refactor!: remove manual registration of Gitlab Runner

.github/workflows/ci.yml

@@ -1,5 +1,5 @@
 name: CI
-on: 
+on:
   push:
     branches:
       - master
@@ -11,7 +11,7 @@ jobs:
     name: Verify module
     strategy:
       matrix:
-        terraform: [1.0.8]    
+        terraform: [1.0.8]
     runs-on: ubuntu-latest
     container:
       image: hashicorp/terraform:${{ matrix.terraform }}
@@ -26,14 +26,14 @@ jobs:
       fail-fast: false
       matrix:
         terraform: [0.13.0, 0.14.0, 0.15.0, 1.0.8]
-        example: ["runner-default", "runner-docker", "runner-pre-registered", "runner-public"]
+        example: ["runner-default", "runner-docker", "runner-public"]
     defaults:
       run:
         working-directory: examples/${{ matrix.example }}
     runs-on: ubuntu-latest
     container:
       image: hashicorp/terraform:${{ matrix.terraform }}
-    steps:   
+    steps:
       - uses: actions/checkout@v2
       - run: terraform init -get -backend=false -input=false
       - if: contains(matrix.terraform, '1.0.')
@@ -66,5 +66,5 @@ jobs:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           cp .release/* .
-          yarn 
+          yarn
           yarn release --repositoryUrl https://x-access-token:[email protected]/$GITHUB_REPOSITORY.git

README.md

@@ -113,42 +113,43 @@ resource "aws_iam_service_linked_role" "autoscaling" {
 
 By default the runner is registered on initial deployment. In previous versions of this module this was a manual process. The manual process is still supported but will be removed in future releases. The runner token will be stored in the AWS SSM parameter store. See [example](examples/runner-pre-registered/) for more details.
 
