feat(compute-providers): add MicroVM webhook routing

Author: edersonbrilhante

lambdas/libs/compute-providers/aws/microvm/provider.test.ts

@@ -0,0 +1,30 @@
+import { expect, it, vi } from 'vitest';
+
+import { provider as controlPlaneProvider } from './control-plane';
+import { provider as webhookProvider } from './webhook';
+
+it('exposes every MicroVM compute provider capability from its compute-provider entry point', () => {
+  const controlPlanePlugin = controlPlaneProvider.createPlugin(vi.fn(async () => []));
+  const webhookPlugin = webhookProvider.createPlugin();
+
+  expect(controlPlanePlugin.type).toBe('microvm');
+  expect(controlPlanePlugin.capabilities.pool()).toEqual({
+    listRunners: expect.any(Function),
+    countAvailableRunners: expect.any(Function),
+    createRunners: expect.any(Function),
+  });
+  expect(controlPlanePlugin.capabilities.scaleUp()).toEqual({
+    resolveLabelsForRunners: expect.any(Function),
+    getCurrentRunners: expect.any(Function),
+    createRunners: expect.any(Function),
+  });
+  expect(controlPlanePlugin.capabilities.scaleDown()).toEqual({
+    list: expect.any(Function),
+    bootTimeExceeded: expect.any(Function),
+    markOrphan: expect.any(Function),
+    unmarkOrphan: expect.any(Function),
+    terminate: expect.any(Function),
+  });
+  expect(webhookPlugin.type).toBe('microvm');
+  expect(webhookPlugin.capabilities.dynamicLabels.getViolations).toEqual(expect.any(Function));
+});

lambdas/libs/compute-providers/aws/microvm/src/webhook/dynamic-labels.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from 'vitest';
+
+import type { RunnerMatcherConfig } from '../../../../contracts';
+import { microvmDynamicLabelProvider } from './dynamic-labels';
+
+const imageArn = 'arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-large';
+const egressConnectorArn = 'arn:aws:lambda:eu-west-1:123456789012:network-connector:github-runner-private-egress';
+
+describe('microvmDynamicLabelProvider', () => {
+  it('accepts supported MicroVM overrides', () => {
+    const queue = microvmQueue();
+    const dynamicLabels = [
+      `ghr-microvm-egress-network-connectors:${egressConnectorArn}`,
+      `ghr-microvm-image-arn:${imageArn}`,
+      'ghr-microvm-image-version:3.0',
+      'ghr-microvm-maximum-duration-in-seconds:7200',
+    ];
+
+    expect(getViolations(queue, dynamicLabels)).toEqual([]);
+  });
+
+  it('rejects unsupported MicroVM resource overrides', () => {
+    expect(getViolations(microvmQueue(), ['ghr-microvm-memory:8192'])).toEqual([
+      {
+        label: 'ghr-microvm-memory:8192',
+        reason: "key 'memory' is not a supported MicroVM override",
+      },
+    ]);
+  });
+
+  it('enforces the AWS dynamic-label policy', () => {
+    const queue = microvmQueue();
+    queue.matcherConfig.awsDynamicLabelsPolicy = {
+      restricted_keys: { 'maximum-duration-in-seconds': { max: 3600 } },
+    };
+
+    expect(getViolations(queue, ['ghr-microvm-maximum-duration-in-seconds:7200'])).toEqual([
+      {
+        label: 'ghr-microvm-maximum-duration-in-seconds:7200',
+        reason: "value '7200' exceeds max '3600'",
+      },
+    ]);
+  });
+
+  it('applies allowed patterns to the complete image ARN', () => {
+    const queue = microvmQueue();
+    queue.matcherConfig.awsDynamicLabelsPolicy = {
+      restricted_keys: {
+        'image-arn': {
+          allowed: ['arn:aws:lambda:eu-west-1:123456789012:microvm-image:approved-*'],
+        },
+      },
+    };
+
+    expect(
+      getViolations(queue, [
+        'ghr-microvm-image-arn:arn:aws:lambda:eu-west-1:123456789012:microvm-image:approved-large',
+      ]),
+    ).toEqual([]);
+    expect(
+      getViolations(queue, ['ghr-microvm-image-arn:arn:aws:lambda:eu-west-1:123456789012:microvm-image:unapproved']),
+    ).toHaveLength(1);
+  });
+
+  it('applies the policy to each egress connector label', () => {
+    const queue = microvmQueue();
+    queue.matcherConfig.awsDynamicLabelsPolicy = {
+      restricted_keys: {
+        'egress-network-connectors': {
+          allowed: ['arn:aws:lambda:eu-west-1:123456789012:network-connector:approved-*'],
+        },
+      },
+    };
+
+    expect(
+      getViolations(queue, [
+        'ghr-microvm-egress-network-connectors:arn:aws:lambda:eu-west-1:123456789012:network-connector:approved-private',
+      ]),
+    ).toEqual([]);
+    expect(
+      getViolations(queue, [
+        'ghr-microvm-egress-network-connectors:arn:aws:lambda:eu-west-1:123456789012:network-connector:unapproved',
+      ]),
+    ).toHaveLength(1);
+  });
+});
+
+function getViolations(queue: RunnerMatcherConfig, labels: string[]) {
+  return microvmDynamicLabelProvider.getViolations({ queue, labels });
+}
+
+function microvmQueue(): RunnerMatcherConfig {
+  return {
+    id: 'microvm',
+    arn: 'arn:aws:sqs:eu-west-1:123456789012:microvm',
+    computeProvider: 'microvm',
+    matcherConfig: {
+      labelMatchers: [['self-hosted', 'linux', 'arm64', 'microvm']],
+      exactMatch: false,
+      enableDynamicLabels: true,
+    },
+  };
+}

