gitlab-runner.tftpl

# Provide the parent instance id in the spawned runner tags
PARENT_INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $token" http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .instanceId)
PARENT_TAG="gitlab-runner-parent-id,$PARENT_INSTANCE_ID"

mkdir -p /etc/gitlab-runner
cat > /etc/gitlab-runner/config.toml <<- EOF

${runners_config}

EOF

cat > /etc/gitlab-runner/runners_userdata.sh <<- EOF
${runners_userdata}
EOF

sed -i.bak s/__PARENT_TAG__/$PARENT_TAG/g /etc/gitlab-runner/config.toml

${pre_install_certificates}

# fetch Runner token from SSM and validate it
token=$(aws ssm get-parameters --names "${secure_parameter_store_runner_token_key}" --with-decryption --region "${secure_parameter_store_region}" | jq -r ".Parameters | .[0] | .Value")

valid_token=true
if [[ "$token" != "null" ]]
then
  valid_token_response=$(curl -s -o /dev/null -w "%%{response_code}" ${curl_cacert} --request POST -L "${runners_gitlab_url}/api/v4/runners/verify" --form "token=$token" )
  [[ "$valid_token_response" != "200" ]] && valid_token=false
fi

if [[ "${runners_token}" == "__REPLACED_BY_USER_DATA__" && "$token" == "null" ]] || [[ "$valid_token" == "false" ]]
then
  if [ "${use_new_runner_authentication_gitlab_16}" == "true" ]
  then
    runner_type_param=""
    if [ "${gitlab_runner_type}" = "group" ]; then
      if [ -z "${gitlab_runner_group_id}" ]; then
        echo "ERROR: If the runner type is group, you must specify a group_id".
        exit 1
      fi
      runner_type_param='--form group_id=${gitlab_runner_group_id}'
    elif [ "${gitlab_runner_type}" = "project" ]; then
      if [ -z "${gitlab_runner_project_id}" ]; then
        echo "ERROR: If the runner type is project_type, you must specify a project_id".
        exit 1
      fi
      runner_type_param='--form project_id=${gitlab_runner_project_id}'
    fi

    # fetch gitlab token from SSM
    gitlab_token=$(aws ssm get-parameter --name "${secure_parameter_store_gitlab_token_name}" --with-decryption --region "${secure_parameter_store_region}" | jq -r ".Parameter | .Value")

    response=$(curl ${curl_cacert} --request POST -L "${runners_gitlab_url}/api/v4/user/runners" \
      --header "private-token: $gitlab_token" \
      --form "tag_list=${gitlab_runner_tag_list}" \
      --form "description=${gitlab_runner_description}" \
      --form "locked=${gitlab_runner_locked_to_project}" \
      --form "run_untagged=${gitlab_runner_run_untagged}" \
      --form "maximum_timeout=${gitlab_runner_maximum_timeout}" \
      --form "runner_type=${gitlab_runner_type}_type" \
      $runner_type_param \
      --form "access_level=${gitlab_runner_access_level}")

    token=$(echo $response | jq -r '.token')
    if [[ "$token" == null ]]
    then
        message=$(echo $response | jq -r '.message // .error_description')
        if [[ "$message" != null ]]
        then
            echo "ERROR: Couldn't register the Runner. GitLab API call returned $message".
            exit 1
        fi
    fi
  else
    gitlab_runner_registration_token=${gitlab_runner_registration_token}

    # fetch registration token from SSM
    if [[ "$gitlab_runner_registration_token" == "__GITLAB_REGISTRATION_TOKEN_FROM_SSM__" ]]
    then
      gitlab_runner_registration_token=$(aws ssm get-parameter --name "${secure_parameter_store_gitlab_runner_registration_token_name}" --with-decryption --region "${secure_parameter_store_region}" | jq -r ".Parameter | .Value")
    fi

    token=$(curl ${curl_cacert} --request POST -L "${runners_gitlab_url}/api/v4/runners" \
    --form "token=$gitlab_runner_registration_token" \
    --form "tag_list=${gitlab_runner_tag_list}" \
    --form "description=${gitlab_runner_description}" \
    --form "locked=${gitlab_runner_locked_to_project}" \
    --form "run_untagged=${gitlab_runner_run_untagged}" \
    --form "maximum_timeout=${gitlab_runner_maximum_timeout}" \
    --form "access_level=${gitlab_runner_access_level}" \
    | jq -r .token)
  fi
  aws ssm put-parameter --overwrite --type SecureString  --name "${secure_parameter_store_runner_token_key}" --value="$token" --region "${secure_parameter_store_region}"
fi