-To register the runner automatically set the variable `gitlab_runner_registration_config["registration_token"]`. This token value can be found in your GitLab project, group, or global settings. For a generic runner you can find the token in the admin section. By default the runner will be locked to the target project, not run untagged. Below is an example of the configuration map.
+To register the runner automatically set the variable `gitlab_runner_registration_config["registration_token"]`. This token value can be found in your GitLab project, group, or global settings. For a generic runner you can find the token in the admin section. By default the runner will be locked to the target project, not run untagged. Below is an example of the configuration map. As this token should not appear in your source code management tool, use a SSM parameter which is set manually.
 
 ```hcl
-gitlab_runner_registration_config = {
-  registration_token = "<registration token>"
-  tag_list           = "<your tags, comma separated>"
-  description        = "<some description>"
-  locked_to_project  = "true"
-  run_untagged       = "false"
-  maximum_timeout    = "3600"
-  access_level       = "<not_protected OR ref_protected, ref_protected runner will only run on pipelines triggered on protected branches. Defaults to not_protected>"
-}
-```
+module "gitlab_runner" {
+  ...
 
-For migration to the new setup simply add the runner token to the parameter store. Once the runner is started it will lookup the required values via the parameter store. If the value is `null` a new runner will be registered and a new token created/stored.
+  gitlab_runner_registration_config = {
+    registration_token = aws_ssm_parameter.gitlab_runner_registration_token.value
+    tag_list           = "<your tags, comma separated>"
+    description        = "<some description>"
+    locked_to_project  = "true"
+    run_untagged       = "false"
+    maximum_timeout    = "3600"
+    access_level       = "<not_protected OR ref_protected, ref_protected runner will only run on pipelines triggered on protected branches. Defaults to not_protected>"
+  }
+}
 
-```sh
-# set the following variables, look up the variables in your Terraform config.
-# see your Terraform variables to fill in the vars below.
-aws-region=<${var.aws_region}>
-token=<runner-token-see-your-gitlab-runner>
-parameter-name=<${var.environment}>-<${var.secure_parameter_store_runner_token_key}>
+# obtain this token from your Gitlab instance and store it manually in the SSM parameter
 
-aws ssm put-parameter --overwrite --type SecureString  --name "${parameter-name}" --value ${token} --region "${aws-region}"
-```
+resource "aws_ssm_parameter" "gitlab_runner_registration_token" {
+  name        = "gitlab-registration-token"
+  type        = "SecureString"
+  value       = "Please fill manually."
+  description = "Gitlab registration token for a new runner."
 
-Once you have created the parameter, you must remove the variable `runners_token` from your config. The next time your GitLab runner instance is created it will look up the token from the SSM parameter store.
+  lifecycle {
+    # the secret is set manually
+    ignore_changes = [value]
+  }
+}```
 
-Finally, the runner still supports the manual runner creation. No changes are required. Please keep in mind that this setup will be removed in future releases.
+After deploying this infrastructure, fill in the token manually and kill the agents. After the automatic restart, all runners register automatically.
 
 ### Access runner instance
 
 A few option are provided to access the runner instance:
 
-1.  Provide a public ssh key to access the runner by setting \`\`.
-2.  Provide a EC2 key pair to access the runner by setting \`\`.
 3.  Access via the Session Manager (SSM) by setting `enable_runner_ssm_access` to `true`. The policy to allow access via SSM is not very restrictive.
 4.  By setting none of the above, no keys or extra policies will be attached to the instance. You can still configure you own policies by attaching them to `runner_agent_role_arn`.
 
@@ -423,7 +424,6 @@ terraform destroy
 | <a name="input_runners_volumes_tmpfs"></a> [runners\_volumes\_tmpfs](#input\_runners\_volumes\_tmpfs) | n/a | <pre>list(object({<br>    volume  = string<br>    options = string<br>  }))</pre> | `[]` | no |
 | <a name="input_schedule_config"></a> [schedule\_config](#input\_schedule\_config) | Map containing the configuration of the ASG scale-in and scale-up for the runner instance. Will only be used if enable\_schedule is set to true. | `map(any)` | <pre>{<br>  "scale_in_count": 0,<br>  "scale_in_recurrence": "0 18 * * 1-5",<br>  "scale_out_count": 1,<br>  "scale_out_recurrence": "0 8 * * 1-5"<br>}</pre> | no |
 | <a name="input_secure_parameter_store_runner_sentry_dsn"></a> [secure\_parameter\_store\_runner\_sentry\_dsn](#input\_secure\_parameter\_store\_runner\_sentry\_dsn) | The Sentry DSN name used to store the Sentry DSN in Secure Parameter Store | `string` | `"sentry-dsn"` | no |
-| <a name="input_secure_parameter_store_runner_token_key"></a> [secure\_parameter\_store\_runner\_token\_key](#input\_secure\_parameter\_store\_runner\_token\_key) | The key name used store the Gitlab runner token in Secure Parameter Store | `string` | `"runner-token"` | no |
 | <a name="input_sentry_dsn"></a> [sentry\_dsn](#input\_sentry\_dsn) | Sentry DSN of the project for the runner to use (uses legacy DSN format) | `string` | `"__SENTRY_DSN_REPLACED_BY_USER_DATA__"` | no |
 | <a name="input_ssh_key_pair"></a> [ssh\_key\_pair](#input\_ssh\_key\_pair) | Set this to use existing AWS key pair | `string` | `null` | no |
 | <a name="input_subnet_id_runners"></a> [subnet\_id\_runners](#input\_subnet\_id\_runners) | List of subnets used for hosting the gitlab-runners. | `string` | n/a | yes |

examples/runner-default/variables.tf

@@ -10,14 +10,6 @@ variable "environment" {
   default     = "runners-default"
 }
 
-variable "public_ssh_key_filename" {
-  default = "generated/id_rsa.pub"
-}
-
-variable "private_ssh_key_filename" {
-  default = "generated/id_rsa"
-}
-
 variable "runner_name" {
   description = "Name of the runner, will be used in the runner config.toml"
   type        = string
@@ -31,6 +23,8 @@ variable "gitlab_url" {
 }
 
 variable "registration_token" {
+  description = "The registration token obtained from your Gitlab instance."
+  type        = string
 }
 
 variable "timezone" {

examples/runner-docker/variables.tf

@@ -10,14 +10,6 @@ variable "environment" {
   type        = string
 }
 
-# variable "public_ssh_key_filename" {
-#   default = "generated/id_rsa.pub"
-# }
-
-# variable "private_ssh_key_filename" {
-#   default = "generated/id_rsa"
-# }
-
 variable "runner_name" {
   description = "Name of the runner, will be used in the runner config.toml"
   type        = string
@@ -31,5 +23,6 @@ variable "gitlab_url" {
 }
 
 variable "registration_token" {
+  description = "The registration token obtained from your Gitlab instance."
+  type        = string
 }
-

examples/runner-public/variables.tf

@@ -31,5 +31,6 @@ variable "gitlab_url" {
 }
 
 variable "registration_token" {
+  description = "The registration token obtained from your Gitlab instance."
+  type        = string
 }
-

locals.tf

@@ -9,7 +9,7 @@ locals {
   runners_max_builds_string = var.runners_max_builds == 0 ? "" : format("MaxBuilds = %d", var.runners_max_builds)
 
   // Define key for runner token for SSM
-  secure_parameter_store_runner_token_key  = "${var.environment}-${var.secure_parameter_store_runner_token_key}"
+  secure_parameter_store_runner_token_key  = "${var.environment}-runner-token"
   secure_parameter_store_runner_sentry_dsn = "${var.environment}-${var.secure_parameter_store_runner_sentry_dsn}"
 
   // custom names for instances and security groups

variables.tf

@@ -555,12 +555,6 @@ variable "gitlab_runner_registration_config" {
   }
 }
 
-variable "secure_parameter_store_runner_token_key" {
-  description = "The key name used store the Gitlab runner token in Secure Parameter Store"
-  type        = string
-  default     = "runner-token"
-}
-
 variable "secure_parameter_store_runner_sentry_dsn" {
   description = "The Sentry DSN name used to store the Sentry DSN in Secure Parameter Store"
   type        = string