Skip to content
This repository was archived by the owner on Mar 3, 2026. It is now read-only.

Commit cc877ca

Browse files
nikola-jokicCopilot
authored and
unpollito
committed
Introduce new kubernetes-novolume mode (actions#4250)
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 7fcca5f commit cc877ca

7 files changed

Lines changed: 453 additions & 44 deletions

File tree

‎charts/gha-runner-scale-set/templates/_helpers.tpl‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -377,6 +377,101 @@ volumeMounts:
377377
{{- end }}
378378
{{- end }}
379379

380+
{{- define "gha-runner-scale-set.kubernetes-novolume-mode-runner-container" -}}
381+
{{- $tlsConfig := (default (dict) .Values.githubServerTLS) }}
382+
{{- range $i, $container := .Values.template.spec.containers }}
383+
{{- if eq $container.name "runner" }}
384+
{{- $setRunnerImage := "" }}
385+
{{- range $key, $val := $container }}
386+
{{- if and (ne $key "env") (ne $key "volumeMounts") (ne $key "name") }}
387+
{{- if eq $key "image" }}
388+
{{- $setRunnerImage = $val }}
389+
{{- end }}
390+
{{ $key }}: {{ $val | toYaml | nindent 2 }}
391+
{{- end }}
392+
{{- end }}
393+
{{- $setContainerHooks := 1 }}
394+
{{- $setPodName := 1 }}
395+
{{- $setRequireJobContainer := 1 }}
396+
{{- $setActionsRunnerImage := 1 }}
397+
{{- $setNodeExtraCaCerts := 0 }}
398+
{{- $setRunnerUpdateCaCerts := 0 }}
399+
{{- if $tlsConfig.runnerMountPath }}
400+
{{- $setNodeExtraCaCerts = 1 }}
401+
{{- $setRunnerUpdateCaCerts = 1 }}
402+
{{- end }}
403+
env:
404+
{{- with $container.env }}
405+
{{- range $i, $env := . }}
406+
{{- if eq $env.name "ACTIONS_RUNNER_CONTAINER_HOOKS" }}
407+
{{- $setContainerHooks = 0 }}
408+
{{- end }}
409+
{{- if eq $env.name "ACTIONS_RUNNER_IMAGE" }}
410+
{{- $setActionsRunnerImage = 0 }}
411+
{{- end }}
412+
{{- if eq $env.name "ACTIONS_RUNNER_POD_NAME" }}
413+
{{- $setPodName = 0 }}
414+
{{- end }}
415+
{{- if eq $env.name "ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER" }}
416+
{{- $setRequireJobContainer = 0 }}
417+
{{- end }}
418+
{{- if eq $env.name "NODE_EXTRA_CA_CERTS" }}
419+
{{- $setNodeExtraCaCerts = 0 }}
420+
{{- end }}
421+
{{- if eq $env.name "RUNNER_UPDATE_CA_CERTS" }}
422+
{{- $setRunnerUpdateCaCerts = 0 }}
423+
{{- end }}
424+
- {{ $env | toYaml | nindent 4 }}
425+
{{- end }}
426+
{{- end }}
427+
{{- if $setContainerHooks }}
428+
- name: ACTIONS_RUNNER_CONTAINER_HOOKS
429+
value: /home/runner/k8s-novolume/index.js
430+
{{- end }}
431+
{{- if $setPodName }}
432+
- name: ACTIONS_RUNNER_POD_NAME
433+
valueFrom:
434+
fieldRef:
435+
fieldPath: metadata.name
436+
{{- end }}
437+
{{- if $setRequireJobContainer }}
438+
- name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
439+
value: "true"
440+
{{- end }}
441+
{{- if $setActionsRunnerImage }}
442+
- name: ACTIONS_RUNNER_IMAGE
443+
value: "{{- $setRunnerImage -}}"
444+
{{- end }}
445+
{{- if $setNodeExtraCaCerts }}
446+
- name: NODE_EXTRA_CA_CERTS
447+
value: {{ clean (print $tlsConfig.runnerMountPath "/" $tlsConfig.certificateFrom.configMapKeyRef.key) }}
448+
{{- end }}
449+
{{- if $setRunnerUpdateCaCerts }}
450+
- name: RUNNER_UPDATE_CA_CERTS
451+
value: "1"
452+
{{- end }}
453+
{{- $mountGitHubServerTLS := 0 }}
454+
{{- if $tlsConfig.runnerMountPath }}
455+
{{- $mountGitHubServerTLS = 1 }}
456+
{{- end }}
457+
volumeMounts:
458+
{{- with $container.volumeMounts }}
459+
{{- range $i, $volMount := . }}
460+
{{- if eq $volMount.name "github-server-tls-cert" }}
461+
{{- $mountGitHubServerTLS = 0 }}
462+
{{- end }}
463+
- {{ $volMount | toYaml | nindent 4 }}
464+
{{- end }}
465+
{{- end }}
466+
{{- if $mountGitHubServerTLS }}
467+
- name: github-server-tls-cert
468+
mountPath: {{ clean (print $tlsConfig.runnerMountPath "/" $tlsConfig.certificateFrom.configMapKeyRef.key) }}
469+
subPath: {{ $tlsConfig.certificateFrom.configMapKeyRef.key }}
470+
{{- end }}
471+
{{- end }}
472+
{{- end }}
473+
{{- end }}
474+
380475
{{- define "gha-runner-scale-set.default-mode-runner-containers" -}}
381476
{{- $tlsConfig := (default (dict) .Values.githubServerTLS) }}
382477
{{- range $i, $container := .Values.template.spec.containers }}

