terraform-cdk-serverless-github-actions-runner-controller 0.0.0 → 0.0.2

package/modules/elastic-container-service/cdk.tf.json

@@ -0,0 +1,314 @@
+{
+  "//": {
+    "metadata": {
+      "backend": "local",
+      "stackName": "elastic-container-service",
+      "version": "0.20.0"
+    },
+    "outputs": {
+    }
+  },
+  "data": {
+    "aws_caller_identity": {
+      "aws_Identity_FDC445BF": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/Identity",
+            "uniqueId": "aws_Identity_FDC445BF"
+          }
+        }
+      }
+    },
+    "aws_region": {
+      "aws_Region_7477CA06": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/Region",
+            "uniqueId": "aws_Region_7477CA06"
+          }
+        }
+      }
+    },
+    "aws_security_groups": {
+      "aws_SecurityGroups_BAABB08D": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/SecurityGroups",
+            "uniqueId": "aws_SecurityGroups_BAABB08D"
+          }
+        }
+      }
+    },
+    "aws_subnets": {
+      "aws_Subnets_75E5377D": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/Subnets",
+            "uniqueId": "aws_Subnets_75E5377D"
+          }
+        }
+      }
+    }
+  },
+  "resource": {
+    "aws_cloudwatch_log_group": {
+      "aws_AutoscalerLogGroup_BFE58053": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/AutoscalerLogGroup",
+            "uniqueId": "aws_AutoscalerLogGroup_BFE58053"
+          }
+        },
+        "name": "/ecs/Autoscaler"
+      },
+      "aws_RunnerLogGroup_711756A6": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/RunnerLogGroup",
+            "uniqueId": "aws_RunnerLogGroup_711756A6"
+          }
+        },
+        "name": "/ecs/GHA"
+      }
+    },
+    "aws_ecs_cluster": {
+      "aws_Cluster_BA268616": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/Cluster",
+            "uniqueId": "aws_Cluster_BA268616"
+          }
+        },
+        "name": "gha-runner-cluster"
+      }
+    },
+    "aws_ecs_service": {
+      "aws_AutoscalerService_C7C3AA3C": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/AutoscalerService",
+            "uniqueId": "aws_AutoscalerService_C7C3AA3C"
+          }
+        },
+        "cluster": "${aws_ecs_cluster.aws_Cluster_BA268616.arn}",
+        "desired_count": 1,
+        "launch_type": "FARGATE",
+        "lifecycle": {
+          "ignore_changes": [
+            "desired_count"
+          ]
+        },
+        "name": "autoscaler-service",
+        "network_configuration": {
+          "assign_public_ip": true,
+          "security_groups": "${data.aws_security_groups.aws_SecurityGroups_BAABB08D.ids}",
+          "subnets": "${data.aws_subnets.aws_Subnets_75E5377D.ids}"
+        },
+        "task_definition": "${aws_ecs_task_definition.aws_AutoscalerTaskDefinition_24A76F67.arn_without_revision}"
+      }
+    },
+    "aws_ecs_task_definition": {
+      "aws_AutoscalerTaskDefinition_24A76F67": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/AutoscalerTaskDefinition",
+            "uniqueId": "aws_AutoscalerTaskDefinition_24A76F67"
+          }
+        },
