diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 01ec836..0dcd28c 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -6,74 +6,7 @@ on: types: [published] # build on release jobs: - build-ubuntu: - runs-on: ubuntu-latest # use the GitHub hosted runners - permissions: - contents: write # for uploading the SBOM to the release - packages: write # for uploading the finished container - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - id-token: write # to complete the identity challenge with sigstore/fulcio when running outside of PRs - strategy: - matrix: - runner-image: [ubuntu-focal, rootless-ubuntu-focal, ubuntu-jammy] - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Set version - run: echo "VERSION=$(cat ${GITHUB_EVENT_PATH} | jq -r '.release.tag_name')" >> $GITHUB_ENV - - - name: Set short SHA - run: echo "SHA_SHORT=${GITHUB_SHA::7}" >> $GITHUB_ENV - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - - - name: Login to GitHub Container Registry - uses: docker/login-action@v2 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push the image - uses: docker/build-push-action@v4 - id: build-and-push - with: - file: "images/${{ matrix.runner-image }}.Dockerfile" - push: true - tags: | - ghcr.io/some-natalie/kubernoodles/${{ matrix.runner-image }}:latest - ghcr.io/some-natalie/kubernoodles/${{ matrix.runner-image }}:${{ env.VERSION }} - ghcr.io/some-natalie/kubernoodles/${{ matrix.runner-image }}:${{ env.VERSION }}-${{ env.SHA_SHORT }} - - - name: Run Anchore scan - uses: anchore/scan-action@v3 - id: scan - with: - image: "ghcr.io/some-natalie/kubernoodles/${{ matrix.runner-image }}:${{ env.VERSION }}" - fail-build: false - - - name: Upload Anchore scan report - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ${{ steps.scan.outputs.sarif }} - - - name: Generate SBOM for the Ubuntu-based runners - uses: anchore/sbom-action@v0 - with: - image: ghcr.io/some-natalie/kubernoodles/${{ matrix.runner-image }}:${{ env.VERSION }}-${{ env.SHA_SHORT }} - - - name: Install cosign - uses: sigstore/cosign-installer@main - - - name: Sign the published Docker image - env: - COSIGN_EXPERIMENTAL: "true" - run: cosign sign ghcr.io/some-natalie/kubernoodles/${{ matrix.runner-image }}@${{ steps.build-and-push.outputs.digest }} - - build-podman: + build-ubi8: runs-on: ubuntu-latest # use the GitHub hosted runners permissions: contents: write # for uploading the SBOM to the release @@ -95,9 +28,9 @@ jobs: id: build-image uses: redhat-actions/buildah-build@v2 with: - image: ghcr.io/some-natalie/kubernoodles/podman + image: ghcr.io/some-natalie/kubernoodles/ubi8 tags: latest ${{ env.VERSION }} ${{ env.VERSION }}-${{ env.SHA_SHORT }} - containerfiles: images/podman.Dockerfile + containerfiles: images/ubi8.Dockerfile - name: Push image uses: redhat-actions/push-to-registry@v2 @@ -113,7 +46,7 @@ jobs: uses: anchore/scan-action@v3 id: scan with: - image: "ghcr.io/some-natalie/kubernoodles/podman:${{ env.VERSION }}" + image: "ghcr.io/some-natalie/kubernoodles/ubi8:${{ env.VERSION }}" fail-build: false - name: Upload Anchore scan report @@ -124,7 +57,7 @@ jobs: - name: Generate SBOM for the Podman (Fedora 37) runner uses: anchore/sbom-action@v0 with: - image: ghcr.io/some-natalie/kubernoodles/podman:${{ env.VERSION }}-${{ env.SHA_SHORT }} + image: ghcr.io/some-natalie/kubernoodles/ubi8:${{ env.VERSION }}-${{ env.SHA_SHORT }} - name: Get image digest run: echo "IMAGE_DIGEST=$(cat digest.txt)" >> $GITHUB_ENV @@ -138,33 +71,4 @@ jobs: - name: Sign the published Docker image env: COSIGN_EXPERIMENTAL: "true" - run: cosign sign ghcr.io/some-natalie/kubernoodles/podman@${{ env.IMAGE_DIGEST }} - - deploy: - runs-on: ubuntu-latest # use the GitHub hosted runners to deploy the self-hosted runners in GHEC - # If using GHES or GHAE, use another deployment, such as having CentOS redeploy Ubuntu and vice versa - environment: production - needs: [build-podman, build-ubuntu] - strategy: - matrix: - runner-image: - [podman, ubuntu-focal, rootless-ubuntu-focal, ubuntu-jammy] - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Update deployments - run: | - kubectl delete -f deployments/${{ matrix.runner-image }}.yml - sleep 30 - kubectl apply -f deployments/${{ matrix.runner-image }}.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config + run: cosign sign ghcr.io/some-natalie/kubernoodles/ubi8@${{ env.IMAGE_DIGEST }} diff --git a/.github/workflows/test-podman.yml b/.github/workflows/test-podman.yml deleted file mode 100644 index c144199..0000000 --- a/.github/workflows/test-podman.yml +++ /dev/null @@ -1,115 +0,0 @@ -name: Test Podman (Fedora) runner - -on: - workflow_dispatch: - pull_request: - branches: - - main - paths: - - "images/podman.Dockerfile" - - "images/**.sh" - - "images/podman/*" - - "images/software/*" - - "tests/podman/*" - - "tests/sudo-fails/*" - - ".github/workflows/test-podman.yml" - -jobs: - build: - name: Build test image - runs-on: [self-hosted, podman] - permissions: - contents: read - packages: write - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Build the image - id: build-image - uses: redhat-actions/buildah-build@v2 - with: - image: ghcr.io/some-natalie/kubernoodles/podman - tags: test - containerfiles: images/podman.Dockerfile - - - name: Push image - uses: redhat-actions/push-to-registry@v2 - with: - image: ${{ steps.build-image.outputs.image }} - tags: ${{ steps.build-image.outputs.tags }} - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - deploy: - name: Deploy test image to `test-runners` namespace - runs-on: [self-hosted, podman] - needs: [build] - environment: test - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl apply -f deployments/test-podman.