GitLab Runners

Gitlab Runner is an application that works with GitLab CI/CD to execute jobs in a CI/CD pipeline¹.

When developers push code to GitLab, they can define automated tasks in a .gitlab-ci.yml file. These tasks can include running tests, compiling applications, or deploying code. GitLab Runner is the application (which can be in a container, a virtual machine, or a physical server) that executes these tasks.

tip

As ANDES, we provide the Gitlab Runners and manage the infrastructure where these CI/CD jobs run. The CoreOps team provides and maintains some runners for specific cases.

GitLab Runner Tags

GitLab Runner tags are identifiers used to control which specific runners can execute certain tasks in a CI/CD pipeline.

A runner must have all the tags defined in the job's YAML configuration to be able to execute it.

Key concepts:

Task selection logic: For a task to be picked up by a runner, the runner must possess every one of the tags listed in the tags section of the .gitlab-ci.yml file.
tip
It works as an "AND" condition, not "OR".
Purpose: Tags allow differentiating runners based on their capabilities, environments, or platforms (for example, docker, macos, windows, gpu, testing-environment, ci, cd, among others).
Untagged tasks: Runners can be configured to execute tasks that do not have tags (untagged jobs).
tip
LATAM runners are not configured to execute untagged tasks.
GitLab CI/CD tags vs. Git tags: GitLab CI/CD tags are distinct from Git tags, which are used to mark specific points in the repository history (like releases).

Types of Runners in GitLab

There are 2 types of Runners in GitLab:

Shared Runners: These are Runners available to all projects within a GitLab instance.
danger
At LATAM Airlines, it was defined that Shared Runners should not be used, so they do not have access to any organization resources.
Dedicated Runners: These are self-managed Runners available in specific projects or groups, identified with custom tags for their use.

Runners in ANDES

All are dedicated runners.
Each runner uses a specific Google Service Account (SA²).
- These service accounts allow interaction with different GCP³ resources through Workload Identity Federation (Workload Identity Federation).
- For a runner to access resources in a specific GCP project, you must assign the appropriate role to the corresponding service account in the project.
  - Roles to incorporate:
    - Base Role: iam.serviceaccounts.actAs
    - Roles to deploy:
      - Cloud Run: Cloud Run Admin (roles/run.admin)
      - Cloud Function: Cloud Functions Admin (roles/cloudfunctions.admin)
      - GKE:
        
        Kubernetes Engine Admin (roles/container.admin)
        
        Kubernetes Engine Cluster Admin (roles/container.clusterAdmin)
      - Storage:
        
        Storage Admin (roles/storage.admin)
        
        Storage Object Admin (roles/storage.objectAdmin)
  - For more information on available roles in GCP, consult the documentation on roles and permissions in GCP.
Each runner is identified with one or more tags.
- For more information on how to use tags to assign jobs to specific runners in GitLab, you can visit the official GitLab documentation.

Details of all existing runners

Available in the repository latamairlines/gitlab/config directory group_runner

There are different versions of runners available in different groups of https://gitlab.com/latamairlines/

Runners by business domain

All these runners run on Kubernetes. This version of the Runner is versatile and allows the execution of multiple jobs through pods that can run in parallel. This type of runner is compatible with most CI/CD task execution requirements at LATAM.

Here will be executed:

Tasks for compilation and artifact building
Tasks for executing database migrations
Tasks for executing scheduled processes
Container-compatible Test Tasks
Validation Tasks
Result Printing Tasks
Gate type Tasks

Below are the tags corresponding to each business unit:

Sub-Group in Gitlab	Runner Tag	GCP Service Account
latamairlines/config	`latam-0_config`	`gcp-sa-0-config@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`
latamairlines/0-ltm	`latam-0_ltm`
latamairlines/cyse	`latam-cyse`	`gcp-sa-cyse@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`
latamairlines/data	`latam-data`	`gcp-sa-data@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`
latamairlines/lyca	`latam-lyca`	`gcp-sa-lyca@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`
latamairlines/oper	`latam-oper`	`gcp-sa-oper@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`
latamairlines/paxc	`latam-paxc`	`gcp-sa-paxc@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`
latamairlines/shse	`latam-shse`	`gcp-sa-shse@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`
latamairlines/tech	`latam-tech`	`gcp-sa-tech@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`

tip

Runners with tag latam-emx-kubernetes available for the group latamairlines/oper/emx and its subgroups, are managed directly by the eMantto Platform Team.

Runners for dind⁴

In case jobs need to be executed that require the use of runners with Docker-in-Docker, the following tag must be used:

Group in Gitlab	Runner Tag	GCP Service Account
`latamairlines`	`latam-docker`	`gcp-sa-latamairlines@sp-te-cloudbees-prod-f4q0.iam.gserviceaccount.com`

important

This runner is located at the organization level and is shared by all business units.

