feat(ibmcloud): add GitLab runner support for IBM Power (ppc64le) and IBM Z (s390x)

adrianriobo · claude · adrianriobo · commit d465c2bd64a0 · 2026-05-25T07:26:04.000Z
Extends the IBM Power (ppc64le/RHEL9) and IBM Z (s390x/Ubuntu 22.04)
provisioning to register and configure a GitLab runner on each target.

Architecture:
- GitLab 15.10+ new creation workflow: NewUserRunner API returns an auth
  token which is then used with `gitlab-runner register --token` (no
  deprecated registration tokens)
- Runner creation happens inside the Pulumi deploy() function via
  gitlab.CreateRunner(); the auth token is a pulumi.StringOutput resolved
  with ApplyT before cloud-init is rendered
- No global state: the runner args struct is copied before the ApplyT
  closure and AuthToken is set on the local copy

New arch support in pkg/integrations/gitlab:
- Added Ppc64le and S390x Arch values
- Renamed GitLabPAT → GitLabToken (accepts PAT, group/project access
  token, or service account token with create_runner scope)
- Made restorecon graceful on non-SELinux systems (Ubuntu/IBM Z)

CLI changes:
- params.GitLabRunnerArgs now takes *gitlab.Arch so fixed-arch targets
  (IBM) pass their arch directly; variable-arch targets use
  params.LinuxGitLabArch()
- Mutual exclusion check for --glrunner-project-id and --glrunner-group-id
- GitLab runner flags added to ibm-power and ibm-z create commands

Cloud-init (both IBM targets):
- Systemd drop-in redirects gitlab-runner stdout/stderr to
  /var/log/gitlab-runner/runner.log
- Logrotate config for runner.log (daily, 7 rotations, copytruncate)
- otelcol-contrib filelog/gitlab-runner receiver ships job logs to the
  OTLP endpoint when both otel and runner are configured (start_at: end)
- IBM Z cloud-config runs apt-get update before apt-get install

Error handling:
- buildUserDataInput() in ibm-z returns (pulumi.StringPtrInput, error)
  instead of silently dropping template errors

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/cmd/mapt/cmd/aws/hosts/fedora.go b/cmd/mapt/cmd/aws/hosts/fedora.go
@@ -57,7 +57,7 @@ func getFedoraCreate() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
-					GLRunnerArgs:  params.GitLabRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(params.LinuxGitLabArch()),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&fedora.FedoraArgs{
diff --git a/cmd/mapt/cmd/aws/hosts/mac.go b/cmd/mapt/cmd/aws/hosts/mac.go
@@ -48,7 +48,7 @@ func getMacRequest() *cobra.Command {
 					Debug:         viper.IsSet(params.Debug),
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
-					GLRunnerArgs:  params.GitLabRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(params.LinuxGitLabArch()),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&mac.MacRequestArgs{
diff --git a/cmd/mapt/cmd/aws/hosts/rhel.go b/cmd/mapt/cmd/aws/hosts/rhel.go
@@ -53,7 +53,7 @@ func getRHELCreate() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
-					GLRunnerArgs:  params.GitLabRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(params.LinuxGitLabArch()),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&rhel.RHELArgs{
diff --git a/cmd/mapt/cmd/aws/hosts/windows.go b/cmd/mapt/cmd/aws/hosts/windows.go
@@ -66,7 +66,7 @@ func getWindowsCreate() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
-					GLRunnerArgs:  params.GitLabRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(params.LinuxGitLabArch()),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&windows.WindowsServerArgs{
diff --git a/cmd/mapt/cmd/aws/services/mac-pool.go b/cmd/mapt/cmd/aws/services/mac-pool.go
@@ -174,7 +174,7 @@ func request() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
-					GLRunnerArgs:  params.GitLabRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(params.LinuxGitLabArch()),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&macpool.RequestMachineArgs{
diff --git a/cmd/mapt/cmd/azure/hosts/rhel.go b/cmd/mapt/cmd/azure/hosts/rhel.go
@@ -49,7 +49,7 @@ func getCreateRHEL() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
-					GLRunnerArgs:  params.GitLabRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(params.LinuxGitLabArch()),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&azureRHEL.RhelArgs{
diff --git a/cmd/mapt/cmd/azure/hosts/windows.go b/cmd/mapt/cmd/azure/hosts/windows.go
@@ -62,7 +62,7 @@ func getCreateWindowsDesktop() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
-					GLRunnerArgs:  params.GitLabRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(params.LinuxGitLabArch()),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&azureWindows.WindowsArgs{
diff --git a/cmd/mapt/cmd/ibmcloud/hosts/ibm-power.go b/cmd/mapt/cmd/ibmcloud/hosts/ibm-power.go
@@ -2,6 +2,7 @@ package hosts
 
