Fix github runner creation with token from lockbox (#224)

Author: goshander

deploy/terraform/github-runner-config.yaml

@@ -1,14 +1,26 @@
 #cloud-config
 runcmd:
-  - apt update && apt install -y jq unzip curl git docker.io docker-compose-v2
+  - apt update && apt install -y jq unzip curl wget git docker.io docker-compose-v2
+  # install github cli
+  - mkdir -p -m 755 /etc/apt/keyrings
+  - wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null
+  - chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+  - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+  - apt update && apt install gh -y
+  # install yc cli
+  - su - root -c "curl -o ./yc-install.sh -L https://storage.yandexcloud.net/yandexcloud-yc/install.sh"
+  - su - root -c "chmod +x ./yc-install.sh && ./yc-install.sh -i /tmp/yc -n && mv /tmp/yc/bin/yc /usr/bin/yc"
+  # add non root user
   - useradd -m github --shell /bin/bash && usermod -aG docker github
   - cd /home/github
   - su - github -c "mkdir -p /home/github/actions-runner"
   - cd actions-runner
+  # install github runner agent
   - case $(uname -m) in aarch64) ARCH="arm64" ;; amd64|x86_64) ARCH="x64" ;; esac && export RUNNER_ARCH=$${ARCH}
+  - export RUNNER_TOKEN=$(yc lockbox payload get --id ${LOCKBOX_ID} --key ${LOCKBOX_KEY})
   - su - github -c "curl -O -L https://github.com/actions/runner/releases/download/v${VERSION}/actions-runner-linux-$${RUNNER_ARCH}-${VERSION}.tar.gz"
   - su - github -c "tar xzf ./actions-runner-linux-$${RUNNER_ARCH}-${VERSION}.tar.gz"
-  - su - github -c "./config.sh --unattended --url https://github.com/${OWNER}/${REPO} --token ${TOKEN} --name github-runner-${REPO}-ind-${IND} --runnergroup default --work _work --labels cloud"
+  - su - github -c "./config.sh --unattended --url https://github.com/${OWNER}/${REPO} --token $${RUNNER_TOKEN} --name github-runner-${REPO}-ind-${IND} --runnergroup default --work _work --labels cloud"
   - su - github -c "export PATH=\$${PATH}:\$${HOME}/.local/bin && ./run.sh"
 bootcmd:
   - cd /home/github/actions-runner

deploy/terraform/github-runner.tf

@@ -2,9 +2,12 @@ locals {
   gh_owner = "datalens-tech"
   gh_repo  = "datalens"
 
-  runner_version = "2.319.1"
+  runner_ssh_access = false
 
-  runners_count = 1
+  runner_os_image = "ubuntu-2404-lts-oslogin"
+  runner_version  = "2.319.1"
+
+  runners_count = 2
   runners_ids   = local.is_create_github_runner ? [for i in range(0, local.runners_count) : { key = "ind-${i}", ind = i }] : []
 }
 
@@ -14,12 +17,6 @@ resource "yandex_lockbox_secret" "github-runner" {
   name = "${local.service}-github-runner-secrets"
 }
 
-data "yandex_lockbox_secret_version" "github-runner" {
-  for_each = toset(local.is_create_github_runner ? ["main"] : [])
-
-  secret_id = yandex_lockbox_secret.github-runner["main"].id
-}
-
 resource "yandex_iam_service_account" "github-runner" {
   for_each = toset(local.is_create_github_runner ? ["main"] : [])
 
@@ -34,8 +31,29 @@ resource "yandex_resourcemanager_folder_iam_member" "github-runner" {
   member    = "serviceAccount:${yandex_iam_service_account.github-runner["main"].id}"
 }
 
+resource "yandex_lockbox_secret_iam_binding" "github-runner" {
+  for_each = toset(local.is_create_github_runner ? ["main"] : [])
+
+  secret_id = yandex_lockbox_secret.github-runner["main"].id
+  role      = "lockbox.payloadViewer"
+
+  members = [
+    "serviceAccount:${yandex_iam_service_account.github-runner["main"].id}",
+  ]
+}
+
 data "yandex_compute_image" "this" {
-  family = "ubuntu-24-04-lts"
+  family = local.runner_os_image
+}
+
+resource "yandex_vpc_address" "github-runner" {
+  for_each = local.runner_ssh_access ? { for id in local.runners_ids : id.key => id.ind } : {}
+
+  name = "github-runner-${each.key}-ip"
+
+  external_ipv4_address {
+    zone_id = "ru-central1-a"
+  }
 }
 
