Merge pull request #29 from philips-labs/feature/root-runners

Allow the github action runner to be run under root (disabled by defa…

Author: npalm

README.md

@@ -152,17 +152,21 @@ TODO
 | enable_organization_runners           | n/a                                                                                                                 | `bool`                                                                                                                                           | n/a                     |   yes    |
 | environment                           | A name that identifies the environment, used as prefix and for tagging.                                             | `string`                                                                                                                                         | n/a                     |   yes    |
 | github_app                            | GitHub app parameters, see your github aapp. Ensure the key is base64 encoded.                                      | <pre>object({<br> key_base64 = string<br> id = string<br> client_id = string<br> client_secret = string<br> webhook_secret = string<br> })</pre> | n/a                     |   yes    |
-| subnet_ids                            | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`.      | `list(string)`                                                                                                                                   | n/a                     |   yes    |
-| vpc_id                                | The VPC for security groups of the action runners.                                                                  | `string`                                                                                                                                         | n/a                     |   yes    |
+| instance_profile_path                 | The path that will be added to the instance_profile, if not set the environment name will be used.                  | `string`                                                                                                                                         | `null`                  |    no    |
 | minimum_running_time_in_minutes       | The time an ec2 action runner should be running at minium before terminated if non busy.                            | `number`                                                                                                                                         | `5`                     |    no    |
+| role_path                             | The path that will be added to role path for created roles, if not set the environment name will be used.           | `string`                                                                                                                                         | `null`                  |    no    |
+| role_permissions_boundary             | Permissions boundary that will be added to the created roles.                                                       | `string`                                                                                                                                         | `null`                  |    no    |
+| runner_as_root                        | Run the action runner under the root user.                                                                          | `bool`                                                                                                                                           | `false`                 |    no    |
 | runner_binaries_syncer_lambda_timeout | Time out of the binaries sync lambda in seconds.                                                                    | `number`                                                                                                                                         | `300`                   |    no    |
 | runner_binaries_syncer_lambda_zip     | File location of the binaries sync lambda zip file.                                                                 | `string`                                                                                                                                         | `null`                  |    no    |
 | runner_extra_labels                   | Extra labels for the runners (GitHub). Separate each label by a comma                                               | `string`                                                                                                                                         | `""`                    |    no    |
 | runners_lambda_zip                    | File location of the lambda zip file for scaling runners.                                                           | `string`                                                                                                                                         | `null`                  |    no    |
 | runners_scale_down_lambda_timeout     | Time out for the scale up lambda in seconds.                                                                        | `number`                                                                                                                                         | `60`                    |    no    |
 | runners_scale_up_lambda_timeout       | Time out for the scale down lambda in seconds.                                                                      | `number`                                                                                                                                         | `60`                    |    no    |
 | scale_down_schedule_expression        | Scheduler expression to check every x for scale down.                                                               | `string`                                                                                                                                         | `"cron(*/5 * * * ? *)"` |    no    |
+| subnet_ids                            | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`.      | `list(string)`                                                                                                                                   | n/a                     |   yes    |
 | tags                                  | Map of tags that will be added to created resources. By default resources will be tagged with name and environment. | `map(string)`                                                                                                                                    | `{}`                    |    no    |
+| vpc_id                                | The VPC for security groups of the action runners.                                                                  | `string`                                                                                                                                         | n/a                     |   yes    |
 | webhook_lambda_timeout                | Time out of the webhook lambda in seconds.                                                                          | `number`                                                                                                                                         | `10`                    |    no    |
 | webhook_lambda_zip                    | File location of the wehbook lambda zip file.                                                                       | `string`                                                                                                                                         | `null`                  |    no    |
 

main.tf

@@ -58,6 +58,7 @@ module "runners" {
   scale_down_schedule_expression  = var.scale_down_schedule_expression
   minimum_running_time_in_minutes = var.minimum_running_time_in_minutes
   runner_extra_labels             = var.runner_extra_labels
+  runner_as_root                  = var.runner_as_root
 
   lambda_zip                = var.runners_lambda_zip
   lambda_timeout_scale_up   = var.runners_scale_up_lambda_timeout

modules/runners/main.tf

@@ -78,6 +78,7 @@ resource "aws_launch_template" "runner" {
     pre_install                     = var.userdata_pre_install
     post_install                    = var.userdata_post_install
     s3_location_runner_distribution = var.s3_location_runner_binaries
+    service_user                    = var.runner_as_root ? "root" : "ec2-user"
   }))
 
   tags = local.tags

modules/runners/templates/user-data.sh

@@ -35,7 +35,7 @@ export RUNNER_ALLOW_RUNASROOT=1
 ./config.sh --unattended --name $INSTANCE_ID --work "_work" $CONFIG
 
 chown -R ec2-user:ec2-user .
-./svc.sh install ec2-user
+./svc.sh install ${service_user}
 
 ${post_install}
 

modules/runners/variables.tf

@@ -168,3 +168,8 @@ variable "instance_profile_path" {
   default     = null
 }
 
+variable "runner_as_root" {
+  description = "Run the action runner under the root user."
+  type        = bool
+  default     = false
+}

variables.tf

@@ -119,3 +119,9 @@ variable "instance_profile_path" {
   type        = string
   default     = null
 }
+
+variable "runner_as_root" {
+  description = "Run the action runner under the root user."
+  type        = bool
+  default     = false
+}