+        "container_definitions": "${jsonencode([{\"name\" = \"autoscaler\", \"image\" = \"ghcr.io/hi-fi/gha-runners-on-managed-env:test\", \"essential\" = true, \"environment\" = [{\"name\" = \"PAT\", \"value\" = var.PAT}, {\"name\" = \"GITHUB_CONFIG_URL\", \"value\" = var.github_config_url}, {\"name\" = \"TASK_DEFINITION_ARN\", \"value\" = aws_ecs_task_definition.aws_RunnerTaskDefinition_9C7563BE.arn}, {\"name\" = \"ECS_CLUSTER\", \"value\" = aws_ecs_cluster.aws_Cluster_BA268616.arn}, {\"name\" = \"ECS_SUBNETS\", \"value\" = join(\",\", data.aws_subnets.aws_Subnets_75E5377D.ids)}, {\"name\" = \"ECS_SECURITY_GROUPS\", \"value\" = join(\",\", data.aws_security_groups.aws_SecurityGroups_BAABB08D.ids)}, {\"name\" = \"SCALE_SET_NAME\", \"value\" = \"ecs-runner-set\"}], \"logConfiguration\" = {\"logDriver\" = \"awslogs\", \"options\" = {\"awslogs-group\" = aws_cloudwatch_log_group.aws_AutoscalerLogGroup_BFE58053.name, \"awslogs-region\" = data.aws_region.aws_Region_7477CA06.name, \"awslogs-stream-prefix\" = \"ecs\"}}}])}",
+        "cpu": "256",
+        "execution_role_arn": "${aws_iam_role.aws_TaskExecutionRole_FAB64402.arn}",
+        "family": "Autoscaler",
+        "memory": "512",
+        "network_mode": "awsvpc",
+        "requires_compatibilities": [
+          "FARGATE"
+        ],
+        "runtime_platform": {
+          "cpu_architecture": "X86_64",
+          "operating_system_family": "LINUX"
+        },
+        "task_role_arn": "${aws_iam_role.aws_AutoscalerRole_CEB26423.arn}"
+      },
+      "aws_RunnerTaskDefinition_9C7563BE": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/RunnerTaskDefinition",
+            "uniqueId": "aws_RunnerTaskDefinition_9C7563BE"
+          }
+        },
+        "container_definitions": "${jsonencode([{\"name\" = \"runner\", \"image\" = \"ghcr.io/hi-fi/actions-runner:ecs\", \"command\" = [\"/bin/sh\", \"-c\", \"export EXECID=$(cat /proc/sys/kernel/random/uuid) && sudo mkdir -p /tmp/_work/$EXECID && sudo chown runner:runner /tmp/_work/$EXECID && ln -s /tmp/_work/$EXECID _work && sudo chown runner:runner /tmp/externals && /home/runner/run.sh ; sudo rm -r /tmp/_work/$EXECID\"], \"essential\" = true, \"environment\" = [{\"name\" = \"EFS_ID\", \"value\" = aws_efs_file_system.aws_efs_B3BBB350.id}, {\"name\" = \"EXTERNALS_EFS_ID\", \"value\" = aws_efs_file_system.aws_externalsEfs_C15353C9.id}, {\"name\" = \"ECS_CLUSTER_NAME\", \"value\" = aws_ecs_cluster.aws_Cluster_BA268616.name}, {\"name\" = \"ACTIONS_RUNNER_POD_NAME\", \"value\" = \"gha-pod\"}, {\"name\" = \"ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER\", \"value\" = \"false\"}, {\"name\" = \"ECS_SUBNETS\", \"value\" = join(\",\", data.aws_subnets.aws_Subnets_75E5377D.ids)}, {\"name\" = \"ECS_SECURITY_GROUPS\", \"value\" = join(\",\", data.aws_security_groups.aws_SecurityGroups_BAABB08D.ids)}, {\"name\" = \"ECS_TASK_ROLE\", \"value\" = aws_iam_role.aws_RunnerRole_75263C23.arn}, {\"name\" = \"ECS_EXECUTION_ROLE\", \"value\" = aws_iam_role.aws_TaskExecutionRole_FAB64402.arn}], \"mountPoints\" = [{\"sourceVolume\" = \"work\", \"containerPath\" = \"/tmp/_work\"}, {\"sourceVolume\" = \"externals\", \"containerPath\" = \"/tmp/externals\"}], \"logConfiguration\" = {\"logDriver\" = \"awslogs\", \"options\" = {\"awslogs-group\" = aws_cloudwatch_log_group.aws_RunnerLogGroup_711756A6.name, \"awslogs-region\" = data.aws_region.aws_Region_7477CA06.name, \"awslogs-stream-prefix\" = \"ecs\"}}}])}",
+        "cpu": "1024",
+        "execution_role_arn": "${aws_iam_role.aws_TaskExecutionRole_FAB64402.arn}",
+        "family": "GHA",
+        "memory": "2048",
+        "network_mode": "awsvpc",
+        "requires_compatibilities": [
+          "FARGATE"
+        ],
+        "runtime_platform": {
+          "cpu_architecture": "X86_64",
+          "operating_system_family": "LINUX"
+        },
