Skip to content
This repository was archived by the owner on Jan 16, 2025. It is now read-only.

Commit 7907984

Browse files
maths22maths22
authored
fix: Add config for windows ami (#1525)
* Add config for windows ami * Update packer build to validate windows
1 parent 4ec44df commit 7907984

File tree

12 files changed

+208
-12
lines changed

12 files changed

+208
-12
lines changed

‎.github/workflows/packer-build.yml

+5-2
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,20 @@ jobs:
1818
runs-on: ubuntu-latest
1919
container:
2020
image: hashicorp/packer:1.7.8
21+
strategy:
22+
matrix:
23+
image: ["linux-amzn2", "windows-core-2019"]
2124
defaults:
2225
run:
23-
working-directory: images/linux-amzn2
26+
working-directory: images/${{ matrix.image }}
2427
steps:
2528
- name: "Checkout"
2629
uses: actions/checkout@v2
2730

2831
- name: packer init
2932
run: packer init .
3033

31-
- name: check terraform formatting
34+
- name: check packer formatting
3235
run: packer fmt -recursive -check=true .
3336

3437
- name: packer validate

‎examples/prebuilt/README.md

+11-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,17 @@ This module shows how to create GitHub action runners using a prebuilt AMI for t
44

55
## Usages
66

7-
Steps for the full setup, such as creating a GitHub app can be found in the root module's [README](../../README.md).
7+
Steps for the full setup, such as creating a GitHub app can be found in the root module's [README](../../README.md).
8+
9+
## Variables
10+
11+
| Name | Description | Type | Default | Required |
12+
|------|-------------|------|---------|:--------:|
13+
| <a name="input_ami_filter"></a> [ami\_filter](#input\_ami\_filter) | The amis to search. Use the default for the provided amazon linux image, `github-runner-windows-core-2019-*` for the provided widnows image | `string` | `github-runner-amzn2-x86_64-2021*` | no |
14+
| <a name="input_github_app_key_base64"></a> [github\_app\_key\_base64](#input\_github\_app\_key\_base64) | The base64 encoded private key you downloaded from GitHub when creating the app | `string` | | yes |
15+
| <a name="input_github_app_id"></a> [github\_app\_id](#input\_github\_app\_id) | The id of the app you created on GitHub | `string` | | yes |
16+
| <a name="input_region"></a> [region](#input\_region) | The target aws region | `string` | `eu-west-1` | no |
17+
| <a name="input_runner_os"></a> [runner\_os](#input\_runner\_os) | The os of the image, either `linux` or `windows` | `string` | `linux` | no |
818

919
### Lambdas
1020

‎examples/prebuilt/main.tf

+7-6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
locals {
22
environment = "prebuilt"
3-
aws_region = "eu-west-1"
43
}
54

65
resource "random_id" "random" {
@@ -12,7 +11,7 @@ data "aws_caller_identity" "current" {}
1211
module "runners" {
1312
source = "../../"
1413
create_service_linked_role_spot = true
15-
aws_region = local.aws_region
14+
aws_region = var.aws_region
1615
vpc_id = module.vpc.vpc_id
1716
subnet_ids = module.vpc.private_subnets
1817

@@ -24,15 +23,17 @@ module "runners" {
2423
webhook_secret = random_id.random.hex
2524
}
2625

27-
webhook_lambda_zip = "../../lambda_output/webhook.zip"
28-
runner_binaries_syncer_lambda_zip = "../../lambda_output/runner-binaries-syncer.zip"
29-
runners_lambda_zip = "../../lambda_output/runners.zip"
26+
webhook_lambda_zip = "lambdas-download/webhook.zip"
27+
runner_binaries_syncer_lambda_zip = "lambdas-download/runner-binaries-syncer.zip"
28+
runners_lambda_zip = "lambdas-download/runners.zip"
3029

3130
runner_extra_labels = "default,example"
3231

32+
runner_os = var.runner_os
33+
3334
# configure your pre-built AMI
3435
enabled_userdata = false
35-
ami_filter = { name = ["github-runner-amzn2-x86_64-2021*"] }
36+
ami_filter = { name = [var.ami_name_filter] }
3637
ami_owners = [data.aws_caller_identity.current.account_id]
3738

3839
# enable access to the runners via SSM

‎examples/prebuilt/providers.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
provider "aws" {
2-
region = local.aws_region
2+
region = var.aws_region
33
}

‎examples/prebuilt/variables.tf

+15
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,18 @@
22
variable "github_app_key_base64" {}
33