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config - - - name: Wait 5 minutes to let the new pod come up - run: sleep 300 - - test: - name: Run tests! - runs-on: [self-hosted, test-podman] - needs: [deploy] - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Print debug info - uses: ./tests/debug - - - name: Podman test - uses: ./tests/podman - - - name: Sudo fails - uses: ./tests/sudo-fails - - - name: Cache test - uses: ./tests/cache - - remove-deploy: - name: Delete test image deployment - runs-on: [self-hosted, podman] - needs: [test] - environment: test - if: always() - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl delete -f deployments/test-podman.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config diff --git a/.github/workflows/test-rootless-ubuntu-focal.yml b/.github/workflows/test-rootless-ubuntu-focal.yml deleted file mode 100644 index a97f82e..0000000 --- a/.github/workflows/test-rootless-ubuntu-focal.yml +++ /dev/null @@ -1,130 +0,0 @@ -name: Test rootless Ubuntu Focal runner - -on: - workflow_dispatch: - pull_request: - branches: - - main - paths: - - "images/rootless-ubuntu-focal.Dockerfile" - - "images/**.sh" - - "images/docker/*" - - "images/software/*" - - "images/supervisor/*" - - "tests/container/*" - - "tests/docker/*" - - "tests/sudo-fails/*" - - ".github/workflows/test-rootless-ubuntu-focal.yml" - -jobs: - build: - name: Build test image - runs-on: [self-hosted, rootless-focal] - permissions: - contents: read - packages: write - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Setup contexts - run: | - docker context create mycontext - docker context use mycontext - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 - with: - buildkitd-flags: --debug - driver: docker - endpoint: mycontext - - - name: Login to GitHub Packages - uses: docker/login-action@v2 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push image - uses: docker/build-push-action@v4 - with: - file: "images/rootless-ubuntu-focal.Dockerfile" - push: true - tags: ghcr.io/some-natalie/kubernoodles/rootless-ubuntu-focal:test - - deploy: - name: Deploy test image to `test-runners` namespace - runs-on: [self-hosted, rootless-focal] - needs: [build] - environment: test - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl apply -f deployments/test-rootless-ubuntu-focal.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config - - - name: Wait 5 minutes to let the new pod come up - run: sleep 300 - - test: - name: Run tests! - - runs-on: [self-hosted, test-rootless-ubuntu-focal] - needs: [deploy] - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Print debug info - uses: ./tests/debug - - - name: Docker test - uses: ./tests/docker - - - name: Sudo fails - uses: ./tests/sudo-fails - - - name: Container Action test - uses: ./tests/container - - - name: Cache test - uses: ./tests/cache - - remove-deploy: - name: Delete test image deployment - runs-on: [self-hosted, rootless-focal] - needs: [test] - environment: test - if: always() - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl delete -f deployments/test-rootless-ubuntu-focal.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config diff --git a/.github/workflows/test-ubuntu-focal.yml b/.github/workflows/test-ubuntu-focal.yml deleted file mode 100644 index c05bded..0000000 --- a/.github/workflows/test-ubuntu-focal.yml +++ /dev/null @@ -1,120 +0,0 @@ -name: Test Ubuntu Focal runner - -on: - workflow_dispatch: - pull_request: - branches: - - main - paths: - - "images/ubuntu-focal.Dockerfile" - - "images/**.sh" - - "images/docker/*" - - "images/software/*" - - "images/supervisor/*" - - "tests/container/*" - - "tests/docker/*" - - "tests/sudo-works/*" - - ".github/workflows/test-ubuntu-focal.yml" - -jobs: - build: - name: Build test image - runs-on: [self-hosted, focal] - permissions: - contents: read - packages: write - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - - - name: Login to GitHub Packages - uses: docker/login-action@v2 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push image - uses: docker/build-push-action@v4 - with: - file: "images/ubuntu-focal.Dockerfile" - push: true - tags: ghcr.io/some-natalie/kubernoodles/ubuntu-focal:test - - deploy: - name: Deploy test image to `test-runners` namespace - runs-on: [self-hosted, focal] - needs: [build] - environment: test - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl apply -f deployments/test-ubuntu-focal.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config - - - name: Wait 5 minutes to let the new pod come up - run: sleep 300 - - test: - name: Run tests! - runs-on: [self-hosted, test-ubuntu-focal] - needs: [deploy] - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Print debug info - uses: ./tests/debug - - - name: Docker test - uses: ./tests/docker - - - name: Sudo works - uses: ./tests/sudo-works - - - name: Container Action test - uses: ./tests/container - - - name: Cache test - uses: ./tests/cache - - remove-deploy: - name: Delete test image deployment - runs-on: [self-hosted, focal] - needs: [test] - environment: test - if: always() - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl delete -f deployments/test-ubuntu-focal.