Ability to add existing security group to spot runners?

[ryancausey]

I need to be able to add an existing security group to my runner that provides access to resources the CI job needs. The SG only allows ingress and egress based on the requestor being part of the same SG, so the runner as is cannot access the required resources for the jobs being run.

Looking at the code, specifically resource "aws_launch_template" "gitlab_runner_instance", it looks like there is not a way to specify an additional security group to attach to the spot runners. Am I reading this right or did I miss something?

[kayman-mk]

You could add some egress rule via docker_machine_egress_rules. As far as I remember the security group is exported by the module. So you can use it somewhere else as ingress.

[ryancausey]

That's what I was afraid of. That doesn't end up working for my use case as I can't attach a security group to an RDS instance when a separate project manages the instance.

[kayman-mk]

How do you get access to the RDS today? Does the other project give you a security group they maintain? And you add it to your EC2 instances? So access is not based on IP addresses (only)?

Indeed this scenario is not covered at the moment. Time for a PR, right? It's possible to add multiple security groups to an EC2 instance. So let's go for it.

[ryancausey]

@kayman-mk I am working on a change on a fork to test if I can get this to work. My power died last night so I was unable to finish. I'll be making a PR once I get it working on the fork.

My use case is that the SG is created by the other project managing the DB instance, and that SG gets farmed around and attached to things that need the access. Access is determined by the requestor being in that SG.

[ryancausey]

Opened #378.

[kayman-mk]

The discussed feature is available since 4.32.0 now.