sed -i.bak s/__REPLACED_BY_USER_DATA__/$token/g /etc/gitlab-runner/config.toml

if [[ "${use_fleet}" == "true" ]]
then
  echo "${public_key}" > /root/.ssh/id_rsa.pub
  echo "${private_key}" > /root/.ssh/id_rsa

  chmod 600 /root/.ssh/id_rsa
fi

ssm_sentry_dsn=$(aws ssm get-parameters --names "${secure_parameter_store_runner_sentry_dsn}" --with-decryption --region "${secure_parameter_store_region}" | jq -r ".Parameters | .[0] | .Value")
if [[ "${sentry_dsn}" == "__SENTRY_DSN_REPLACED_BY_USER_DATA__" && "$ssm_sentry_dsn" == "null" ]]
then
  ssm_sentry_dsn=""
fi

# For those of you wondering why commas are used in the sed below instead of forward slashes, see https://stackoverflow.com/a/16778711/13169919
# It is because the Sentry DSN contains forward slashes as it is an URL so it would break out of the sed command with forward slashes as delimiters :)
sed -i.bak s,__SENTRY_DSN_REPLACED_BY_USER_DATA__,"$ssm_sentry_dsn",g /etc/gitlab-runner/config.toml

${pre_install}

if [[ "${runners_executor}" == "docker" ]]
then
  echo 'installing docker'
  if grep -q ':2$' /etc/system-release-cpe  ; then
    # AWS Linux 2 provides docker via extras only and uses systemd (https://aws.amazon.com/amazon-linux-2/release-notes/)
    amazon-linux-extras install docker
    usermod -a -G docker ec2-user
    systemctl enable docker
    systemctl start docker
  else
    yum install docker -y
    usermod -a -G docker ec2-user
    service docker start
  fi
fi

if [[ "${runners_install_amazon_ecr_credential_helper}" == "true" ]]
then
  yum install amazon-ecr-credential-helper -y
fi

if [[ "${runners_executor}" == "docker+machine" ]]
then
  if [[ "${docker_machine_download_url}" == "" ]]
  then
    echo "Installing Docker Machine using preconfigured URL"
    curl --fail --retry 6 -L https://arr-cki-prod-docker-machine.s3.amazonaws.com/v${docker_machine_version}/docker-machine-$(uname -s)-$(uname -m) > /tmp/docker-machine
  else
    echo "Installing Docker Machine using custom URL"
    curl --fail --retry 6 -L ${docker_machine_download_url} >/tmp/docker-machine
  fi

  chmod +x /tmp/docker-machine && \
    mv /tmp/docker-machine /usr/local/bin/docker-machine && \
    ln -s /usr/local/bin/docker-machine /usr/bin/docker-machine
  docker-machine --version

  # Create a dummy machine so that the cert is generated properly
  # See: https://gitlab.com/gitlab-org/gitlab-runner/issues/3676
  # See: https://github.com/docker/machine/issues/3845#issuecomment-280389178
  export USER=root
  export HOME=/root
  docker-machine create --driver none --url localhost dummy-machine
  docker-machine rm -y dummy-machine
  unset HOME
  unset USER
fi

# A small script to remove this runner from being registered with Gitlab. Executed at shutdown.
cat <<EOF > /etc/systemd/system/remove-gitlab-registration.service
[Unit]
Description=Remove the GitLab Runner from GitLab at shutdown
After=network-online.target
Wants=network-online.target
Before=shutdown.target reboot.target halt.target kexec.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecStop=/opt/remove_gitlab_registration.sh

[Install]
WantedBy=multi-user.target

EOF

cat <<EOF > /opt/remove_gitlab_registration.sh
#!/bin/bash
echo "Removing Gitlab Runner ..."
aws ssm put-parameter --overwrite --type SecureString  --name "${secure_parameter_store_runner_token_key}" --region "${secure_parameter_store_region}" --value="null" 2>&1
curl -sS ${curl_cacert} --request DELETE "${runners_gitlab_url}/api/v4/runners" --form "token=$token" 2>&1

EOF

chmod a+x /opt/remove_gitlab_registration.sh
systemctl enable remove-gitlab-registration.service

# start the service. Otherwise the stop action will not be triggered at shutdown.
service remove-gitlab-registration start

if ! ( rpm -q gitlab-runner >/dev/null )
then
  curl --fail --retry 6 -L https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.rpm.sh | bash
  yum install gitlab-runner-${gitlab_runner_version} -y
fi

${post_install}

chkconfig gitlab-runner on