44
variable "github_app_id" {}
5+
6+
variable "runner_os" {
7+
type = string
8+
default = "linux"
9+
}
10+
11+
variable "ami_name_filter" {
12+
type = string
13+
default = "github-runner-amzn2-x86_64-2021*"
14+
}
15+
16+
variable "aws_region" {
17+
type = string
18+
default = "eu-west-1"
19+
}

‎examples/prebuilt/vpc.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@ module "vpc" {
22
source = "git::https://github.com/philips-software/terraform-aws-vpc.git?ref=2.2.0"
33

44
environment = local.environment
5-
aws_region = local.aws_region
5+
aws_region = var.aws_region
66
create_private_hosted_zone = false
77
}

‎images/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ The images inside this folder are pre-built images designed to shorten the boot
44

55
These images share the same scripting as used in the user-data mechanism in `/modules/runners/templates/`. We use a `tempaltefile` mechanism to insert the relevant script fragments into the scripts used for provisioning the images.
66

7-
The example in `linux-amzn2` also uploads a `start-runner.sh` script that uses the exact same startup process as used in the user-data mechanism. This means that the image created here does not need any extra scripts injected or changes to boot up and connect to GH.
7+
The examples in `linux-amzn2` and `windows-core-2019` also upload a `start-runner` script that uses the exact same startup process as used in the user-data mechanism. This means that the image created here does not need any extra scripts injected or changes to boot up and connect to GH.
88

99
## Building your own
1010

‎images/install-runner.ps1

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash -e
2+
3+
user_name=ec2-user
4+
5+
## This wrapper file re-uses scripts in the /modules/runners/templates directory
6+
## of this repo. These are the same that are used by the user_data functionality
7+
## to bootstrap the instance if it is started from an existing AMI.
8+
${install_runner}

‎images/start-runner.ps1

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Start-Transcript -Path "C:\runner-startup.log" -Append
2+
${start_runner}
3+
Stop-Transcript

‎images/windows-core-2019/bootstrap_win.ps1

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<powershell>
2+
3+
Write-Output "Running User Data Script"
4+
Write-Host "(host) Running User Data Script"
5+
6+
Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force -ErrorAction Ignore
7+
8+
# Don't set this before Set-ExecutionPolicy as it throws an error
9+
$ErrorActionPreference = "stop"
10+
11+
# Remove HTTP listener
12+
Remove-Item -Path WSMan:\Localhost\listener\listener* -Recurse
13+
14+
# Create a self-signed certificate to let ssl work
15+
$Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName "packer"
16+
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint -Force
17+
18+
# WinRM
19+
Write-Output "Setting up WinRM"
20+
Write-Host "(host) setting up WinRM"
21+
22+
# I'm not really sure why we need the cmd.exe wrapper, but it works with it and doesn't work without it
23+
cmd.exe /c winrm quickconfig -q
24+
cmd.exe /c winrm set "winrm/config" '@{MaxTimeoutms="1800000"}'
25+
cmd.exe /c winrm set "winrm/config/winrs" '@{MaxMemoryPerShellMB="1024"}'
26+
cmd.exe /c winrm set "winrm/config/service" '@{AllowUnencrypted="true"}'
27+
cmd.exe /c winrm set "winrm/config/client" '@{AllowUnencrypted="true"}'
28+
cmd.exe /c winrm set "winrm/config/service/auth" '@{Basic="true"}'
29+
cmd.exe /c winrm set "winrm/config/client/auth" '@{Basic="true"}'
30+
cmd.exe /c winrm set "winrm/config/service/auth" '@{CredSSP="true"}'
31+
cmd.exe /c winrm set "winrm/config/listener?Address=*+Transport=HTTPS" "@{Port=`"5986`";Hostname=`"packer`";CertificateThumbprint=`"$($Cert.Thumbprint)`"}"
32+
cmd.exe /c netsh advfirewall firewall set rule group="remote administration" new enable=yes
33+
cmd.exe /c netsh firewall add portopening TCP 5986 "Port 5986"
34+
cmd.exe /c net stop winrm
35+
cmd.exe /c sc config winrm start= auto
36+
cmd.exe /c net start winrm
37+
38+
</powershell>

‎images/windows-core-2019/github_agent.windows.pkr.hcl

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
packer {
2+
required_plugins {
3+
amazon = {
4+
version = ">= 0.0.2"
5+
source = "github.com/hashicorp/amazon"
6+
}
7+
}
8+
}
9+
10+
variable "action_runner_url" {
11+
description = "The URL to the tarball of the action runner"
12+
type = string
13+
default = "https://github.com/actions/runner/releases/download/v2.285.1/actions-runner-win-x64-2.285.1.zip"
14+
}
15+
16+
variable "region" {
17+
description = "The region to build the image in"
18+
type = string
19+
default = "eu-west-1"
20+
}
21+
22+
source "amazon-ebs" "githubrunner" {
23+
ami_name = "github-runner-windows-core-2019-${formatdate("YYYYMMDDhhmm", timestamp())}"
24+
communicator = "winrm"
25+
instance_type = "t3a.medium"
26+
region = var.region
27+
source_ami_filter {
28+
filters = {
29+
name = "Windows_Server-2019-English-Core-ContainersLatest-*"
30+
root-device-type = "ebs"
31+
virtualization-type = "hvm"
32+
}
33+
most_recent = true
34+
owners = ["amazon"]
35+
}
36+
tags = {
37+
OS_Version = "windows-core-2019"
38+
Release = "Latest"
39+
Base_AMI_Name = "{{ .SourceAMIName }}"
40+
}
41+
user_data_file = "./bootstrap_win.ps1"
42+
winrm_insecure = true
43+
winrm_port = 5986
44+
winrm_use_ssl = true
45+
winrm_username = "Administrator"
46+
}
47+
48+
build {
49+
name = "githubactions-runner"
50+
sources = [
51+
"source.amazon-ebs.githubrunner"
52+
]
53+
54+
provisioner "file" {
55+
content = templatefile("../start-runner.ps1", {
56+
start_runner = templatefile("../../modules/runners/templates/start-runner.ps1", {})
57+
})
58+
destination = "C:\\start-runner.ps1"
59+
}
60+
61+
provisioner "powershell" {
62+
inline = [templatefile("./windows-provisioner.ps1", {
63+
action_runner_url = var.action_runner_url
64+
})]
65+
}
66+
}

‎images/windows-core-2019/windows-provisioner.ps1

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
$ErrorActionPreference = "Continue"
2+
$VerbosePreference = "Continue"
3+
4+
# Install Chocolatey
5+
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
6+
$env:chocolateyUseWindowsCompression = 'true'
7+
Invoke-WebRequest https://chocolatey.org/install.ps1 -UseBasicParsing | Invoke-Expression
8+
9+
# Add Chocolatey to powershell profile
10+
$ChocoProfileValue = @'
11+
$ChocolateyProfile = "$env:ChocolateyInstall\helpers\chocolateyProfile.psm1"
12+
if (Test-Path($ChocolateyProfile)) {
13+
Import-Module "$ChocolateyProfile"
14+
}
15+
16+
refreshenv
17+
'@
18+
# Write it to the $profile location
19+
Set-Content -Path "$PsHome\Microsoft.PowerShell_profile.ps1" -Value $ChocoProfileValue -Force
20+
# Source it
21+
. "$PsHome\Microsoft.PowerShell_profile.ps1"
22+
23+
refreshenv
24+
25+
Write-Host "Installing cloudwatch agent..."
26+
Invoke-WebRequest -Uri https://s3.amazonaws.com/amazoncloudwatch-agent/windows/amd64/latest/amazon-cloudwatch-agent.msi -OutFile C:\amazon-cloudwatch-agent.msi
27+
$cloudwatchParams = '/i', 'C:\amazon-cloudwatch-agent.msi', '/qn', '/L*v', 'C:\CloudwatchInstall.log'
28+
Start-Process "msiexec.exe" $cloudwatchParams -Wait -NoNewWindow
29+
Remove-Item C:\amazon-cloudwatch-agent.msi
30+
31+
# Install dependent tools
32+
Write-Host "Installing additional development tools"
33+
choco install git awscli -y
34+
refreshenv
35+
36+
Write-Host "Creating actions-runner directory for the GH Action installtion"
37+
New-Item -ItemType Directory -Path C:\actions-runner ; Set-Location C:\actions-runner
38+
39+
Write-Host "Downloading the GH Action runner from ${action_runner_url}"
40+
Invoke-WebRequest -Uri ${action_runner_url} -OutFile actions-runner.zip
41+
42+
Write-Host "Un-zip action runner"
43+
Expand-Archive -Path actions-runner.zip -DestinationPath .
44+
45+
Write-Host "Delete zip file"
46+
Remove-Item actions-runner.zip
47+
48+
$action = New-ScheduledTaskAction -WorkingDirectory "C:\actions-runner" -Execute "PowerShell.exe" -Argument "-File C:\start-runner.ps1"
49+
$trigger = New-ScheduledTaskTrigger -AtStartup
50+
Register-ScheduledTask -TaskName "runnerinit" -Action $action -Trigger $trigger -User System -RunLevel Highest -Force
51+
52+
C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeInstance.ps1 -Schedule

0 commit comments

Comments
 (0)