terraform-aws-ona-runner/locals.tf at main · gitpod-io/terraform-aws-ona-runner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

locals {
  runner_name_prefix    = trimsuffix(substr(lower(var.runner_name), 0, 12), "-")
  runner_id_name_suffix = substr(sha256(lower(var.runner_id)), 0, 16)
  default_name_prefix   = "${local.runner_name_prefix}-${local.runner_id_name_suffix}"
  name_prefix           = coalesce(var.resource_name_prefix, local.default_name_prefix)

  memorydb_name_prefix           = substr(local.name_prefix, 0, 31)
  memorydb_subnet_name_prefix    = substr(local.name_prefix, 0, 40)
  memorydb_user_name_prefix      = substr(local.name_prefix, 0, 26)
  memorydb_acl_name_prefix       = substr(local.name_prefix, 0, 27)
  elasticache_name_prefix        = substr(local.name_prefix, 0, 34)
  elasticache_subnet_name_prefix = substr(local.name_prefix, 0, 38)
  load_balancer_name_prefix      = substr(local.name_prefix, 0, 25)
  target_group_name_prefix       = substr(local.name_prefix, 0, 26)
  s3_bucket_name_prefix          = substr(local.name_prefix, 0, 25)
  iam_role_name_prefix           = substr(local.name_prefix, 0, 24)

  common_tags = merge(var.tags, {
    "aws-apn-id"                           = "pc:7fmtjv5ewmq6d8gwjb08fwitz"
    "gitpod:terraform:module"              = "terraform-aws-ona-runner"
    "gitpod:cloudformation:stack-provider" = "gitpod-flex"
    "gitpod.dev/runner-id"                 = var.runner_id
  })

  runner_owned_resource_tag_keys = [
    "aws-apn-id",
    "gitpod.dev/runner-id",
  ]

  runner_resource_tags = {
    for key, value in local.common_tags : key => value
    if !contains(local.runner_owned_resource_tag_keys, key)
  }

  runner_is_large = var.runner_size == "large"

  non_graviton_cache_region = contains(["eu-west-3", "eu-south-2"], data.aws_region.current.name)
  elasticache_node_type = local.runner_is_large ? (
    local.non_graviton_cache_region ? "cache.r5.large" : "cache.r7g.large"
    ) : (
    local.non_graviton_cache_region ? "cache.t3.small" : "cache.t4g.small"
  )
  memorydb_node_type = local.runner_is_large ? "db.t4g.medium" : "db.t4g.small"

  runner_token_secret_name = "${data.aws_region.current.name}-${var.runner_id}-runner-token"
  runner_token_secret_arn  = "arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:${local.runner_token_secret_name}-??????"

  redis_parameter_name = "/gitpod/runner/${var.runner_id}/ai-execution-redis"
  runner_config_key    = "/gitpod/runner/${var.runner_id}"

  internal_runner_namespace = "${local.name_prefix}.internal"
  internal_runner_endpoint  = "https://runner.${local.internal_runner_namespace}:${var.internal_llm_proxy_port}"
  internal_runner_config_fragments = var.restrict_ingress ? [
    ",\"internalRunnerEndpoint\":", jsonencode(local.internal_runner_endpoint),
    ",\"internalRunnerLLMPort\":", jsonencode(var.internal_llm_proxy_port),
    ",\"internalRunnerTLSSecretARN\":", jsonencode(aws_secretsmanager_secret.internal_llm_tls[0].arn),
  ] : []
  proxy_log_config_fragments = var.restrict_ingress ? [] : [
    ",\"proxyLogGroup\":", jsonencode(aws_cloudwatch_log_group.proxy[0].name),
  ]
  runner_proxy_domain_config_fragments = [
    ",\"runnerProxyDomain\":", jsonencode(var.runner_domain == null ? "" : var.runner_domain),
  ]
  ssh_over_gateway = var.restrict_ingress ? "false" : "true"

  release_public_ecr_prefix = "public.ecr.aws/k5t9d3j5/application/gitpod-next"
  release_runner_image = var.runner_image != "" ? var.runner_image : (
    "${local.release_public_ecr_prefix}/gitpod-ec2-runner:${var.runner_template_build_version}"
  )
  release_proxy_image = var.proxy_image != "" ? var.proxy_image : (
    "${local.release_public_ecr_prefix}/gitpod-proxy:${var.runner_template_build_version}"
  )
  release_inputs_are_consistent = endswith(local.release_runner_image, ":${var.runner_template_build_version}") && endswith(local.release_proxy_image, ":${var.runner_template_build_version}")

