Skip to content

feat(runners): adopt nested EC2 provider configuration - #638

Merged
edersonbrilhante merged 5 commits into
mainfrom
feat/ec2-multiple-compute-providers
Aug 11, 2026
Merged

feat(runners): adopt nested EC2 provider configuration#638
edersonbrilhante merged 5 commits into
mainfrom
feat/ec2-multiple-compute-providers

Conversation

@edersonbrilhante

@edersonbrilhante edersonbrilhante commented Aug 11, 2026

Copy link
Copy Markdown
Member

Description

Introduces the nested, v2-compatible EC2 runner input in the existing ec2_deployment and forge_runners modules. This is an intentional breaking input change: EC2 settings move from flat runner_specs fields into compute_provider.ec2.

This phase keeps the released upstream runtime:

  • ec2_deployment explicitly translates the nested EC2 object into stable multi_runner_config.
  • The upstream module, Lambda artifacts, resource tag, and Terragrunt source override remain aligned on v7.10.1.
  • Outputs continue to use runners_map, preserving the upstream v1 runner resource addresses.
  • Forge AMI refresh, user data and hooks, logging, tags, IAM policies, subnet overrides, dynamic labels, queue redrive, and pool behavior remain wired through the adapter.
  • The EC2 field and default shape mirrors the upstream v2 proposal, but experimental.multi_runner_config_v2 is not enabled in this PR.

Boundaries:

  • EC2 only; MicroVM remains deferred.
  • No module folders are renamed.
  • Example config.yml retains the existing top-level ec2_runner_specs; Terragrunt translates it into the nested module contract.
  • Forge continues to own AMI SSM parameters and instance profiles, so external AMI parameter ownership and external instance profiles are rejected.
  • Stable v1 has no per-lane user-data debug flag, so user_data.debug_logging_enabled must remain false.

Type of Change

  • Feature
  • Bug Fix
  • Documentation
  • Refactor
  • Other: __________

Testing

  • tofu test in modules/platform/ec2_deployment: 3 passed.
  • tofu test in modules/platform/forge_runners: 2 passed.
  • tofu test in modules/platform/ec2_deployment/ec2_update_runner_ssm_ami: 2 passed.
  • tofu validate passed for all three changed modules.
  • TFLint passed for ec2_deployment and forge_runners.
  • Focused example, Terragrunt, and Terraform contract tests: 22 passed.
  • Repository pre-commit hooks passed, including Terragrunt/OpenTofu formatting, Terraform validation, TFLint, and Gitleaks.

@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@github-actions

Copy link
Copy Markdown
Contributor

OPA/conftest tenant-isolation gate

Result: passed

Gate Result
conftest verify --policy policy/opa passed

@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Automation gate tests

Result: passed

Suite Passed Failed Errors Skipped Total Duration Result
Automation gate tests 26 0 0 0 26 0.83s passed

Coverage: 84.81% (670/790 lines)

Lowest-covered Lambda files

File Coverage Missed lines

@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Offline IaC contract tests

Result: passed

Suite Passed Failed Errors Skipped Total Duration Result
Offline IaC contracts 128 0 0 0 128 4.81s passed

Coverage: 95.14% (1467/1542 lines)

Lowest-covered Lambda files

File Coverage Missed lines

@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Mutation test critical Lambda boundaries

Result: passed

Suite Passed Failed Errors Skipped Total Duration Result
Mutation tests 17 0 0 0 17 1.45s passed

Coverage: 39.67% (1215/3063 lines)

Lowest-covered Lambda files

File Coverage Missed lines

@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

OpenTofu module tests (latest-stable)

