fix(compute-providers): remove MicroVM duration label

Author: edersonbrilhante

lambdas/libs/compute-providers/aws/microvm/README.md

@@ -60,12 +60,11 @@ separate roles, prefixes, and provider deployments.
 When a runner matcher enables dynamic labels, workflow jobs can override the
 following `RunMicrovm` inputs:
 
-| Label                                               | Override                                       |
-| --------------------------------------------------- | ---------------------------------------------- |
-| `ghr-microvm-egress-network-connectors:<arn>`       | One egress network connector ARN               |
-| `ghr-microvm-image-arn:<arn>`                       | MicroVM image ARN                              |
-| `ghr-microvm-image-version:<version>`               | MicroVM image version                          |
-| `ghr-microvm-maximum-duration-in-seconds:<seconds>` | Maximum lifetime from 1 through 28,800 seconds |
+| Label                                         | Override                         |
+| --------------------------------------------- | -------------------------------- |
+| `ghr-microvm-egress-network-connectors:<arn>` | One egress network connector ARN |
+| `ghr-microvm-image-arn:<arn>`                 | MicroVM image ARN                |
+| `ghr-microvm-image-version:<version>`         | MicroVM image version            |
 
 Repeat `ghr-microvm-egress-network-connectors:<arn>` to attach multiple
 connectors. Specify one ARN per label; `RunMicrovm` accepts at most 10. These
@@ -84,7 +83,7 @@ explicit `allowed` list for the corresponding key.
 
 Use the matcher's `awsDynamicLabelsPolicy` to restrict values accepted from
 workflow jobs. The MicroVM policy keys are `egress-network-connectors`,
-`image-arn`, `image-version`, and `maximum-duration-in-seconds`. For example:
+`image-arn`, and `image-version`. For example:
 
 ```json
 {
@@ -97,9 +96,6 @@ workflow jobs. The MicroVM policy keys are `egress-network-connectors`,
     },
     "image-version": {
       "allowed": ["3.*"]
-    },
-    "maximum-duration-in-seconds": {
-      "max": 3600
     }
   }
 }

lambdas/libs/compute-providers/aws/microvm/src/control-plane/runner-config.test.ts

@@ -138,7 +138,7 @@ describe('createMicrovmRunners', () => {
     expect(setMicrovmGithubRunnerId).toHaveBeenNthCalledWith(1, metadataSsmPath, 'mvm-1', 'github-mvm-1');
   });
 
-  it('applies dynamic labels to the RunMicrovm configuration and metadata tags', async () => {
+  it('applies dynamic labels without overriding the deployment-controlled duration', async () => {
     const overrideImageArn = 'arn:aws:lambda:eu-west-1:123456789012:microvm-image:runner-large';
     const overrideEgressConnectorArn =
       'arn:aws:lambda:eu-west-1:123456789012:network-connector:github-runner-private-egress';
@@ -151,7 +151,6 @@ describe('createMicrovmRunners', () => {
       egressNetworkConnectors: [overrideEgressConnectorArn],
       imageIdentifier: overrideImageArn,
       imageVersion: '3.0',
-      maximumDurationInSeconds: 7200,
     });
 
     expect(runMicrovmRunner).toHaveBeenCalledWith({
@@ -160,7 +159,7 @@ describe('createMicrovmRunners', () => {
         imageIdentifier: overrideImageArn,
         imageVersion: '3.0',
         executionRoleArn: 'arn:aws:iam::123456789012:role/microvm-runner',
-        maximumDurationInSeconds: 7200,
+        maximumDurationInSeconds: 1200,
         metadataSsmPath,
       },
       environment: 'unit-test',

lambdas/libs/compute-providers/aws/microvm/src/control-plane/scale-up.test.ts

@@ -50,32 +50,33 @@ describe('createMicrovmScaleUpProvider', () => {