 resource "yandex_compute_disk" "github-runner" {
@@ -77,10 +95,14 @@ resource "yandex_compute_instance" "github-runner" {
     subnet_id          = yandex_vpc_subnet.this[local.zones[each.value % length(local.zones)]].id
     security_group_ids = [yandex_vpc_security_group.github-runner["main"].id]
     ipv4               = true
+
+    nat            = local.runner_ssh_access
+    nat_ip_address = local.runner_ssh_access ? yandex_vpc_address.github-runner[each.key].external_ipv4_address[0].address : null
   }
 
   metadata = {
     skip_update_ssh_keys = true
+    enable-oslogin       = true
 
     user-data = templatefile("github-runner-config.yaml", {
       VERSION = local.runner_version
@@ -89,7 +111,8 @@ resource "yandex_compute_instance" "github-runner" {
       REPO  = local.gh_repo
       IND   = "${each.value}"
 
-      TOKEN = [for secret in data.yandex_lockbox_secret_version.github-runner["main"].entries : secret.text_value if secret.key == "RUNNER_${upper(replace(local.gh_repo, "-", "_"))}_${each.value}_TOKEN"][0]
+      LOCKBOX_ID  = yandex_lockbox_secret.github-runner["main"].id
+      LOCKBOX_KEY = "RUNNER_${upper(replace(local.gh_repo, "-", "_"))}_${each.value}_TOKEN"
     })
   }
 }
@@ -130,11 +153,11 @@ data "dns_a_record_set" "github-runner-gh" {
 locals {
   v4_gh_any_cidr_blocks = ["0.0.0.0/0"]
 
-  ingress_github_runner = [
+  ingress_github_runner = concat([
     { proto = "ANY", target = "self_security_group", from_port = 0, to_port = 65535, desc = "self" },
     { proto = "ANY", cidr_v4 = local.v4_subnets_cidr_blocks, from_port = 0, to_port = 65535, desc = "subnets" },
     { proto = "ICMP", cidr_v4 = local.v4_icmp_cidr_blocks, from_port = 0, to_port = 65535, desc = "icmp" },
-  ]
+  ], local.runner_ssh_access ? [{ proto = "TCP", cidr_v4 = ["${local.v4_public_ip}/32"], port = 22, desc = "ssh" }] : [])
   egress_github_runner = concat(
     [
       { proto = "ANY", target = "self_security_group", from_port = 0, to_port = 65535, desc = "self" },
@@ -147,7 +170,7 @@ locals {
       { proto = "TCP", cidr_v4 = local.v4_gh_any_cidr_blocks, port = 443, desc = "any" },
     ],
     [for e in local.endpoints : { proto = "TCP", cidr_v4 = ["${data.dns_a_record_set.this[e].addrs[0]}/32"], port = 443, desc = e }],
-    [for e in local.gh_endpoints : { proto = "TCP", cidr_v4 = ["${data.dns_a_record_set.github-runner-gh[e].addrs[0]}/32"], port = 43, desc = e }],
+    [for e in local.gh_endpoints : { proto = "TCP", cidr_v4 = ["${data.dns_a_record_set.github-runner-gh[e].addrs[0]}/32"], port = 443, desc = e }],
     [for e in local.common_endpoints : { proto = "TCP", cidr_v4 = ["${data.dns_a_record_set.github-runner-common[e].addrs[0]}/32"], port = 80, desc = e }],
     [for e in local.common_endpoints : { proto = "TCP", cidr_v4 = ["${data.dns_a_record_set.github-runner-common[e].addrs[0]}/32"], port = 443, desc = e }],
   )

deploy/terraform/provider.tf

@@ -33,12 +33,12 @@ provider "yandex" {
 }
 
 provider "kubernetes" {
-  config_path = data.shell_script.kubeconfig.output["path"]
+  config_path = try(data.shell_script.kubeconfig.output["path"], "./kubeconfig.conf")
 }
 
 provider "helm" {
   kubernetes {
-    config_path = data.shell_script.kubeconfig.output["path"]
+    config_path = try(data.shell_script.kubeconfig.output["path"], "./kubeconfig.conf")
   }
 
   registry {