Result: passed

OpenTofu version: 1.12.5

Metric Count
Passed modules 71
Failed modules 0
Total modules 71
Module Result
modules/helpers/ami_policy passed
modules/helpers/ami_sharing passed
modules/helpers/aws_config_recording passed
modules/helpers/cloud_custodian passed
modules/helpers/cloud_formation passed
modules/helpers/dedicated_mac_hosts passed
modules/helpers/ecr passed
modules/helpers/forge_subscription passed
modules/helpers/opt_in_regions passed
modules/helpers/service_linked_roles passed
modules/helpers/storage passed
modules/infra/eks passed
modules/integrations/github_webhook_relay_destination passed
modules/integrations/github_webhook_relay_destination_receivers passed
modules/integrations/github_webhook_relay_destination_receivers/webex_webhook_relay passed
modules/integrations/splunk_aws_billing passed
modules/integrations/splunk_cloud_conf_shared passed
modules/integrations/splunk_cloud_data_manager passed
modules/integrations/splunk_cloud_data_manager/data_input passed
modules/integrations/splunk_cloud_data_manager/log_group_reconciler passed
modules/integrations/splunk_cloud_data_manager/sec_meta_ec2_tags passed
modules/integrations/splunk_cloud_data_manager_common passed
modules/integrations/splunk_dependency_monitor passed
modules/integrations/splunk_o11y_aws_integration passed
modules/integrations/splunk_o11y_aws_integration_common passed
modules/integrations/splunk_o11y_conf_shared passed
modules/integrations/splunk_o11y_conf_shared/dashboards/arc_runner_operations passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_service_limits passed
modules/integrations/splunk_o11y_conf_shared/dashboards/billing passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dynamodb passed
modules/integrations/splunk_o11y_conf_shared/dashboards/ebs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/forge_impact passed
modules/integrations/splunk_o11y_conf_shared/dashboards/k8s_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/metric_ingest passed
modules/integrations/splunk_o11y_conf_shared/dashboards/opencost passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_ec2 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_k8s passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_usage passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs_control_plane passed
modules/integrations/splunk_o11y_conf_shared/detectors/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/detectors/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/detectors/ec2_runner_health passed
modules/integrations/splunk_o11y_conf_shared/detectors/k8s passed
modules/integrations/splunk_opencost_eks passed
modules/integrations/splunk_otel_eks passed
modules/integrations/splunk_secrets passed
modules/integrations/splunk_stuck_workflow_job_dispatcher passed
modules/integrations/teleport passed
modules/integrations/teleport/tenant passed
modules/platform/arc passed
modules/platform/arc/scale_set passed
modules/platform/arc/scale_set_controller passed
modules/platform/arc_deployment passed
modules/platform/ec2_deployment passed
modules/platform/ec2_deployment/ec2_update_runner_ssm_ami passed
modules/platform/ec2_deployment/ec2_update_runner_tags passed
modules/platform/forge_runners passed
modules/platform/forge_runners/forge_trust_validator passed
modules/platform/forge_runners/github_actions_job_logs passed
modules/platform/forge_runners/github_app_runner_group passed
modules/platform/forge_runners/github_global_lock passed
modules/platform/forge_runners/github_webhook_relay passed
modules/platform/forge_runners/github_webhook_relay/source passed
modules/platform/forge_runners/redrive_deadletter passed

@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

OpenTofu module tests (minimum-supported)

