terraform-provider-stackgen

sg_remote_runner (Resource)

⚠️ Experimental — Manages a remote runner registration in the Guild.

Authentication token — The token attribute is the one-time plaintext credential returned when the runner is created. It is marked sensitive (hidden in default CLI apply output); it is stored in Terraform state and retained across refresh and attachment updates because the read API does not return it again. Changing name, description, or labels still forces replacement (new token); routine applies must not rotate the token.

Use a root output with sensitive = true, terraform show -json, or automation that reads state to pass the token to your runner process.

Install commands — After create, computed cli_start_command and helm_install_command match the Guild UI start instructions (aiden-runner CLI and Helm chart). Expose them via output blocks or consume them in CI to deploy runners in customer VPCs or clusters.

Example Usage

# When to use: Register an outbound-only aiden-runner so agents can reach
# private-network tools (kubectl, terraform, internal APIs). Create the runner
# before attaching its name/id on sg_agent.remote_runners or binding secrets.
#
# Prerequisites: provider workspace_id when org-scoping; mothership reachable from
# the runner host. Optional: sg_remote_runner_secrets for Vault env sync.
#
# Related: sg_remote_runner_secrets, sg_agent.remote_runners, sg_app (attached_apps).
# See also: examples/resources/sg_remote_runner/main.tf for a full applyable stack
# that prints cli_start_command / helm_install_command.
resource "sg_remote_runner" "edge" {
  name        = "edge-vpc-runner"
  description = "Runner for private VPC tool execution."
  labels = {
    env = "production"
  }

  attached_agents = ["infra-bot"]
  attached_apps   = ["sre"]
}

Import

Import an existing sg_remote_runner using its runner UUID:

terraform import sg_remote_runner.example '123e4567-e89b-12d3-a456-426614174000'

Schema

Required

Optional

Read-Only