lambdas/libs/compute-providers/aws/microvm/src/webhook/dynamic-labels.ts

@@ -0,0 +1,16 @@
+import { violationsAgainstAwsDynamicLabelsPolicy } from '../../../dynamic-labels-policy';
+import type { DynamicLabelProvider } from '../../../../contracts';
+import { MICROVM_DYNAMIC_LABEL_PREFIX, parseMicrovmDynamicLabels } from '../dynamic-labels';
+
+export const microvmDynamicLabelProvider: DynamicLabelProvider = {
+  getViolations: ({ queue, labels }) => {
+    const parsedLabels = parseMicrovmDynamicLabels(labels);
+    const policyViolations = violationsAgainstAwsDynamicLabelsPolicy(
+      labels,
+      queue.matcherConfig.awsDynamicLabelsPolicy,
+      MICROVM_DYNAMIC_LABEL_PREFIX,
+    );
+
+    return [...parsedLabels.violations, ...policyViolations];
+  },
+};

lambdas/libs/compute-providers/aws/microvm/webhook.ts

@@ -0,0 +1,16 @@
+import type { ComputeProviderPlugin } from '../../core';
+
+import type { WebhookProviderCapabilities, WebhookProviderModule } from '../../contracts';
+import { microvmDynamicLabelProvider } from './src/webhook/dynamic-labels';
+
+export function createMicrovmWebhookPlugin(): ComputeProviderPlugin<WebhookProviderCapabilities, 'microvm'> {
+  return {
+    type: 'microvm',
+    capabilities: { dynamicLabels: microvmDynamicLabelProvider },
+  };
+}
+
+export const provider = {
+  type: 'microvm',
+  createPlugin: createMicrovmWebhookPlugin,
+} satisfies WebhookProviderModule<'microvm'>;

lambdas/libs/compute-providers/package.json

@@ -12,6 +12,7 @@
     "./aws/ec2/control-plane": "./aws/ec2/control-plane.ts",
     "./aws/ec2/control-plane/runners": "./aws/ec2/src/control-plane/runners.ts",
     "./aws/ec2/control-plane/runner-config": "./aws/ec2/src/control-plane/runner-config.ts",
+    "./aws/microvm/webhook": "./aws/microvm/webhook.ts",
     "./aws/microvm/control-plane": "./aws/microvm/control-plane.ts"
   },
   "type": "module",

lambdas/libs/compute-providers/providers.config.webhook.ts

@@ -1,5 +1,6 @@
 import { provider as ec2 } from './aws/ec2/webhook';
+import { provider as microvm } from './aws/microvm/webhook';
 import type { WebhookProviderModule } from './contracts';
 