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config diff --git a/.github/workflows/test-ubuntu-jammy.yml b/.github/workflows/test-ubuntu-jammy.yml deleted file mode 100644 index d1c2970..0000000 --- a/.github/workflows/test-ubuntu-jammy.yml +++ /dev/null @@ -1,120 +0,0 @@ -name: Test Ubuntu Jammy runner - -on: - workflow_dispatch: - pull_request: - branches: - - main - paths: - - "images/ubuntu-jammy.Dockerfile" - - "images/**.sh" - - "images/docker/*" - - "images/software/*" - - "images/supervisor/*" - - "tests/container/*" - - "tests/docker/*" - - "tests/sudo-works/*" - - ".github/workflows/test-ubuntu-jammy.yml" - -jobs: - build: - name: Build test image - runs-on: [self-hosted, jammy] - permissions: - contents: read - packages: write - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - - - name: Login to GitHub Packages - uses: docker/login-action@v2 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push image - uses: docker/build-push-action@v4 - with: - file: "images/ubuntu-jammy.Dockerfile" - push: true - tags: ghcr.io/some-natalie/kubernoodles/ubuntu-jammy:test - - deploy: - name: Deploy test image to `test-runners` namespace - runs-on: [self-hosted, jammy] - needs: [build] - environment: test - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl apply -f deployments/test-ubuntu-jammy.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config - - - name: Wait 5 minutes to let the new pod come up - run: sleep 300 - - test: - name: Run tests! - runs-on: [self-hosted, test-ubuntu-jammy] - needs: [deploy] - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Print debug info - uses: ./tests/debug - - - name: Docker test - uses: ./tests/docker - - - name: Sudo works - uses: ./tests/sudo-works - - - name: Container Action test - uses: ./tests/container - - - name: Cache test - uses: ./tests/cache - - remove-deploy: - name: Delete test image deployment - runs-on: [self-hosted, jammy] - needs: [test] - environment: test - if: always() - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Write out the kubeconfig info - run: | - echo ${{ secrets.DEPLOY_ACCOUNT }} | base64 -d > /tmp/config - - - name: Deploy - run: | - kubectl delete -f deployments/test-ubuntu-jammy.yml - env: - KUBECONFIG: /tmp/config - - - name: Remove kubeconfig info - run: rm -f /tmp/config diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..260adba --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +# deployment files used for local testing +deployments/local-* \ No newline at end of file diff --git a/README.md b/README.md index ea13ebc..b881be1 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ Kubernoodles is a framework for managing custom self-hosted runners for GitHub Actions in Kubernetes at the enterprise-wide scale. The design goal is to easily bootstrap a system where customized self-hosted runners update, build, test, deploy, and scale themselves with minimal interaction from enterprise admins and maximum input from the developers using it. -This is an _opinionated_ reference implementation, designed to be taken and modified to your liking. I use this to test GitHub Actions on my personal account, [GitHub Enterprise Cloud](https://github.com) (SaaS), [GitHub Enterprise Server](https://docs.github.com/en/enterprise-server@latest) (self-hosted), and [GitHub AE](https://docs.github.com/en/github-ae@latest) from Docker Desktop, a Raspberry Pi cluster for `arm64`, a managed Kubernetes provider, and other random platforms as needed. Your implementation may look wildly different, etc. +This is an _opinionated_ reference implementation, designed to be taken and modified to your liking. I use this to test GitHub Actions on my personal account, [GitHub Enterprise Cloud](https://github.com) (SaaS) or [GitHub Enterprise Server](https://docs.github.com/en/enterprise-server@latest) (self-hosted) from Docker Desktop, a Raspberry Pi cluster for `arm64`, a managed Kubernetes provider, and other random platforms as needed. Your implementation may look wildly different, etc. :question: Are you a GitHub Enterprise admin that's new to GitHub Actions? Don't know how to set up self-hosted runners at scale? Start [here](docs/admin-introduction.md)! @@ -65,8 +65,7 @@ These are all excellent reads and can provide more insight into the customizatio ### Dependencies of note -- [actions-runner-controller](https://github.com/actions-runner-controller/actions-runner-controller) -- [cert-manager](https://cert-manager.io) +- [actions-runner-controller](https://github.com/actions/actions-runner-controller) - [Helm](https://helm.sh/) - [Yelp dumb-init](https://github.com/Yelp/dumb-init) - [Docker engine](https://docs.docker.com/engine/release-notes/) and [Docker Compose](https://docs.docker.com/compose/release-notes/) for Debian-based images diff --git a/_config.yml b/_config.yml deleted file mode 100644 index c741881..0000000 --- a/_config.yml +++ /dev/null @@ -1 +0,0 @@ -theme: jekyll-theme-slate \ No newline at end of file diff --git a/deployments/README.md b/deployments/README.md index 369ac4c..8e77cc8 100644 --- a/deployments/README.md +++ b/deployments/README.md @@ -1,52 +1,6 @@ # Deployments -This folder contains all the deployment files for the Kubernetes cluster. A deployment is a discrete group of runners that can have unique hardware, scaling functions, or scope (repository, organization, or enterprise wide. These are defined by [actions-runner-controller](https://github.com/actions-runner-controller/actions-runner-controller#usage) and there's more information in the