Skip to content

Commit 8bcfee6

Browse files
edersonbrilhanteedersonbrilhante
committed
feat(microvm): add Terraform compute provider
1 parent c0c0679 commit 8bcfee6

31 files changed

Lines changed: 2230 additions & 14 deletions

‎.github/workflows/terraform.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,8 @@ jobs:
8787
"multi-runner",
8888
"compute-providers/aws/ec2",
8989
"compute-providers/aws/ec2/trust-policy",
90+
"compute-providers/aws/microvm",
91+
"compute-providers/aws/microvm/trust-policy",
9092
"runner-binaries-syncer",
9193
"orchestration-providers/webhook",
9294
"orchestration-providers/webhook/job-retry",
@@ -231,6 +233,8 @@ jobs:
231233
- modules/runner-config/ssm-housekeeper
232234
- modules/compute-providers/aws/ec2
233235
- modules/compute-providers/aws/ec2/trust-policy
236+
- modules/compute-providers/aws/microvm
237+
- modules/compute-providers/aws/microvm/trust-policy
234238
defaults:
235239
run:
236240
working-directory: ${{ matrix.module }}

‎modules/compute-providers/aws/microvm/control-plane.tf‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
data "aws_iam_policy_document" "scale_up" {
2+
statement {
3+
effect = "Allow"
4+
actions = [
5+
"lambda:ListMicrovms",
6+
"lambda:PassNetworkConnector",
7+
]
8+
resources = ["*"]
9+
}
10+
11+
statement {
12+
effect = "Allow"
13+
actions = ["lambda:RunMicrovm"]
14+
resources = var.config.iam.resource_arns.images
15+
}
16+
17+
statement {
18+
effect = "Allow"
19+
actions = [
20+
"lambda:ListTags",
21+
"lambda:TagResource",
22+
"lambda:TerminateMicrovm",
23+
]
24+
resources = var.config.iam.resource_arns.microvms
25+
}
26+
27+
statement {
28+
effect = "Allow"
29+
actions = ["iam:PassRole"]
30+
resources = [var.runner.iam.role.arn]
31+
}
32+
}
33+
34+
data "aws_iam_policy_document" "scale_down" {
35+
statement {
36+
effect = "Allow"
37+
actions = ["lambda:ListMicrovms"]
38+
resources = ["*"]
39+
}
40+
41+
statement {
42+
effect = "Allow"
43+
actions = [
44+
"lambda:ListTags",
45+
"lambda:TagResource",
46+
"lambda:TerminateMicrovm",
47+
"lambda:UntagResource",
48+
]
49+
resources = var.config.iam.resource_arns.microvms
50+
}
51+
}
52+
53+
locals {
54+
microvm_environment_variables = merge(var.config.environment_variables, {
55+
MICROVM_EGRESS_NETWORK_CONNECTORS = length(var.config.egress_network_connectors) == 0 ? "" : jsonencode(var.config.egress_network_connectors)
56+
MICROVM_EXECUTION_ROLE_ARN = var.runner.iam.role.arn
57+
MICROVM_IMAGE_ARN = var.config.image_arn
58+
MICROVM_IMAGE_VERSION = var.config.image_version == null ? "" : var.config.image_version
59+
MICROVM_INGRESS_NETWORK_CONNECTORS = length(var.config.ingress_network_connectors) == 0 ? "" : jsonencode(var.config.ingress_network_connectors)
60+
MICROVM_LOG_GROUP = try(var.config.logging.log_group, null) == null ? "" : var.config.logging.log_group
61+
MICROVM_MAXIMUM_DURATION_IN_SECONDS = var.config.maximum_duration_in_seconds == null ? "" : tostring(var.config.maximum_duration_in_seconds)
62+
})
63+
64+
scale_up_environment_variables = local.microvm_environment_variables
65+
scale_down_environment_variables = local.microvm_environment_variables
66+
pool_environment_variables = local.microvm_environment_variables
67+
}