  # Keep these paths aligned with the private-ECR template renderer in
  # gitpod-next/dev/ci-jobs/tasks/ec2-runner/releasebundle.
  release_private_ecr_prefix = "025066274397.dkr.ecr.${data.aws_region.current.name}.amazonaws.com/gitpod/ecr"
  runner_image = startswith(local.release_runner_image, "${local.release_public_ecr_prefix}/") ? (
    "${local.release_private_ecr_prefix}/${trimprefix(local.release_runner_image, "public.ecr.aws/")}"
  ) : local.release_runner_image
  proxy_image = startswith(local.release_proxy_image, "${local.release_public_ecr_prefix}/") ? (
    "${local.release_private_ecr_prefix}/${trimprefix(local.release_proxy_image, "public.ecr.aws/")}"
  ) : local.release_proxy_image

  private_ecr_prefix_pattern = "^([^/]+\\.dkr\\.ecr\\.[^.]+\\.amazonaws\\.com/gitpod/ecr)/"
  runner_private_ecr_prefix  = can(regex(local.private_ecr_prefix_pattern, local.runner_image)) ? regex(local.private_ecr_prefix_pattern, local.runner_image)[0] : ""
  proxy_private_ecr_prefix   = can(regex(local.private_ecr_prefix_pattern, local.proxy_image)) ? regex(local.private_ecr_prefix_pattern, local.proxy_image)[0] : ""
  private_ecr_prefix         = local.runner_private_ecr_prefix
  private_ecr_images_are_consistent = (
    local.runner_private_ecr_prefix == local.proxy_private_ecr_prefix
  )
  adot_image = local.private_ecr_prefix == "" ? (
    "public.ecr.aws/aws-observability/aws-otel-collector:v0.43.3"
  ) : "${local.private_ecr_prefix}/k5t9d3j5/application/gitpod-next/external/aws-otel-collector:v0.43.3"
  metrics_audit_sync_image = local.private_ecr_prefix == "" ? (
    "public.ecr.aws/aws-cli/aws-cli:2.27.22@sha256:1d5753647df57828762601f4d82790f3441060dbc8671cd01c52df05cfd3b2c7"
  ) : "${local.private_ecr_prefix}/k5t9d3j5/application/gitpod-next/external/aws-cli:2.27.22@sha256:1d5753647df57828762601f4d82790f3441060dbc8671cd01c52df05cfd3b2c7"

  proxy_env = compact([
    try(var.proxy_config.http_proxy, "") == "" ? "" : "http_proxy=${var.proxy_config.http_proxy}",
    try(var.proxy_config.https_proxy, "") == "" ? "" : "https_proxy=${var.proxy_config.https_proxy}",
    try(var.proxy_config.all_proxy, "") == "" ? "" : "all_proxy=${var.proxy_config.all_proxy}",
    try(var.proxy_config.no_proxy, "") == "" ? "" : "no_proxy=${var.proxy_config.no_proxy}",
  ])

  # Keep this order aligned with config.Runner in gitpod-next. The runner
  # rewrites this SSM value with encoding/json and Terraform compares raw bytes.
  runner_config = join("", concat(
    [
      "{",
      "\"awsAccountId\":", jsonencode(data.aws_caller_identity.current.account_id),
      ",\"resourceTableName\":", jsonencode(aws_dynamodb_table.resources.name),
      ",\"vpcId\":", jsonencode(var.vpc_id),
      ",\"stackName\":", jsonencode(local.name_prefix),
      ",\"runnerLogGroup\":", jsonencode(aws_cloudwatch_log_group.runner.name),
    ],
    local.proxy_log_config_fragments,
    [
      ",\"adotLogGroup\":", jsonencode(aws_cloudwatch_log_group.adot.name),
      ",\"subnetIDs\":", jsonencode(join(" ", var.runner_subnet_ids)),
      ",\"securityGroupId\":", jsonencode(aws_security_group.environment.id),
      ",\"instanceProfileName\":", jsonencode(aws_iam_instance_profile.environment.name),
      ",\"environmentRoleArn\":", jsonencode(aws_iam_role.environment.arn),
      ",\"apiEndpoint\":", jsonencode(var.api_endpoint),
      ",\"exchangeToken\":", jsonencode(var.runner_token),
      ",\"gatewayAPIEndpoint\":\"\"",
      ",\"infrastructureVersion\":\"terraform\"",
      ",\"sshPort\":29222",
      ",\"resourceTags\":", jsonencode(local.runner_resource_tags),
      ",\"cacheBucketName\":", jsonencode(aws_s3_bucket.container_registry.bucket),
      ",\"logsBucket\":", jsonencode(aws_s3_bucket.logs.bucket),
      ",\"agentBucketName\":", jsonencode(aws_s3_bucket.agent.bucket),
      ",\"logLevel\":\"info\"",
      ",\"devContainerCacheRegistryAccessRoleArn\":", jsonencode(aws_iam_role.devcontainer_cache_registry_access.arn),
      ",\"sshOverGateway\":", jsonencode(local.ssh_over_gateway),
    ],
    local.runner_proxy_domain_config_fragments,
    local.internal_runner_config_fragments,
    [
      ",\"runnerPackage\":\"Enterprise\"",
      ",\"runnerTemplateBuildVersion\":", jsonencode(var.runner_template_build_version),
      ",\"asgWarmPoolEnabled\":true",
      ",\"horizontalScalingEnabled\":true",
      "}",
    ],
  ))
}