Skip to content

Commit 2424864

Browse files
BenbentwoBenbentwo
authored
Upstream RunsOn (#1141)
1 parent 0d0040c commit 2424864

File tree

8 files changed

+786
-0
lines changed

8 files changed

+786
-0
lines changed

‎modules/runs-on/README.md‎

Lines changed: 262 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
---
2+
tags:
3+
- component/cloudformation-stack
4+
- provider/aws
5+
---
6+
7+
# Component: `runs-on`
8+
9+
This component is responsible for provisioning an RunsOn (https://runs-on.com/).
10+
11+
After deploying this component, you will need to install the RunsOn app to GitHub. See the
12+
[RunsOn documentation](https://runs-on.com/guides/install/#3-github-app-registration) for more information.
13+
14+
## Usage
15+
16+
**Stack Level**: Regional
17+
18+
The following is an example snippet for how to use this component:
19+
20+
(`runs-on.yaml`)
21+
22+
```yaml
23+
import:
24+
- orgs/acme/core/auto/_defaults
25+
- mixins/region/us-east-1
26+
27+
components:
28+
terraform:
29+
runs-on:
30+
metadata:
31+
component: runs-on
32+
vars:
33+
name: runs-on
34+
enabled: true
35+
capabilities: ["CAPABILITY_IAM"]
36+
on_failure: "ROLLBACK"
37+
timeout_in_minutes: 30
38+
template_url: https://runs-on.s3.eu-west-1.amazonaws.com/cloudformation/template.yaml
39+
parameters:
40+
AppCPU: 512
41+
AppMemory: 1024
42+
EmailAddress: [email protected]
43+
Environment: core-auto
44+
GithubOrganization: ACME
45+
LicenseKey: <LICENSE>
46+
Private: always # always | true | false - Always will default place in private subnet, true will place in private subnet if tag `private=true` present on workflow, false will place in public subnet
47+
VpcCidrBlock: 10.100.0.0/16
48+
```
49+
50+
### Setting up with Transit Gateway
51+
52+
This assumes you are using the Cloud Posse Components for Transit Gateway
53+
([tgw/hub](https://docs.cloudposse.com/components/library/aws/tgw/hub/) &
54+
[tgw/spoke](https://docs.cloudposse.com/components/library/aws/tgw/spoke/)).
55+
56+
The outputs of this component contain the same outputs as the `vpc` component. This is because the runs-on
57+
cloudformation stack creates a VPC and subnets.
58+
59+
First we need to update the TGW/Hub - this stores information about the VPCs that are allowed to be used by TGW Spokes.
60+
61+
Assuming your TGW/Hub lives in the `core-network` account and your Runs-On is deployed to `core-auto` (`tgw-hub.yaml`)
62+
63+
```yaml
64+
vars:
65+
connections:
66+
- account:
67+
tenant: core
68+
stage: auto
69+
vpc_component_names:
70+
- vpc
71+
- runs-on
72+
```
73+
74+
<details><summary>Click to show full stack configuration</summary>
75+
76+
```yaml
77+
components:
78+
terraform:
79+
tgw/hub/defaults:
80+
metadata:
81+
type: abstract
82+
component: tgw/hub
83+
vars:
84+
enabled: true
85+
name: tgw-hub
86+
tags:
87+
Team: sre
88+
Service: tgw-hub
89+
90+
tgw/hub:
91+
metadata:
92+
inherits:
93+
- tgw/hub/defaults
94+
component: tgw/hub
95+
vars:
96+
connections:
97+
- account:
98+
tenant: core
99+
stage: network
100+
- account:
101+
tenant: core
102+
stage: auto
103+
vpc_component_names:
104+
- vpc
105+
- runs-on
106+
- account:
107+
tenant: plat
108+
stage: sandbox
109+
- account:
110+
tenant: plat
111+
stage: dev
112+
- account:
113+
tenant: plat
114+
stage: staging
115+
- account:
116+
tenant: plat
117+
stage: prod
118+
```
119+
120+
We then need to create a spoke that refers to the VPC created by Runs-On.
121+
122+
(`tgw-spoke.yaml`)
123+
124+
```yaml
125+
tgw/spoke/runs-on:
126+
metadata:
127+
component: tgw/spoke
128+
inherits:
129+
- tgw/spoke-defaults
130+
vars:
131+
own_vpc_component_name: runs-on
132+
attributes:
133+
- "runs-on"
134+
connections:
135+
- account:
136+
tenant: core
137+
stage: network
138+
- account:
139+
tenant: core
140+
stage: auto
141+
vpc_component_names:
142+
- vpc
143+
- runs-on
144+
- account:
145+
tenant: plat
146+
stage: sandbox
147+
- account:
148+
tenant: plat
149+
stage: dev
150+
- account:
151+
tenant: plat
152+
stage: staging
153+
- account:
154+
tenant: plat
155+
stage: prod
156+
```
157+
158+
Finally we need to update the spokes of the TGW/Spokes to allow Runs-On traffic to the other accounts.
159+
160+
Typically this includes `core-auto`, `core-network`, and your platform accounts.
161+
162+
(`tgw-spoke.yaml`)
163+
164+
```yaml
165+
tgw/spoke:
166+
metadata:
167+
inherits:
168+
- tgw/spoke-defaults
169+
vars:
170+
connections:
171+
...
172+
vpc_component_names:
173+
- vpc
174+
- runs-on
175+
...
176+
```
177+
178+
<!-- prettier-ignore-start -->
179+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