‎charts/gha-runner-scale-set/templates/autoscalingrunnerset.yaml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,12 @@ metadata:
3737
{{- end }}
3838
actions.github.com/cleanup-manager-role-binding: {{ include "gha-runner-scale-set.managerRoleBindingName" . }}
3939
actions.github.com/cleanup-manager-role-name: {{ include "gha-runner-scale-set.managerRoleName" . }}
40-
{{- if and $containerMode (eq $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
40+
{{- if and (or (eq $containerMode.type "kubernetes") (eq $containerMode.type "kubernetes-novolume")) (not .Values.template.spec.serviceAccountName) }}
4141
actions.github.com/cleanup-kubernetes-mode-role-binding-name: {{ include "gha-runner-scale-set.kubeModeRoleBindingName" . }}
4242
actions.github.com/cleanup-kubernetes-mode-role-name: {{ include "gha-runner-scale-set.kubeModeRoleName" . }}
4343
actions.github.com/cleanup-kubernetes-mode-service-account-name: {{ include "gha-runner-scale-set.kubeModeServiceAccountName" . }}
4444
{{- end }}
45-
{{- if and (ne $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
45+
{{- if and (ne $containerMode.type "kubernetes") (ne $containerMode.type "kubernetes-novolume") (not .Values.template.spec.serviceAccountName) }}
4646
actions.github.com/cleanup-no-permission-service-account-name: {{ include "gha-runner-scale-set.noPermissionServiceAccountName" . }}
4747
{{- end }}
4848

@@ -157,7 +157,7 @@ spec:
157157
restartPolicy: Never
158158
{{- end }}
159159
{{- $containerMode := .Values.containerMode }}
160-
{{- if eq $containerMode.type "kubernetes" }}
160+
{{- if or (eq $containerMode.type "kubernetes") (eq $containerMode.type "kubernetes-novolume") }}
161161
serviceAccountName: {{ default (include "gha-runner-scale-set.kubeModeServiceAccountName" .) .Values.template.spec.serviceAccountName }}
162162
{{- else }}
163163
serviceAccountName: {{ default (include "gha-runner-scale-set.noPermissionServiceAccountName" .) .Values.template.spec.serviceAccountName }}
@@ -189,11 +189,15 @@ spec:
189189
- name: runner
190190
{{- include "gha-runner-scale-set.kubernetes-mode-runner-container" . | nindent 8 }}
191191
{{- include "gha-runner-scale-set.non-runner-containers" . | nindent 6 }}
192+
{{- else if eq $containerMode.type "kubernetes-novolume" }}
193+
- name: runner
194+
{{- include "gha-runner-scale-set.kubernetes-novolume-mode-runner-container" . | nindent 8 }}
195+
{{- include "gha-runner-scale-set.non-runner-containers" . | nindent 6 }}
192196
{{- else }}
193197
{{- include "gha-runner-scale-set.default-mode-runner-containers" . | nindent 6 }}
194198
{{- end }}
195199
{{- $tlsConfig := (default (dict) .Values.githubServerTLS) }}
196-
{{- if or .Values.template.spec.volumes (eq $containerMode.type "dind") (eq $containerMode.type "kubernetes") $tlsConfig.runnerMountPath }}
200+
{{- if or .Values.template.spec.volumes (eq $containerMode.type "dind") (eq $containerMode.type "kubernetes") (eq $containerMode.type "kubernetes-novolume") $tlsConfig.runnerMountPath }}
197201
volumes:
198202
{{- if $tlsConfig.runnerMountPath }}
199203
{{- include "gha-runner-scale-set.tls-volume" $tlsConfig | nindent 6 }}

‎charts/gha-runner-scale-set/templates/kube_mode_role.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{{- $containerMode := .Values.containerMode }}
22
{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.kubernetesModeRole) }}
3-
{{- if and (eq $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
3+
{{- if and (or (eq $containerMode.type "kubernetes") (eq $containerMode.type "kubernetes-novolume")) (not .Values.template.spec.serviceAccountName) }}
44
# default permission for runner pod service account in kubernetes mode (container hook)
55
apiVersion: rbac.authorization.k8s.io/v1
66
kind: Role
@@ -38,9 +38,11 @@ rules:
3838
- apiGroups: [""]
3939
resources: ["pods/log"]
4040
verbs: ["get", "list", "watch",]
41+
{{- if ne $containerMode.type "kubernetes-novolume" }}
4142
- apiGroups: ["batch"]
4243
resources: ["jobs"]
4344
verbs: ["get", "list", "create", "delete"]
45+
{{- end }}
4446
- apiGroups: [""]
4547
resources: ["secrets"]
4648
verbs: ["get", "list", "create", "delete"]

‎charts/gha-runner-scale-set/templates/kube_mode_role_binding.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{{- $containerMode := .Values.containerMode }}
22
{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.kubernetesModeRoleBinding) }}
3-
{{- if and (eq $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
3+
{{- if and (or (eq $containerMode.type "kubernetes") (eq $containerMode.type "kubernetes-novolume")) (not .Values.template.spec.serviceAccountName) }}
44
apiVersion: rbac.authorization.k8s.io/v1
55
kind: RoleBinding
66
metadata:

‎charts/gha-runner-scale-set/templates/kube_mode_serviceaccount.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{{- $containerMode := .Values.containerMode }}
22
{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.kubernetesModeServiceAccount) }}
3-
{{- if and (eq $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
3+
{{- if and (or (eq $containerMode.type "kubernetes") (eq $containerMode.type "kubernetes-novolume")) (not .Values.template.spec.serviceAccountName) }}
44
apiVersion: v1
55
kind: ServiceAccount
66
metadata:

0 commit comments

Comments
 (0)