         `ghr-microvm-egress-network-connectors:${overrideEgressConnectorArn}`,
         `ghr-microvm-image-arn:${overrideImageArn}`,
         'ghr-microvm-image-version:3.0',
-        'ghr-microvm-maximum-duration-in-seconds:7200',
       ]),
     ).resolves.toEqual({
       runnerLabels: [
         `ghr-microvm-egress-network-connectors:${overrideEgressConnectorArn}`,
         `ghr-microvm-image-arn:${overrideImageArn}`,
         'ghr-microvm-image-version:3.0',
-        'ghr-microvm-maximum-duration-in-seconds:7200',
       ],
       state: {
         overrides: {
           egressNetworkConnectors: [overrideEgressConnectorArn],
           imageIdentifier: overrideImageArn,
           imageVersion: '3.0',
-          maximumDurationInSeconds: 7200,
         },
       },
     });
   });
 
-  it('rejects unsupported MicroVM override labels at the control-plane boundary', async () => {
+  it.each([
+    ['ghr-microvm-memory:8192', "key 'memory' is not a supported MicroVM override"],
+    [
+      'ghr-microvm-maximum-duration-in-seconds:7200',
+      "key 'maximum-duration-in-seconds' is not a supported MicroVM override",
+    ],
+  ])('rejects unsupported MicroVM override label %s at the control-plane boundary', async (label, reason) => {
     const provider = createMicrovmScaleUpProvider(createStartRunnerConfig);
 
-    await expect(provider.resolveLabelsForRunners(['ghr-microvm-memory:8192'])).rejects.toThrow(
-      "key 'memory' is not a supported MicroVM override",
-    );
+    await expect(provider.resolveLabelsForRunners([label])).rejects.toThrow(reason);
   });
 
   it('counts managed MicroVMs for the runner owner', async () => {

lambdas/libs/compute-providers/aws/microvm/src/dynamic-labels.test.ts

@@ -15,14 +15,12 @@ describe('parseMicrovmDynamicLabels', () => {
         `ghr-microvm-egress-network-connectors:${internetEgressConnectorArn}`,
         `ghr-microvm-image-arn:${imageArn}`,
         'ghr-microvm-image-version:3.0',
-        'ghr-microvm-maximum-duration-in-seconds:7200',
       ]),
     ).toEqual({
       overrides: {
         egressNetworkConnectors: [egressConnectorArn, internetEgressConnectorArn],
         imageIdentifier: imageArn,
         imageVersion: '3.0',
-        maximumDurationInSeconds: 7200,
       },
       violations: [],
     });
@@ -40,8 +38,10 @@ describe('parseMicrovmDynamicLabels', () => {
     ],
     ['ghr-microvm-image-arn:not-an-arn', 'is not a valid customer MicroVM image ARN'],
     ['ghr-microvm-image-version:', "key 'image-version' requires a value"],
-    ['ghr-microvm-maximum-duration-in-seconds:0', 'maximum duration must be an integer between 1 and 28800'],
-    ['ghr-microvm-maximum-duration-in-seconds:28801', 'maximum duration must be an integer between 1 and 28800'],
+    [
+      'ghr-microvm-maximum-duration-in-seconds:7200',
+      "key 'maximum-duration-in-seconds' is not a supported MicroVM override",
+    ],
   ])('rejects invalid override %s', (label, reason) => {
     const result = parseMicrovmDynamicLabels([label]);
 

lambdas/libs/compute-providers/aws/microvm/src/dynamic-labels.ts

@@ -1,6 +1,5 @@
 export const MICROVM_DYNAMIC_LABEL_PREFIX = 'ghr-microvm-';
 
-const MAXIMUM_DURATION_IN_SECONDS = 28_800;
 const MAXIMUM_EGRESS_NETWORK_CONNECTORS = 10;
 const MICROVM_IMAGE_ARN_PATTERN = /^arn:[^:]+:lambda:[^:]+:[0-9]{12}:microvm-image:.+$/;
 const MICROVM_NETWORK_CONNECTOR_ARN_PATTERN =
@@ -10,7 +9,6 @@ export interface MicrovmDynamicLabelOverrides {
   egressNetworkConnectors?: string[];
   imageIdentifier?: string;
   imageVersion?: string;
-  maximumDurationInSeconds?: number;
 }
 
 export interface MicrovmDynamicLabelViolation {
