Skip to content
This repository was archived by the owner on Feb 11, 2025. It is now read-only.

Commit c2eef53

Browse files
authored
feat: add extended proxy support (#62)
1 parent 026a19c commit c2eef53

File tree

3 files changed

+151
-37
lines changed

3 files changed

+151
-37
lines changed

README.md

Lines changed: 83 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,16 +43,94 @@ Available Tags:
4343

4444
For the helm values see the [values.yaml](https://github.com/fullstack-devops/helm-charts/blob/main/charts/github-actions-runner/values.yaml), section `envValues`
4545

46-
| Variable | Type | Default | Description |
47-
| ----------------- | ------ | ------------------------ | -------------------------------------------------------------------- |
48-
| `GH_URL` | string | `https://github.com` | For GitHub Enterprise support |
49-
| `GH_API_ENDPOINT` | string | `https://api.github.com` | For GitHub Enterprise support eg.: `https://git.example.com/api/v3/` |
50-
| `KANIKO_ENABLED` | bool | `false` | enable builds with kaniko (works only with kaniko-sidecar) |
46+
| Variable | Type | Default | Description |
47+
| ------------------------ | ------ | ------------------------ | ------------------------------------------------------------------------- |
48+
| `GH_URL` | string | `https://github.com` | For GitHub Enterprise support |
49+
| `GH_API_ENDPOINT` | string | `https://api.github.com` | For GitHub Enterprise support eg.: `https://git.example.com/api/v3/` |
50+
| `KANIKO_ENABLED` | bool | `false` | enable builds with kaniko (works only with kaniko-sidecar) |
51+
| `PROXY_PAC` | string | - | proxy pac file url |
52+
| `PROXY_NTLM_CREDENTIALS` | string | - | (required when `PROXY_PAC` is set) credentials when connecting with proxy |
5153

5254
---
5355

56+
## Proxy Support
57+
58+
The way out ;)
59+
60+
- Getting the Software to create the Credentials: https://github.com/samuong/alpaca/releases
61+
- Creating your NTML Cerdentials `alpaca -d <windows-domain (optional)> -u <windows-user> -H`
62+
- Set the env variables `PROXY_PAC` and `PROXY_NTLM_CREDENTIALS` in your container, pod or helm-chart
63+
- If you want to use the proxy service in your github-action checkout the examples
64+
5465
## Examples
5566

67+
### Proxy in github actions
68+
69+
#### for only one step
70+
71+
```yaml
72+
name: Deploy from internet
73+
74+
on:
75+
76+
jobs:
77+
add-helm-chart:
78+
runs-on: [self-hosted, ansible] # look for default tags or your own
79+
steps:
80+
- name: Checkout code
81+
uses: actions/checkout@v3
82+
83+
- name: check helm chart
84+
env:
85+
http_proxy: http://localhost:3128
86+
https_proxy: http://localhost:3128
87+
no_proxy: "197.0.0.0/8,*.internal.net" # replace with you internal reachable adresses
88+
run: |
89+
helm repo add fs-devops https://fullstack-devops.github.io/helm-charts/
90+
helm repo add sonatype https://sonatype.github.io/helm3-charts/
91+
92+
- name: do something here
93+
94+
- name: remove check helm chart
95+
if: always()
96+
run: |
97+
helm repo remove fs-devops
98+
helm repo remove sonatype
99+
```
100+
101+
#### for whole workflow
102+
103+
```yaml
104+
name: Deploy from internet
105+
106+
on:
107+
108+
env:
109+
http_proxy: http://localhost:3128
110+
https_proxy: http://localhost:3128
111+
no_proxy: "197.0.0.0/8,*.internal.net" # replace with you internal reachable adresses
112+
113+
jobs:
114+
add-helm-chart:
115+
runs-on: [self-hosted, ansible] # look for default tags or your own
116+
steps:
117+
- name: Checkout code
118+
uses: actions/checkout@v3
119+
120+
- name: check helm chart
121+
run: |
122+
helm repo add fs-devops https://fullstack-devops.github.io/helm-charts/
123+
helm repo add sonatype https://sonatype.github.io/helm3-charts/
124+
125+
- name: do something here
126+
127+
- name: remove check helm chart
128+
if: always()
129+
run: |
130+
helm repo remove fs-devops
131+
helm repo remove sonatype
132+
```
133+
56134
### docker
57135
58136
If you are using `docker` or `podman` the options and commands are basically the same.