Result: passed

OpenTofu version: 1.11.0

Metric Count
Passed modules 71
Failed modules 0
Total modules 71
Module Result
modules/helpers/ami_policy passed
modules/helpers/ami_sharing passed
modules/helpers/aws_config_recording passed
modules/helpers/cloud_custodian passed
modules/helpers/cloud_formation passed
modules/helpers/dedicated_mac_hosts passed
modules/helpers/ecr passed
modules/helpers/forge_subscription passed
modules/helpers/opt_in_regions passed
modules/helpers/service_linked_roles passed
modules/helpers/storage passed
modules/infra/eks passed
modules/integrations/github_webhook_relay_destination passed
modules/integrations/github_webhook_relay_destination_receivers passed
modules/integrations/github_webhook_relay_destination_receivers/webex_webhook_relay passed
modules/integrations/splunk_aws_billing passed
modules/integrations/splunk_cloud_conf_shared passed
modules/integrations/splunk_cloud_data_manager passed
modules/integrations/splunk_cloud_data_manager/data_input passed
modules/integrations/splunk_cloud_data_manager/log_group_reconciler passed
modules/integrations/splunk_cloud_data_manager/sec_meta_ec2_tags passed
modules/integrations/splunk_cloud_data_manager_common passed
modules/integrations/splunk_dependency_monitor passed
modules/integrations/splunk_o11y_aws_integration passed
modules/integrations/splunk_o11y_aws_integration_common passed
modules/integrations/splunk_o11y_conf_shared passed
modules/integrations/splunk_o11y_conf_shared/dashboards/arc_runner_operations passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/dashboards/aws_service_limits passed
modules/integrations/splunk_o11y_conf_shared/dashboards/billing passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/dashboards/dynamodb passed
modules/integrations/splunk_o11y_conf_shared/dashboards/ebs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/forge_impact passed
modules/integrations/splunk_o11y_conf_shared/dashboards/k8s_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda passed
modules/integrations/splunk_o11y_conf_shared/dashboards/lambda_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/metric_ingest passed
modules/integrations/splunk_o11y_conf_shared/dashboards/opencost passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_ec2 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_k8s passed
modules/integrations/splunk_o11y_conf_shared/dashboards/runner_usage passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3 passed
modules/integrations/splunk_o11y_conf_shared/dashboards/s3_control_plane passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs passed
modules/integrations/splunk_o11y_conf_shared/dashboards/sqs_control_plane passed
modules/integrations/splunk_o11y_conf_shared/detectors/aws_regional_health passed
modules/integrations/splunk_o11y_conf_shared/detectors/dependency_probes passed
modules/integrations/splunk_o11y_conf_shared/detectors/ec2_runner_health passed
modules/integrations/splunk_o11y_conf_shared/detectors/k8s passed
modules/integrations/splunk_opencost_eks passed
modules/integrations/splunk_otel_eks passed
modules/integrations/splunk_secrets passed
modules/integrations/splunk_stuck_workflow_job_dispatcher passed
modules/integrations/teleport passed
modules/integrations/teleport/tenant passed
modules/platform/arc passed
modules/platform/arc/scale_set passed
modules/platform/arc/scale_set_controller passed
modules/platform/arc_deployment passed
modules/platform/ec2_deployment passed
modules/platform/ec2_deployment/ec2_update_runner_ssm_ami passed
modules/platform/ec2_deployment/ec2_update_runner_tags passed
modules/platform/forge_runners passed
modules/platform/forge_runners/forge_trust_validator passed
modules/platform/forge_runners/github_actions_job_logs passed
modules/platform/forge_runners/github_app_runner_group passed
modules/platform/forge_runners/github_global_lock passed
modules/platform/forge_runners/github_webhook_relay passed
modules/platform/forge_runners/github_webhook_relay/source passed
modules/platform/forge_runners/redrive_deadletter passed

@edersonbrilhante edersonbrilhante changed the title feat(runners): support multiple compute providers feat(runners): adopt nested EC2 v2 configuration Aug 11, 2026
@edersonbrilhante edersonbrilhante changed the title feat(runners): adopt nested EC2 v2 configuration feat(runners): adopt nested EC2 provider configuration Aug 11, 2026
@edersonbrilhante
edersonbrilhante marked this pull request as ready for review August 11, 2026 21:12
@edersonbrilhante
edersonbrilhante requested a review from a team as a code owner August 11, 2026 21:12
@edersonbrilhante
edersonbrilhante enabled auto-merge (squash) August 11, 2026 21:16

@im-ko-git im-ko-git left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@edersonbrilhante
edersonbrilhante merged commit 5937cf6 into main Aug 11, 2026
16 checks passed
@edersonbrilhante
edersonbrilhante deleted the feat/ec2-multiple-compute-providers branch August 11, 2026 21:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants