From 195fe61297d549d61287fef8f21a3e873909d148 Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Fri, 25 Sep 2026 23:48:31 +0100 Subject: [PATCH 1/4] feat(arc): make the controller's release name and namespace configurable github_runner_arc_controller_release_name and github_runner_arc_controller_namespace default to arc and actions-runner-controller, as before. The controller install, its anti-affinity selector, the stale-listener lookup, the heartbeat's RBAC and the namespaces the platform ensures all use them, so the role can manage a controller that an existing install created under other names instead of adding a second one. The heartbeat script reads the controller's namespace from HEARTBEAT_CONTROLLER_NAMESPACE. The role passes it only when it differs from the script's default, so an unchanged configuration leaves the heartbeat Deployment as it is. --- roles/github_runner_arc/README.md | 1 + roles/github_runner_arc/defaults/main.yml | 4 ++ .../tasks/install_controller.yml | 4 +- .../tasks/install_platform.yml | 42 +++++++++++-------- .../tasks/install_scale_set_profile.yml | 4 +- roles/github_runner_arc/tasks/validate.yml | 6 +++ .../templates/controller-values.yaml.j2 | 2 +- scripts/heartbeat.sh | 4 +- 8 files changed, 44 insertions(+), 23 deletions(-) diff --git a/roles/github_runner_arc/README.md b/roles/github_runner_arc/README.md index a170fcc..b27301b 100644 --- a/roles/github_runner_arc/README.md +++ b/roles/github_runner_arc/README.md @@ -22,6 +22,7 @@ Before touching the cluster the role then checks the secrets it is about to writ - `github_runner_arc_values_dir`: the control-node directory relative `values_file` paths are read from. - `github_runner_arc_kubeconfig_path`: the kubeconfig on the host the role runs against. Defaults to `github_runner_cluster`'s kubeconfig; empty means `KUBECONFIG` or `~/.kube/config`. - `github_runner_arc_controller_chart_version`, `github_runner_arc_scaleset_chart_version`: chart pins; unset installs the latest chart. +- `github_runner_arc_controller_release_name`, `github_runner_arc_controller_namespace`: the controller's Helm release and namespace, default `arc` in `actions-runner-controller`. The stale-listener check, the heartbeat's RBAC and the heartbeat's controller check use them too. - `github_runner_arc_controller_replicas`: above 1, the chart turns on leader election and the role adds a preferred pod anti-affinity across nodes. `github_runner_arc_controller_extra_values` is merged over the role's controller values. - `github_runner_arc_metrics_enabled` (and the `_addr`/`_endpoint` settings): Prometheus metrics for the controller and every listener; the 0.14 chart only enables them together. - `github_runner_arc_listener_probes_enabled`: readiness and liveness probes on each listener's metrics endpoint, so a listener that starts and then fails its GitHub authentication is not counted ready during a rollout. Needs metrics on. diff --git a/roles/github_runner_arc/defaults/main.yml b/roles/github_runner_arc/defaults/main.yml index 24b35bb..9ca80fc 100644 --- a/roles/github_runner_arc/defaults/main.yml +++ b/roles/github_runner_arc/defaults/main.yml @@ -12,6 +12,10 @@ github_runner_arc_kubeconfig_path: "{{ github_runner_cluster_kubeconfig_path | d # Helm chart version pins, left undefined so the tasks omit --version and Helm installs the latest chart. Set github_runner_arc_controller_chart_version and/or github_runner_arc_scaleset_chart_version (e.g. "0.14.2") to hold a chart back. +# The ARC controller's Helm release name and namespace. The stale-listener check, the heartbeat's RBAC and the heartbeat itself look for the controller here too, so a cluster whose controller was installed under other names sets both to those names rather than getting a second controller. +github_runner_arc_controller_release_name: "arc" +github_runner_arc_controller_namespace: "actions-runner-controller" + # ARC controller. Replicas above 1 turn on the chart's leader election and spread the pods across nodes with a preferred pod anti-affinity. Extra values are merged over the role's own controller values. github_runner_arc_controller_replicas: 1 github_runner_arc_controller_extra_values: {} diff --git a/roles/github_runner_arc/tasks/install_controller.yml b/roles/github_runner_arc/tasks/install_controller.yml index 62cd36d..65da77c 100644 --- a/roles/github_runner_arc/tasks/install_controller.yml +++ b/roles/github_runner_arc/tasks/install_controller.yml @@ -3,9 +3,9 @@ - name: Install/upgrade the ARC controller release kubernetes.core.helm: - name: arc + name: "{{ github_runner_arc_controller_release_name }}" chart_ref: oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller chart_version: "{{ github_runner_arc_controller_chart_version | default(omit) }}" - release_namespace: actions-runner-controller + release_namespace: "{{ github_runner_arc_controller_namespace }}" create_namespace: true values: "{{ lookup('ansible.builtin.template', 'controller-values.yaml.j2') | from_yaml | default({}, true) | combine(github_runner_arc_controller_extra_values, recursive=true) }}" diff --git a/roles/github_runner_arc/tasks/install_platform.yml b/roles/github_runner_arc/tasks/install_platform.yml index 640058d..4653b97 100644 --- a/roles/github_runner_arc/tasks/install_platform.yml +++ b/roles/github_runner_arc/tasks/install_platform.yml @@ -9,7 +9,7 @@ kind: Namespace metadata: name: "{{ item }}" - loop: "{{ [github_runner_arc_platform_namespace, 'actions-runner-controller'] + ([github_runner_arc_fleet.autoscaled.namespace] if github_runner_arc_fleet.autoscaled else []) }}" + loop: "{{ [github_runner_arc_platform_namespace, github_runner_arc_controller_namespace] + ([github_runner_arc_fleet.autoscaled.namespace] if github_runner_arc_fleet.autoscaled else []) }}" - name: "Platform: create heartbeat/autoscaler service accounts" kubernetes.core.k8s: @@ -58,7 +58,7 @@ kind: Role metadata: name: github-runner-heartbeat-controller-reader - namespace: actions-runner-controller + namespace: "{{ github_runner_arc_controller_namespace }}" rules: - apiGroups: ["apps"] resources: ["deployments"] @@ -71,7 +71,7 @@ kind: RoleBinding metadata: name: github-runner-heartbeat-controller-reader - namespace: actions-runner-controller + namespace: "{{ github_runner_arc_controller_namespace }}" subjects: - kind: ServiceAccount name: heartbeat @@ -284,20 +284,7 @@ containers: - name: heartbeat image: "{{ github_runner_arc_heartbeat_image }}" - env: - - name: HEARTBEAT_GIST_ID - value: "{{ github_runner_arc_heartbeat_gist_id }}" - - name: HEARTBEAT_WINDOW_SECONDS - value: "{{ github_runner_arc_heartbeat_window_seconds | string }}" - - name: HEARTBEAT_INTERVAL_SECONDS - value: "{{ github_runner_arc_heartbeat_interval_seconds | string }}" - - name: HEARTBEAT_STATE_NAMESPACE - value: "{{ github_runner_arc_platform_namespace }}" - - name: HEARTBEAT_GH_TOKEN - valueFrom: - secretKeyRef: - name: heartbeat-gh-token - key: token + env: "{{ github_runner_arc_heartbeat_env + github_runner_arc_heartbeat_controller_env }}" resources: requests: cpu: "50m" @@ -305,6 +292,27 @@ limits: cpu: "200m" memory: "64Mi" + vars: + github_runner_arc_heartbeat_env: + - name: HEARTBEAT_GIST_ID + value: "{{ github_runner_arc_heartbeat_gist_id }}" + - name: HEARTBEAT_WINDOW_SECONDS + value: "{{ github_runner_arc_heartbeat_window_seconds | string }}" + - name: HEARTBEAT_INTERVAL_SECONDS + value: "{{ github_runner_arc_heartbeat_interval_seconds | string }}" + - name: HEARTBEAT_STATE_NAMESPACE + value: "{{ github_runner_arc_platform_namespace }}" + - name: HEARTBEAT_GH_TOKEN + valueFrom: + secretKeyRef: + name: heartbeat-gh-token + key: token + # Where the heartbeat looks for the controller's Deployment. Passed only when it differs from scripts/heartbeat.sh's own default, so that a heartbeat Deployment installed before this setting existed is not rolled by an unchanged configuration. + github_runner_arc_heartbeat_controller_env: >- + {{ + [{'name': 'HEARTBEAT_CONTROLLER_NAMESPACE', 'value': github_runner_arc_controller_namespace}] + if github_runner_arc_controller_namespace != 'actions-runner-controller' else [] + }} - name: "Platform: install/upgrade the autoscaler Deployment" when: github_runner_arc_fleet.autoscaled is not none diff --git a/roles/github_runner_arc/tasks/install_scale_set_profile.yml b/roles/github_runner_arc/tasks/install_scale_set_profile.yml