linked documentation. - -## Example deployment - -Here's an example deployment file with comments: - -```yaml -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment # manage these as a "set" of runners, not individually -metadata: - name: ubuntu-focal # give it a name for humans to read - namespace: runners # specify the Kubernetes namespace these live in -spec: - replicas: 2 # I want 2 of these, please :) - template: - spec: - organization: universal-exports-ltd # attached to this organization - group: secret-agent-test # GitHub can group runners by name for management, so these are in "secret-agent-test" - env: [] # envirnoment stuff for Kubernetes can be passed here - read `actions-runner-controller` docs before using this, otherwise leave it empty! - ephemeral: true # throw out the pod and redeploy it fresh after each run - image: ghcr.io/some-natalie/kubernoodles/ubuntu-focal:latest # where is the Docker image to use as a pod - imagePullPolicy: IfNotPresent # pull this image only if it isn't already on the Kubernetes node - imagePullSecrets: - - name: ghcr # credentials needed to log in to the image registry, more on this below - dockerdWithinRunnerContainer: true # can this support Docker-in-Docker, implies `privileged: true`, more on this below - dockerMTU: 1450 # set the MTU size of the Docker agent in the container, more on this below - volumeMounts: # this uses the read only cache set up in ../cluster-configs/runner-tool-cache.yml, more on this below - - mountPath: /opt/hostedtoolcache # mount path from within the container - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: test-tool-cache-pvc # which persistent volume claim to use - resources: - limits: # the max size any individual runner can get to - cpu: "4000m" - memory: "8Gi" - requests: # the guaranteed amount of compute any individual runner gets - cpu: "200m" - memory: "200Mi" - labels: # custom labels for GitHub Actions to target, more on this below - - dependabot # special label to allow Dependabot to use this for compute, more on this below - - docker - - ubuntu - - focal -``` +This folder contains all the deployment files for the Kubernetes cluster. A deployment is a discrete group of runners that can have unique hardware, scaling functions, or scope (repository, organization, or enterprise wide. These are defined by [actions-runner-controller](https://github.com/actions/actions-runner-controller) and there's more information in the linked documentation. More details as noted: diff --git a/deployments/ghes/README.md b/deployments/ghes/README.md deleted file mode 100644 index 8a13369..0000000 --- a/deployments/ghes/README.md +++ /dev/null @@ -1,14 +0,0 @@ -# GHES runners - -There's nothing special about these runners. They deploy to a different Kubernetes cluster (the `docker-desktop` environment or the `open-shift` environment) and attach to a different organization in GHES for testing/demonstration. The [`bootstrap.sh`](bootstrap.sh) script takes a URL and token to set up test environments very quickly. - -## Local environments - -This bootstrap script has been tested and is used routinely on [Docker Desktop's local Kubernetes cluster](https://docs.docker.com/desktop/kubernetes/), [Azure Kubernetes Service](https://azure.microsoft.com/en-us/products/kubernetes-service/#overview), and [RedHat OpenShift Local](https://access.redhat.com/documentation/en-us/red_hat_openshift_local). - -For OpenShift, because these are privileged pods, you must allow this explicitly in the namespaces the pods will run in. - - ```shell - oc adm policy add-scc-to-user privileged -z default -n runners - oc adm policy add-scc-to-user privileged -z default -n test-runners - ``` diff --git a/deployments/ghes/bootstrap.sh b/deployments/ghes/bootstrap.sh deleted file mode 100755 index f4e6e4d..0000000 --- a/deployments/ghes/bootstrap.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash - -# This script is designed to use docker-desktop's cluster to GHES/GHAE real fast :) - -# Inputs -# $1: The GHES server to use (e.g. "https://github.yourcompany.com") -# $2: The GHES token to use (e.g. "ghp_123456789") - -# Remove the trailing slash from the server URL if it exists -if [[ "$1" == *"/" ]]; then - URL="${1::-1}" -else - URL="$1" -fi - -# Setup cert-manager -kubectl create namespace cert-manager -helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.10.0 --set installCRDs=true - -# Setup ARC -kubectl create namespace actions-runner-system -helm install -n actions-runner-system actions-runner-controller actions-runner-controller/actions-runner-controller --version=0.21.1 -kubectl set env deploy actions-runner-controller -c manager GITHUB_ENTERPRISE_URL="$URL" --namespace actions-runner-system -kubectl create secret generic controller-manager -n actions-runner-system --from-literal=github_token="$2" -kubectl create namespace runners -kubectl create namespace test-runners - -# Don't deploy runners automatically, edit them to test whatever is needed diff --git a/deployments/ghes/podman.yml b/deployments/ghes/podman.yml deleted file mode 100644 index 935fbd2..0000000 --- a/deployments/ghes/podman.yml +++ /dev/null @@ -1,57 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: podman - namespace: runners -spec: - replicas: 2 - template: - spec: - enterprise: github - # organization: acme - # repository: acme/testrepo - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/podman:latest # change this to the version you really