gitlab-runner-template.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Autoscaling Gitlab Runners Spawned by Fargate
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Network Configuration"
        Parameters:
          - VpcId
          - SubnetId
      -
        Label:
          default: "GitLab Configuration"
        Parameters:
          - GitLabURL
          - GitLabRegistrationToken
          - RunnerTagList
          - RunnerRequestConcurrency
          - AdditionalRegisterParams
      -
        Label:
          default: "GitLab Runner Configuration"
        Parameters:
          - RunnerVersion
          - InstanceType
          - RootVolumeSize
          - CacheExpirationInDays
      -
        Label:
          default: "Fargate Spawner Configuration"
        Parameters:
          - CPU
          - Memory
          - DockerImage



Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: Select a VPC that allows instances access to the Internet
  SubnetId:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Select subnets - Must be in the selected VPC!
  CacheExpirationInDays:
    Type: Number
    Default: 1
    Description: Select how long to store a jobs cache output in S3
  RootVolumeSize:
    Type: Number
    Description: The size of the root volume on the runners
    Default: 40
  GitLabURL:
    Type: String
    Description: The Gitlab URL, change if self-hosted
    Default: https://gitlab.com
  GitLabRegistrationToken:
    Type: String
    Description: The Gitlab runer registration token
    NoEcho: true
  RunnerRequestConcurrency:
    Type: Number
    Description: Specify the number of concurrent EC2 virtual machines to spawn
    Default: 12
  RunnerTagList:
    Type: String
    Description: Optional parameter to specify the gitlab-runner tags (Example "docker,aws")
    Default: ""
  AdditionalRegisterParams:
    Type: String
    Description: Optional parameters to be passed to gitlab-runner register
    Default: ""
  DockerImage:
    Type: String
    Default: "docker:latest"
    Description: The default docker image if not provided in a gitlab-ci.yml file
  CPU:
    Type: Number
    Description: Set the number of CPUs for the spawner (1 CPU = 1024)
    Default: '512'
  Memory:
    Type: Number
    Description: Set the amount of RAM in KB for the spawner
    Default: '1024'
  InstanceType:
    Type: String
    Description: The instance type of the runners
    Default: t3.micro
    AllowedValues: [
      'c1.medium', 'c1.xlarge',
      'c3.large', 'c3.xlarge', 'c3.2xlarge', 'c3.4xlarge', 'c3.8xlarge',
      'c4.large', 'c4.xlarge', 'c4.2xlarge', 'c4.4xlarge', 'c4.8xlarge',
      'c5.large', 'c5.xlarge', 'c5.2xlarge', 'c5.4xlarge', 'c5.9xlarge', 'c5.18xlarge',
      'c5d.large', 'c5d.xlarge', 'c5d.2xlarge', 'c5d.4xlarge', 'c5d.9xlarge', 'c5d.18xlarge',
      'cc2.8xlarge',
      'cr1.8xlarge',
      'd2.xlarge', 'd2.2xlarge', 'd2.4xlarge', 'd2.8xlarge',
      'f1.2xlarge', 'f1.4xlarge', 'f1.16xlarge',
      'g2.2xlarge', 'g2.8xlarge',
      'g3.4xlarge', 'g3.8xlarge', 'g3.16xlarge',
      'g3s.xlarge',
      'h1.2xlarge', 'h1.4xlarge', 'h1.8xlarge', 'h1.16xlarge',
      'hs1.8xlarge',
      'i2.xlarge', 'i2.2xlarge', 'i2.4xlarge', 'i2.8xlarge',
      'i3.large', 'i3.xlarge', 'i3.2xlarge', 'i3.4xlarge', 'i3.8xlarge', 'i3.16xlarge', 'i3.metal',
      'm1.small', 'm1.medium', 'm1.large', 'm1.xlarge',
      'm2.xlarge', 'm2.2xlarge', 'm2.4xlarge',
      'm3.medium', 'm3.large', 'm3.xlarge', 'm3.2xlarge',
      'm4.large', 'm4.xlarge', 'm4.2xlarge', 'm4.4xlarge', 'm4.10xlarge', 'm4.16xlarge',
      'm5.large', 'm5.xlarge', 'm5.2xlarge', 'm5.4xlarge', 'm5.12xlarge', 'm5.24xlarge',
      'm5d.large', 'm5d.xlarge', 'm5d.2xlarge', 'm5d.4xlarge', 'm5d.12xlarge', 'm5d.24xlarge',
      'p2.xlarge', 'p2.8xlarge', 'p2.16xlarge',
      'p3.2xlarge', 'p3.8xlarge', 'p3.16xlarge',
      'r3.large', 'r3.xlarge', 'r3.2xlarge', 'r3.4xlarge', 'r3.8xlarge',
      'r4.large', 'r4.xlarge', 'r4.2xlarge', 'r4.4xlarge', 'r4.8xlarge', 'r4.16xlarge',
      'r5.large', 'r5.xlarge', 'r5.2xlarge', 'r5.4xlarge', 'r5.12xlarge', 'r5.24xlarge',
      'r5d.large', 'r5d.xlarge', 'r5d.2xlarge', 'r5d.4xlarge', 'r5d.12xlarge', 'r5d.24xlarge',
      't1.micro',
      't2.nano', 't2.micro', 't2.small', 't2.medium', 't2.large', 't2.xlarge', 't2.2xlarge',
      't3.nano', 't3.micro', 't3.small', 't3.medium', 't3.large', 't3.xlarge', 't3.2xlarge',
      'x1.16xlarge', 'x1.32xlarge',
      'x1e.xlarge', 'x1e.2xlarge', 'x1e.4xlarge', 'x1e.8xlarge', 'x1e.16xlarge', 'x1e.32xlarge',
      'z1d.large', 'z1d.xlarge', 'z1d.2xlarge', 'z1d.3xlarge', 'z1d.6xlarge', 'z1d.12xlarge',
    ]
  RunnerVersion:
    Type: String
    Description: The GitLab Runner Version
    Default: latest
    AllowedValues: [
      'latest',
      '13.2.1',
      '13.2.0',
      '13.1.1',
      '13.1.0',
      '13.0.0',
      '12.10.2',
      '12.10.1',
      '12.10.0',
      '12.8.0',
      '12.7.1',
      'dev',
      ]