@@ -69,18 +67,6 @@ export function parseMicrovmDynamicLabels(labels: string[]): {
       case 'image-version':
         overrides.imageVersion = value;
         break;
-      case 'maximum-duration-in-seconds': {
-        const duration = Number(value);
-        if (!Number.isInteger(duration) || duration < 1 || duration > MAXIMUM_DURATION_IN_SECONDS) {
-          violations.push({
-            label,
-            reason: `maximum duration must be an integer between 1 and ${MAXIMUM_DURATION_IN_SECONDS}`,
-          });
-        } else {
-          overrides.maximumDurationInSeconds = duration;
-        }
-        break;
-      }
       default:
         violations.push({ label, reason: `key '${key}' is not a supported MicroVM override` });
     }

lambdas/libs/compute-providers/aws/microvm/src/webhook/dynamic-labels.test.ts

@@ -20,7 +20,6 @@ describe('microvmDynamicLabelProvider', () => {
       `ghr-microvm-egress-network-connectors:${egressConnectorArn}`,
       `ghr-microvm-image-arn:${imageArn}`,
       'ghr-microvm-image-version:3.0',
-      'ghr-microvm-maximum-duration-in-seconds:7200',
     ];
 
     expect(getViolations(queue, dynamicLabels)).toEqual([]);
@@ -32,7 +31,6 @@ describe('microvmDynamicLabelProvider', () => {
         `ghr-microvm-egress-network-connectors:${egressConnectorArn}`,
         `ghr-microvm-image-arn:${imageArn}`,
         'ghr-microvm-image-version:3.0',
-        'ghr-microvm-maximum-duration-in-seconds:3600',
       ]),
     ).toEqual([
       {
@@ -50,25 +48,31 @@ describe('microvmDynamicLabelProvider', () => {
     ]);
   });
 
-  it('preserves violations from the MicroVM label parser', () => {
-    expect(getViolations(microvmQueue(), ['ghr-microvm-memory:8192'])).toEqual([
+  it.each([
+    ['ghr-microvm-memory:8192', "key 'memory' is not a supported MicroVM override"],
+    [
+      'ghr-microvm-maximum-duration-in-seconds:7200',
+      "key 'maximum-duration-in-seconds' is not a supported MicroVM override",
+    ],
+  ])('preserves the parser violation for %s', (label, reason) => {
+    expect(getViolations(microvmQueue(), [label])).toEqual([
       {
-        label: 'ghr-microvm-memory:8192',
-        reason: "key 'memory' is not a supported MicroVM override",
+        label,
+        reason,
       },
     ]);
   });
 
   it('enforces the AWS dynamic-label policy', () => {
     const queue = microvmQueue();
     queue.matcherConfig.awsDynamicLabelsPolicy = {
-      restricted_keys: { 'maximum-duration-in-seconds': { max: 3600 } },
+      restricted_keys: { 'image-version': { allowed: ['2.*'] } },
     };
 
-    expect(getViolations(queue, ['ghr-microvm-maximum-duration-in-seconds:7200'])).toEqual([
+    expect(getViolations(queue, ['ghr-microvm-image-version:3.0'])).toEqual([
       {
-        label: 'ghr-microvm-maximum-duration-in-seconds:7200',
-        reason: "value '7200' exceeds max '3600'",
+        label: 'ghr-microvm-image-version:3.0',
+        reason: "value '3.0' not in allowed list",
       },
     ]);
   });

lambdas/libs/compute-providers/aws/microvm/webhook.test.ts

@@ -3,13 +3,20 @@ import { provider } from './webhook';
 
 defineWebhookProviderContractTests({
   provider,
-  acceptedDynamicLabels: ['ghr-microvm-maximum-duration-in-seconds:3600'],
+  acceptedDynamicLabels: ['ghr-microvm-image-version:3.0'],
+  configureQueue: (queue) => {
+    queue.matcherConfig.awsDynamicLabelsPolicy = {
+      restricted_keys: {
+        'image-version': { allowed: ['3.0'] },
+      },
+    };
+  },
   rejectingPolicies: [
     {
       name: 'blocked keys',
       apply: (queue) => {
         queue.matcherConfig.awsDynamicLabelsPolicy = {
