0FBUyxFQUFFLEVBQUU7d0JBQ2IsV0FBVyxFQUFFLElBQUksQ0FBQyxpQkFBaUI7d0JBQ25DLFNBQVMsRUFBRSxDQUFDO3dCQUNaLFFBQVEsRUFBRSxHQUFHO3dCQUNiLGNBQWMsRUFBRTs0QkFDZCxtQkFBbUIsRUFBRSxJQUFJOzRCQUN6QixTQUFTLEVBQUUsSUFBSTt5QkFDaEI7cUJBQ0Y7b0JBQ0QsV0FBVyxFQUFFO3dCQUNYLHdCQUF3Qjt3QkFDeEIseUJBQXlCO3dCQUN6Qix3RUFDRSxHQUFHLENBQUMsT0FDTixtREFBbUQ7cUJBQ3BEO2lCQUNGO2dCQUNELFlBQVksRUFBRSxzQkFBWSxDQUFDLEVBQUUsQ0FBQyx1QkFBYSxDQUFDLEVBQUUsRUFBRSxzQkFBWSxDQUFDLEtBQUssQ0FBQzthQUNwRSxDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUF6RkQsb0NBeUZDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIGltcG9ydC9uby1leHRyYW5lb3VzLWRlcGVuZGVuY2llc1xuaW1wb3J0IHtcbiAgQXV0b3NjYWxpbmdDb25maWd1cmF0aW9uLFxuICBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZyxcbiAgR2l0bGFiUnVubmVyQXV0b3NjYWxpbmdKb2JSdW5uZXJQcm9wcyxcbn0gZnJvbSAnQHBlcHBlcml6ZS9jZGstYXV0b3NjYWxpbmctZ2l0bGFiLXJ1bm5lcic7XG5pbXBvcnQgeyBFbnZpcm9ubWVudCwgU3RhY2sgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBJbnN0YW5jZUNsYXNzLCBJbnN0YW5jZVNpemUsIEluc3RhbmNlVHlwZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1lYzInO1xuaW1wb3J0IHsgSVJvbGUgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IFN0cmluZ1BhcmFtZXRlciB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1zc20nO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBSaW9MYW5kaW5nWm9uZSB9IGZyb20gJy4uLy4uLy4uL3Jpby1sYW5kaW5nLXpvbmUnO1xuXG5cbi8qKlxuICogVGhlIEdpdExhYlJ1bm5lclByb3BzIHJlcXVpcmUgdGhlIFZQQyBJRCwgYSBkZWZpbmVkIGVudmlyb25tZW50IG9mIGFjY291bnQgYW5kIHJlZ2lvbiwgb3B0aW9uYWxcbiAqIHJ1bm5lciBjb25maWd1cmF0aW9uIGFuZCBvcHRpb25hbGx5IHRoZSBHaXRMYWIgUnVubmVyIE1hbmFnZXIgaW5zdGFuY2UgdHlwZS4gQnkgZGVmYXVsdCwgYSBUMyBNaWNybyBpbnN0YW5jZSB3aWxsIGJlIHVzZWQuXG4gKiBGb3IgbGFyZ2VyIHdvcmtsb2FkcyBhbmQgdmVyeSBhY3RpdmUgdGVhbXMgaXQgaXMgcmVjb21tZW5kZWQgdG8gdXNlIFQzIFNtYWxsIGZvciB0aGUgbWFuYWdlciBpbnN0ZWFkLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdExhYlJ1bm5lclByb3BzIHtcbiAgcmVhZG9ubHkgZW52OiBFbnZpcm9ubWVudDtcbiAgcmVhZG9ubHkgcnVubmVyc1dvcmtlclByb3BzPzogR2l0bGFiUnVubmVyV29ya2VyUHJvcHNbXTtcbiAgcmVhZG9ubHkgbWFuYWdlckluc3RhbmNlVHlwZT86IEluc3RhbmNlVHlwZTtcbn1cblxuLyoqXG4gKiBUaGUgR2l0bGFiUnVubmVyV29ya2VyUHJvcHMgaW50ZXJmYWNlIHByb3ZpZGVzIGEgc2ltcGxpZmllZCBHaXRMYWIgUnVubmVyIHdvcmtlciBjb25maWd1cmF0aW9uXG4gKiByZXF1aXJpbmcgYSB0b2tlbiBhcyBhbiBTU00gcGFyYW1ldGVyLCBvbmUgb2YgdGhlIHZhbGlkIGdpdGxhYiBVUkxzLCBpbnN0YW5jZSBvZiB5b3UgY2hvaWNlLCB0aGUgZGVzaXJlZCBtYXggc3BvdCBwcmljZSxcbiAqIHdoZXRoZXIgdG8gdXNlIHNwb3QgaW5zdGFuY2Ugb3Igbm90IGFuZCBhIGRlZmF1bHQgcm9sZS5cbiAqIEl0IGlzIHJlY29tbWVuZGVkIHRvIHVzZSB0aGUgUnVubmVyUm9sZXMgY29uc3RydWN0LCBhbmQgaXQncyBleHBvc2VkIGRlZmF1bHQgcnVubmVyIHJvbGUuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgR2l0bGFiUnVubmVyV29ya2VyUHJvcHMge1xuICAvKiogVGhlIFNTTSBTdHJpbmdQYXJhbWV0ZXIgd2l0aCB0aGUgcmVnaXN0ZXJlZCBydW5uZXIgdG9rZW4gICovXG4gIHRva2VuOiBTdHJpbmdQYXJhbWV0ZXI7XG4gIC8qKiBUaGUgR2l0TGFiIGluc3RhbmNlIFVSTCwgZWl0aGVyIGh0dHBzOi8vZ2l0bGFiLmNpY2QubWFuIG9yIGh0dHBzOi8vZ2l0bGFiLmNvbGxhYm9yYXRpb25sYXllci10cmF0b24uY29tICovXG4gIGdpdEluc3RhbmNlVXJsOiBHaXRsYWJJbnN0YW5jZVVybDtcbiAgLyoqIFRoZSBpbnN0YW5jZSB0eXBlIGZvciB0aGUgcnVubmVyIHdvcmtlciAqL1xuICBpbnN0YW5jZVR5cGU6IEluc3RhbmNlVHlwZTtcbiAgLyoqIFRoZSBkZXNpcmVkIG1heCBzcG90IHByaWNlICovXG4gIHNwb3RQcmljZTogbnVtYmVyO1xuICAvKiogV2hldGhlciB0byB1c2Ugc3BvdCBpbnN0YW5jZSBvciBub3QsIFJlcXVpcmVzIFNlcnZpY2VMaW5rZWQgUm9sZSBmb3IgRUMyIFNwb3QgdG8gYmUgZGVwbG95ZWQgaW4gdGhlIGFjY291bnQgKi9cbiAgcmVxdWVzdFNwb3RQcmljZTogYm9vbGVhbjtcbiAgLyoqIFRoZSBkZWZhdWx0IHJvbGUgZm9yIHRoZSBydW5uZXIgd29ya2VyIHdoZW4gc3Bhd25lZCAqL1xuICBkZWZhdWx0V29ya2VyUm9sZTogSVJvbGU7XG4gIC8qKiBUaGUgbWF4aW11bSBudW1iZXIgb2YgYnVpbGRzIGZvciBhbiBpbnN0YW5jZSBiZWZvcmUgaXQgaGFzIHRvIGJlIGRlY29tbWlzc2lvbmVkLiBEZWZhdWx0IDEwICovXG4gIG1heEJ1aWxkcz86IG51bWJlcjtcbiAgLyoqIFRoZSBtYXhpbXVtIG51bWJlciBvZiBpbnN0YW5jZXMgdG8ga2VlcCBpZGxlIGZvciBuZXcgaW5jb21pbmcgam9icy4gRGVmYXVsdCA1ICovXG4gIG1heElkbGVJbnN0YW5jZT86IG51bWJlcjtcbiAgLyoqIFRoZSBtYXhpbXVtIGlkbGUgdGltZSBzZWNvbmRzIGZvciBhbiBpbnN0YW5jZS4gRGVmYXVsdCA5MDAgc2Vjb25kcyAqL1xuICBtYXhJZGxlVGltZT86IG51bWJlcjtcbn1cblxuZXhwb3J0IHR5cGUgR2l0bGFiSW5zdGFuY2VVcmwgPSAnaHR0cHM6Ly9naXRsYWIuY2ljZC5tYW4nIHwgJ2h0dHBzOi8vZ2l0bGFiLmNvbGxhYm9yYXRpb25sYXllci10cmF0b24uY29tJ1xuXG5cbi8qKlxuICogVGhlIGNvbnN0cnVjdCBjcmVhdGUgdGhlIEdpdExhYlJ1bm5lciBNYW5hZ2VyIGluc3RhbmNlIHdoaWNoIHdpbGwgYXV0b3NjYWxlIFJ1bm5lciBpbnN0YW5jZXMgYmFzZWQgb24gdGhlIGNvbmZpZ3VyYXRpb24uXG4gKiBCeSBkZWZhdWx0LCB0aGUgY29uc3RydWN0IHdpbGwgY3JlYXRlIGEgUnVubmVyIHdpdGggYSBtYW5hZ2VyIFQzIE