want! - imagePullPolicy: IfNotPresent - # imagePullSecrets: - # - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - podman - - fedora - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: podman-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: podman - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/deployments/ghes/rootless-ubuntu-focal.yml b/deployments/ghes/rootless-ubuntu-focal.yml deleted file mode 100644 index 15b9008..0000000 --- a/deployments/ghes/rootless-ubuntu-focal.yml +++ /dev/null @@ -1,58 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: rootless-ubuntu-focal - namespace: runners -spec: - replicas: 2 - template: - spec: - enterprise: github - # organization: acme - # repository: acme/testrepo - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/rootless-ubuntu-focal:latest # change this to the version you really want! - imagePullPolicy: IfNotPresent - # imagePullSecrets: - # - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - ubuntu - - focal - - ubuntu-latest # overlaps w/ hosted runners on GHEC, can use in GHES and GHAE - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: rootless-ubuntu-focal-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: ubuntu-focal - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/deployments/ghes/ubuntu-focal.yml b/deployments/ghes/ubuntu-focal.yml deleted file mode 100644 index 25193ad..0000000 --- a/deployments/ghes/ubuntu-focal.yml +++ /dev/null @@ -1,58 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: ubuntu-focal - namespace: runners -spec: - replicas: 2 - template: - spec: - enterprise: github - # organization: acme - # repository: acme/testrepo - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/ubuntu-focal:latest # change this to the version you really want! - imagePullPolicy: IfNotPresent - # imagePullSecrets: - # - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - ubuntu - - focal - - ubuntu-latest # overlaps w/ hosted runners on GHEC, can use in GHES and GHAE - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: ubuntu-focal-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: ubuntu-focal - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/deployments/ghes/ubuntu-jammy.yml b/deployments/ghes/ubuntu-jammy.yml deleted file mode 100644 index d25b643..0000000 --- a/deployments/ghes/ubuntu-jammy.yml +++ /dev/null @@ -1,58 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: ubuntu-jammy - namespace: runners -spec: - replicas: 2 - template: - spec: - enterprise: github - # organization: acme - # repository: acme/testrepo - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/ubuntu-jammy:latest # change this to the version you really want! - imagePullPolicy: IfNotPresent - # imagePullSecrets: - # - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - ubuntu - - jammy - - ubuntu-latest # overlaps w/ hosted runners on GHEC, can use in GHES and GHAE - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: ubuntu-jammy-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: ubuntu-jammy - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/deployments/podman.yml b/deployments/podman.yml deleted file mode 100644 index 4696729..0000000 --- a/deployments/podman.yml +++ /dev/null @@ -1,66 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: podman - namespace: runners -spec: - replicas: 2 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/podman:latest # change this to the version you really want! - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: prod-tool-cache-pvc - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - podman - - fedora - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: podman-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: podman - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/deployments/rootless-ubuntu-focal.yml b/deployments/rootless-ubuntu-focal.yml deleted file mode 100644 index 7a4a55d..0000000 --- a/deployments/rootless-ubuntu-focal.yml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: rootless-ubuntu-focal - namespace: runners -spec: - replicas: 2 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/rootless-ubuntu-focal:latest # change this to the version you really want! - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: prod-tool-cache-pvc - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - rootless-ubuntu - - rootless-focal - # - ubuntu-latest # overlaps w/ hosted runners on GHEC, can use in GHES and GHAE - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: rootless-ubuntu-focal-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: rootless-ubuntu-focal - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/deployments/test-podman.yml b/deployments/test-podman.yml deleted file mode 100644 index 3d0e512..0000000 --- a/deployments/test-podman.yml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: test-podman - namespace: test-runners -spec: - replicas: 1 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/podman:test - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: test-tool-cache-pvc - resources: - limits: - cpu: "1000m" - memory: "2Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - test-podman - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true diff --git a/deployments/test-rootless-ubuntu-focal.yml b/deployments/test-rootless-ubuntu-focal.yml deleted file mode 100644 index a514539..0000000 --- a/deployments/test-rootless-ubuntu-focal.yml +++ /dev/null @@ -1,48 