+        "task_role_arn": "${aws_iam_role.aws_RunnerRole_75263C23.arn}",
+        "volume": [
+          {
+            "efs_volume_configuration": {
+              "file_system_id": "${aws_efs_file_system.aws_efs_B3BBB350.id}"
+            },
+            "name": "work"
+          },
+          {
+            "efs_volume_configuration": {
+              "file_system_id": "${aws_efs_file_system.aws_externalsEfs_C15353C9.id}"
+            },
+            "name": "externals"
+          }
+        ]
+      }
+    },
+    "aws_efs_file_system": {
+      "aws_efs_B3BBB350": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/efs",
+            "uniqueId": "aws_efs_B3BBB350"
+          }
+        },
+        "tags": {
+          "Name": "work"
+        },
+        "throughput_mode": "elastic"
+      },
+      "aws_externalsEfs_C15353C9": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/externalsEfs",
+            "uniqueId": "aws_externalsEfs_C15353C9"
+          }
+        },
+        "tags": {
+          "Name": "externals"
+        },
+        "throughput_mode": "elastic"
+      }
+    },
+    "aws_efs_mount_target": {
+      "aws_EfsMountTarget_B2BDD3E5": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/EfsMountTarget",
+            "uniqueId": "aws_EfsMountTarget_B2BDD3E5"
+          }
+        },
+        "file_system_id": "${aws_efs_file_system.aws_efs_B3BBB350.id}",
+        "for_each": "${toset(data.aws_subnets.aws_Subnets_75E5377D.ids)}",
+        "subnet_id": "${each.value}"
+      },
+      "aws_ExternalsEfsMountTarget_2D9AE418": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/ExternalsEfsMountTarget",
+            "uniqueId": "aws_ExternalsEfsMountTarget_2D9AE418"
+          }
+        },
+        "file_system_id": "${aws_efs_file_system.aws_externalsEfs_C15353C9.id}",
+        "for_each": "${toset(data.aws_subnets.aws_Subnets_75E5377D.ids)}",
+        "subnet_id": "${each.value}"
+      }
+    },
+    "aws_iam_policy": {
+      "aws_AutoscalerPolicy_FF16A997": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/AutoscalerPolicy",
+            "uniqueId": "aws_AutoscalerPolicy_FF16A997"
+          }
+        },
+        "policy": "${jsonencode({\"Version\" = \"2012-10-17\", \"Statement\" = [{\"Sid\" = \"StartandMonitorTask\", \"Effect\" = \"Allow\", \"Action\" = [\"ecs:RunTask\", \"ecs:DescribeTasks\", \"logs:GetLogEvents\", \"iam:PassRole\"], \"Resource\" = [\"${aws_ecs_task_definition.aws_RunnerTaskDefinition_9C7563BE.arn_without_revision}:*\", aws_iam_role.aws_TaskExecutionRole_FAB64402.arn, aws_iam_role.aws_RunnerRole_75263C23.arn, \"arn:aws:ecs:${data.aws_region.aws_Region_7477CA06.name}:${data.aws_caller_identity.aws_Identity_FDC445BF.account_id}:task/${aws_ecs_cluster.aws_Cluster_BA268616.name}/*\", \"${aws_cloudwatch_log_group.aws_RunnerLogGroup_711756A6.arn}:log-stream:*\"]}, {\"Sid\" = \"GetVpcInfo\", \"Effect\" = \"Allow\", \"Action\" = [\"ec2:DescribeSubnets\", \"ec2:DescribeSecurityGroups\"], \"Resource\" = \"*\"}]})}"
+      },
+      "aws_RunnerPolicy_7B21DB81": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/RunnerPolicy",
+            "uniqueId": "aws_RunnerPolicy_7B21DB81"
+          }
+        },
