@rio-cloud/cdk-v2-constructs 6.1.0 → 6.2.2

package/lib/contributions/smart-route/gitlab-runner/autoscaling-runner.d.ts

@@ -0,0 +1,87 @@
+import { Environment, Stack } from 'aws-cdk-lib';
+import { InstanceType } from 'aws-cdk-lib/aws-ec2';
+import { IRole } from 'aws-cdk-lib/aws-iam';
+import { IStringParameter } from 'aws-cdk-lib/aws-ssm';
+import { Construct } from 'constructs';
+/**
+ * The GitLabRunnerProps require the VPC ID, a defined environment of account and region, optional
+ * runner configuration and optionally the GitLab Runner Manager instance type. By default, a T3 Micro instance will be used.
+ * For larger workloads and very active teams it is recommended to use T3 Small for the manager instead.
+ */
+export interface GitLabRunnerProps {
+    readonly env: Environment;
+    readonly runnersWorkerProps?: GitlabRunnerWorkerProps[];
+    readonly managerInstanceType?: InstanceType;
+}
+/**
+ * The GitlabRunnerWorkerProps interface provides a simplified GitLab Runner worker configuration
+ * requiring a token as an SSM parameter, one of the valid gitlab URLs, instance of you choice, the desired max spot price,
+ * whether to use spot instance or not and a default role.
+ * It is recommended to use the RunnerRoles construct, and it's exposed default runner role.
+ */
+export interface GitlabRunnerWorkerProps {
+    /** The SSM StringParameter with the registered runner token  */
+    readonly token: IStringParameter;
+    /** The GitLab instance URL, either https://gitlab.cicd.man or https://gitlab.collaborationlayer-traton.com */
+    readonly gitInstanceUrl: GitlabInstanceUrl;
+    /** The instance type for the runner worker */
+    readonly instanceType: InstanceType;
+    /** The desired max spot price */
+    readonly spotPrice: number;
+    /** Whether to use spot instance or not, Requires ServiceLinked Role for EC2 Spot to be deployed in the account */
+    readonly requestSpotPrice: boolean;
+    /** The default role for the runner worker when spawned */
+    readonly defaultWorkerRole: IRole;
+    /** The maximum number of builds for an instance before it has to be decommissioned. Default 10 */
+    readonly maxBuilds?: number;
+    /** The maximum number of instances to keep idle for new incoming jobs. Default 5 */
+    readonly maxIdleInstance?: number;
+    /** The maximum idle time seconds for an instance. Default 900 seconds */
+    readonly maxIdleTime?: number;
+}
+export type GitlabInstanceUrl = 'https://gitlab.cicd.man' | 'https://gitlab.collaborationlayer-traton.com';
+/**
+ * The construct create the GitLabRunner Manager instance which will autoscale Runner instances based on the configuration.
+ * By default, the construct will create a Runner with a manager T3 Micro instance which will be enabled to spawn T3 Large Runner
+ * worker spot instance. The default runner Role has only the permissions to upload and download from the S3 runner cache.
+ *
+ * minimal configuration with runner spot instance:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'}
+ * });
+ *```
+ * recommended:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * const runnerRoles = new RunnerRoles(stack, 'RunnerRoles', {env: {account: '123456789012', region: 'eu-west-1'}});
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'},
+ *  runnersWorkerProps: [
+ *    {
+ *      token: myTokenForTaggedRunner1, // with this runner we only want to run jobs that require more power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.M7I_FLEX, InstanceSize.XLARGE), // exemplary larger runner
+ *      spotPrice: 0.2, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *    {
+ *      token: myTokenForTaggedRunner2, // with this runner we want to run all generic jobs that do not require much processing power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM), // exemplary smaller runner
+ *      spotPrice: 0.044, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *  ],
+ * });
+ * ```
+ */
+export declare class GitlabRunner extends Construct {
+    private autoscalingConfig;
+    constructor(scope: Stack, id: string, props: GitLabRunnerProps);
+    private createWorkerConfigurations;
+    private getDefaultRunnerWorkerConfig;
+}

package/lib/contributions/smart-route/gitlab-runner/autoscaling-runner.js

@@ -0,0 +1,137 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitlabRunner = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+// eslint-disable-next-line import/no-extraneous-dependencies
+const cdk_autoscaling_gitlab_runner_1 = require("@pepperize/cdk-autoscaling-gitlab-runner");
+const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
+const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
+const constructs_1 = require("constructs");
+const rio_landing_zone_1 = require("../../../rio-landing-zone");
+/**
+ * The construct create the GitLabRunner Manager instance which will autoscale Runner instances based on the configuration.
+ * By default, the construct will create a Runner with a manager T3 Micro instance which will be enabled to spawn T3 Large Runner
+ * worker spot instance. The default runner Role has only the permissions to upload and download from the S3 runner cache.
