0

Context and code used

Here is the code I produced to deploy any kind of container on Azure. (We are doing the same on AWS and facing the same kind of issues)

resource "azurerm_container_group" "container_service" {
  for_each = local.container_services

  name                = each.key
  location            = azurerm_resource_group.rg_lab.location
  resource_group_name = azurerm_resource_group.rg_lab.name

  ip_address_type = each.value.ip_address_type
  os_type         = each.value.os_type
  restart_policy  = each.value.restart_policy
  tags            = each.value.tags

  image_registry_credential {
    username = local.image_registry_username
    password = local.image_registry_password
    server   = var.image_registry_server
  }

  dynamic "exposed_port" {
    for_each = each.value.exposed_ports
    iterator = exposed_port

    content {
      port     = exposed_port.value.access_port
      protocol = exposed_port.value.access_protocol
    }
  }

  dynamic "container" {
    for_each = each.value.containers
    iterator = container

    content {
      name     = container.key
      image    = container.value.imagepath
      cpu      = container.value.cpu_cores
      memory   = container.value.memory_gb
      commands = container.value.commands

      dynamic "ports" {
        for_each = container.value.ports
        iterator = port

        content {
          port     = port.value.access_port
          protocol = port.value.access_protocol
        }
      }

      dynamic "volume" {
        for_each = container.value.volumes
        iterator = volume

        content {
          name       = volume.value.name
          mount_path = volume.value.mount_path
          read_only  = volume.value.read_only
          empty_dir  = volume.value.empty_dir
        }
      }

      environment_variables        = container.value.envvars
      secure_environment_variables = container.value.envvars_secure
    }
  }
}

This code uses a local file which looks like this. Its purpose is to deploy a single gitlab-runner container and automatically register the runner after it is running.

locals {
  container_services = {
    "container_gitlab-runner_service" = {
      ip_address_type = "Public"
      os_type         = "Linux"
      restart_policy  = "Always"
      exposed_ports = []
      tags = {
        "Type Tenant"  = "Azure",
        "Architecture" = "Ansible",
        "Environment"  = "Lab",
        "service"      = "gitlab-runner"
      }
      containers = {
        "gitlab-runner" = {
          imagepath = "${var.image_registry_server}/gitlab/gitlab-runner:alpine3.19"
          cpu_cores = 1
          memory_gb = 2
          ports = [
            {
              access_port     = 22
              access_protocol = "TCP"
            }
          ]
          commands = [
            /*"/bin/sh",
            "-c",
            "gitlab-runner register --non-interactive --url $CI_SERVER_URL --token $GITLAB_RUNNER_TOKEN --executor $GITLAB_RUNNER_EXECUTOR --name $GITLAB_RUNNER_NAME --docker-image $GITLAB_RUNNER_DEFAULT_IMAGE"*/
          ]
          volumes = [
            {
              name       = "gitlab-runner-etc-gitlab-runner"
              mount_path = "/etc/gitlab-runner"
              read_only  = false
              empty_dir  = true
            },
            {
              name       = "gitlab-runner-home-gitlab-runner"
              mount_path = "/home/gitlab-runner"
              read_only  = false
              empty_dir  = true
            }
          ]
          envvars = {
            "CI_SERVER_URL"               = "https://fake_onpremise_private-gitlab.com"
            "GITLAB_RUNNER_NAME"          = "runner_name"
            "GITLAB_RUNNER_EXECUTOR"      = "docker"
            "GITLAB_RUNNER_DEFAULT_IMAGE" = "alpine:3.19"
          }
          envvars_secure = {
            "GITLAB_RUNNER_TOKEN" = data.vault_generic_secret.secrets.data["secret_to_token"]
          }
        }
      }
    }
  }

  image_registry_username = data.vault_generic_secret.secrets.data[var.image_registry_username]
  image_registry_password = data.vault_generic_secret.secrets.data[var.image_registry_password]
}

Issue encountered

The issue is with the fact that the commands property of a container is replacing the current CMD. So the registering the runner works after we put the commands property, but the runner is not "running" anymore since it replaces the following layer :
CMD ["run" "--user=gitlab-runner" "--working-directory=/home/gitlab-runner"]

Anyone knows how we could simply pass a command after the container is deployed and running ?

Subsidiary question

When we don't pass the commands attribute and register the runner manually we encounter an issue with the docker executor, it says docker is not running.

Is there a way to use azurerm_container_group as a dind (Docker in docker) solution ? I feel like the issue we encounter is the same as the following question : https://stackoverflow.com/questions/63054835/running-gitlab-runner-in-azure-container-instances-aci

References

Current docker image used
How to register runner unattended
Docker executor

1
  • PS : I also saw the possibility of using remote-exec provider but i'm not sure it is able to connect to a container unless an SSH service is enabled (which would not be great considering the security context)
    – Hybris95
    Commented Mar 29 at 15:53

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.