 /** Provider plugins included in the webhook bundle. */
-export const enabledWebhookProviders = [ec2] as const satisfies readonly WebhookProviderModule[];
+export const enabledWebhookProviders = [ec2, microvm] as const satisfies readonly WebhookProviderModule[];

lambdas/libs/compute-providers/webhook.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, it, vi } from 'vitest';
 
 import type { DynamicLabelProvider, DynamicLabelViolation, RunnerMatcherConfig } from './contracts';
-import type { ComputeProviderType } from './provider-types';
 import { createDynamicLabelQueueSelector } from './webhook';
 
+type TestProvider = 'provider-a' | 'provider-b';
+
 describe('createDynamicLabelQueueSelector', () => {
   it('returns the first queue accepted by its provider', () => {
     const queue = runnerQueue('accepted');
@@ -55,41 +56,37 @@ describe('createDynamicLabelQueueSelector', () => {
     expect(selectQueue([queue], ['self-hosted'], ['ghr-test-size:large'])).toBeUndefined();
   });
 
-  /* TODO: Re-enable this scenario when the MicroVM provider is added.
-  it('skips EC2 and selects the MicroVM queue for MicroVM override labels', () => {
-    const ec2Queue = runnerQueue('ec2');
-    const microvmQueue = runnerQueue('microvm');
-    const imageVersionLabel = 'ghr-microvm-image-version:3.0';
+  it('skips queues when labels target another provider', () => {
+    const firstQueue = runnerQueue('first');
+    const secondQueue = runnerQueue('second');
     const { getViolations, selectQueue } = selector({
-      providerByQueue: { ec2: 'ec2', microvm: 'microvm' },
-      labelsForOtherProvider: (labels, provider) =>
-        provider === 'ec2' ? labels.filter((label) => label.startsWith('ghr-microvm-')) : [],
+      providerByQueue: { first: 'provider-a', second: 'provider-b' },
+      labelsForOtherProvider: (_labels, provider) => (provider === 'provider-a' ? ['ghr-provider-b-size:large'] : []),
     });
 
-    expect(selectQueue([ec2Queue, microvmQueue], ['self-hosted', 'linux'], [imageVersionLabel])).toEqual({
-      queue: microvmQueue,
-      labels: ['self-hosted', 'linux', imageVersionLabel],
+    expect(selectQueue([firstQueue, secondQueue], ['self-hosted'], ['ghr-provider-b-size:large'])).toEqual({
+      queue: secondQueue,
+      labels: ['self-hosted', 'ghr-provider-b-size:large'],
     });
     expect(getViolations).toHaveBeenCalledOnce();
-    expect(getViolations).toHaveBeenCalledWith({ queue: microvmQueue, labels: [imageVersionLabel] });
+    expect(getViolations).toHaveBeenCalledWith({ queue: secondQueue, labels: ['ghr-provider-b-size:large'] });
   });
-  */
 });
 
 function selector(options?: {
-  providerByQueue?: Record<string, ComputeProviderType>;
+  providerByQueue?: Record<string, TestProvider>;
   violationsByQueue?: Record<string, DynamicLabelViolation[]>;
-  labelsForOtherProvider?: (labels: string[], provider: ComputeProviderType) => string[];
+  labelsForOtherProvider?: (labels: string[], provider: TestProvider) => string[];
 }) {
   const getViolations = vi.fn<DynamicLabelProvider['getViolations']>(({ queue }) => {
     return options?.violationsByQueue?.[queue.id] ?? [];
   });
 
   return {
     getViolations,
-    selectQueue: createDynamicLabelQueueSelector<ComputeProviderType>({
+    selectQueue: createDynamicLabelQueueSelector<TestProvider>({
       resolveProvider: (queue) => ({
-        type: options?.providerByQueue?.[queue.id] ?? 'ec2',
+        type: options?.providerByQueue?.[queue.id] ?? 'provider-a',
         dynamicLabels: { getViolations },
       }),
       dynamicLabelsForOtherProvider: options?.labelsForOtherProvider ?? (() => []),