+ *
+ * minimal configuration with runner spot instance:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'}
+ * });
+ *```
+ * recommended:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * const runnerRoles = new RunnerRoles(stack, 'RunnerRoles', {env: {account: '123456789012', region: 'eu-west-1'}});
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'},
+ *  runnersWorkerProps: [
+ *    {
+ *      token: myTokenForTaggedRunner1, // with this runner we only want to run jobs that require more power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.M7I_FLEX, InstanceSize.XLARGE), // exemplary larger runner
+ *      spotPrice: 0.2, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *    {
+ *      token: myTokenForTaggedRunner2, // with this runner we want to run all generic jobs that do not require much processing power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM), // exemplary smaller runner
+ *      spotPrice: 0.044, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *  ],
+ * });
+ * ```
+ */
+class GitlabRunner extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.autoscalingConfig = [
+            {
+                periods: ['* * 7-24 * * mon-fri *'],
+                timezone: 'Europe/Berlin',
+            },
+        ];
+        const vpc = rio_landing_zone_1.RioLandingZone.getDefaultVpc(scope);
+        const runnerConfig = props.runnersWorkerProps
+            ? this.createWorkerConfigurations(props.runnersWorkerProps, props.env)
+            : this.getDefaultRunnerWorkerConfig(props.env);
+        const managerInstance = props.managerInstanceType ??
+            aws_ec2_1.InstanceType.of(aws_ec2_1.InstanceClass.T3, aws_ec2_1.InstanceSize.MICRO);
+        new cdk_autoscaling_gitlab_runner_1.GitlabRunnerAutoscaling(scope, `GLR${scope.stackName}`, {
+            runners: runnerConfig,
+            network: {
+                vpc: vpc,
+            },
+            manager: {
+                instanceType: managerInstance,
+            },
+            checkInterval: 30, // check every 30s for pending jobs
+            concurrent: 300, // Global limit of concurrent jobs,
+        });
+    }
+    createWorkerConfigurations(workerProps, env) {
+        return workerProps.map((val) => ({
+            token: val.token,
+            role: val.defaultWorkerRole,
+            configuration: {
+                url: val.gitInstanceUrl,
+                machine: {
+                    autoscaling: this.autoscalingConfig,
+                    maxBuilds: val.maxBuilds ?? 10,
+                    idleCount: val.maxIdleInstance ?? 5,
+                    idleTime: val.maxIdleTime ?? 900,
+                    machineOptions: {
+                        requestSpotInstance: val.requestSpotPrice,
+                        spotPrice: val.spotPrice,
+                    },
+                },
+                environment: [
+                    'DOCKER_DRIVER=overlay2',
+                    'DOCKER_TLS_DIRCE=/certs',