Mappings:
  AWSAMIRegionMap:
    af-south-1:
      UBUNTU1804: ami-04ef2733e8b8097f4
    ap-east-1:
      UBUNTU1804: ami-107d3e61
    ap-northeast-1:
      UBUNTU1804: ami-01c36f3329957b16a
    ap-northeast-2:
      UBUNTU1804: ami-05438a9ce08100b25
    ap-northeast-3:
      UBUNTU1804: ami-05a1fb6629fedc070
    ap-south-1:
      UBUNTU1804: ami-02b5fbc2cb28b77b8
    ap-southeast-1:
      UBUNTU1804: ami-0007cf37783ff7e10
    ap-southeast-2:
      UBUNTU1804: ami-0f87b0a4eff45d9ce
    ca-central-1:
      UBUNTU1804: ami-054798b3f62ca2a31
    eu-central-1:
      UBUNTU1804: ami-04932daa2567651e7
    eu-north-1:
      UBUNTU1804: ami-0363142d8c97b94c8
    eu-south-1:
      UBUNTU1804: ami-072ba62ae4c03effc
    eu-west-1:
      UBUNTU1804: ami-07ee42ba0209b6d77
    eu-west-2:
      UBUNTU1804: ami-04edc9c2bfcf9a772
    eu-west-3:
      UBUNTU1804: ami-03d4fca0a9ced3d1f
    me-south-1:
      UBUNTU1804: ami-06fdc76efb53b5d44
    sa-east-1:
      UBUNTU1804: ami-08caf314e5abfbef4
    us-east-1:
      UBUNTU1804: ami-0bcc094591f354be2
    us-east-2:
      UBUNTU1804: ami-0bbe28eb2173f6167
    us-west-1:
      UBUNTU1804: ami-0dd005d3eb03f66e8
    us-west-2:
      UBUNTU1804: ami-0a634ae95e11c6f91