180+
## Requirements
181+
182+
| Name | Version |
183+
|------|---------|
184+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
185+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9.0 |
186+
187+
## Providers
188+
189+
| Name | Version |
190+
|------|---------|
191+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.9.0 |
192+
193+
## Modules
194+
195+
| Name | Source | Version |
196+
|------|--------|---------|
197+
| <a name="module_cloudformation_stack"></a> [cloudformation\_stack](#module\_cloudformation\_stack) | cloudposse/cloudformation-stack/aws | v0.7.1 |
198+
| <a name="module_iam_policy"></a> [iam\_policy](#module\_iam\_policy) | cloudposse/iam-policy/aws | v2.0.1 |
199+
| <a name="module_iam_roles"></a> [iam\_roles](#module\_iam\_roles) | ../account-map/modules/iam-roles | n/a |
200+
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
201+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | cloudposse/stack-config/yaml//modules/remote-state | 1.5.0 |
202+
203+
## Resources
204+
205+
| Name | Type |
206+
|------|------|
207+
| [aws_nat_gateways.ngws](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/nat_gateways) | data source |
208+
209+
## Inputs
210+
211+
| Name | Description | Type | Default | Required |
212+
|------|-------------|------|---------|:--------:|
213+
| <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.<br/>This is for some rare cases where resources want additional configuration of tags<br/>and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
214+
| <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br/>in the order they appear in the list. New attributes are appended to the<br/>end of the list. The elements of the list are joined by the `delimiter`<br/>and treated as a single ID element. | `list(string)` | `[]` | no |
215+
| <a name="input_capabilities"></a> [capabilities](#input\_capabilities) | A list of capabilities. Valid values: CAPABILITY\_IAM, CAPABILITY\_NAMED\_IAM, CAPABILITY\_AUTO\_EXPAND | `list(string)` | `[]` | no |
216+
| <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br/>See description of individual variables for details.<br/>Leave string and numeric variables as `null` to use default value.<br/>Individual variable settings (non-null) override settings in context object,<br/>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br/> "additional_tag_map": {},<br/> "attributes": [],<br/> "delimiter": null,<br/> "descriptor_formats": {},<br/> "enabled": true,<br/> "environment": null,<br/> "id_length_limit": null,<br/> "label_key_case": null,<br/> "label_order": [],<br/> "label_value_case": null,<br/> "labels_as_tags": [<br/> "unset"<br/> ],<br/> "name": null,<br/> "namespace": null,<br/> "regex_replace_chars": null,<br/> "stage": null,<br/> "tags": {},<br/> "tenant": null<br/>}</pre> | no |
217+
| <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br/>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
218+
| <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br/>Map of maps. Keys are names of descriptors. Values are maps of the form<br/>`{<br/> format = string<br/> labels = list(string)<br/>}`<br/>(Type is `any` so the map values can later be enhanced to provide additional options.)<br/>`format` is a Terraform format string to be passed to the `format()` function.<br/>`labels` is a list of labels, in order, to pass to `format()` function.<br/>Label values will be normalized before being passed to `format()` so they will be<br/>identical to how they appear in `id`.<br/>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
219+
| <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
220+
| <a name="input_environment"></a> [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
221+
| <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br/>Set to `0` for unlimited length.<br/>Set to `null` for keep the existing setting, which defaults to `0`.<br/>Does not affect `id_full`. | `number` | `null` | no |
222+
| <a name="input_label_key_case"></a> [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.<br/>Does not affect keys of tags passed in via the `tags` input.<br/>Possible values: `lower`, `title`, `upper`.<br/>Default value: `title`. | `string` | `null` | no |
223+
| <a name="input_label_order"></a> [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.<br/>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br/>You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |
224+
