chialab/aws-autoscaling-gitlab-runner

CloudFormation template to deploy a GitLab Runner with auto-scaling on AWS.

aws-autoscaling-gitlab-runner's Issues

Clarification on Manager Image

Im trying to deploy your aws template but not sure what i need to do for the Manager Image ID? Do i need to create my own server with docker and gitlab-runner installed on it first?

Limited IAM profile

Hi,

Happen to stumble upon this while searching for ideas of how to do lifecycle management of runners with autoscaling groups. I hope that your'e aware that gitlab-runner will be able to terminate any instance in that VPC, since it can describe all instances and apply tags to any instance in that account.

I'm currently looking for a solution to this, but have yet to find anything fruitful.

outdated docker machine image fails to load runners

I am unable to start runners using docker machine v0.14.0 but am successfully processing runners using v0.16.2.

EIP is not associated to EC2::Instance: no internet connection from Manager

Hello there,
first I want to thanks all the people that has contributed to this project. I think it a very good starting point to learn how to deploy gitlab runner cluster within AWS.

However I'm stacked with a problem related to internet connection from within the Manager EC2 Instance. When executing the UserData, there is not Internet Connection and the commands fail with connection refused. I've noticed that the Elastic IP defined in the stack is not automatically associated to the EC2::Instance resource defined, even if the correct InstanceId property is specified. Indeed, if I attach an elastic IP and execute the UserData commands by hand the stack is correctly created and a new Elastic IP is associated to the EC2::Instance.

I've tried to use EIPAssociation (without success) and also to define a NetworkInterface to be attached to the EC2 instance: same error result. My question is: there are specific requirements for the definition of the VPC that can block this association? I've defined a VPC with active InternetGateway: is there any other property/feature that needs to be set in the VPC?

Thanks for the attention to this matter.

Missing Permission for Spot Instance Creation

I use spot instances for runners.
However, after setting GitLabRunnerSpotInstance to "Yes", the manager could not create the new machines and the logs stated that:

Error creating machine: Error in driver during machine creation: Error request spot instance: AuthFailure.ServiceLinkedRoleCreationNotPermitted: The provided
credentials do not have permission to create the service-linked role for EC2 Spot Instances.

I had to add "iam:CreateServiceLinkedRole" for resource "*" to the manager's inline policy "Runners".
I got the information from a related issue: LeanerCloud/AutoSpotting#187

zoneinfo.zip: no such file or directory error when using OffPeakTimezone

I had the following issue, documented here: https://docs.gitlab.com/runner/faq/#zoneinfozip-no-such-file-or-directory-error-when-using-offpeaktimezone

Used the newest AMI as described in this comment

Possible to pull from private aws ecr-registry

Hi, I'm trying to pull from our private ECR registry but having trouble authenticating, I believe this should be possible based on this post:

https://gitlab.com/gitlab-org/gitlab-runner/issues/1583#note_93170156

By adding the aws credential-helper (https://github.com/awslabs/amazon-ecr-credential-helper) to the main EC2 manager.

Currently, I've added this to the Userdata of the instance:

UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          yum update -y aws-cfn-bootstrap
 >>>      yum install -y amazon-ecr-credential-helper

And an env var named DOCKER_AUTH_CONFIG to our gitlab project variables with the address of the registry:

{
  "credHelpers": {
    "123.dkr.ecr.eu-central-1.amazonaws.com": "ecr-login"
  }
}

But currently, I'm still getting a no basic credentials specified when trying to pull the image.

Is this a supported/out of scope feature or has anyone succeeded with this use case? (Sorry if a SO question would be a better place for this question but it seemed like this would be a common use case for this repo.