{"id":523,"date":"2024-08-21T13:09:39","date_gmt":"2024-08-21T07:39:39","guid":{"rendered":"https:\/\/blogs.infosys.com\/nextgen-devops\/?p=523"},"modified":"2024-08-21T13:09:39","modified_gmt":"2024-08-21T07:39:39","slug":"amplify-devsecops-solution-on-github-actions-using-self-hosted-runners","status":"publish","type":"post","link":"https:\/\/blogs.infosys.com\/nextgen-devops\/devops\/amplify-devsecops-solution-on-github-actions-using-self-hosted-runners\/","title":{"rendered":"Amplify DevSecOps solution on GitHub Actions using self-hosted runners"},"content":{"rendered":"

Overview:<\/h4>\n

In today’s fast-paced software development landscape, time is a precious commodity. Every developer strives to streamline their CI\/CD pipeline \u2013 the automated process that builds, tests, and deploys code. GitHub Actions, a built-in automation champion within your GitHub repository, simplifies building these pipelines with runners. These runners are virtual machines that execute your CI\/CD jobs.<\/p>\n

While GitHub-hosted runners offer a convenient starting point with a standardized environment, self-hosted runners unlock further control and customization. This blog dives into the world of self-hosted runners.<\/p>\n

Empowering Organizations: Deploying self-hosted runners for a robust CI\/CD environment<\/h4>\n

Elevate your CI\/CD pipeline with self-hosted runners on GitHub Actions. Organizations can tailor the execution environments within their infrastructure, fostering superior performance and robust security for complex workflows.<\/p>\n

Organizations adopting GitHub for their CI\/CD pipelines can reap significant benefits by implementing self-hosted runners:<\/p>\n

Fine-grained configuration<\/strong>:\u00a0 Provision runners with the specific hardware and software tailored to your project’s requirements. This ensures optimal performance for your unique technology stack. Additionally, organizations can enforce mandatory compliance checks directly on the runners.<\/p>\n

Enhanced observability:<\/strong>\u00a0 Deploying self-hosted runners within your infrastructure allows superior monitoring capabilities. Gain deeper insights into the health and performance of your CI\/CD pipeline, enabling proactive identification and resolution of potential issues.<\/p>\n

Heightened security:<\/strong>\u00a0 Organizations have complete control over the security posture of their runners. Restrict internet access, specific software, and software versions, tailoring the security profile to align with your risk tolerance perfectly.<\/p>\n

Cost savings:<\/strong>\u00a0 For large-scale DevOps implementations using GitHub Actions, self-hosted runners can offer significant cost advantages compared to relying solely on GitHub-managed runners. This is especially true for organizations with excess computing resources or predictable workloads.<\/p>\n

Key considerations before adopting self-hosted runners:<\/h4>\n

Self-hosted runners offer significant benefits, but careful planning is essential. Before opting in, consider these key factors:<\/p>\n

Maintenance overhead: <\/strong>Setting up, maintaining, and scaling self-hosted runners requires more effort than GitHub-managed runners. This includes infrastructure management, software updates, and security patching.<\/p>\n

Infrastructure strategy:<\/strong>\u00a0 Self-hosted runners reside on your infrastructure, granting control but requiring a long-term infrastructure strategy.\u00a0 Excessive reliance on specific cloud service providers might make switching approaches costly or complex later.<\/p>\n

Network dependency:\u00a0<\/strong> Self-hosted runners require a reliable and consistent network connection to communicate with GitHub and other services. Resiliency planning to address potential outages is crucial.<\/p>\n

Essential security measures:<\/strong>\u00a0 While self-hosted runners offer greater control, implementing robust security practices and access controls is mandatory to safeguard your infrastructure.<\/p>\n

Optimizing your self-hosted runner architecture<\/h4>\n

Building a robust and scalable self-hosted runner architecture requires careful consideration of several key factors:<\/p>\n

Auto-scaling:<\/strong>\u00a0 Dynamically scale your runner fleet up or down based on the number of triggered jobs in GitHub workflows. This ensures optimal resource utilization and avoids unnecessary costs.<\/p>\n

Multiple runner labels:<\/strong> \u00a0Support multiple runner labels as defined by the runs-on field in your action workflow. This allows for granular job execution by matching workloads with specific runner capabilities.<\/p>\n

Containerized runners:\u00a0<\/strong> Consider running your runners in a containerized environment for improved portability, isolation, and security.<\/p>\n

Reference implementation using cloud-based architecture with AWS<\/h4>\n

Here’s a breakdown of some key components to consider in AWS and their significance in implementing self-hosted runners:<\/p>\n

API Gateway:<\/strong> Handles incoming API requests, assists with authentication and authorization, and forwards them to backend services for processing.<\/p>\n

Simple queue service (SQS):<\/strong> Acts as a buffer, decoupling service components and ensuring messages aren’t missed, especially during peak loads.<\/p>\n

AWS lambda:<\/strong> Serverless functions for tasks like triggering runners based on incoming webhooks.<\/p>\n

Elastic container service (ECS):<\/strong> The central component, orchestrating containerized runner deployments. Additional supporting services like Task Definition and ECR (Elastic Container Registry) are often used.:<\/p>\n

Flow of execution: Putting It all together<\/h4>\n

Let’s take a closer look at how your self-hosted runner architecture might work in action. The following diagram showcases an automated workflow triggered by a GitHub webhook.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 When a workflow starts in GitHub, a web request is sent to API Gateway which triggers a Lambda function.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The Lambda function puts the request in a queue for asynchronous processing.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Another Lambda function monitors the queue and triggers an ECS task with the appropriate runner image based on the request. The runner then executes the workflow job.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 A separate Lambda function cleans up inactive runners periodically.<\/p>\n

Sample architecture diagram<\/h4>\n

\"\"<\/p>\n

Conclusion:<\/h4>\n

In conclusion, the choice of using self-hosted runners depends on your specific needs and infrastructure setup. For organizations equipped to manage their infrastructure, self-hosted runners offer a powerful advantage. You can unlock the power of self-hosted runners with GitHub actions to create a CI\/CD pipeline that delivers exceptional efficiency and control.<\/p>\n","protected":false},"excerpt":{"rendered":"

Overview: In today’s fast-paced software development landscape, time is a precious commodity. Every developer […]<\/p>\n","protected":false},"author":467,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[2,1,3],"tags":[],"coauthors":[22],"class_list":["post-523","post","type-post","status-publish","format-standard","hentry","category-cloud-devops","category-devops","category-devsecops"],"acf":[],"_links":{"self":[{"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/posts\/523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/users\/467"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/comments?post=523"}],"version-history":[{"count":6,"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/posts\/523\/revisions"}],"predecessor-version":[{"id":532,"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/posts\/523\/revisions\/532"}],"wp:attachment":[{"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/media?parent=523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/categories?post=523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/tags?post=523"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.infosys.com\/nextgen-devops\/wp-json\/wp\/v2\/coauthors?post=523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}