shahar1 commented on code in PR #65: URL: https://github.com/apache/airflow-ci-infra/pull/65#discussion_r4359708941
########## terraform/runs-on/README.rst: ########## @@ -0,0 +1,165 @@ +.. Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + +.. http://www.apache.org/licenses/LICENSE-2.0 + +.. Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. + +RunsOn — self-hosted CI runners on AWS +====================================== + +`RunsOn <https://runs-on.com/>`_ is the approach selected by +`AIP-118 <https://cwiki.apache.org/confluence/spaces/AIRFLOW/pages/451974652>`_ for Airflow's +self-hosted GitHub Actions runners. It packages runner provisioning into a CloudFormation stack in +Airflow's AWS account: a small control plane (ECS Fargate + API Gateway) receives GitHub's +``workflow_job`` webhooks and launches one ephemeral EC2 instance per job, Spot first, sized from +the job's ``runs-on:`` label. RunsOn's `free open-source license <https://runs-on.com/billing/free/>`_ +covers the product; EC2/EBS/S3 usage is billed to the account. + +This module creates the stack for the **apache** organization from RunsOn's published, +version-pinned template, with the configuration validated on 2026-09-25 (full ``Tests (AMD)`` +graph green apart from two non-hermetic tests — see the AIP-118 appendix). + +Files +----- + +``main.tf`` + The ``aws_cloudformation_stack`` resource, its parameters and the license-key lookup. +``variables.tf`` + All variables have defaults: ``stack_name`` (``runs-on``), ``github_organization`` + (``apache``), ``alert_email`` (``[email protected]``), ``runs_on_version`` (``v3.3.2``), + ``vpc_cidr`` (``10.2.0.0/16``) and ``region`` (``us-east-2``). +``state.tf`` + S3 backend ``airflow-ci-tfstate`` / ``tf-state/runs-on.tfstate`` (its own key next to the + EKS states). +``runs-on.yml.example`` + Runner presets for Airflow's three size classes, to be committed as ``.github/runs-on.yml`` + in the organization's ``.github-private`` repository (or a repository's default branch). + +Step 1 — create the license-key parameter (manual, once) +-------------------------------------------------------- + +RunsOn accepts ``LicenseKey`` either as plain text or as the ARN of an SSM Parameter Store +parameter that must be named ``/<stack name>/license-key`` (`reference +<https://runs-on.com/docs/maintenance/configuration/flex/cloudformation/>`_). The ARN form keeps +the key out of Terraform variables, plan output and state: ``main.tf`` reads the parameter +**without decryption** (only to prove it exists) and passes its ARN; the stack's service role is +the only principal that decrypts it. Secrets Manager is not supported by the template. + +.. code-block:: bash + + aws ssm put-parameter --region us-east-2 \ + --name /runs-on/license-key \ Review Comment: Dropped the variable in 87e1da6. `us-east-2` is now written out in `provider.tf`, with a comment saying the backend in `state.tf` and the README commands must change with it. The README's variables list says the same. --- Drafted-by: Claude Code (Opus 5.5) (no human review before posting) ########## terraform/runs-on/outputs.tf: ########## @@ -0,0 +1,34 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +output "entry_point" { + description = "RunsOn web entry point: open it once after creation to register the GitHub App." + value = aws_cloudformation_stack.runs_on.outputs["RunsOnEntryPoint"] +} + +output "cache_bucket" { + description = "S3 bucket the runners can use under the cache/ prefix (stash payloads)." + value = aws_cloudformation_stack.runs_on.outputs["RunsOnBucketCache"] +} + +output "app_version" { Review Comment: Added in 87e1da6. --- Drafted-by: Claude Code (Opus 5.5) (no human review before posting) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
