github-actions-runner-operator

K8s operator for scheduling GitHub Actions runner pods. self-hosted-runners are a way to host your own runners and customize the environment used to run jobs in your GitHub Actions workflows.

This operator helps you scale and schedule runners on-demand in a declarative way.

Configuration

Authentication modes

The operator communicates with GitHub in order to determine available jobs and execute workflow on runners. Authentication to GitHub is available using the following modes:

As a GitHub app.

This is the preferred mode as it provides enhanced security and increased API quota, and avoids exposure of tokens to runner pods.

Follow the guide for creating GitHub applications. There is no need to define a callback url or webhook secret as they are not used by this integration.

Depending on whether the GitHub application will operate at a repository or organization level, the following permissions must be set:

Repository level
- Actions - Read/Write
- Administration - Read/Write
Organization level
- Self Hosted Runners - Read/Write

Once the GitHub application has been created, obtain the integration ID and download the private key.

A Github application can only be used by injecting environment variables into the Operator deployment. It is recommended that credentials be stored as Kubernetes secrets and then injected into the operator deployment.

Create a secret called github-runner-app by executing the following command in the namespace containing the operator:

kubectl create secret generic github-runner-app --from-literal=GITHUB_APP_INTEGRATION_ID=<app_id> --from-file=GITHUB_APP_PRIVATE_KEY=<private_key>

Finally define the following on the operator deployment:

envFrom:
- secretRef:
    name: github-runner-app

Using Personal Access Tokens (PAT)

Create a Personal Access token with rights at a repository or organization level.

This PAT can be defined at the operator level or within the custom resource (A PAT defined at the CR level will take precedence)

To make use of a PAT that is declared at a CR level, first create a secret called actions-runner

kubectl create secret generic actions-runner --from-literal=GH_TOKEN=<token>

Define the tokenRef field on the GithubActionRunner custom resource as shown below:

apiVersion: garo.tietoevry.com/v1alpha1
kind: GithubActionRunner
metadata:
  name: runner-pool
spec:
  tokenRef:
    key: GH_TOKEN
    name: actions-runner

Runner Scope

Runners can be registered either against an individual repository or at an organizational level. The following fields are available on the GithubActionRunner custom resource to specify the repository and/or organization to monitor actions:

organization - GitHub user or Organization
repository - (Optional) GitHub repository

apiVersion: garo.tietoevry.com/v1alpha1
kind: GithubActionRunner
metadata:
  name: runner-pool
spec:
  # the github org, required
  organization: yourOrg
  # the githb repository
  repository: myrepo

Runner Selection

Arguably the most important field of the GithubActionRunner custom resource is the podTemplateSpec field as it allow you to define the runner that will be managed by the operator. You have the flexibility to define all of the properties that will be needed by the runner including the image, resources and environment variables. During normal operation, the operator will create a token that can be used in your runner to communicate with GitHub. This token is created in a secret called <CR_NAME>-regtoken in the RUNNER_TOKEN key. You should inject this secret into your runner using an environment variable or volume mount.

Installation Methods

The following options are available to install the operator:

Helm Chart

A Helm chart is available from this Helm repository.

Use the following steps to create a namespace and install the operator into the namespace using a Helm chart

helm repo add evryfs-oss https://evryfs.github.io/helm-charts/
kubectl create namespace github-actions-runner-operator
helm install github-actions-runner-operator evryfs-oss/github-actions-runner-operator --namespace github-actions-runner-operator

Manual

Execute the following commands to deploy the operator using manifests available within this repository.

Note: The Kustomize tool is required

Install the CRD's

make install

Deploy the Operator

make deploy

OperatorHub

Coming Soon

Examples

A sample of the GithubActionRunner custom resource is found here

development

Operator is based on Operator SDK / Kube builder and written in Go.

sklirg/github-actions-runner-operator