Skip to content

Latest commit

 

History

History
45 lines (41 loc) · 2.23 KB

README.md

File metadata and controls

45 lines (41 loc) · 2.23 KB
Raw

K8s Hooks

Description

This implementation provides a way to dynamically spin up jobs to run container workflows, rather then relying on the default docker implementation. It is meant to be used when the runner itself is running in k8s, for example when using the Actions Runner Controller

Pre-requisites

Some things are expected to be set when using these hooks

  • The runner itself should be running in a pod, with a service account with the following permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: runner-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "create", "delete"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["get", "create"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get", "list", "watch",]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "create", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "delete"]
  • The ACTIONS_RUNNER_POD_NAME env should be set to the name of the pod
  • The ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER env should be set to true to prevent the runner from running any jobs outside of a container
  • The runner pod should map a persistent volume claim into the _work directory
    • The ACTIONS_RUNNER_CLAIM_NAME env should be set to the persistent volume claim that contains the runner's working directory, otherwise it defaults to ${ACTIONS_RUNNER_POD_NAME}-work
  • Some actions runner env's are expected to be set. These are set automatically by the runner.
    • RUNNER_WORKSPACE is expected to be set to the workspace of the runner
    • GITHUB_WORKSPACE is expected to be set to the workspace of the job

Limitations

  • A job containers will be required for all jobs
  • Building container actions from a dockerfile is not supported at this time
  • Container actions will not have access to the services network or job container network
  • Docker create options are not supported