+        "policy": "${jsonencode({\"Version\" = \"2012-10-17\", \"Statement\" = [{\"Sid\" = \"StartandMonitorTask\", \"Effect\" = \"Allow\", \"Action\" = [\"ecs:RunTask\", \"ecs:TagResource\", \"ecs:ListTaskDefinitions\", \"ecs:ListTasks\", \"ecs:StopTask\", \"ecs:RegisterTaskDefinition\", \"ecs:DescribeTaskDefinition\", \"ecs:DeregisterTaskDefinition\", \"ecs:DeleteTaskDefinitions\", \"ecs:ExecuteCommand\", \"ecs:DescribeTasks\", \"logs:GetLogEvents\", \"iam:PassRole\", \"logs:StartLiveTail\", \"logs:CreateLogStream\"], \"Resource\" = [\"arn:aws:ecs:${data.aws_region.aws_Region_7477CA06.name}:${data.aws_caller_identity.aws_Identity_FDC445BF.account_id}:task-definition/gha-pod-workflow:*\", aws_ecs_cluster.aws_Cluster_BA268616.arn, aws_iam_role.aws_TaskExecutionRole_FAB64402.arn, aws_iam_role.aws_RunnerRole_75263C23.arn, \"arn:aws:ecs:${data.aws_region.aws_Region_7477CA06.name}:${data.aws_caller_identity.aws_Identity_FDC445BF.account_id}:task/${aws_ecs_cluster.aws_Cluster_BA268616.name}/*\", \"*\"]}, {\"Sid\" = \"GetVpcInfo\", \"Effect\" = \"Allow\", \"Action\" = [\"ec2:DescribeSubnets\", \"ec2:DescribeSecurityGroups\"], \"Resource\" = \"*\"}, {\"Sid\" = \"ExecCommands\", \"Effect\" = \"Allow\", \"Action\" = [\"ssmmessages:CreateControlChannel\", \"ssmmessages:CreateDataChannel\", \"ssmmessages:OpenControlChannel\", \"ssmmessages:OpenDataChannel\"], \"Resource\" = \"*\"}]})}"
+      }
+    },
+    "aws_iam_role": {
+      "aws_AutoscalerRole_CEB26423": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/AutoscalerRole",
+            "uniqueId": "aws_AutoscalerRole_CEB26423"
+          }
+        },
+        "assume_role_policy": "${jsonencode({\"Version\" = \"2012-10-17\", \"Statement\" = [{\"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = \"ecs-tasks.amazonaws.com\"}, \"Action\" = \"sts:AssumeRole\"}]})}"
+      },
+      "aws_RunnerRole_75263C23": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/RunnerRole",
+            "uniqueId": "aws_RunnerRole_75263C23"
+          }
+        },
+        "assume_role_policy": "${jsonencode({\"Version\" = \"2012-10-17\", \"Statement\" = [{\"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = \"ecs-tasks.amazonaws.com\"}, \"Action\" = \"sts:AssumeRole\"}]})}"
+      },
+      "aws_TaskExecutionRole_FAB64402": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/TaskExecutionRole",
+            "uniqueId": "aws_TaskExecutionRole_FAB64402"
+          }
+        },
+        "assume_role_policy": "${jsonencode({\"Version\" = \"2012-10-17\", \"Statement\" = [{\"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = \"ecs-tasks.amazonaws.com\"}, \"Action\" = \"sts:AssumeRole\"}]})}",
+        "managed_policy_arns": [
+          "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+        ]
+      }
+    },
+    "aws_iam_role_policy_attachment": {
+      "aws_AutoscalerPolicyAttachment_5402A0C0": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/AutoscalerPolicyAttachment",
+            "uniqueId": "aws_AutoscalerPolicyAttachment_5402A0C0"
+          }
+        },
+        "policy_arn": "${aws_iam_policy.aws_AutoscalerPolicy_FF16A997.arn}",
+        "role": "${aws_iam_role.aws_AutoscalerRole_CEB26423.name}"
+      },
+      "aws_RunnerPolicyAttachment_A293771C": {
+        "//": {
+          "metadata": {
+            "path": "elastic-container-service/aws/RunnerPolicyAttachment",
+            "uniqueId": "aws_RunnerPolicyAttachment_A293771C"
+          }
+        },
+        "policy_arn": "${aws_iam_policy.aws_RunnerPolicy_7B21DB81.arn}",
+        "role": "${aws_iam_role.aws_RunnerRole_75263C23.name}"
+      }
+    }
+  },
+  "terraform": {
+    "required_providers": {
+      "aws": {
+        "source": "aws",
+        "version": "5.96.0"
+      }
+    }
+  },
+  "variable": {
+    "PAT": {