+                    `DOCKER_AUTH_CONFIG={"credHelpers": { "public.ecr.aws": "ecr-login", "${env.account}.dkr.ecr.<region>.amazonaws.com": "ecr-login" } }`,
+                ],
+            },
+            instanceType: val.instanceType,
+        }));
+    }
+    getDefaultRunnerWorkerConfig(env) {
+        const gitLabRunnerTokenParameter = aws_ssm_1.StringParameter.fromStringParameterAttributes(this, 'RunnerToken', {
+            parameterName: '/config/gitlab-runner-cdk/token',
+        });
+        return [
+            {
+                token: gitLabRunnerTokenParameter,
+                configuration: {
+                    url: 'https://gitlab.cicd.man',
+                    limit: 0,
+                    machine: {
+                        maxBuilds: 10,
+                        autoscaling: this.autoscalingConfig,
+                        idleCount: 5,
+                        idleTime: 900,
+                        machineOptions: {
+                            requestSpotInstance: true,
+                            spotPrice: 0.09,
+                        },
+                    },
+                    environment: [
+                        'DOCKER_DRIVER=overlay2',
+                        'DOCKER_TLS_DIRCE=/certs',
+                        `DOCKER_AUTH_CONFIG={"credHelpers": { "public.ecr.aws": "ecr-login", "${env.account}.dkr.ecr.<region>.amazonaws.com": "ecr-login" } }`,
+                    ],
+                },
+                instanceType: aws_ec2_1.InstanceType.of(aws_ec2_1.InstanceClass.T3, aws_ec2_1.InstanceSize.LARGE),
+            },
+        ];
+    }
+}
+exports.GitlabRunner = GitlabRunner;
+_a = JSII_RTTI_SYMBOL_1;
+GitlabRunner[_a] = { fqn: "@rio-cloud/cdk-v2-constructs.GitlabRunner", version: "0.0.0" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0b3NjYWxpbmctcnVubmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NvbnRyaWJ1dGlvbnMvc21hcnQtcm91dGUvZ2l0bGFiLXJ1bm5lci9hdXRvc2NhbGluZy1ydW5uZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2REFBNkQ7QUFDN0QsNEZBSWtEO0FBRWxELGlEQUFnRjtBQUVoRixpREFBd0U7QUFDeEUsMkNBQXVDO0FBQ3ZDLGdFQUEyRDtBQTRDM0Q7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBc0NHO0FBQ0gsTUFBYSxZQUFhLFNBQVEsc0JBQVM7SUFPekMsWUFBWSxLQUFZLEVBQUUsRUFBVSxFQUFFLEtBQXdCO1FBQzVELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFQWCxzQkFBaUIsR0FBK0I7WUFDdEQ7Z0JBQ0UsT0FBTyxFQUFFLENBQUMsd0JBQXdCLENBQUM7Z0JBQ25DLFFBQVEsRUFBRSxlQUFlO2FBQzFCO1NBQ0YsQ0FBQztRQUlBLE1BQU0sR0FBRyxHQUFHLGlDQUFjLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRWhELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxrQkFBa0I7WUFDM0MsQ0FBQyxDQUFDLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEVBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQztZQUN0RSxDQUFDLENBQUMsSUFBSSxDQUFDLDRCQUE0QixDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUVqRCxNQUFNLGVBQWUsR0FDbkIsS0FBSyxDQUFDLG1CQUFtQjtZQUN6QixzQkFBWSxDQUFDLEVBQUUsQ0FBQyx1QkFBYSxDQUFDLEVBQUUsRUFBRSxzQkFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRXhELElBQUksdURBQXVCLENBQUMsS0FBSyxFQUFFLE1BQU0sS0FBSyxDQUFDLFNBQVMsRUFBRSxFQUFFO1lBQzFELE9BQU8sRUFBRSxZQUFZO1lBQ3JCLE9BQU8sRUFBRTtnQkFDUCxHQUFHLEVBQUUsR0FBRzthQUNUO1lBQ0QsT0FBTyxFQUFFO2dCQUNQLFlBQVksRUFBRSxlQUFlO2FBQzlCO1lBQ0QsYUFBYSxFQUFFLEVBQUUsRUFBRSxtQ0FBbUM7WUFDdEQsVUFBVSxFQUFFLEdBQUcsRUFBRSxtQ0FBbUM7U0FDckQsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLDBCQUEwQixDQUNoQyxXQUFzQyxFQUN0QyxHQUFnQjtRQUVoQixPQUFPLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDL0IsS0FBSyxFQUFFLEdBQUcsQ0FBQyxLQUFLO1lBQ2hCLElBQUksRUFBRSxHQUFHLENBQUMsaUJBQWlCO1lBQzNCLGFBQWEsRUFBRTtnQkFDYixHQUFHLEVBQUUsR0FBRyxDQUFDLGNBQWM7Z0JBQ3ZCLE9BQU8sRUFBRTtvQkFDUCxXQUFXLEVBQUUsSUFBSSxDQUFDLGlCQUFpQjtvQkFDbkMsU0FBUyxFQUFFLEdBQUcsQ0FBQyxTQUFTLElBQUksRUFBRTtvQkFDOUIsU0FBUyxFQUFFLEdBQUcsQ0FBQyxlQUFlLElBQUksQ0FBQztvQkFDbkMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxXQUFXLElBQUksR0FBRztvQkFDaEMsY0FBYyxFQUFFO3dCQUNkLG1CQUFtQixFQUFFLEdBQUcsQ0FBQyxnQkFBZ0I7d0JBQ3pDLFNBQVMsRUFBRSxHQUFHLENBQUMsU0FBUztxQkFDekI7aUJBQ0Y7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLHdCQUF3QjtvQkFDeEIseUJBQXlCO29CQUN6Qix3RUFDRSxHQUFHLENBQUMsT0FDTixtREFBbUQ7aUJBQ3BEO2FBQ0Y7WUFDRCxZQUFZLEVBQUUsR0FBRyxDQUFDLFlBQVk7U0FDL0IsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBRU8sNEJBQTRCLENBQ2xDLEdBQWdCO1FBRWhCLE1BQU0sMEJBQTBCLEdBQzlCLHlCQUFlLENBQUMsNkJBQTZCLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRTtZQUNqRSxhQUFhLEVBQUUsaUNBQWlDO1NBQ2pELENBQUMsQ0FBQztRQUNMLE9BQU87WUFDTDtnQkFDRSxLQUFLLEVBQUUsMEJBQTBCO2dCQUNqQyxhQUFhLEVBQUU7b0JBQ2IsR0FBRyxFQUFFLHlCQUF5QjtvQkFDOUIsS0FBSyxFQUFFLENBQUM7b0JBQ1IsT0FBTyxFQUFFO3dCQUNQLFNBQVMsRUFBRSxFQUFFO3dCQUNiLFdBQVcsRUFBRSxJQUFJLENBQUMsaUJBQWlCO3dCQUNuQyxTQUFTLEVBQUUsQ0FBQzt3QkFDWixRQUFRLEVBQUUsR0FBRzt3QkFDYixjQUFjLEVBQUU7NEJBQ2QsbUJBQW1CLEVBQUUsSUFBSTs0QkFDekIsU0FBUyxFQUFFLElBQUk7eUJBQ2hCO3FCQUNGO29CQUNELFdBQVcsRUFBRTt3QkFDWCx3QkFBd0I7d0JBQ3hCLHlCQUF5Qjt3QkFDekIsd0VBQ0UsR0FBRyxDQUFDLE9BQ04sbURBQW1EO3FCQUNwRDtpQkFDRjtnQkFDRCxZQUFZLEVBQUUsc0JBQVksQ0FBQyxFQUFFLENBQUMsdUJBQWEsQ0FBQyxFQUFFLEVBQUUsc0JBQVksQ0FBQyxLQUFLLENBQUM7YUFDcEU7U0FDRixDQUFDO0lBQ0osQ0FBQzs7QUFsR0gsb0NBbUdDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIGltcG9ydC9uby1leHRyYW5lb3VzLWRlcGVuZGVuY2llc1xuaW1wb3J0IHtcbiAgQXV0b3NjYWxpbmdDb25maWd1cmF0aW9uLFxuICBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZyxcbiAgR2l0bGFiUnVubmVyQXV0b3NjYWxpbmdKb2JSdW5uZXJQcm9wcyxcbn0gZnJvbSAnQHBlcHBlcml6ZS9jZGstYXV0b3NjYWxpbmctZ2l0bGFiLXJ1bm5lcic7XG5pbXBvcnQgeyBFbnZpcm9ubWVudCwgU3RhY2sgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBJbnN0YW5jZUNsYXNzLCBJbnN0YW5jZVNpemUsIEluc3RhbmNlVHlwZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1lYzInO1xuaW1wb3J0IHsgSVJvbGUgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IElTdHJpbmdQYXJhbWV0ZXIsIFN0cmluZ1BhcmFtZXRlciB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1zc20nO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBSaW9MYW5kaW5nWm9uZSB9IGZyb20gJy4uLy4uLy4uL3Jpby1sYW5kaW5nLXpvbmUnO1xuXG4vKipcbiAqIFRoZSBHaXRMYWJSdW5uZXJQcm9wcyByZXF1aXJlIHRoZSBWUEMgSUQsIGEgZGVmaW5lZCBlbnZpcm9ubWVudCBvZiBhY2NvdW50IGFuZCByZWdpb24sIG9wdGlvbmFsXG4gKiBydW5uZXIgY29uZmlndXJhdGlvbiBhbmQgb3B0aW9uYWxseSB0aGUgR2l0TGFiIFJ1bm5lciBNYW5hZ2VyIGluc3RhbmNlIHR5cGUuIEJ5IGRlZmF1bHQsIGEgVDMgTWljcm8gaW5zdGFuY2Ugd2lsbCBiZSB1c2VkLlxuICogRm9yIGxhcmdlciB3b3JrbG9hZHMgYW5kIHZlcnkgYWN0aXZlIHRlYW1zIGl0IGlzIHJlY29tbWVuZGVkIHRvIHVzZSBUMyBTbWFsbCBmb3IgdGhlIG1hbmFnZXIgaW5zdGVhZC5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRMYWJSdW5uZXJQcm9wcyB7XG4gIHJlYWRvbmx5IGVudjogRW52aXJvbm1lbnQ7XG4gIHJlYWRvbmx5IHJ1bm5lcnNXb3JrZXJQcm9wcz86IEdpdGxhYlJ1bm5lcldvcmtlclByb3BzW107XG4gIHJlYWRvbmx5IG1hbmFnZXJJbnN0YW5jZVR5cGU/OiBJbnN0YW5jZVR5cGU7XG59XG5cbi8qKlxuICogVGhlIEdpdGxhYlJ1bm5lcldvcmtlclByb3BzIGludGVyZmFjZSBwcm92aWRlcyBhIHNpbXBsaWZpZWQgR2l0TGFiIFJ1bm5lciB3b3JrZXIgY29uZmlndXJhdGlvblxuICogcmVxdWlyaW5nIGEgdG9rZW4gYXMgYW4gU1NNIHBhcmFtZXRlciwgb25lIG9mIHRoZSB2YWxpZCBnaXRsYWIgVVJMcywgaW5zdGFuY2Ugb2YgeW91IGNob2ljZSwgdGhlIGRlc2lyZWQgbWF4IHNwb3QgcHJpY2UsXG4gKiB3aGV0aGVyIHRvIHVzZSBzcG90IGluc3RhbmNlIG9yIG5vdCBhbmQgYSBkZWZhdWx0IHJvbGUuXG4gKiBJdCBpcyByZWNvbW1lbmRlZCB0byB1c2UgdGhlIFJ1bm5lclJvbGVzIGNvbnN0cnVjdCwgYW5kIGl0J3MgZXhwb3NlZCBkZWZhdWx0IHJ1bm5lciByb2xlLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdGxhYlJ1bm5lcldvcmtlclByb3BzIHtcbiAgLyoqIFRoZSBTU00gU3RyaW5nUGFyYW1ldGVyIHdpdGggdGhlIHJlZ2lzdGVyZWQgcnVubmVyIHRva2VuICAqL1xuICByZWFkb25seSB0b2tlbjogSVN0cmluZ1BhcmFtZXRlcjtcbiAgLyoqIFRoZSBHaXRMYWIgaW5zdGFuY2UgVVJMLCBlaXRoZXIgaHR0cHM6Ly9naXRsYWIuY2ljZC5tYW4gb3IgaHR0cHM6Ly9naXRsYWIuY29sbGFib3JhdGlvbmxheWVyLXRyYXRvbi5jb20gKi9cbiAgcmVhZG9ubHkgZ2l0SW5zdGFuY2VVcmw6IEdpdGxhYkluc3RhbmNlVXJsO1xuICAvKiogVGhlIGluc3RhbmNlIHR5cGUgZm9yIHRoZSBydW5uZXIgd29ya2VyICovXG4gIHJlYWRvbmx5IGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlO1xuICAvKiogVGhlIGRlc2lyZWQgbWF4IHNwb3QgcHJpY2UgKi9cbiAgcmVhZG9ubHkgc3BvdFByaWNlOiBudW1iZXI7XG4gIC8qKiBXaGV0aGVyIHRvIHVzZSBzcG90IGluc3RhbmNlIG9yIG5vdCwgUmVxdWlyZXMgU2VydmljZUxpbmtlZCBSb2xlIGZvciBFQzIgU3BvdCB0byBiZSBkZXBsb3llZCBpbiB0aGUgYWNjb3VudCAqL1xuICByZWFkb25seSByZXF1ZXN0U3BvdFByaWNlOiBib29sZWFuO1xuICAvKiogVGhlIGRlZmF1bHQgcm9sZSBmb3IgdGhlIHJ1bm5lciB3b3JrZXIgd2hlbiBzcGF3bmVkICovXG4gIHJlYWRvbmx5IGRlZmF1bHRXb3JrZXJSb2xlOiBJUm9sZTtcbiAgLyoqIFRoZSBtYXhpbXVtIG51bWJlciBvZiBidWlsZHMgZm9yIGFuIGluc3RhbmNlIGJlZm9yZSBpdCBoYXMgdG8gYmUgZGVjb21taXNzaW9uZWQuIERlZmF1bHQgMTAgKi9cbiAgcmVhZG9ubHkgbWF4QnVpbGRzPzogbnVtYmVyO1xuICAvKiogVGhlIG1heGltdW0gbnVtYmVyIG9mIGluc3RhbmNlcyB0byBrZWVwIGlkbGUgZm9yIG5ldyBpbmNvbWluZyBqb2JzLiBEZWZhdWx0IDUgKi9cbiAgcmVhZG9ubHkgbWF4SWRsZUluc3RhbmNlPzogbnVtYmVyO1xuICAvKiogVGhlIG1heGltdW0gaWRsZSB0aW1lIHNlY29uZHMgZm9yIGFuIGluc3RhbmNlLiBEZWZhdWx0IDkwMCBzZWNvbmRzICovXG4gIHJlYWRvbmx5IG1heElkbGVUaW1lPzogbnVtYmVyO1xufVxuXG5leHBvcnQgdHlwZSBHaXRsYWJJbnN0YW5jZVVybCA9XG4gIHwgJ2h0dHBzOi8vZ2l0bGFiLmNpY2QubWFuJ1xuICB8ICdodHRwczovL2dpdGxhYi5jb2xsYWJvcmF0aW9ubGF5ZXItdHJhdG9uLmNvbSc7XG5cbi8qKlxuICogVGhlIGNvbnN0cnVjdCBjcmVhdGUgdGhlIEdpdExhYlJ1bm5lciBNYW5hZ2VyIGluc3RhbmNlIHdoaWNoIHdpbGwgYXV0b3NjYWxlIFJ1bm5lciBpbnN0YW5jZXMgYmFzZWQgb24gdGhlIGNvbmZpZ3VyYXRpb24uXG4gKiBCeSBkZWZhdWx0LCB0aGUgY29uc3RydWN0IHdpbGwgY3JlYXRlIGEgUnVubmVyIHdpdGggYSBtYW5hZ2VyIFQzIE1pY3JvIGluc3RhbmNlIHdoaWNoIHdpbGwgYmUgZW5hYmxlZCB0byBzcGF3biBUMyBMYXJnZSBSdW5uZXJcbiAqIHdvcmtlciBzcG90IGluc3RhbmNlLiBUaGUgZGVmYXVsdCBydW5uZXIgUm9sZSBoYXMgb25seSB0aGUgcGVybWlzc2lvbnMgdG8gdXBsb2FkIGFuZCBkb3dubG9hZCBmcm9tIHRoZSBTMyBydW5uZXIgY2FjaGUuXG4gKlxuICogbWluaW1hbCBjb25maWd1cmF0aW9uIHdpdGggcnVubmVyIHNwb3QgaW5zdGFuY2U6XG4gKiBgYGB0c1xuICogbmV3IFNwb3RTZXJ2aWNlTGlua2VkUm9sZShzdGFjaywgJ1Nwb3RMaW5rZWRSb2xlJyk7XG4gKiBuZXcgR2l0bGFiUnVubmVyKHN0YWNrLCAnR2l0TGFiUnVubmVyJywge1xuICogIGVudjoge2FjY291bnQ6ICcxMjM0NTY3ODkwMTInLCByZWdpb246ICdldS13ZXN0LTEnfVxuICogfSk7XG4gKmBgYFxuICogcmVjb21tZW5kZWQ6XG4gKiBgYGB0c1xuICogbmV3IFNwb3RTZXJ2aWNlTGlua2VkUm9sZShzdGFjaywgJ1Nwb3RMaW5rZWRSb2xlJyk7XG4gKiBjb25zdCBydW5uZXJSb2xlcyA9IG5ldyBSdW5uZXJSb2xlcyhzdGFjaywgJ1J1bm5lclJvbGVzJywge2Vudjoge2FjY291bnQ6ICcxMjM0NTY3ODkwMTInLCByZWdpb246ICdldS13ZXN0LTEnfX0pO1xuICogbmV3IEdpdGxhYlJ1bm5lcihzdGFjaywgJ0dpdExhYlJ1bm5lcicsIHtcbiAqICBlbnY6IHthY2NvdW50OiAnMTIzNDU2Nzg5MDEyJywgcmVnaW9uOiAnZXUtd2VzdC0xJ30sXG4gKiAgcnVubmVyc1dvcmtlclByb3BzOiBbXG4gKiAgICB7XG4gKiAgICAgIHRva2VuOiBteVRva2VuRm9yVGFnZ2VkUnVubmVyMSwgLy8gd2l0aCB0aGlzIHJ1bm5lciB3ZSBvbmx5IHdhbnQgdG8gcnVuIGpvYnMgdGhhdCByZXF1aXJlIG1vcmUgcG93ZXJcbiAqICAgICAgZ2l0SW5zdGFuY2VVcmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsIC8vIG9yIHRoZSBUcmF0b24gR2l0TGFiXG4gKiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuTTdJX0ZMRVgsIEluc3RhbmNlU2l6ZS5YTEFSR0UpLCAvLyBleGVtcGxhcnkgbGFyZ2VyIHJ1bm5lclxuICogICAgICBzcG90UHJpY2U6IDAuMiwgLy8gZXhlbXBsYXJ5IHNwb3QgcHJpY2VcbiAqICAgICAgcmVxdWVzdFNwb3RQcmljZTogdHJ1ZSxcbiAqICAgICAgZGVmYXVsdFdvcmtlclJvbGU6IHJ1bm5lclJvbGVzLnJ1bm5lckJhc2VSb2xlLCAvLyB1c2UgdGhlIGJhc2Ugcm9sZVxuICogICAgfSxcbiAqICAgIHtcbiAqICAgICAgdG9rZW46IG15VG9rZW5Gb3JUYWdnZWRSdW5uZXIyLCAvLyB3aXRoIHRoaXMgcnVubmVyIHdlIHdhbnQgdG8gcnVuIGFsbCBnZW5lcmljIGpvYnMgdGhhdCBkbyBub3QgcmVxdWlyZSBtdWNoIHByb2Nlc3NpbmcgcG93ZXJcbiAqICAgICAgZ2l0SW5zdGFuY2VVcmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsIC8vIG9yIHRoZSBUcmF0b24gR2l0TGFiXG4gKiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuVDMsIEluc3RhbmNlU2l6ZS5NRURJVU0pLCAvLyBleGVtcGxhcnkgc21hbGxlciBydW5uZXJcbiAqICAgICAgc3BvdFByaWNlOiAwLjA0NCwgLy8gZXhlbXBsYXJ5IHNwb3QgcHJpY2VcbiAqICAgICAgcmVxdWVzdFNwb3RQcmljZTogdHJ1ZSxcbiAqICAgICAgZGVmYXVsdFdvcmtlclJvbGU6IHJ1bm5lclJvbGVzLnJ1bm5lckJhc2VSb2xlLCAvLyB1c2UgdGhlIGJhc2Ugcm9sZVxuICogICAgfSxcbiAqICBdLFxuICogfSk7XG4gKiBgYGBcbiAqL1xuZXhwb3J0IGNsYXNzIEdpdGxhYlJ1bm5lciBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHByaXZhdGUgYXV0b3NjYWxpbmdDb25maWc6IEF1dG9zY2FsaW5nQ29uZmlndXJhdGlvbltdID0gW1xuICAgIHtcbiAgICAgIHBlcmlvZHM6IFsnKiAqIDctMjQgKiAqIG1vbi1mcmkgKiddLFxuICAgICAgdGltZXpvbmU6ICdFdXJvcGUvQmVybGluJyxcbiAgICB9LFxuICBdO1xuICBjb25zdHJ1Y3RvcihzY29wZTogU3RhY2ssIGlkOiBzdHJpbmcsIHByb3BzOiBHaXRMYWJSdW5uZXJQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCB2cGMgPSBSaW9MYW5kaW5nWm9uZS5nZXREZWZhdWx0VnBjKHNjb3BlKTtcblxuICAgIGNvbnN0IHJ1bm5lckNvbmZpZyA9IHByb3BzLnJ1bm5lcnNXb3JrZXJQcm9wc1xuICAgICAgPyB0aGlzLmNyZWF0ZVdvcmtlckNvbmZpZ3VyYXRpb25zKHByb3BzLnJ1bm5lcnNXb3JrZXJQcm9wcywgcHJvcHMuZW52KVxuICAgICAgOiB0aGlzLmdldERlZmF1bHRSdW5uZXJXb3JrZXJDb25maWcocHJvcHMuZW52KTtcblxuICAgIGNvbnN0IG1hbmFnZXJJbnN0YW5jZSA9XG4gICAgICBwcm9wcy5tYW5hZ2VySW5zdGFuY2VUeXBlID8/XG4gICAgICBJbnN0YW5jZVR5cGUub2YoSW5zdGFuY2VDbGFzcy5UMywgSW5zdGFuY2VTaXplLk1JQ1JPKTtcblxuICAgIG5ldyBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZyhzY29wZSwgYEdMUiR7c2NvcGUuc3RhY2tOYW1lfWAsIHtcbiAgICAgIHJ1bm5lcnM6IHJ1bm5lckNvbmZpZyxcbiAgICAgIG5ldHdvcms6IHtcbiAgICAgICAgdnBjOiB2cGMsXG4gICAgICB9LFxuICAgICAgbWFuYWdlcjoge1xuICAgICAgICBpbnN0YW5jZVR5cGU6IG1hbmFnZXJJbnN0YW5jZSxcbiAgICAgIH0sXG4gICAgICBjaGVja0ludGVydmFsOiAzMCwgLy8gY2hlY2sgZXZlcnkgMzBzIGZvciBwZW5kaW5nIGpvYnNcbiAgICAgIGNvbmN1cnJlbnQ6IDMwMCwgLy8gR2xvYmFsIGxpbWl0IG9mIGNvbmN1cnJlbnQgam9icyxcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgY3JlYXRlV29ya2VyQ29uZmlndXJhdGlvbnMoXG4gICAgd29ya2VyUHJvcHM6IEdpdGxhYlJ1bm5lcldvcmtlclByb3BzW10sXG4gICAgZW52OiBFbnZpcm9ubWVudCxcbiAgKTogR2l0bGFiUnVubmVyQXV0b3NjYWxpbmdKb2JSdW5uZXJQcm9wc1tdIHtcbiAgICByZXR1cm4gd29ya2VyUHJvcHMubWFwKCh2YWwpID0+ICh7XG4gICAgICB0b2tlbjogdmFsLnRva2VuLFxuICAgICAgcm9sZTogdmFsLmRlZmF1bHRXb3JrZXJSb2xlLFxuICAgICAgY29uZmlndXJhdGlvbjoge1xuICAgICAgICB1cmw6IHZhbC5naXRJbnN0YW5jZVVybCxcbiAgICAgICAgbWFjaGluZToge1xuICAgICAgICAgIGF1dG9zY2FsaW5nOiB0aGlzLmF1dG9zY2FsaW5nQ29uZmlnLFxuICAgICAgICAgIG1heEJ1aWxkczogdmFsLm1heEJ1aWxkcyA/PyAxMCxcbiAgICAgICAgICBpZGxlQ291bnQ6IHZhbC5tYXhJZGxlSW5zdGFuY2UgPz8gNSxcbiAgICAgICAgICBpZGxlVGltZTogdmFsLm1heElkbGVUaW1lID8/IDkwMCxcbiAgICAgICAgICBtYWNoaW5lT3B0aW9uczoge1xuICAgICAgICAgICAgcmVxdWVzdFNwb3RJbnN0YW5jZTogdmFsLnJlcXVlc3RTcG90UHJpY2UsXG4gICAgICAgICAgICBzcG90UHJpY2U6IHZhbC5zcG90UHJpY2UsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAgZW52aXJvbm1lbnQ6IFtcbiAgICAgICAgICAnRE9DS0VSX0RSSVZFUj1vdmVybGF5MicsXG4gICAgICAgICAgJ0RPQ0tFUl9UTFNfRElSQ0U9L2NlcnRzJyxcbiAgICAgICAgICBgRE9DS0VSX0FVVEhfQ09ORklHPXtcImNyZWRIZWxwZXJzXCI6IHsgXCJwdWJsaWMuZWNyLmF3c1wiOiBcImVjci1sb2dpblwiLCBcIiR7XG4gICAgICAgICAgICBlbnYuYWNjb3VudFxuICAgICAgICAgIH0uZGtyLmVjci48cmVnaW9uPi5hbWF6b25hd3MuY29tXCI6IFwiZWNyLWxvZ2luXCIgfSB9YCxcbiAgICAgICAgXSxcbiAgICAgIH0sXG4gICAgICBpbnN0YW5jZVR5cGU6IHZhbC5pbnN0YW5jZVR5cGUsXG4gICAgfSkpO1xuICB9XG5cbiAgcHJpdmF0ZSBnZXREZWZhdWx0UnVubmVyV29ya2VyQ29uZmlnKFxuICAgIGVudjogRW52aXJvbm1lbnQsXG4gICk6IEdpdGxhYlJ1bm5lckF1dG9zY2FsaW5nSm9iUnVubmVyUHJvcHNbXSB7XG4gICAgY29uc3QgZ2l0TGFiUnVubmVyVG9rZW5QYXJhbWV0ZXIgPVxuICAgICAgU3RyaW5nUGFyYW1ldGVyLmZyb21TdHJpbmdQYXJhbWV0ZXJBdHRyaWJ1dGVzKHRoaXMsICdSdW5uZXJUb2tlbicsIHtcbiAgICAgICAgcGFyYW1ldGVyTmFtZTogJy9jb25maWcvZ2l0bGFiLXJ1bm5lci1jZGsvdG9rZW4nLFxuICAgICAgfSk7XG4gICAgcmV0dXJuIFtcbiAgICAgIHtcbiAgICAgICAgdG9rZW46IGdpdExhYlJ1bm5lclRva2VuUGFyYW1ldGVyLFxuICAgICAgICBjb25maWd1cmF0aW9uOiB7XG4gICAgICAgICAgdXJsOiAnaHR0cHM6Ly9naXRsYWIuY2ljZC5tYW4nLFxuICAgICAgICAgIGxpbWl0OiAwLFxuICAgICAgICAgIG1hY2hpbmU6IHtcbiAgICAgICAgICAgIG1heEJ1aWxkczogMTAsXG