| <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,<br/>set as tag values, and output by this module individually.<br/>Does not affect values of tags passed in via the `tags` input.<br/>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br/>Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.<br/>Default value: `lower`. | `string` | `null` | no |
225+
| <a name="input_labels_as_tags"></a> [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.<br/>Default is to include all labels.<br/>Tags with empty values will not be included in the `tags` output.<br/>Set to `[]` to suppress all generated tags.<br/>**Notes:**<br/> The value of the `name` tag, if included, will be the `id`, not the `name`.<br/> Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be<br/> changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | <pre>[<br/> "default"<br/>]</pre> | no |
226+
| <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br/>This is the only ID element not also included as a `tag`.<br/>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
227+
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
228+
| <a name="input_on_failure"></a> [on\_failure](#input\_on\_failure) | Action to be taken if stack creation fails. This must be one of: `DO_NOTHING`, `ROLLBACK`, or `DELETE` | `string` | `"ROLLBACK"` | no |
229+
| <a name="input_parameters"></a> [parameters](#input\_parameters) | Key-value map of input parameters for the Stack Set template. (\_e.g.\_ map("BusinessUnit","ABC") | `map(string)` | `{}` | no |
230+
| <a name="input_policy_body"></a> [policy\_body](#input\_policy\_body) | Structure containing the stack policy body | `string` | `""` | no |
231+
| <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.<br/>Characters matching the regex will be removed from the ID elements.<br/>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
232+
| <a name="input_region"></a> [region](#input\_region) | AWS Region | `string` | n/a | yes |
233+
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
234+
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br/>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
235+
| <a name="input_template_url"></a> [template\_url](#input\_template\_url) | Amazon S3 bucket URL location of a file containing the CloudFormation template body. Maximum file size: 460,800 bytes | `string` | n/a | yes |
236+
| <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
237+
| <a name="input_timeout_in_minutes"></a> [timeout\_in\_minutes](#input\_timeout\_in\_minutes) | The amount of time that can pass before the stack status becomes `CREATE_FAILED` | `number` | `30` | no |
238+
| <a name="input_vpc_peering_component"></a> [vpc\_peering\_component](#input\_vpc\_peering\_component) | The component name of the VPC Peering Connection | <pre>object({<br/> component = string<br/> environment = optional(string)<br/> tenant = optional(string)<br/> stage = optional(string)<br/> })</pre> | `null` | no |
239+
240+
## Outputs
241+
242+
| Name | Description |
243+
|------|-------------|
244+
| <a name="output_id"></a> [id](#output\_id) | ID of the CloudFormation Stack |
245+
| <a name="output_name"></a> [name](#output\_name) | Name of the CloudFormation Stack |
246+
| <a name="output_nat_gateway_ids"></a> [nat\_gateway\_ids](#output\_nat\_gateway\_ids) | NAT Gateway IDs |
247+
| <a name="output_nat_instance_ids"></a> [nat\_instance\_ids](#output\_nat\_instance\_ids) | NAT Instance IDs |
248+
| <a name="output_outputs"></a> [outputs](#output\_outputs) | Outputs of the CloudFormation Stack |
249+
| <a name="output_private_route_table_ids"></a> [private\_route\_table\_ids](#output\_private\_route\_table\_ids) | Private subnet route table IDs |
250+
| <a name="output_private_subnet_ids"></a> [private\_subnet\_ids](#output\_private\_subnet\_ids) | Private subnet IDs |
251+
| <a name="output_public_subnet_ids"></a> [public\_subnet\_ids](#output\_public\_subnet\_ids) | Public subnet IDs |
252+
| <a name="output_vpc_cidr"></a> [vpc\_cidr](#output\_vpc\_cidr) | CIDR of the VPC created by RunsOn CloudFormation Stack |
253+
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | ID of the VPC created by RunsOn CloudFormation Stack |
254+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
255+
<!-- prettier-ignore-end -->
256+
257+
## References
258+
259+
- [cloudposse/terraform-aws-components](https://github.com/cloudposse/terraform-aws-components/tree/main/modules/cloudtrail) -
260+
Cloud Posse's upstream component
261+
262+
[<img src="https://cloudposse.com/logo-300x69.svg" height="32" align="right"/>](https://cpco.io/component)

0 commit comments

Comments
 (0)