images/base/helper-scripts/detect-setup.sh

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
#!/bin/bash
22

33
CA_FILE="/etc/ssl/certs/ca-certificates.crt"
4-
CUSTOM_CA_FILE="/etc/ssl/certs/custom/ca-certificates.crt"
54

65
importCertOldJava () {
76
alias=$(openssl x509 -noout -subject -in "$1" | awk -F= '{print $NF}' | sed -e 's/^[ \t]*//' | sed -e 's/ /_/g')
@@ -15,9 +14,8 @@ importCertNewJava () {
1514
keytool -importcert -alias $alias -cacerts -storepass changeit -file $1 -noprompt -trustcacerts
1615
}
1716

18-
# merge custom ca file
19-
if [ -f "$CA_FILE" ]; then
20-
cat $CUSTOM_CA_FILE >> $CA_FILE
17+
if test -r $CA_FILE; then
18+
echo "[WARN] no permissions on $CA_FILE"
2119
fi
2220

2321
# yarn

images/base/helper-scripts/gh-entrypoint.sh

Lines changed: 66 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,44 @@
11
#!/bin/bash
22

3+
echo "#####################"
4+
echo "Running entrypoint.sh"
5+
echo ""
6+
37
# connection details
4-
last_char="${GH_URL: -1}"
5-
[[ $last_char == "/" ]] && GH_URL="${GH_URL::-1}"
6-
readonly _GH_URL="${GH_URL:-https://github.com}"
8+
if [ -n "$GH_URL" ]; then
9+
last_char="${GH_URL: -1}"
10+
[[ $last_char == "/" ]] && GH_URL="${GH_URL::-1}"
11+
readonly _GH_URL="$GH_URL"
12+
echo "Using custom GitHub enterprise instance: $_GH_URL"
13+
else
14+
readonly _GH_URL="https://github.com"
15+
echo "Using default GitHub instance: $_GH_URL"
16+
fi
717

8-
last_char="${GH_API_ENDPOINT: -1}"
9-
[[ $last_char == "/" ]] && GH_API_ENDPOINT="${GH_API_ENDPOINT::-1}"
10-
readonly _GH_API_ENDPOINT="${GH_API_ENDPOINT:-https://api.github.com}"
18+
if [ -n "$GH_API_ENDPOINT" ]; then
19+
last_char="${GH_API_ENDPOINT: -1}"
20+
[[ $last_char == "/" ]] && GH_API_ENDPOINT="${GH_API_ENDPOINT::-1}"
21+
readonly _GH_API_ENDPOINT="$GH_API_ENDPOINT"
22+
echo "Using custom api url: $_GH_API_ENDPOINT"
23+
else
24+
# if GH_API_ENDPOINT not specified but GH_URL
25+
if [ -n "$GH_URL" ]; then
26+
readonly _GH_API_ENDPOINT="$_GH_URL/api/v3"
27+
echo "Using custom GitHub instance with default api url: $_GH_API_ENDPOINT"
28+
else
29+
readonly _GH_API_ENDPOINT="https://api.github.com"
30+
echo "Using default GitHub instance: $_GH_API_ENDPOINT"
31+
fi
32+
fi
1133

1234
# Org/ Repo details
1335
if [ -n "$GH_ORG" ]; then
1436
readonly RUNNER_URL="${_GH_URL}/${GH_ORG}"
1537
readonly RUNNER_REG_TOKEN_URL="${_GH_API_ENDPOINT}/orgs/${GH_ORG}/actions/runners/registration-token"
16-
elif [ -n "$GH_ORG" ] && [ -n "$GH_REPO" ]; then
38+
elif [ -n "$GH_ORG" ] && [ -n "$GH_REPO" ]; then
1739
readonly RUNNER_URL="${_GH_URL}/${GH_ORG}/${GH_REPO}"
1840
readonly RUNNER_REG_TOKEN_URL="${_GH_API_ENDPOINT}/repos/${GH_ORG}/${GH_REPO}/actions/runners/registration-token"
19-
elif [ -n "$GH_ENTERPRISE" ]; then
41+
elif [ -n "$GH_ENTERPRISE" ]; then
2042
readonly RUNNER_URL="${_GH_URL}/${GH_ENTERPRISE}"
2143
readonly RUNNER_REG_TOKEN_URL="${_GH_API_ENDPOINT}/enterprises/${GH_ENTERPRISEs}/actions/runners/registration-token"
2244
else
@@ -30,7 +52,7 @@ fi
3052
# access details
3153
if [ ! -z "$RUNNER_TOKEN" ]; then
3254
readonly REG_TOKEN=$RUNNER_TOKEN
33-
elif [ ! -z $GH_ACCESS_TOKEN ]; then
55+
elif [ ! -z $GH_ACCESS_TOKEN ]; then
3456
readonly REG_TOKEN=$(curl -s -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $GH_ACCESS_TOKEN" $RUNNER_REG_TOKEN_URL | jq .token --raw-output)
3557
else
3658
echo "Please provide one of the Environment Variables:"
@@ -40,43 +62,59 @@ fi
4062