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: test-rootless-ubuntu-focal - namespace: test-runners -spec: - replicas: 1 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/rootless-ubuntu-focal:test - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: test-tool-cache-pvc - resources: - limits: - cpu: "1000m" - memory: "2Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - test-rootless-ubuntu-focal - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true - fsGroup: 1000 - fsGroupChangePolicy: "Always" diff --git a/deployments/test-ubuntu-focal.yml b/deployments/test-ubuntu-focal.yml deleted file mode 100644 index 142d284..0000000 --- a/deployments/test-ubuntu-focal.yml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: test-ubuntu-focal - namespace: test-runners -spec: - replicas: 1 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/ubuntu-focal:test - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: test-tool-cache-pvc - resources: - limits: - cpu: "1000m" - memory: "2Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - test-ubuntu-focal - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true diff --git a/deployments/test-ubuntu-jammy.yml b/deployments/test-ubuntu-jammy.yml deleted file mode 100644 index 5e96a69..0000000 --- a/deployments/test-ubuntu-jammy.yml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: test-ubuntu-jammy - namespace: test-runners -spec: - replicas: 1 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/ubuntu-jammy:test - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: test-tool-cache-pvc - resources: - limits: - cpu: "1000m" - memory: "2Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - test-ubuntu-jammy - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true diff --git a/deployments/ubuntu-focal.yml b/deployments/ubuntu-focal.yml deleted file mode 100644 index cbacef1..0000000 --- a/deployments/ubuntu-focal.yml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: ubuntu-focal - namespace: runners -spec: - replicas: 2 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/ubuntu-focal:latest # change this to the version you really want! - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: prod-tool-cache-pvc - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - ubuntu - - focal - # - ubuntu-latest # overlaps w/ hosted runners on GHEC, can use in GHES and GHAE - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: ubuntu-focal-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: ubuntu-focal - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/deployments/ubuntu-jammy.yml b/deployments/ubuntu-jammy.yml deleted file mode 100644 index ffa8ea3..0000000 --- a/deployments/ubuntu-jammy.yml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: actions.summerwind.dev/v1alpha1 -kind: RunnerDeployment -metadata: - name: ubuntu-jammy - namespace: runners -spec: - replicas: 2 - template: - spec: - repository: some-natalie/kubernoodles - env: - - name: DISABLE_RUNNER_UPDATE # Disables automatic runner updates - value: "true" - ephemeral: true - image: ghcr.io/some-natalie/kubernoodles/ubuntu-jammy:latest # change this to the version you really want! - imagePullPolicy: Always - imagePullSecrets: - - name: ghcr - dockerdWithinRunnerContainer: true - dockerMTU: 1450 - volumeMounts: - - mountPath: /opt/statictoolcache - name: runnertoolcache - readOnly: true - volumes: - - name: runnertoolcache - persistentVolumeClaim: - claimName: prod-tool-cache-pvc - resources: - limits: - cpu: "4000m" - memory: "8Gi" - requests: - cpu: "200m" - memory: "200Mi" - labels: - - docker - - ubuntu - - jammy - # - ubuntu-latest # overlaps w/ hosted runners on GHEC, can use in GHES and GHAE - containers: - - name: runner - securityContext: - privileged: true # making this explicit, as it's implied by `dockerdWithinRunnerContainer` - securityContext: - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - runAsNonRoot: true ---- -apiVersion: actions.summerwind.dev/v1alpha1 -kind: HorizontalRunnerAutoscaler -metadata: - name: ubuntu-jammy-autoscaling - namespace: runners -spec: - scaleTargetRef: - name: ubuntu-jammy - minReplicas: 2 - maxReplicas: 6 - scaleDownDelaySecondsAfterScaleOut: 60 - metrics: - - type: PercentageRunnersBusy - scaleUpThreshold: "0.75" - scaleDownThreshold: "0.3" - scaleUpFactor: "1.5" - scaleDownFactor: "0.7" diff --git a/images/docker/daemon.json b/images/docker/daemon.json deleted file mode 100644 index fccfbf1..0000000 --- a/images/docker/daemon.json +++ /dev/null @@ -1,3 +0,0 @@ -{ - "mtu": 1400 -} diff --git a/images/entrypoint.sh b/images/entrypoint.sh deleted file mode 100755 index c20d3c0..0000000 --- a/images/entrypoint.sh +++ /dev/null @@ -1,185 +0,0 @@ -#!