4gICAgICAgICAgICBhdXRvc2NhbGluZzogdGhpcy5hdXRvc2NhbGluZ0NvbmZpZyxcbiAgICAgICAgICAgIGlkbGVDb3VudDogNSxcbiAgICAgICAgICAgIGlkbGVUaW1lOiA5MDAsXG4gICAgICAgICAgICBtYWNoaW5lT3B0aW9uczoge1xuICAgICAgICAgICAgICByZXF1ZXN0U3BvdEluc3RhbmNlOiB0cnVlLFxuICAgICAgICAgICAgICBzcG90UHJpY2U6IDAuMDksXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgICAgZW52aXJvbm1lbnQ6IFtcbiAgICAgICAgICAgICdET0NLRVJfRFJJVkVSPW92ZXJsYXkyJyxcbiAgICAgICAgICAgICdET0NLRVJfVExTX0RJUkNFPS9jZXJ0cycsXG4gICAgICAgICAgICBgRE9DS0VSX0FVVEhfQ09ORklHPXtcImNyZWRIZWxwZXJzXCI6IHsgXCJwdWJsaWMuZWNyLmF3c1wiOiBcImVjci1sb2dpblwiLCBcIiR7XG4gICAgICAgICAgICAgIGVudi5hY2NvdW50XG4gICAgICAgICAgICB9LmRrci5lY3IuPHJlZ2lvbj4uYW1hem9uYXdzLmNvbVwiOiBcImVjci1sb2dpblwiIH0gfWAsXG4gICAgICAgICAgXSxcbiAgICAgICAgfSxcbiAgICAgICAgaW5zdGFuY2VUeXBlOiBJbnN0YW5jZVR5cGUub2YoSW5zdGFuY2VDbGFzcy5UMywgSW5zdGFuY2VTaXplLkxBUkdFKSxcbiAgICAgIH0sXG4gICAgXTtcbiAgfVxufVxuIl19

package/lib/contributions/smart-route/gitlab-runner/index.d.ts

@@ -0,0 +1,3 @@
+export * from './autoscaling-runner';
+export * from './runner-roles';
+export * from './spot-role';

package/lib/contributions/smart-route/gitlab-runner/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./autoscaling-runner"), exports);
+__exportStar(require("./runner-roles"), exports);
+__exportStar(require("./spot-role"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvY29udHJpYnV0aW9ucy9zbWFydC1yb3V0ZS9naXRsYWItcnVubmVyL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1REFBcUM7QUFDckMsaURBQStCO0FBQy9CLDhDQUE0QiIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXV0b3NjYWxpbmctcnVubmVyJztcbmV4cG9ydCAqIGZyb20gJy4vcnVubmVyLXJvbGVzJztcbmV4cG9ydCAqIGZyb20gJy4vc3BvdC1yb2xlJzsiXX0=

package/lib/contributions/smart-route/gitlab-runner/runner-roles.d.ts

@@ -0,0 +1,20 @@
+import { Environment, Stack } from 'aws-cdk-lib';
+import { Role } from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+export interface RunnerRoleProps {
+    readonly env: Environment;
+}
+/**
+ * This construct provides a set of base roles for gitlab runners in order to build, test, validate and deploy applications
+ * on RIO. The roles need to be assumed during job runtime to perform more permissive actions, such as creating certificates to
+ * authenticate towards the RIO MSK, pushing docker images to ECR, performing a secrets backup, deploying stacks,
+ * or to publish an SPA to a S3 bucket. Do not assume the deployment role unless needed.
+ * The base role can be the default role attached to GitLab runners.
+ * The role allows to read various basic parameters such as the NIST data mirror, the OSS license bucket, DataDog keys
+ * and to pull ECR images form public Gallery or the specified account in the environment.
+ * The Role ARNs are export using CFNOutputs. Use the outputs to configure environment variables in your GitLab group.
+ */
+export declare class RunnerRoles extends Construct {
+    readonly runnerBaseRole: Role;
+    constructor(scope: Stack, id: string, props: RunnerRoleProps);
+}