1pY3JvIGluc3RhbmNlIHdoaWNoIHdpbGwgYmUgZW5hYmxlZCB0byBzcGF3biBUMyBMYXJnZSBSdW5uZXJcbiAqIHdvcmtlciBzcG90IGluc3RhbmNlLiBUaGUgZGVmYXVsdCBydW5uZXIgUm9sZSBoYXMgb25seSB0aGUgcGVybWlzc2lvbnMgdG8gdXBsb2FkIGFuZCBkb3dubG9hZCBmcm9tIHRoZSBTMyBydW5uZXIgY2FjaGUuXG4gKlxuICogbWluaW1hbCBjb25maWd1cmF0aW9uIHdpdGggcnVubmVyIHNwb3QgaW5zdGFuY2U6XG4gKiBgYGB0c1xuICogbmV3IFNwb3RTZXJ2aWNlTGlua2VkUm9sZShzdGFjaywgJ1Nwb3RMaW5rZWRSb2xlJyk7XG4gKiBuZXcgR2l0bGFiUnVubmVyKHN0YWNrLCAnR2l0TGFiUnVubmVyJywge1xuICogIGVudjoge2FjY291bnQ6ICcxMjM0NTY3ODkwMTInLCByZWdpb246ICdldS13ZXN0LTEnfVxuICogfSk7XG4gKmBgYFxuICogcmVjb21tZW5kZWQ6XG4gKiBgYGB0c1xuICogbmV3IFNwb3RTZXJ2aWNlTGlua2VkUm9sZShzdGFjaywgJ1Nwb3RMaW5rZWRSb2xlJyk7XG4gKiBjb25zdCBydW5uZXJSb2xlcyA9IG5ldyBSdW5uZXJSb2xlcyhzdGFjaywgJ1J1bm5lclJvbGVzJywge2Vudjoge2FjY291bnQ6ICcxMjM0NTY3ODkwMTInLCByZWdpb246ICdldS13ZXN0LTEnfX0pO1xuICogbmV3IEdpdGxhYlJ1bm5lcihzdGFjaywgJ0dpdExhYlJ1bm5lcicsIHtcbiAqICBlbnY6IHthY2NvdW50OiAnMTIzNDU2Nzg5MDEyJywgcmVnaW9uOiAnZXUtd2VzdC0xJ30sXG4gKiAgcnVubmVyc1dvcmtlclByb3BzOiBbXG4gKiAgICB7XG4gKiAgICAgIHRva2VuOiBteVRva2VuRm9yVGFnZ2VkUnVubmVyMSwgLy8gd2l0aCB0aGlzIHJ1bm5lciB3ZSBvbmx5IHdhbnQgdG8gcnVuIGpvYnMgdGhhdCByZXF1aXJlIG1vcmUgcG93ZXJcbiAqICAgICAgZ2l0SW5zdGFuY2VVcmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsIC8vIG9yIHRoZSBUcmF0b24gR2l0TGFiXG4gKiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuTTdJX0ZMRVgsIEluc3RhbmNlU2l6ZS5YTEFSR0UpLCAvLyBleGVtcGxhcnkgbGFyZ2VyIHJ1bm5lclxuICogICAgICBzcG90UHJpY2U6IDAuMiwgLy8gZXhlbXBsYXJ5IHNwb3QgcHJpY2VcbiAqICAgICAgcmVxdWVzdFNwb3RQcmljZTogdHJ1ZSxcbiAqICAgICAgZGVmYXVsdFdvcmtlclJvbGU6IHJ1bm5lclJvbGVzLnJ1bm5lckJhc2VSb2xlLCAvLyB1c2UgdGhlIGJhc2Ugcm9sZVxuICogICAgfSxcbiAqICAgIHtcbiAqICAgICAgdG9rZW46IG15VG9rZW5Gb3JUYWdnZWRSdW5uZXIyLCAvLyB3aXRoIHRoaXMgcnVubmVyIHdlIHdhbnQgdG8gcnVuIGFsbCBnZW5lcmljIGpvYnMgdGhhdCBkbyBub3QgcmVxdWlyZSBtdWNoIHByb2Nlc3NpbmcgcG93ZXJcbiAqICAgICAgZ2l0SW5zdGFuY2VVcmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsIC8vIG9yIHRoZSBUcmF0b24gR2l0TGFiXG4gKiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuVDMsIEluc3RhbmNlU2l6ZS5NRURJVU0pLCAvLyBleGVtcGxhcnkgc21hbGxlciBydW5uZXJcbiAqICAgICAgc3BvdFByaWNlOiAwLjA0NCwgLy8gZXhlbXBsYXJ5IHNwb3QgcHJpY2VcbiAqICAgICAgcmVxdWVzdFNwb3RQcmljZTogdHJ1ZSxcbiAqICAgICAgZGVmYXVsdFdvcmtlclJvbGU6IHJ1bm5lclJvbGVzLnJ1bm5lckJhc2VSb2xlLCAvLyB1c2UgdGhlIGJhc2Ugcm9sZVxuICogICAgfSxcbiAqICBdLFxuICogfSk7XG4gKiBgYGBcbiAqL1xuZXhwb3J0IGNsYXNzIEdpdGxhYlJ1bm5lciBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHByaXZhdGUgYXV0b3NjYWxpbmdDb25maWc6IEF1dG9zY2FsaW5nQ29uZmlndXJhdGlvbltdID0gW3tcbiAgICBwZXJpb2RzOiBbJyogKiA3LTI0ICogKiBtb24tZnJpIConXSxcbiAgICB0aW1lem9uZTogJ0V1cm9wZS9CZXJsaW4nLFxuICB9XTtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IFN0YWNrLCBpZCA6IHN0cmluZywgcHJvcHM6IEdpdExhYlJ1bm5lclByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHZwYyA9IFJpb0xhbmRpbmdab25lLmdldERlZmF1bHRWcGMoc2NvcGUpO1xuXG4gICAgY29uc3QgcnVubmVyQ29uZmlnID0gcHJvcHMucnVubmVyc1dvcmtlclByb3BzID9cbiAgICAgIHRoaXMuY3JlYXRlV29ya2VyQ29uZmlndXJhdGlvbnMocHJvcHMucnVubmVyc1dvcmtlclByb3BzLCBwcm9wcy5lbnYpIDpcbiAgICAgIHRoaXMuZ2V0RGVmYXVsdFJ1bm5lcldvcmtlckNvbmZpZyhwcm9wcy5lbnYpO1xuXG4gICAgY29uc3QgbWFuYWdlckluc3RhbmNlID0gcHJvcHMubWFuYWdlckluc3RhbmNlVHlwZSA/PyBJbnN0YW5jZVR5cGUub2YoSW5zdGFuY2VDbGFzcy5UMywgSW5zdGFuY2VTaXplLk1JQ1JPKTtcblxuICAgIG5ldyBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZyhzY29wZSwgYEdMUiR7c2NvcGUuc3RhY2tOYW1lfWAsIHtcbiAgICAgIHJ1bm5lcnM6IHJ1bm5lckNvbmZpZyxcbiAgICAgIG5ldHdvcms6IHtcbiAgICAgICAgdnBjOiB2cGMsXG4gICAgICB9LFxuICAgICAgbWFuYWdlcjoge1xuICAgICAgICBpbnN0YW5jZVR5cGU6IG1hbmFnZXJJbnN0YW5jZSxcbiAgICAgIH0sXG4gICAgICBjaGVja0ludGVydmFsOiAzMCwgLy8gY2hlY2sgZXZlcnkgMzBzIGZvciBwZW5kaW5nIGpvYnNcbiAgICAgIGNvbmN1cnJlbnQ6IDMwMCwgLy8gR2xvYmFsIGxpbWl0IG9mIGNvbmN1cnJlbnQgam9icyxcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgY3JlYXRlV29ya2VyQ29uZmlndXJhdGlvbnMod29ya2VyUHJvcHM6IEdpdGxhYlJ1bm5lcldvcmtlclByb3BzW10sIGVudjogRW52aXJvbm1lbnQpOiBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZ0pvYlJ1bm5lclByb3BzW10ge1xuICAgIHJldHVybiB3b3JrZXJQcm9wcy5tYXAodmFsID0+IChcbiAgICAgIHtcbiAgICAgICAgdG9rZW46IHZhbC50b2tlbixcbiAgICAgICAgcm9sZTogdmFsLmRlZmF1bHRXb3JrZXJSb2xlLFxuICAgICAgICBjb25maWd1cmF0aW9uOiB7XG4gICAgICAgICAgdXJsOiB2YWwuZ2l0SW5zdGFuY2VVcmwsXG4gICAgICAgICAgbWFjaGluZToge1xuICAgICAgICAgICAgYXV0b3NjYWxpbmc6IHRoaXMuYXV0b3NjYWxpbmdDb25maWcsXG4gICAgICAgICAgICBtYXhCdWlsZHM6IHZhbC5tYXhCdWlsZHMgPz8gMTAsXG4gICAgICAgICAgICBpZGxlQ291bnQ6IHZhbC5tYXhJZGxlSW5zdGFuY2UgPz8gNSxcbiAgICAgICAgICAgIGlkbGVUaW1lOiB2YWwubWF4SWRsZVRpbWUgPz8gOTAwLFxuICAgICAgICAgICAgbWFjaGluZU9wdGlvbnM6IHtcbiAgICAgICAgICAgICAgcmVxdWVzdFNwb3RJbnN0YW5jZTogdmFsLnJlcXVlc3RTcG90UHJpY2UsXG4gICAgICAgICAgICAgIHNwb3RQcmljZTogdmFsLnNwb3RQcmljZSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICBlbnZpcm9ubWVudDogW1xuICAgICAgICAgICAgJ0RPQ0tFUl9EUklWRVI9b3ZlcmxheTInLFxuICAgICAgICAgICAgJ0RPQ0tFUl9UTFNfRElSQ0U9L2NlcnRzJyxcbiAgICAgICAgICAgIGBET0NLRVJfQVVUSF9DT05GSUc9e1wiY3JlZEhlbHBlcnNcIjogeyBcInB1YmxpYy5lY3IuYXdzXCI6IFwiZWNyLWxvZ2luXCIsIFwiJHtcbiAgICAgICAgICAgICAgZW52LmFjY291bnRcbiAgICAgICAgICAgIH0uZGtyLmVjci48cmVnaW9uPi5hbWF6b25hd3MuY29tXCI6IFwiZWNyLWxvZ2luXCIgfSB9YCxcbiAgICAgICAgICBdLFxuICAgICAgICB9LFxuICAgICAgICBpbnN0YW5jZVR5cGU6IHZhbC5pbnN0YW5jZVR5cGUsXG4gICAgICB9XG4gICAgKSk7XG4gIH1cblxuICBwcml2YXRlIGdldERlZmF1bHRSdW5uZXJXb3JrZXJDb25maWcoZW52OiBFbnZpcm9ubWVudCk6IEdpdGxhYlJ1bm5lckF1dG9zY2FsaW5nSm9iUnVubmVyUHJvcHNbXSB7XG4gICAgY29uc3QgZ2l0TGFiUnVubmVyVG9rZW5QYXJhbWV0ZXIgPSBTdHJpbmdQYXJhbWV0ZXIuZnJvbVN0cmluZ1BhcmFtZXRlckF0dHJpYnV0ZXModGhpcywgJ1J1bm5lclRva2VuJywge1xuICAgICAgcGFyYW1ldGVyTmFtZTogJy9jb25maWcvZ2l0bGFiLXJ1bm5lci1jZGsvdG9rZW4nLFxuICAgIH0pO1xuICAgIHJldHVybiBbe1xuICAgICAgdG9rZW46IGdpdExhYlJ1bm5lclRva2VuUGFyYW1ldGVyLFxuICAgICAgY29uZmlndXJhdGlvbjoge1xuICAgICAgICB1cmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsXG4gICAgICAgIGxpbWl0OiAwLFxuICAgICAgICBtYWNoaW5lOiB7XG4gICAgICAgICAgbWF4QnVpbGRzOiAxMCxcbiAgICAgICAgICBhdXRvc2NhbGluZzogdGhpcy5hdXRvc2NhbGluZ0NvbmZpZyxcbiAgICAgICAgICBpZGxlQ291bnQ6IDUsXG4gICAgICAgICAgaWRsZVRpbWU6IDkwMCxcbiAgICAgICAgICBtYWNoaW5lT3B0aW9uczoge1xuICAgICAgICAgICAgcmVxdWVzdFNwb3RJbnN0YW5jZTogdHJ1ZSxcbiAgICAgICAgICAgIHNwb3RQcmljZTogMC4wOSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgICBlbnZpcm9ubWVudDogW1xuICAgICAgICAgICdET0NLRVJfRFJJVkVSPW92ZXJsYXkyJyxcbiAgICAgICAgICAnRE9DS0VSX1RMU19ESVJDRT0vY2VydHMnLFxuICAgICAgICAgIGBET0NLRVJfQVVUSF9DT05GSUc9e1wiY3JlZEhlbHBlcnNcIjogeyBcInB1YmxpYy5lY3IuYXdzXCI6IFwiZWNyLWxvZ2luXCIsIFwiJHtcbiAgICAgICAgICAgIGVudi5hY2NvdW50XG4gICAgICAgICAgfS5ka3IuZWNyLjxyZWdpb24+LmFtYXpvbmF3cy5jb21cIjogXCJlY3ItbG9naW5cIiB9IH1gLFxuICAgICAgICBdLFxuICAgICAgfSxcbiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuVDMsIEluc3RhbmNlU2l6ZS5MQVJHRSksXG4gICAgfV07XG4gIH1cbn0iXX0=