-          blocked_keys: ['maximum-duration-in-seconds'],
+          blocked_keys: ['image-version'],
         };
       },
     },
@@ -18,7 +25,7 @@ defineWebhookProviderContractTests({
       apply: (queue) => {
         queue.matcherConfig.awsDynamicLabelsPolicy = {
           restricted_keys: {
-            'maximum-duration-in-seconds': { max: 1800 },
+            'image-version': { allowed: ['2.*'] },
           },
         };
       },

lambdas/libs/compute-providers/test/webhook-provider-contract.ts

@@ -13,17 +13,25 @@ interface RejectingPolicyCase {
 interface WebhookProviderContractOptions<TProvider extends ComputeProviderType> {
   provider: WebhookProviderModule<TProvider>;
   acceptedDynamicLabels: readonly [string, ...string[]];
+  configureQueue?(queue: RunnerMatcherConfig): void;
   rejectingPolicies: readonly [RejectingPolicyCase, ...RejectingPolicyCase[]];
 }
 
 export function defineWebhookProviderContractTests<TProvider extends ComputeProviderType>({
   provider,
   acceptedDynamicLabels,
+  configureQueue,
   rejectingPolicies,
 }: WebhookProviderContractOptions<TProvider>): void {
   const nonGhrLabels = ['self-hosted', 'linux'];
   const dynamicLabels = [...acceptedDynamicLabels];
 
+  function configuredRunnerQueue(id: string, computeProvider?: ComputeProviderType): RunnerMatcherConfig {
+    const queue = runnerQueue(id, computeProvider);
+    configureQueue?.(queue);
+    return queue;
+  }
+
   function expectProviderSelected(queue: RunnerMatcherConfig) {
     expect(selectDynamicLabelQueue([queue], nonGhrLabels, dynamicLabels)).toEqual({
       queue,
@@ -33,35 +41,35 @@ export function defineWebhookProviderContractTests<TProvider extends ComputeProv
 
   describe(`${provider.type} webhook provider contract`, () => {
     it('selects an explicitly configured provider through the production registry', () => {
-      expectProviderSelected(runnerQueue(`${provider.type}-configured`, provider.type));
+      expectProviderSelected(configuredRunnerQueue(`${provider.type}-configured`, provider.type));
     });
 
     it('skips the provider when dynamic labels are disabled', () => {
-      const queue = runnerQueue(`${provider.type}-disabled`, provider.type);
+      const queue = configuredRunnerQueue(`${provider.type}-disabled`, provider.type);
       queue.matcherConfig.enableDynamicLabels = false;
 
       expect(selectDynamicLabelQueue([queue], nonGhrLabels, dynamicLabels)).toBeUndefined();
     });
 
     for (const policy of rejectingPolicies) {
       it(`skips the provider when its ${policy.name} policy rejects the labels`, () => {
-        const queue = runnerQueue(`${provider.type}-policy-rejected`, provider.type);
+        const queue = configuredRunnerQueue(`${provider.type}-policy-rejected`, provider.type);
         policy.apply(queue);
 
         expect(selectDynamicLabelQueue([queue], nonGhrLabels, dynamicLabels)).toBeUndefined();
       });
     }
 
     it('normalizes provider configuration before registry selection', () => {
-      const queue = runnerQueue(`${provider.type}-normalized`);
+      const queue = configuredRunnerQueue(`${provider.type}-normalized`);
       (queue as unknown as { computeProvider: string }).computeProvider = ` ${provider.type.toUpperCase()} `;
 
       expectProviderSelected(queue);
     });
 
     if (provider.type === defaultComputeProvider) {
       it('selects the default provider when the queue omits provider configuration', () => {
-        expectProviderSelected(runnerQueue(`${provider.type}-default`));
+        expectProviderSelected(configuredRunnerQueue(`${provider.type}-default`));
       });
     }
   });