 import (
 	"github.com/redhat-developer/mapt/cmd/mapt/cmd/params"
+	"github.com/redhat-developer/mapt/pkg/integrations/gitlab"
 	maptContext "github.com/redhat-developer/mapt/pkg/manager/context"
 	ibmpower "github.com/redhat-developer/mapt/pkg/provider/ibmcloud/action/ibm-power"
 	"github.com/spf13/cobra"
@@ -52,6 +53,7 @@ func ibmPowerCreate() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(&gitlab.Ppc64le),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&ibmpower.PWArgs{
@@ -79,6 +81,7 @@ func ibmPowerCreate() *cobra.Command {
 	flagSet.StringToStringP(params.OtelExtraAttrs, "", nil, params.OtelExtraAttrsDesc)
 	params.AddGHActionsFlags(flagSet)
 	params.AddCirrusFlags(flagSet)
+	params.AddGitLabRunnerFlags(flagSet)
 	c.PersistentFlags().AddFlagSet(flagSet)
 	_ = c.MarkPersistentFlagRequired(params.PIPrivateSubnetID)
 	_ = c.MarkPersistentFlagRequired(params.WorkspaceID)
diff --git a/cmd/mapt/cmd/ibmcloud/hosts/ibm-z.go b/cmd/mapt/cmd/ibmcloud/hosts/ibm-z.go
@@ -2,6 +2,7 @@ package hosts
 
 import (
 	"github.com/redhat-developer/mapt/cmd/mapt/cmd/params"
+	"github.com/redhat-developer/mapt/pkg/integrations/gitlab"
 	maptContext "github.com/redhat-developer/mapt/pkg/manager/context"
 	ibmz "github.com/redhat-developer/mapt/pkg/provider/ibmcloud/action/ibm-z"
 	"github.com/spf13/cobra"
@@ -52,6 +53,7 @@ func ibmZCreate() *cobra.Command {
 					DebugLevel:    viper.GetUint(params.DebugLevel),
 					CirrusPWArgs:  params.CirrusPersistentWorkerArgs(),
 					GHRunnerArgs:  params.GithubRunnerArgs(),
+					GLRunnerArgs:  params.GitLabRunnerArgs(&gitlab.S390x),
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&ibmz.ZArgs{
@@ -75,6 +77,7 @@ func ibmZCreate() *cobra.Command {
 	flagSet.StringToStringP(params.OtelExtraAttrs, "", nil, params.OtelExtraAttrsDesc)
 	params.AddGHActionsFlags(flagSet)
 	params.AddCirrusFlags(flagSet)
+	params.AddGitLabRunnerFlags(flagSet)
 	c.PersistentFlags().AddFlagSet(flagSet)
 	return c
 }
diff --git a/cmd/mapt/cmd/params/params.go b/cmd/mapt/cmd/params/params.go
@@ -7,6 +7,7 @@ import (
 	cr "github.com/redhat-developer/mapt/pkg/provider/api/compute-request"
 	spotTypes "github.com/redhat-developer/mapt/pkg/provider/api/spot"
 	"github.com/redhat-developer/mapt/pkg/util"
+	"github.com/redhat-developer/mapt/pkg/util/logging"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
 )
@@ -82,7 +83,7 @@ const (
 	cirrusPWLabelsDesc string = "additional labels to use on the persistent worker (--it-cirrus-pw-labels key1=value1,key2=value2)"
 
 	glRunnerToken         string = "glrunner-token"
-	glRunnerTokenDesc     string = "GitLab Personal Access Token with api scope"
+	glRunnerTokenDesc     string = "GitLab token with create_runner scope (personal access token, group/project access token, or service account token)"
 	glRunnerProjectID     string = "glrunner-project-id"
 	glRunnerProjectIDDesc string = "GitLab project ID for project runner registration"
 	glRunnerGroupID       string = "glrunner-group-id"
@@ -271,6 +272,7 @@ func AddGitLabRunnerFlags(fs *pflag.FlagSet) {
 	fs.StringSlice(glRunnerTags, nil, glRunnerTagsDesc)
 }
 