package/lib/contributions/smart-route/gitlab-runner/index.d.ts

@@ -0,0 +1,3 @@
+export * from './autoscaling-runner';
+export * from './runner-roles';
+export * from './spot-role';

package/lib/contributions/smart-route/gitlab-runner/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./autoscaling-runner"), exports);
+__exportStar(require("./runner-roles"), exports);
+__exportStar(require("./spot-role"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvY29udHJpYnV0aW9ucy9zbWFydC1yb3V0ZS9naXRsYWItcnVubmVyL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1REFBcUM7QUFDckMsaURBQStCO0FBQy9CLDhDQUE0QiIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXV0b3NjYWxpbmctcnVubmVyJztcbmV4cG9ydCAqIGZyb20gJy4vcnVubmVyLXJvbGVzJztcbmV4cG9ydCAqIGZyb20gJy4vc3BvdC1yb2xlJzsiXX0=

package/lib/contributions/smart-route/gitlab-runner/runner-roles.d.ts

@@ -0,0 +1,20 @@
+import { Environment, Stack } from 'aws-cdk-lib';
+import { Role } from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+export interface RunnerRoleProps {
+    env: Environment;
+}
+/**
+ * This construct provides a set of base roles for gitlab runners in order to build, test, validate and deploy applications
+ * on RIO. The roles need to be assumed during job runtime to perform more permissive actions, such as creating certificates to
+ * authenticate towards the RIO MSK, pushing docker images to ECR, performing a secrets backup, deploying stacks,
+ * or to publish an SPA to a S3 bucket. Do not assume the deployment role unless needed.
+ * The base role can be the default role attached to GitLab runners.
+ * The role allows to read various basic parameters such as the NIST data mirror, the OSS license bucket, DataDog keys
+ * and to pull ECR images form public Gallery or the specified account in the environment.
+ * The Role ARNs are export using CFNOutputs. Use the outputs to configure environment variables in your GitLab group.
+ */
+export declare class RunnerRoles extends Construct {
+    readonly runnerBaseRole: Role;
+    constructor(scope: Stack, id: string, props: RunnerRoleProps);
+}