4163
if [ -z ${RUNNER_HOME} ]; then
4264
echo "Environment variable 'RUNNER_HOME' is not set"
43-
exit 1
65+
exit 255
4466
fi
4567

4668
if [ "$KANIKO_ENABLED" == "true" ]; then
4769
readonly GH_WORKDIR=$GH_KANIKO_WORKDIR
48-
echo "Build container via Kaniko: enabled"
70+
echo "Build container via Kaniko: enabled"
4971
GH_RUNNER_LABELS="${GH_RUNNER_LABELS},kaniko"
5072
else
5173
readonly GH_WORKDIR=$GH_RUNNER_WORKDIR
52-
echo "Build container via Kaniko: disabled"
74+
echo "Build container via Kaniko: disabled"
5375
fi
5476

55-
echo "Connecting runner to: $RUNNER_URL"
56-
echo "Individual Runner Name: $HOSTNAME"
57-
echo "Runner Home: $RUNNER_HOME"
77+
echo "Connecting runner to: $RUNNER_URL"
78+
echo "Individual Runner Name: $HOSTNAME"
79+
echo "Runner Home: $RUNNER_HOME"
80+
echo ""
81+
82+
# proxy support
83+
if [ -n "$PROXY_PAC" ]; then
84+
echo "Using configured Proxy PAC"
85+
if [ ! -n "$PROXY_NTLM_CREDENTIALS" ]; then
86+
echo "Please provide the Environment Variable 'PROXY_NTLM_CREDENTIALS'"
87+
exit 255
88+
fi
89+
NTLM_CREDENTIALS="$PROXY_NTLM_CREDENTIALS" alpaca -C "$PROXY_PAC" >/dev/null 2>&1 &
90+
unset PROXY_NTLM_CREDENTIALS
91+
echo $! >/tmp/proxy_pid
92+
fi
5893

59-
echo "Running setup fpr installed software..."
94+
echo ""
95+
echo "Running setup for installed software..."
6096
/helper-scripts/detect-setup.sh
6197

98+
echo "configure GitHub runner"
6299
${RUNNER_HOME}/config.sh \
63-
--name $HOSTNAME \
64-
--token $REG_TOKEN \
65-
--work $GH_WORKDIR \
66-
--url "$RUNNER_URL" \
67-
--labels $GH_RUNNER_LABELS \
68-
--unattended \
69-
--replace
70-
echo "Runner configured"
100+
--name $HOSTNAME \
101+
--token $REG_TOKEN \
102+
--work $GH_WORKDIR \
103+
--url "$RUNNER_URL" \
104+
--labels $GH_RUNNER_LABELS \
105+
--runnergroup ${GH_RUNNER_GROUP:-'default'} \
106+
--unattended \
107+
--replace
108+
echo "GitHub runner configured"
71109

72110
cleanup() {
73111
echo "Removing runner..."
74112
if [ ! -z "$RUNNER_TOKEN" ]; then
75-
readonly REG_TOKEN=$RUNNER_TOKEN
76-
elif [ ! -z $GH_ACCESS_TOKEN ]; then
77-
readonly REG_TOKEN=$(curl -s -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $GH_ACCESS_TOKEN" $RUNNER_REG_TOKEN_URL | jq .token --raw-output)
113+
readonly REG_TOKEN_RM=$RUNNER_TOKEN
114+
elif [ ! -z $GH_ACCESS_TOKEN ]; then
115+
readonly REG_TOKEN_RM=$(curl -s -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: token $GH_ACCESS_TOKEN" $RUNNER_REG_TOKEN_URL | jq .token --raw-output)
78116
fi
79-
${RUNNER_HOME}/config.sh remove --token ${REG_TOKEN}
117+
${RUNNER_HOME}/config.sh remove --token ${REG_TOKEN_RM}
80118
exit 1
81119
}
82120

0 commit comments

Comments
 (0)