+
 func CirrusPersistentWorkerArgs() *cirrus.PersistentWorkerArgs {
 	if viper.IsSet(cirrusPWToken) {
 		return &cirrus.PersistentWorkerArgs{
@@ -284,21 +286,29 @@ func CirrusPersistentWorkerArgs() *cirrus.PersistentWorkerArgs {
 	return nil
 }
 
-func GitLabRunnerArgs() *gitlab.GitLabRunnerArgs {
+func GitLabRunnerArgs(arch *gitlab.Arch) *gitlab.GitLabRunnerArgs {
 	if viper.IsSet(glRunnerToken) {
+		if viper.IsSet(glRunnerProjectID) && viper.IsSet(glRunnerGroupID) {
+			logging.Error("--glrunner-project-id and --glrunner-group-id are mutually exclusive; ignoring GitLab runner configuration")
+			return nil
+		}
 		return &gitlab.GitLabRunnerArgs{
-			GitLabPAT: viper.GetString(glRunnerToken),
-			ProjectID: viper.GetString(glRunnerProjectID),
-			GroupID:   viper.GetString(glRunnerGroupID),
-			URL:       viper.GetString(glRunnerURL),
-			Tags:      viper.GetStringSlice(glRunnerTags),
-			Platform:  &gitlab.Linux,
-			Arch:      linuxArchAsGitLabArch(viper.GetString(LinuxArch)),
+			GitLabToken: viper.GetString(glRunnerToken),
+			ProjectID:   viper.GetString(glRunnerProjectID),
+			GroupID:     viper.GetString(glRunnerGroupID),
+			URL:         viper.GetString(glRunnerURL),
+			Tags:        viper.GetStringSlice(glRunnerTags),
+			Platform:    &gitlab.Linux,
+			Arch:        arch,
 		}
 	}
 	return nil
 }
 
+func LinuxGitLabArch() *gitlab.Arch {
+	return linuxArchAsGitLabArch(viper.GetString(LinuxArch))
+}
+
 func linuxArchAsCirrusArch(arch string) *cirrus.Arch {
 	switch arch {
 	case "x86_64":
@@ -338,3 +348,4 @@ func MACArchAsGitLabArch(arch string) *gitlab.Arch {
 	}
 	return &gitlab.Arm64
 }
+
diff --git a/pkg/integrations/gitlab/glrunner.go b/pkg/integrations/gitlab/glrunner.go
@@ -147,7 +147,7 @@ func CreateRunner(ctx *pulumi.Context, args *GitLabRunnerArgs) (pulumi.StringOut
 
 	// Configure GitLab provider with PAT
 	provider, err := gitlab.NewProvider(ctx, "gitlab-provider", &gitlab.ProviderArgs{
-		Token:   pulumi.String(args.GitLabPAT),
+		Token:   pulumi.String(args.GitLabToken),
 		BaseUrl: pulumi.String(args.URL),
 	})
 	if err != nil {
diff --git a/pkg/integrations/gitlab/snippet-linux.sh b/pkg/integrations/gitlab/snippet-linux.sh
@@ -8,8 +8,8 @@ chmod +x /tmp/gitlab-runner
 # Move to trusted path
 sudo mv /tmp/gitlab-runner /usr/bin/gitlab-runner
 
-# Fix SELinux context
-sudo restorecon -v /usr/bin/gitlab-runner
+# Fix SELinux context (no-op on non-SELinux systems)
+sudo restorecon -v /usr/bin/gitlab-runner 2>/dev/null || true
 
 # Register runner
 sudo gitlab-runner register \
diff --git a/pkg/integrations/gitlab/types.go b/pkg/integrations/gitlab/types.go
@@ -8,13 +8,15 @@ var (
 	Linux   Platform = "linux"
 	Darwin  Platform = "darwin"
 
-	Arm64 Arch = "arm64"
-	Amd64 Arch = "amd64"
-	Arm   Arch = "arm"
+	Arm64   Arch = "arm64"
+	Amd64   Arch = "amd64"
+	Arm     Arch = "arm"
+	Ppc64le Arch = "ppc64le"
+	S390x   Arch = "s390x"
 )
 
