Skip to content

Commit 3c6207b

Browse files
armenmelkonyan90armenmelkonyan90
committed
MO-1098 added actions-runner-controller to k8s-addons module
1 parent 6599a78 commit 3c6207b

File tree

2 files changed

+181
-0
lines changed

2 files changed

+181
-0
lines changed

Diff for: ‎terraform/modules/k8s-addons/eks-github-runner.tf

+175
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
locals {
2+
github_runner = {
3+
name = local.helm_releases[index(local.helm_releases.*.id, "github-runner")].id
4+
enabled = local.helm_releases[index(local.helm_releases.*.id, "github-runner")].enabled
5+
chart = local.helm_releases[index(local.helm_releases.*.id, "github-runner")].chart
6+
repository = local.helm_releases[index(local.helm_releases.*.id, "github-runner")].repository
7+
chart_version = local.helm_releases[index(local.helm_releases.*.id, "github-runner")].chart_version
8+
namespace = local.helm_releases[index(local.helm_releases.*.id, "github-runner")].namespace
9+
}
10+
github_runner_registration_token = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "github_runner_registration_token", "")
11+
github_runner_values = <<VALUES
12+
authSecret:
13+
annotations:
14+
github_token: ${local.github_runner_registration_token}
15+
serviceAccount:
16+
name: dev-runner-sa
17+
annotations:
18+
eks.amazonaws.com/role-arn: ${local.github_runner.enabled ? module.aws_iam_github_runner[0].role_arn : ""}
19+
20+
VALUES
21+
}
22+
23+
resource "kubernetes_service_account" "dev_runner_sa" {
24+
metadata {
25+
name = "dev-runner-sa"
26+
namespace = "dev"
27+
}
28+
}
29+
30+
resource "kubernetes_role" "dev_runner_role" {
31+
metadata {
32+
name = "dev-runner-role"
33+
namespace = "dev"
34+
}
35+
36+
rule {
37+
api_groups = [""]
38+
resources = ["pods", "services", "configmaps"]
39+
verbs = ["get", "list", "watch", "create", "update", "delete"]
40+
}
41+
}
42+
43+
resource "kubernetes_role_binding" "dev_runner_rolebinding" {
44+
metadata {
45+
name = "dev-runner-rolebinding"
46+
namespace = "dev"
47+
}
48+
49+
subject {
50+
kind = "ServiceAccount"
51+
name = kubernetes_service_account.dev_runner_sa.metadata[0].name
52+
namespace = "dev"
53+
}
54+
55+
role_ref {
56+
kind = "Role"
57+
name = kubernetes_role.dev_runner_role.metadata[0].name
58+
api_group = "rbac.authorization.k8s.io"
59+
}
60+
}
61+
62+
module "github_runner_namespace" {
63+
count = local.github_runner.enabled ? 1 : 0
64+
65+
source = "../eks-kubernetes-namespace"
66+
name = "github-runner"
67+
network_policies = [
68+
{
69+
name = "default-deny"
70+
policy_types = ["Ingress", "Egress"]
71+
pod_selector = {}
72+
},
73+
{
74+
name = "allow-this-namespace"
75+
policy_types = ["Ingress"]
76+
pod_selector = {}
77+
ingress = {
78+
from = [
79+
{
80+
namespace_selector = {
81+
match_labels = {
82+
name = "github-runner"
83+
}
84+
}
85+
}
86+
]
87+
}
88+
},
89+
{
90+
name = "allow-egress"
91+
policy_types = ["Egress"]
92+
pod_selector = {}
93+
egress = {
94+
to = [
95+
{
96+
ip_block = {
97+
cidr = "0.0.0.0/0"
98+
except = [
99+
"169.254.169.254/32"
100+
]
101+
}
102+
}
103+
]
104+
}
105+
}
106+
]
107+
}
108+
109+
# resource "kubernetes_manifest" "runner_deployment" {
110+
# depends_on = [helm_release.github_runner]
111+
# manifest = {
112+
# apiVersion = "actions.summerwind.dev/v1alpha1"
113+
# kind = "RunnerDeployment"
114+
# metadata = {
115+
# name = "dev-runner"
116+
# namespace = "dev"
117+
# }
118+
# spec = {
119+
# replicas = 1
120+
# template = {
121+
# spec = {
122+
# nodeSelector = {
123+
# "eks.amazonaws.com/capacity-type" = "SPOT"
124+
# }
125+
# }
126+
# }
127+
# }
128+
# }
129+
# }
130+
131+
module "aws_iam_github_runner" {
132+
count = local.github_runner.enabled ? 1 : 0
133+
134+
source = "../aws-iam-eks-trusted"
135+
name = "${local.name}-${local.gitlab_runner.name}"
136+
region = local.region
137+
oidc_provider_arn = local.eks_oidc_provider_arn
138+
policy = jsonencode({
139+
"Version" : "2012-10-17",
140+
"Statement" : [
141+
{
142+
"Effect" : "Allow",
143+
"Action" : [
144+
"ecr:GetAuthorizationToken",
145+
"ecr:GetDownloadUrlForLayer",
146+
"ecr:BatchGetImage",
147+
"ecr:BatchCheckLayerAvailability",
148+
"ecr:PutImage",
149+
"ecr:InitiateLayerUpload",
150+
"ecr:UploadLayerPart",
151+
"ecr:CompleteLayerUpload",
152+
"ecr:ListTagsForResource",
153+
"ecr:DescribeImageScanFindings",
154+
"ecr:DescribeImages"
155+
],
156+
"Resource" : "*"
157+
}
158+
]
159+
})
160+
}
161+
162+
resource "helm_release" "github_runner" {
163+
count = local.github_runner.enabled ? 1 : 0
164+
165+
name = local.github_runner.name
166+
chart = local.github_runner.chart
167+
repository = local.github_runner.repository
168+
version = local.github_runner.chart_version
169+
namespace = module.github_runner_namespace[count.index].name
170+
max_history = var.helm_release_history_size
171+
172+
values = [
173+
local.github_runner_values
174+
]
175+
}

Diff for: ‎terraform/modules/k8s-addons/helm-releases.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -95,3 +95,9 @@ releases:
9595
repository: https://victoriametrics.github.io/helm-charts
9696
chart_version: 0.24.1
9797
namespace: monitoring
98+
- id: github-runner
99+
enabled: true
100+
chart: actions-runner-controller
101+
repository: https://actions-runner-controller.github.io/actions-runner-controller
102+
chart_version: 0.23.7
103+
namespace: github-runner

0 commit comments

Comments
 (0)