+      "description": "Github PAT with Actions:Read and Admin:Read+Write scopes",
+      "nullable": false,
+      "sensitive": true
+    },
+    "github_config_url": {
+      "description": "Github URL where runners should register to. Format https://<GitHub host>/<your_enterprise/org/repo>",
+      "nullable": false
+    }
+  }
+}

package/modules/google-cloud-run/README.md

@@ -0,0 +1,62 @@
+# Actions Runner Controller (ARC) on Google Cloud Run
+
+> [!WARNING]  
+> This is currently PoC level thing for module publishing. Not ready for production or any use
+
+## Usage
+
+```hcl
+module "arc_on_aca" {
+  source = "Hi-Fi/serverless-github-actions-runner-controller/cdk//modules/google-cloud-run"
+}
+```
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_google"></a> [google](#requirement\_google) | 6.32.0 |
+| <a name="requirement_null"></a> [null](#requirement\_null) | 3.2.4 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_google"></a> [google](#provider\_google) | 6.32.0 |
+| <a name="provider_null"></a> [null](#provider\_null) | 3.2.4 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [google_artifact_registry_repository.cr_registry_886F88F0](https://registry.terraform.io/providers/google/6.32.0/docs/resources/artifact_registry_repository) | resource |
+| [google_cloud_run_service.cr_autoscalerService_A4FAA2B6](https://registry.terraform.io/providers/google/6.32.0/docs/resources/cloud_run_service) | resource |
+| [google_cloud_run_v2_job.cr_ghaJob_3BDFC08A](https://registry.terraform.io/providers/google/6.32.0/docs/resources/cloud_run_v2_job) | resource |
+| [google_project_iam_custom_role.cr_autoscalerRole_8A950337](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_custom_role) | resource |
+| [google_project_iam_custom_role.cr_runnerRole_07508BC4](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_custom_role) | resource |
+| [google_project_iam_member.cr_autoscalerRoleBindingRunServiceAgent_83C78179](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.cr_autoscalerRoleBindingRun_76E1E813](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.cr_autoscalerRoleBindingStorage_C1A676AA](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.cr_runnerRoleBindingRunServiceAgent_88652FB8](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.cr_runnerRoleBindingRunViewer_328C548F](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.cr_runnerRoleBindingStorage_8D8C3B87](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.cr_runnerRoleBinding_E20193A5](https://registry.terraform.io/providers/google/6.32.0/docs/resources/project_iam_member) | resource |
+| [google_service_account.cr_autoscalerServiceAccount_37C5FFAD](https://registry.terraform.io/providers/google/6.32.0/docs/resources/service_account) | resource |
+| [google_service_account.cr_jobServiceAccount_4D2CB679](https://registry.terraform.io/providers/google/6.32.0/docs/resources/service_account) | resource |
+| [null_resource.cr_gcloud_3D7A726F](https://registry.terraform.io/providers/null/3.2.4/docs/resources/resource) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_PAT"></a> [PAT](#input\_PAT) | Github PAT with Actions:Read and Admin:Read+Write scopes | `any` | n/a | yes |
+| <a name="input_github_config_url"></a> [github\_config\_url](#input\_github\_config\_url) | Github URL where runners should register to. Format https://<GitHub host>/<your\_enterprise/org/repo> | `any` | n/a | yes |
+
+## Outputs
+
+No outputs.
+<!-- END_TF_DOCS -->