 type GitLabRunnerArgs struct {
-	GitLabPAT string   // Personal Access Token for Pulumi GitLab provider (input)
+	GitLabToken string   // Token with create_runner scope (PAT, group/project access token, or service account token)
 	ProjectID string   // GitLab project ID for project runner registration (mutually exclusive with GroupID)
 	GroupID   string   // GitLab group ID for group runner registration (mutually exclusive with ProjectID)
 	URL       string   // GitLab instance URL (e.g., https://gitlab.com)
diff --git a/pkg/provider/ibmcloud/action/ibm-power/cloud-config b/pkg/provider/ibmcloud/action/ibm-power/cloud-config
@@ -1,6 +1,7 @@
 #cloud-config
-{{- if and .AppCode .OtelAuthToken .OtelIndex}}
+{{- if or (and .AppCode .OtelAuthToken .OtelIndex) .GitLabRunnerScript}}
 write_files:
+{{- if and .AppCode .OtelAuthToken .OtelIndex}}
   - path: /etc/otelcol-contrib/config.yaml
     permissions: '0640'
     content: |
@@ -72,6 +73,26 @@ write_files:
             index: "{{.OtelIndex}}"
             _sourceCategory: audit
             _sourceHost: ${env:HOSTNAME}
+{{- if .GitLabRunnerScript}}
+        filelog/gitlab-runner:
+          include:
+          - /var/log/gitlab-runner/runner.log
+          start_at: end
+          include_file_path: true
+          include_file_name: true
+          operators:
+          - type: move
+            id: move_to_source_name
+            from: attributes["log.file.path"]
+            to: attributes["_sourceName"]
+          - type: remove
+            id: remove_file_name
+            field: attributes["log.file.name"]
+          attributes:
+            index: "{{.OtelIndex}}"
+            _sourceCategory: gitlab-runner
+            _sourceHost: ${env:HOSTNAME}
+{{- end}}
       processors:
         filter/drop_null_bytes:
           logs:
@@ -109,7 +130,7 @@ write_files:
             level: "basic"
         pipelines:
           logs:
-            receivers: [filelog/syslog, filelog/secure, filelog/audit]
+            receivers: [filelog/syslog, filelog/secure, filelog/audit{{if .GitLabRunnerScript}}, filelog/gitlab-runner{{end}}]
             processors: [filter/drop_null_bytes, resource, batch]
             exporters: [otlphttp]
   - path: /etc/otelcol-contrib/auth_token
@@ -124,7 +145,33 @@ write_files:
       Environment="HOSTNAME=%H"
       EnvironmentFile=/etc/otelcol-contrib/auth_token
 {{- end}}
+{{- if .GitLabRunnerScript}}
+  - path: /etc/systemd/system/gitlab-runner.service.d/logging.conf
+    permissions: '0644'
+    content: |
+      [Service]
+      StandardOutput=append:/var/log/gitlab-runner/runner.log
+      StandardError=append:/var/log/gitlab-runner/runner.log
+  - path: /etc/logrotate.d/gitlab-runner
+    permissions: '0644'
+    content: |
+      /var/log/gitlab-runner/runner.log {
+          daily
+          rotate 7
+          compress
+          delaycompress
+          missingok
+          notifempty
+          copytruncate
+      }
+  - path: /opt/install-glrunner.sh
+    permissions: '0755'
+    content: |
+{{.GitLabRunnerScript}}
+{{- end}}
+{{- end}}
 runcmd:
+  - dnf install -y git podman
   - |
     IFACE=$(ip route show default | awk '/default/ {print $5; exit}')
     ip route add 10.0.0.0/8 via {{.Gateway}} dev "$IFACE" 2>/dev/null || true
@@ -147,3 +194,7 @@ runcmd:
     systemctl daemon-reload
     systemctl enable --now otelcol-contrib
 {{- end}}
+{{- if .GitLabRunnerScript}}
+  - mkdir -p /var/log/gitlab-runner
+  - bash /opt/install-glrunner.sh
+{{- end}}
diff --git a/pkg/provider/ibmcloud/action/ibm-power/ibm-power.go b/pkg/provider/ibmcloud/action/ibm-power/ibm-power.go
diff --git a/pkg/provider/ibmcloud/action/ibm-power/ibm-power_test.go b/pkg/provider/ibmcloud/action/ibm-power/ibm-power_test.go
diff --git a/pkg/provider/ibmcloud/action/ibm-z/cloud-config b/pkg/provider/ibmcloud/action/ibm-z/cloud-config
diff --git a/pkg/provider/ibmcloud/action/ibm-z/ibm-z.go b/pkg/provider/ibmcloud/action/ibm-z/ibm-z.go
diff --git a/pkg/provider/ibmcloud/action/ibm-z/ibm-z_test.go b/pkg/provider/ibmcloud/action/ibm-z/ibm-z_test.go