‎modules/compute-providers/aws/microvm/outputs.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
output "environment_variables" {
2+
description = "Provider-specific Lambda environment variable fragments consumed by runner-config."
3+
value = local.provider_environment_variables
4+
}
5+
6+
output "policies" {
7+
description = "Provider-specific IAM policy fragments consumed by runner-config."
8+
value = local.provider_policies
9+
}
10+
11+
output "resources" {
12+
description = "Provider-specific MicroVM resources exposed by runner-config."
13+
value = local.provider_resources
14+
}
15+
16+
output "provider" {
17+
description = "Nested Lambda MicroVM compute-provider contract consumed by runner-config."
18+
value = {
19+
environment_variables = local.provider_environment_variables
20+
policies = local.provider_policies
21+
resources = local.provider_resources
22+
}
23+
}

‎modules/compute-providers/aws/microvm/provider-contract.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
locals {
2+
provider_environment_variables = {
3+
scale_up = local.scale_up_environment_variables
4+
scale_down = local.scale_down_environment_variables
5+
pool = local.pool_environment_variables
6+
}
7+
8+
provider_policies = {
9+
runner = {
10+
inline_policies = local.runner_inline_policies
11+
managed_policy_arns = var.runner.iam.managed_policy_arns
12+
}
13+
scale_up = {
14+
iam_policy_json = data.aws_iam_policy_document.scale_up.json
15+
additional_iam_policy_json = var.config.iam.additional_policy_json.scale_up
16+
managed_policy_enabled = var.config.iam.managed_policies.scale_up != null
17+
managed_policy_arn = try(var.config.iam.managed_policies.scale_up.arn, null)
18+
}
19+
scale_down = {
20+
iam_policy_json = data.aws_iam_policy_document.scale_down.json
21+
}
22+
pool = {
23+
iam_policy_json = data.aws_iam_policy_document.scale_up.json
24+
managed_policy_enabled = var.config.iam.managed_policies.pool != null
25+
managed_policy_arn = try(var.config.iam.managed_policies.pool.arn, null)
26+
}
27+
}
28+
29+
provider_resources = {
30+
image_arn = var.config.image_arn
31+
image_version = var.config.image_version
32+
execution_role_arn = var.runner.iam.role.arn
33+
}
34+
}

‎modules/compute-providers/aws/microvm/runner-policies.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
data "aws_caller_identity" "current" {}
2+
3+
locals {
4+
ssm_parameter_arn_prefix = "arn:${var.aws_partition}:ssm:${var.aws_region}:${data.aws_caller_identity.current.account_id}:parameter"
5+
runner_token_path_arn = "${local.ssm_parameter_arn_prefix}${var.ssm.paths.root}/${var.ssm.paths.tokens}/*"
6+
7+
runtime_log_group_name = try(var.config.logging.log_group, null) == null ? "/aws/lambda/microvms/*" : var.config.logging.log_group
8+
runtime_log_group_arn = "arn:${var.aws_partition}:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${local.runtime_log_group_name}"
9+
10+
runner_inline_policies = {
11+
ssm_jit = {
12+
name = "runner-microvm-ssm-jit"
13+
policy_json = data.aws_iam_policy_document.runner_ssm_jit.json
14+
}
15+
runtime_logs = {
16+
name = "runner-microvm-runtime-logs"
17+
policy_json = data.aws_iam_policy_document.runner_runtime_logs.json
18+
}
19+
}
20+
}
21+
22+
data "aws_iam_policy_document" "runner_ssm_jit" {
23+
statement {
24+
effect = "Allow"
25+
actions = [
26+
"ssm:DeleteParameter",
27+
"ssm:GetParameter",
28+
]
29+
resources = [local.runner_token_path_arn]
30+
}
31+
}
32+
33+
data "aws_iam_policy_document" "runner_runtime_logs" {
34+
statement {
35+
effect = "Allow"
36+
actions = ["logs:CreateLogGroup"]
37+
resources = [local.runtime_log_group_arn]
38+
}
39+
40+
statement {
41+
effect = "Allow"
42+
actions = [
43+
"logs:CreateLogStream",
44+
"logs:PutLogEvents",
45+
]
46+
resources = ["${local.runtime_log_group_arn}:*"]
47+
}
48+
}

0 commit comments

Comments
 (0)