# Conditions:

Resources:
  gitLabRegistrationToken:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Join ['-', [ !Ref 'AWS::StackName', gitLabRegistrationToken]]
      Description: The Gitlab runer registration token
      SecretString: !Ref GitLabRegistrationToken
  iamUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Join ['-', [ !Ref 'AWS::StackName', s3user]]
      Policies:
        - PolicyName: !Join ['-', [ !Ref 'AWS::StackName', GitLabCacheBucket]]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 's3:ListObjects*'
                  - 's3:GetObject*'
                  - 's3:DeleteObject*'
                  - 's3:PutObject*'
                Resource:
                  - !Sub '${GitLabRunnerCacheBucket.Arn}/*'
              - Effect: 'Allow'
                Action:
                  - 's3:ListBucket'
                Resource:
                  - !GetAtt GitLabRunnerCacheBucket.Arn
  iamAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      Status: Active
      UserName: !Ref iamUser
  iamRoleForEcsExecution:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['-', [ !Ref 'AWS::StackName', GitlabECSExecutionRole]]
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - ecs-tasks.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: !Join ['-', [ !Ref 'AWS::StackName', GitLabRegistrationToken]]
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'secretsmanager:DescribeSecret'
                  - 'secretsmanager:GetSecretValue'
                Resource: !Ref gitLabRegistrationToken
  iamRoleForEcsTask:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['-', [ !Ref 'AWS::StackName', GitlabECSTaskRole]]
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - ecs-tasks.amazonaws.com
            Action:
              - 'sts:AssumeRole'
  SpawnerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: GitlabSpawnerSecurityRules
      GroupName: !Join ['-', [ !Ref 'AWS::StackName', GitlabSpawnerSecurityRules]]
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
      VpcId: !Ref VpcId
  RunnerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: GitlabRunnerSecurityRules
      GroupName: !Join ['-', [ !Ref 'AWS::StackName', GitlabRunnerSecurityRules]]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          SourceSecurityGroupId: !GetAtt SpawnerSecurityGroup.GroupId
        - IpProtocol: tcp
          FromPort: 2376
          ToPort: 2376
          SourceSecurityGroupId: !GetAtt SpawnerSecurityGroup.GroupId
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
      VpcId: !Ref VpcId
  GitLabRunnerCacheBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      AccessControl: Private
      PublicAccessBlockConfiguration:
          BlockPublicAcls: true
          BlockPublicPolicy: true
          IgnorePublicAcls: true
          RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Status: 'Enabled'
            ExpirationInDays: !Ref 'CacheExpirationInDays'
  ECSCluster:
    Type: AWS::ECS::Cluster
  ECSService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LaunchType: FARGATE
      ServiceName: !Join ['-', [ !Ref 'AWS::StackName', service]]
      TaskDefinition: !Ref TaskDefinition
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets: !Ref SubnetId
          SecurityGroups:
            - !GetAtt SpawnerSecurityGroup.GroupId
  CloudwatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['-', [!Ref 'AWS::StackName', ECSLogGroup]]
      RetentionInDays: 14
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Join ['', [!Ref 'AWS::StackName', -gitlab-runner-spawner]]
      Cpu: !Ref CPU
      Memory: !Ref Memory
      NetworkMode: awsvpc
      ExecutionRoleArn: !GetAtt iamRoleForEcsExecution.Arn
      TaskRoleArn: !GetAtt iamRoleForEcsTask.Arn
      RequiresCompatibilities: [ FARGATE ]
      ContainerDefinitions:
      - Name: !Join ['', [!Ref 'AWS::StackName', -gitlab-runner-spawner]]
        Image: !Join [':', [woodjme/autoscaling-ec2-gitlab-runners-fargate, !Ref RunnerVersion]]
        Environment: [
          {"Name":"CI_SERVER_URL", "Value": !Ref GitLabURL},
          {"Name":"AWS_ROOT_SIZE", "Value": !Ref RootVolumeSize},
          {"Name":"AWS_DEFAULT_REGION", "Value": !Ref "AWS::Region"},
          {"Name":"AWS_VPC_ID", "Value": !Ref VpcId},
          {"Name":"AWS_SSH_USER", "Value": 'ubuntu'},
          {"Name":"AWS_SECURITY_GROUP", "Value": !Join ['-', [ !Ref 'AWS::StackName', GitlabRunnerSecurityRules]]},
          {"Name":"AWS_AMI", "Value": { "Fn::FindInMap": [ "AWSAMIRegionMap", { "Ref": "AWS::Region" }, "UBUNTU1804"]}},
          {"Name":"DOCKER_IMAGE", "Value": !Ref DockerImage},
          {"Name":"ADDITIONAL_REGISTER_PARAMS", "Value": !Ref AdditionalRegisterParams},
          {"Name":"AWS_INSTANCE_TYPE", "Value": !Ref InstanceType},
          {"Name":"CACHE_TYPE", "Value": 's3'},
          {"Name":"CACHE_S3_ACCESS_KEY", "Value": !Ref iamAccessKey},
          {"Name":"CACHE_S3_SECRET_KEY", "Value": !GetAtt iamAccessKey.SecretAccessKey},
          {"Name":"CACHE_SHARED", "Value": "true"},
          {"Name":"CACHE_S3_BUCKET_NAME", "Value": !Ref GitLabRunnerCacheBucket},
          {"Name":"CACHE_S3_BUCKET_LOCATION", "Value": !Ref "AWS::Region"},
          {"Name":"CACHE_S3_SERVER_ADDRESS", "Value": !Join ['', [s3., !Ref 'AWS::URLSuffix']]},
          {"Name":"RUNNER_REQUEST_CONCURRENCY", "Value": !Ref RunnerRequestConcurrency},
          {"Name":"RUNNER_TAG_LIST", "Value": !Ref RunnerTagList}
        ]
        Secrets: [
          {"Name":"REGISTRATION_TOKEN", "ValueFrom": !Ref gitLabRegistrationToken}
        ]
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group: !Ref 'CloudwatchLogsGroup'
            awslogs-region: !Ref 'AWS::Region'
            awslogs-stream-prefix: gitlab-runner-spawner

Outputs:
  GitLabRunnerCacheBucketName:
    Description: Name of the cache bucket
    Value: !Ref GitLabRunnerCacheBucket