/bin/bash -if [ -e "/.env" ]; then - echo "Adding custom environment variables" 1>&2 - source /.env -fi - -RUNNER_ASSETS_DIR=${RUNNER_ASSETS_DIR:-/runnertmp} -RUNNER_HOME=${RUNNER_HOME:-/runner} - -LIGHTGREEN="\e[0;32m" -LIGHTRED="\e[0;31m" -WHITE="\e[0;97m" -RESET="\e[0m" - -log(){ - printf "%s %s %s\n" "$WHITE" "${@}" "$RESET" 1>&2 -} - -success(){ - printf "%s %s %s\n" "$LIGHTGREEN" "${@}" "$RESET" 1>&2 -} - -error(){ - printf "%s %s %s\n" "$LIGHTRED" "${@}" "$RESET" 1>&2 -} - -if [ -n "${STARTUP_DELAY_IN_SECONDS}" ]; then - log "Delaying startup by ${STARTUP_DELAY_IN_SECONDS} seconds" - sleep "${STARTUP_DELAY_IN_SECONDS}" -fi - -if [[ "${DISABLE_WAIT_FOR_DOCKER}" != "true" ]] && [[ "${DOCKER_ENABLED}" == "true" ]]; then - log "Docker enabled runner detected and Docker daemon wait is enabled" - log "Waiting until Docker is avaliable or the timeout is reached" - timeout 120s bash -c 'until docker ps ;do sleep 1; done' -else - log "Docker wait check skipped. Either Docker is disabled or the wait is disabled, continuing with entrypoint" -fi - -if [ -z "${GITHUB_URL}" ]; then - log "Working with public GitHub" - GITHUB_URL="https://github.com/" -else - length=${#GITHUB_URL} - last_char=${GITHUB_URL:length-1:1} - - [[ $last_char != "/" ]] && GITHUB_URL="$GITHUB_URL/"; : - log "Github endpoint URL ${GITHUB_URL}" -fi - -if [ -z "${RUNNER_NAME}" ]; then - error "RUNNER_NAME must be set" - exit 1 -fi - -if [ -n "${RUNNER_ORG}" ] && [ -n "${RUNNER_REPO}" ] && [ -n "${RUNNER_ENTERPRISE}" ]; then - ATTACH="${RUNNER_ORG}/${RUNNER_REPO}" -elif [ -n "${RUNNER_ORG}" ]; then - ATTACH="${RUNNER_ORG}" -elif [ -n "${RUNNER_REPO}" ]; then - ATTACH="${RUNNER_REPO}" -elif [ -n "${RUNNER_ENTERPRISE}" ]; then - ATTACH="enterprises/${RUNNER_ENTERPRISE}" -else - error "At least one of RUNNER_ORG or RUNNER_REPO or RUNNER_ENTERPRISE must be set" - exit 1 -fi - -if [ -z "${RUNNER_TOKEN}" ]; then - error "RUNNER_TOKEN must be set" - exit 1 -fi - -if [ -z "${RUNNER_REPO}" ] && [ -n "${RUNNER_GROUP}" ];then - RUNNER_GROUPS=${RUNNER_GROUP} -fi - -# Hack due to https://github.com/actions-runner-controller/actions-runner-controller/issues/252#issuecomment-758338483 -if [ ! -d "${RUNNER_HOME}" ]; then - error "${RUNNER_HOME} should be an emptyDir mount. Please fix the pod spec." - exit 1 -fi - -# if this is not a testing environment -if [[ "${UNITTEST:-}" == '' ]]; then - sudo chown -R runner:docker "$RUNNER_HOME" - # enable dotglob so we can copy a ".env" file to load in env vars as part of the service startup if one is provided - # loading a .env from the root of the service is part of the actions/runner logic - shopt -s dotglob - # use cp instead of mv to avoid issues when src and dst are on different devices - cp -r "$RUNNER_ASSETS_DIR"/* "$RUNNER_HOME"/ - shopt -u dotglob -fi - -cd "${RUNNER_HOME}" || exit 2 -# past that point, it's all relative pathes from /runner - -config_args=() -if [ "${RUNNER_FEATURE_FLAG_EPHEMERAL:-}" == "true" ] && [ "${RUNNER_EPHEMERAL}" == "true" ]; then - config_args+=(--ephemeral) - echo "Passing --ephemeral to config.sh to enable the ephemeral runner." -fi -if [ "${DISABLE_RUNNER_UPDATE:-}" == "true" ]; then - config_args+=(--disableupdate) - echo "Passing --disableupdate to config.sh to disable automatic runner updates." -fi - -retries_left=10 -while [[ ${retries_left} -gt 0 ]]; do - log "Configuring the runner." - ./config.sh --unattended --replace \ - --name "${RUNNER_NAME}" \ - --url "${GITHUB_URL}${ATTACH}" \ - --token "${RUNNER_TOKEN}" \ - --runnergroup "${RUNNER_GROUPS}" \ - --labels "${RUNNER_LABELS}" \ - --work "${RUNNER_WORKDIR}" "${config_args[@]}" - - if [ -f .runner ]; then - success "Runner successfully configured." - break - fi - - error "Configuration failed. Retrying" - retries_left=$((retries_left - 1)) - sleep 1 -done - -if [ ! -f .runner ]; then - # we couldn't configure and register the runner; no point continuing - error "Configuration failed!" - exit 2 -fi - -cat .runner -# Note: the `.runner` file's content should be something like the below: -# -# $ cat /runner/.runner -# { -# "agentId": 117, #=> corresponds to the ID of the runner -# "agentName": "THE_RUNNER_POD_NAME", -# "poolId": 1, -# "poolName": "Default", -# "serverUrl": "https://pipelines.actions.githubusercontent.com/SOME_RANDOM_ID", -# "gitHubUrl": "https://github.com/USER/REPO", -# "workFolder": "/some/work/dir" #=> corresponds to Runner.Spec.WorkDir -# } -# -# Especially `agentId` is important, as other than listing all the runners in the repo, -# this is the only change we could get the exact runnner ID which can be useful for further -# GitHub API call like the below. Note that 171 is the agentId seen above. -# curl \ -# -H "Accept: application/vnd.github.v3+json" \ -# -H "Authorization: bearer ${GITHUB_TOKEN}" -# https://api.github.com/repos/USER/REPO/actions/runners/171 - -if [ -z "${UNITTEST:-}" ]; then - mkdir -p ./externals - # Hack due to the DinD volumes - mv ./externalstmp/* ./externals/ -fi - -args=() -if [ "${RUNNER_FEATURE_FLAG_EPHEMERAL:-}" != "true" ] && [ "${RUNNER_EPHEMERAL}" == "true" ]; then - args+=(--once) - echo "[WARNING] Passing --once is deprecated and will be removed as an option from the image and ARC at the release of 0.24.0." - echo "[WARNING] Upgrade to GHES => 3.3 to continue using actions-runner-controller. If you are using github.com ignore this warning." -fi - -# Unset entrypoint environment variables so they don't leak into the runner environment -unset RUNNER_NAME RUNNER_REPO RUNNER_TOKEN STARTUP_DELAY_IN_SECONDS DISABLE_WAIT_FOR_DOCKER - -# Docker ignores PAM and thus never loads the system environment variables that -# are meant to be set in every environment of every user. We emulate the PAM -# behavior by reading the environment variables without interpreting them. -# -# https://github.com/actions-runner-controller/actions-runner-controller/issues/1135 -# https://github.com/actions/runner/issues/1703 - -# /etc/environment may not exist when running unit tests depending on the platform being used -# (e.g. Mac OS) so we just skip the mapping entirely -if [ -z "${UNITTEST:-}" ]; then - mapfile -t env /home/${USERNAME}/.config/containers/storage.conf && \ - chown -Rv ${USERNAME} /home/${USERNAME}/.config/ - -RUN chmod +x /usr/local/bin/entrypoint.sh \ - && chmod +x /usr/local/bin/podman-startup.sh \ - && sed -i 's|\[machine\]|\#\[machine\]|g' /usr/share/containers/containers.conf \ - && mkdir -p /github/home \ - && mkdir /github/workflow \ - && mkdir /github/file_commands \ - && mkdir /github/workspace \ - && chown -R podman:podman /github - -USER $UID - -CMD [ "podman-startup.sh"] \ No newline at end of file diff --git a/images/podman/11-tcp-mtu-probing.conf b/images/podman/11-tcp-mtu-probing.conf deleted file mode 100644 index c34569d..0000000 --- a/images/podman/11-tcp-mtu-probing.conf +++ /dev/null @@ -1,3 +0,0 @@ -# Turn on MTU probing to avoid network hangs when the Docker MTU is larger than -# the host or upstream network MTU. -net.ipv4.tcp_mtu_probing=1 \ No newline at end of file diff --git a/images/podman/containers.conf b/images/podman/containers.conf deleted file mode 100644 index 0bf45cd..0000000 --- a/images/podman/containers.conf +++ /dev/null @@ -1,2 +0,0 @@ -[engine] -cgroup_manager = "cgroupfs" diff --git a/images/podman/registries.conf b/images/podman/registries.conf deleted file mode 100644 index 9d3bf99..0000000 --- a/images/podman/registries.conf +++ /dev/null @@ -1,79 +0,0 @@ -# For more information on this configuration file, see containers-registries.conf(5). -# -# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES -# We recommend always using fully qualified image names including the registry -# server (full dns name), namespace, image name, and tag -# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e., -# quay.io/repository/name@digest) further eliminates the ambiguity of tags. -# When using short names, there is always an inherent risk that the image being -# pulled could be spoofed. For example, a user wants to pull an image named -# `foobar` from a registry and expects it to come from myregistry.com. If -# myregistry.com is not first in the search list, an attacker could place a -# different `foobar` image at a registry earlier in the search list. The user -# would accidentally pull and run the attacker's image and code rather than the -# intended content. We recommend only adding registries which are completely -# trusted (i.e., registries which don't allow unknown or anonymous users to -# create accounts with arbitrary names). This will prevent an image from being -# spoofed, squatted or otherwise made insecure. If it is necessary to use one -# of these registries, it should be added at the end of the list. -# -# # An array of host[:port] registries to try when pulling an unqualified image, in order. -unqualified-search-registries = ["localhost", "registry.fedoraproject.org", "registry.access.redhat.com", "docker.io", "quay.io"] -# -# [[registry]] -# # The "prefix" field is used to choose the relevant [[registry]] TOML table; -# # (only) the TOML table with the longest match for the input image name -# # (taking into account namespace/repo/tag/digest separators) is used. -# # -# # The prefix can also be of the form: *.example.com for wildcard subdomain -# # matching. -# # -# # If the prefix field is missing, it defaults to be the same as the "location" field. -# prefix = "example.com/foo" -# -# # If true, unencrypted HTTP as well as TLS connections with untrusted -# # certificates are allowed. -# insecure = false -# -# # If true, pulling images with matching names is forbidden. -# blocked = false -# -# # The physical location of the "prefix"-rooted namespace. -# # -# # By default, this is equal to "prefix" (in which case "prefix" can be omitted -# # and the [[registry]] TOML table can only specify "location"). -# # -# # Example: Given -# # prefix = "example.com/foo" -# # location = "internal-registry-for-example.net/bar" -# # requests for the image example.com/foo/myimage:latest will actually work with the -# # internal-registry-for-example.net/bar/myimage:latest image. -# -# # The location can be empty iff prefix is in a -# # wildcarded format: "*.example.com". In this case, the input reference will -# # be used as-is without any rewrite. -# location = internal-registry-for-example.com/bar" -# -# # (Possibly-partial) mirrors for the "prefix"-rooted namespace. -# # -# # The mirrors are attempted in the specified order; the first one that can be -# # contacted and contains the image will be used (and if none of the mirrors contains the image, -# # the primary location specified by the "registry.location" field, or using the unmodified -# # user-specified reference, is tried last). -# # -# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics -# # as if specified in the [[registry]] TOML table directly: -# # - location -# # - insecure -# [[registry.mirror]] -# location = "example-mirror-0.local/mirror-for-foo" -# [[registry.mirror]] -# location = "example-mirror-1.local/mirrors/foo" -# insecure = true -# # Given the above, a pull of example.com/foo/image:latest will try: -# # 1. example-mirror-0.local/mirror-for-foo/image:latest -# # 2. example-mirror-1.local/mirrors/foo/image:latest -# # 3. internal-registry-for-example.net/bar/image:latest -# # in order, and use the first one that exists. - -short-name-mode="permissive" \ No newline at end of file diff --git a/images/rootless-startup.sh b/images/rootless-startup.sh deleted file mode 100644 index e1da411..0000000 --- a/images/rootless-startup.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -source /usr/bin/logger.sh - -log.notice "Writing out Docker config file" -/bin/bash <