Awesome
github-actions-runner-operator
K8s operator for scheduling GitHub Actions runner pods. self-hosted-runners are a way to host your own runners and customize the environment used to run jobs in your GitHub Actions workflows.
This operator helps you scale and schedule runners on-demand in a declarative way.
Configuration
Authentication modes
The operator communicates with GitHub in order to determine available jobs and execute workflow on runners. Authentication to GitHub is available using the following modes:
- As a GitHub app.
This is the preferred mode as it provides enhanced security and increased API quota, and avoids exposure of tokens to runner pods.
Follow the guide for creating GitHub applications. There is no need to define a callback url or webhook secret as they are not used by this integration.
Depending on whether the GitHub application will operate at a repository or organization level, the following permissions must be set:
- Repository level
- Actions - Read/Write
- Administration - Read/Write
- Organization level
- Self Hosted Runners - Read/Write
Once the GitHub application has been created, obtain the integration ID and download the private key.
A Github application can only be used by injecting environment variables into the Operator deployment. It is recommended that credentials be stored as Kubernetes secrets and then injected into the operator deployment.
Create a secret called github-runner-app
by executing the following command in the namespace containing the operator:
kubectl create secret generic github-runner-app --from-literal=GITHUB_APP_INTEGRATION_ID=<app_id> --from-file=GITHUB_APP_PRIVATE_KEY=<private_key>
Finally define the following on the operator deployment:
envFrom:
- secretRef:
name: github-runner-app
Create a Personal Access token with rights at a repository or organization level.
This PAT can be defined at the operator level or within the custom resource (A PAT defined at the CR level will take precedence)
To make use of a PAT that is declared at a CR level, first create a secret called actions-runner
kubectl create secret generic actions-runner --from-literal=GH_TOKEN=<token>
Define the tokenRef
field on the GithubActionRunner
custom resource as shown below:
apiVersion: garo.tietoevry.com/v1alpha1
kind: GithubActionRunner
metadata:
name: runner-pool
spec:
tokenRef:
key: GH_TOKEN
name: actions-runner
Runner Scope
Runners can be registered either against an individual repository or at an organizational level. The following fields are available on the GithubActionRunner
custom resource to specify the repository and/or organization to monitor actions:
organization
- GitHub user or Organizationrepository
- (Optional) GitHub repository
apiVersion: garo.tietoevry.com/v1alpha1
kind: GithubActionRunner
metadata:
name: runner-pool
spec:
# the github org, required
organization: yourOrg
# the githb repository
repository: myrepo
Runner Selection
Arguably the most important field of the GithubActionRunner
custom resource is the podTemplateSpec
field as it allow you to define the runner that will be managed by the operator. You have the flexibility to define all of the properties that will be needed by the runner including the image, resources and environment variables. During normal operation, the operator will create a token that can be used in your runner to communicate with GitHub. This token is created in a secret called <CR_NAME>-regtoken
in the RUNNER_TOKEN
key. You should inject this secret into your runner using an environment variable or volume mount.
Installation Methods
The following options are available to install the operator:
Helm Chart
A Helm chart is available from this Helm repository.
Use the following steps to create a namespace and install the operator into the namespace using a Helm chart
helm repo add evryfs-oss https://evryfs.github.io/helm-charts/
kubectl create namespace github-actions-runner-operator
helm install github-actions-runner-operator evryfs-oss/github-actions-runner-operator --namespace github-actions-runner-operator
Manual
Execute the following commands to deploy the operator using manifests available within this repository.
Note: The Kustomize tool is required
- Install the CRD's
make install
- Deploy the Operator
make deploy
OperatorHub
Coming Soon
Examples
A sample of the GithubActionRunner
custom resource is found here
development
Operator is based on Operator SDK / Kube builder and written in Go.