Runners by at-core domain

These runners all contain the andes tag and are created by at-core domain in the following structure:

ci-amd64: Continuous integration tasks, on AMD64 architecture. 3 sizes are created:
- small
- medium
- large
cd: Continuous delivery tasks. Created in 1 size, but separating pre-productive and productive environments:
- preprod For deployments in all pre-productive environments.
- prod: For deployments in production.

Runner Name	Sub-Group in Gitlab	Runner Tags	GCP Service Account	Description
`andes-cd-medium-preprod`	latamairlines/andes	`andes`, `cd`, `medium`, `preprod`	`run-andes-cd-preprod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for preprod deploy in ANDES
`andes-cd-medium-prod`	latamairlines/andes	`andes`, `cd`, `medium`, `prod`	`run-andes-cd-prod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod deploy in ANDES
`andes-ci-large`	latamairlines/andes	`andes`, `ci-amd64`, `large`, `prod`	`run-andes-ci-l-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Large runner for prod integration in ANDES
`andes-ci-medium`	latamairlines/andes	`andes`, `ci-amd64`, `medium`, `prod`	`run-andes-ci-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod integration in ANDES
`andes-ci-small`	latamairlines/andes	`andes`, `ci-amd64`, `prod`, `small`	`run-andes-ci-s-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Small runner for prod integration in ANDES
`andes-components-cd-medium-preprod`	latamairlines/config/andes	`andes`, `platforms`, `medium`, `cd`, `preprod`	`run-comp-cd-preprod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for preprod deploy in ANDES components
`andes-components-cd-medium-prod`	latamairlines/config/andes	`andes`, `platforms`, `medium`, `cd`, `prod`	`run-comp-cd-prod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod deploy in ANDES components
`andes-components-ci-large`	latamairlines/config/andes	`andes`, `platforms`, `large`, `ci-amd64`	`run-comp-ci-l-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Large runner for CI in ANDES components
`andes-components-ci-medium`	latamairlines/config/andes	`andes`, `platforms`, `medium`, `ci-amd64`	`run-comp-ci-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for CI in ANDES components
`andes-components-ci-small`	latamairlines/config/andes	`andes`, `platforms`, `small`, `ci-amd64`	`run-comp-ci-s-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Small runner for CI in ANDES components
`andes-ebusiness-cd-medium-preprod`	latamairlines/paxc/ebz	`andes`, `ebusiness`, `medium`, `cd`, `preprod`	`run-ebiz-cd-preprod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for preprod deploy in ebusiness
`andes-ebusiness-cd-medium-prod`	latamairlines/paxc/ebz	`andes`, `ebusiness`, `medium`, `cd`, `prod`	`run-ebiz-cd-prod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod deploy in ebusiness
`andes-ebusiness-ci-large`	latamairlines/paxc/ebz	`andes`, `ebusiness`, `large`, `ci-amd64`	`run-ebiz-ci-l-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Large runner for CI in ebusiness
`andes-ebusiness-ci-medium`	latamairlines/paxc/ebz	`andes`, `ebusiness`, `medium`, `ci-amd64`	`run-ebiz-ci-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for CI in ebusiness
`andes-ebusiness-ci-small`	latamairlines/paxc/ebz	`andes`, `ebusiness`, `small`, `ci-amd64`	`run-ebiz-ci-s-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Small runner for CI in ebusiness
`andes-ecargo-cd-medium-preprod`	latamairlines/lyca/ecargo	`andes`, `ecargo`, `medium`, `cd`, `preprod`	`run-eca-cd-preprod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for preprod deploy in ecargo
`andes-ecargo-cd-medium-prod`	latamairlines/lyca/ecargo	`andes`, `ecargo`, `medium`, `cd`, `prod`	`run-eca-cd-prod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod deploy in ecargo
`andes-ecargo-ci-large`	latamairlines/lyca/ecargo	`andes`, `ecargo`, `large`, `ci-amd64`	`run-eca-ci-l-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Large runner for CI in ecargo
`andes-ecargo-ci-medium`	latamairlines/lyca/ecargo	`andes`, `ecargo`, `medium`, `ci-amd64`	`run-eca-ci-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for CI in ecargo
`andes-ecargo-ci-small`	latamairlines/lyca/ecargo	`andes`, `ecargo`, `small`, `ci-amd64`	`run-eca-ci-s-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Small runner for CI in ecargo
`andes-eloyalty-cd-medium-preprod`	latamairlines/lyca/eloyalty	`andes`, `eloyalty`, `medium`, `cd`, `preprod`	`run-ely-cd-preprod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for preprod deploy in eloyalty
`andes-eloyalty-cd-medium-prod`	latamairlines/lyca/eloyalty	`andes`, `eloyalty`, `medium`, `cd`, `prod`	`run-ely-cd-prod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod deploy in eloyalty
`andes-eloyalty-ci-large`	latamairlines/lyca/eloyalty	`andes`, `eloyalty`, `large`, `ci-amd64`	`run-ely-ci-l-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Large runner for CI in eloyalty
`andes-eloyalty-ci-medium`	latamairlines/lyca/eloyalty	`andes`, `eloyalty`, `medium`, `ci-amd64`	`run-ely-ci-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for CI in eloyalty
`andes-eloyalty-ci-small`	latamairlines/lyca/eloyalty	`andes`, `eloyalty`, `small`, `ci-amd64`	`run-ely-ci-s-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Small runner for CI in eloyalty
`andes-emantto-cd-medium-preprod`	latamairlines/oper/emx	`andes`, `emantto`, `medium`, `cd`, `preprod`	`run-emx-cd-preprod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for preprod deploy in emantto
`andes-emantto-cd-medium-prod`	latamairlines/oper/emx	`andes`, `emantto`, `medium`, `cd`, `prod`	`run-emx-cd-prod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod deploy in emantto
`andes-emantto-ci-large`	latamairlines/oper/emx	`andes`, `emantto`, `large`, `ci-amd64`	`run-emx-ci-l-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Large runner for CI in emantto
`andes-emantto-ci-medium`	latamairlines/oper/emx	`andes`, `emantto`, `medium`, `ci-amd64`	`run-emx-ci-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for CI in emantto
`andes-emantto-ci-small`	latamairlines/oper/emx	`andes`, `emantto`, `small`, `ci-amd64`	`run-emx-ci-s-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Small runner for CI in emantto
`andes-platforms-cd-medium-preprod`	latamairlines/tech/platforms	`andes`, `platforms`, `medium`, `cd`, `preprod`	`run-plat-cd-preprod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for preprod deploy in platforms
`andes-platforms-cd-medium-prod`	latamairlines/tech/platforms	`andes`, `platforms`, `medium`, `cd`, `prod`	`run-plat-cd-prod-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for prod deploy in platforms
`andes-platforms-ci-large`	latamairlines/tech/platforms	`andes`, `platforms`, `large`, `ci-amd64`	`run-plat-ci-l-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Large runner for CI in platforms
`andes-platforms-ci-medium`	latamairlines/tech/platforms	`andes`, `platforms`, `medium`, `ci-amd64`	`run-plat-ci-m-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Medium runner for CI in platforms
`andes-platforms-ci-small`	latamairlines/tech/platforms	`andes`, `platforms`, `small`, `ci-amd64`	`run-plat-ci-s-prod-sa@latam-platform-prod-f7eb.iam.gserviceaccount.com`	Small runner for CI in platforms

important

Currently, the available ANDES runners for CI job execution correspond to the AMD64/x86_64 architecture and must use the ci-amd64 tag. At this time, there are no available runners associated with the ci-arm64 tag. As a result, pipelines that require execution on ARM64 architecture are not currently supported by ANDES runners.

Requests related to Runners

Request a new runner?

If you need a new runner for your project or group in GitLab, you must follow these steps:

Identify the need: Clearly define why you need a new runner.
Identify characteristics: Define what specific characteristics it must have (for example, tags, resources, etc.).
Identify the sub-group: Determine in which GitLab sub-group the runner should be created.
Request the runner: Contact the ANDES team through the ANDES Bot bot in Google Chat, option 8.0 with the above information.

Implement Runners on own infrastructure?

In case it is necessary to implement independent runners, follow the same steps as above, but you only need to ask for the runner token which is delivered in a secret in Google Secret Manager. Then, you must proceed to implement the runner in your infrastructure.

To evaluate the conditions for having an independent runner structure, you must review the document on Runner Usage Policy

The pipeline task execution service must consider the following elements to operate:

Cache using a GCP storage.
Job artifacts under the same GCP storage.
Gitlab runner deployment.
Service Account assigned to the Gitlab Runner nodepools.

CI/CD (Continuous Integration/Continuous Delivery or Continuous Deployment) is a set of automated practices in software development that accelerate the delivery of new code versions to production frequently and reliably, bridging the integration of small changes with automated testing and continuous release to improve the quality and agility of the process, a key concept within DevOps. ↩
A Service Account (SA) in Google Cloud Platform (GCP). More information at https://docs.cloud.google.com/iam/docs/service-account-overview ↩
Google Cloud Platform (GCP) is a cloud service platform offered by Google that provides a wide range of services and tools for the development, deployment, and management of applications and services in the cloud. ↩
Docker-in-Docker (DinD) is a technique that allows running Docker containers inside other Docker containers, facilitating the creation of isolated development and testing environments. ↩

GitLab Runner Tags​

Types of Runners in GitLab​

Runners in ANDES​

Runners by business domain​

Runners for dind4​

Runners by at-core domain​

Requests related to Runners​

Request a new runner?​

Implement Runners on own infrastructure?​

Footnotes​