You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+4-6
Original file line number
Diff line number
Diff line change
@@ -50,7 +50,7 @@ Scaling down the runners is at the moment brute-forced, every configurable amoun
50
50
51
51
Downloading the GitHub Action Runner distribution can be occasionally slow (more than 10 minutes). Therefore a lambda is introduced that synchronizes the action runner binary from GitHub to an S3 bucket. The EC2 instance will fetch the distribution from the S3 bucket instead of the internet.
52
52
53
-
Secrets and private keys which are passed to the lambdas as environment variables are encrypted by default by a KMS key managed by the module. Alternatively you can pass your own KMS key. Encryption via KMS can be complete disabled by setting `encrypt_secrets` to `false`.
53
+
Secrets and private keys are stored in SSM Parameter Store. These values are encrypted using the default KMS key for SSM or passing in a custom KMS key.
| enable\_cloudwatch\_agent | Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`. |`bool`|`true`| no |
352
351
| enable\_organization\_runners | Register runners to organization, instead of repo level |`bool`|`false`| no |
353
352
| enable\_ssm\_on\_runners | Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. |`bool`|`false`| no |
354
-
| encrypt\_secrets | Encrypt secret variables for lambda's such as secrets and private keys. |`bool`|`true`| no |
355
353
| environment | A name that identifies the environment, used as prefix and for tagging. |`string`| n/a | yes |
356
354
| ghes\_url | GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB |`string`|`null`| no |
357
355
| github\_app | GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`). | <pre>object({<br> key_base64 = string<br> id = string<br> client_id = string<br> client_secret = string<br> webhook_secret = string<br> })</pre> | n/a | yes |
@@ -360,12 +358,11 @@ No requirements.
360
358
| instance\_type |[DEPRECATED] See instance\_types. |`string`|`"m5.large"`| no |
361
359
| instance\_types | List of instance types for the action runner. |`set(string)`|`null`| no |
362
360
| key\_name | Key pair name |`string`|`null`| no |
363
-
| kms\_key\_id|Custom KMS key to encrypted lambda secrets, if not provided and `encrypt_secrets` = `true` a KMS key will be created by the module. Secrets will be encrypted with a context `Environment = var.environment`. |`string`|`null`| no |
361
+
| kms\_key\_arn|Optional CMK Key ARN to be used for Parameter Store. This key must be in the current account. |`string`|`null`| no |
364
362
| lambda\_s3\_bucket | S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. |`any`|`null`| no |
365
363
| lambda\_security\_group\_ids | List of security group IDs associated with the Lambda function. |`list(string)`|`[]`| no |
366
364
| lambda\_subnet\_ids | List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. |`list(string)`|`[]`| no |
367
365
| logging\_retention\_in\_days | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. |`number`|`180`| no |
368
-
| manage\_kms\_key | Let the module manage the KMS key. |`bool`|`true`| no |
369
366
| market\_options | Market options for the action runner instances. Setting the value to `null` let the scaler create on-demand instances instead of spot instances. |`string`|`"spot"`| no |
370
367
| minimum\_running\_time\_in\_minutes | The time an ec2 action runner should be running at minimum before terminated if non busy. |`number`|`5`| no |
371
368
| repository\_white\_list | List of repositories allowed to use the github app |`list(string)`|`[]`| no |
| enable\_cloudwatch\_agent | Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`. |`bool`|`true`| no |
| enable\_ssm\_on\_runners | Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. |`bool`| n/a | yes |
101
-
| encryption | KMS key to encrypted lambda environment secrets. Either provide a key and `encrypt` set to `true`. Or set the key to `null` and encrypt to `false`. | <pre>object({<br> kms_key_id = string<br> encrypt = bool<br> })</pre> | n/a | yes |
102
99
| environment | A name that identifies the environment, used as prefix and for tagging. |`string`| n/a | yes |
103
100
| ghes\_url | GitHub Enterprise Server URL. DO NOT SET IF USING PUBLIC GITHUB |`string`|`null`| no |
104
-
| github\_app |GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`). | <pre>object({<br> key_base64 = string<br> id = string<br> client_id = string<br> client_secret = string<br> })</pre> | n/a | yes |
101
+
| github\_app\_parameters|Parameter Store for GitHub App Parameters. | <pre>object({<br> key_base64 = map(string)<br> id = map(string)<br> client_id = map(string)<br> client_secret = map(string)<br> })</pre> | n/a | yes |
105
102
| idle\_config | List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle. | <pre>list(object({<br> cron = string<br> timeZone = string<br> idleCount = number<br> }))</pre> |`[]`| no |
106
103
| instance\_profile\_path | The path that will be added to the instance\_profile, if not set the environment name will be used. |`string`|`null`| no |
107
104
| instance\_type |[DEPRECATED] See instance\_types. |`string`|`"m5.large"`| no |
108
105
| instance\_types | List of instance types for the action runner. |`set(string)`|`null`| no |
109
106
| key\_name | Key pair name |`string`|`null`| no |
107
+
| kms\_key\_arn | Optional CMK Key ARN to be used for Parameter Store. |`string`|`null`| no |
110
108
| lambda\_s3\_bucket | S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly. |`any`|`null`| no |
111
109
| lambda\_security\_group\_ids | List of security group IDs associated with the Lambda function. |`list(string)`|`[]`| no |
112
110
| lambda\_subnet\_ids | List of subnets in which the lambda will be launched, the subnets needs to be subnets in the `vpc_id`. |`list(string)`|`[]`| no |
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
0 commit comments