index 1f83dcf..20256ca 100644 --- a/roles/github_runner_arc/tasks/install_scale_set_profile.yml +++ b/roles/github_runner_arc/tasks/install_scale_set_profile.yml @@ -64,7 +64,7 @@ kubernetes.core.k8s_info: api_version: actions.github.com/v1alpha1 kind: AutoscalingListener - namespace: actions-runner-controller + namespace: "{{ github_runner_arc_controller_namespace }}" label_selectors: - "actions.github.com/scale-set-name={{ profile.release }}" register: github_runner_arc_listener @@ -83,7 +83,7 @@ state: absent api_version: actions.github.com/v1alpha1 kind: AutoscalingListener - namespace: actions-runner-controller + namespace: "{{ github_runner_arc_controller_namespace }}" name: "{{ github_runner_arc_listener.resources[0].metadata.name }}" when: - github_runner_arc_listener.resources | length > 0 diff --git a/roles/github_runner_arc/tasks/validate.yml b/roles/github_runner_arc/tasks/validate.yml index 67fac13..c0293e2 100644 --- a/roles/github_runner_arc/tasks/validate.yml +++ b/roles/github_runner_arc/tasks/validate.yml @@ -29,6 +29,12 @@ loop: - msg: github_runner_arc_controller_replicas must be a whole number of at least 1. failed: "{{ github_runner_arc_controller_replicas | string is not match('^[1-9][0-9]*$') }}" + - msg: github_runner_arc_controller_release_name and github_runner_arc_controller_namespace must be valid Kubernetes names (lower-case letters, digits and '-', at most 63 characters). + failed: >- + {{ + [github_runner_arc_controller_release_name, github_runner_arc_controller_namespace] + | reject('match', '^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$') | list | length > 0 + }} - msg: github_runner_arc_controller_extra_values must be a mapping. failed: "{{ github_runner_arc_controller_extra_values is not mapping }}" - msg: github_runner_arc_listener_probes_enabled needs github_runner_arc_metrics_enabled, since the probes poll the listener's metrics endpoint. diff --git a/roles/github_runner_arc/templates/controller-values.yaml.j2 b/roles/github_runner_arc/templates/controller-values.yaml.j2 index 029e28c..38614e4 100644 --- a/roles/github_runner_arc/templates/controller-values.yaml.j2 +++ b/roles/github_runner_arc/templates/controller-values.yaml.j2 @@ -11,7 +11,7 @@ affinity: labelSelector: matchLabels: app.kubernetes.io/name: gha-rs-controller - app.kubernetes.io/instance: arc + app.kubernetes.io/instance: {{ github_runner_arc_controller_release_name | to_json }} {% endif %} {% if github_runner_arc_node_label_key | length > 0 %} nodeSelector: diff --git a/scripts/heartbeat.sh b/scripts/heartbeat.sh index 1a8f2cd..904f23b 100755 --- a/scripts/heartbeat.sh +++ b/scripts/heartbeat.sh @@ -7,6 +7,7 @@ # - HEARTBEAT_GIST_ID: the secret gist id to refresh # - HEARTBEAT_STATE_NAMESPACE: namespace holding the autoscaler's own status ConfigMap (see scripts/autoscaler.sh) # - AUTOSCALER_STATUS_CONFIGMAP: name of that ConfigMap +# - HEARTBEAT_CONTROLLER_NAMESPACE: namespace of the ARC controller's Deployment, when it is not the default actions-runner-controller set -euo pipefail HEARTBEAT_GH_TOKEN="${HEARTBEAT_GH_TOKEN:?HEARTBEAT_GH_TOKEN must be set (a PAT with gist scope)}" @@ -17,6 +18,7 @@ AUTOSCALER_STATUS_CONFIGMAP="${AUTOSCALER_STATUS_CONFIGMAP:-autoscaler-status}" AUTOSCALER_STATUS_GIST_FILE="${AUTOSCALER_STATUS_GIST_FILE:-autoscaler-status.json}" # How far in the future to set the timestamp: comfortably longer than the loop interval, so a single missed/slow tick doesn't look like an outage, but short enough that a real outage is detected promptly. HEARTBEAT_WINDOW_SECONDS="${HEARTBEAT_WINDOW_SECONDS:-600}" +HEARTBEAT_CONTROLLER_NAMESPACE="${HEARTBEAT_CONTROLLER_NAMESPACE:-actions-runner-controller}" healthy=true @@ -24,7 +26,7 @@ if ! kubectl get nodes --no-headers 2>/dev/null | grep -q Ready; then healthy=false fi -if ! kubectl get deployment -n actions-runner-controller -l app.kubernetes.io/name=gha-rs-controller \ +if ! kubectl get deployment -n "$HEARTBEAT_CONTROLLER_NAMESPACE" -l app.kubernetes.io/name=gha-rs-controller \ -o jsonpath='{.items[0].status.readyReplicas}' 2>/dev/null | grep -q '^[1-9]'; then healthy=false fi From 94cef53b17f8ffd56936db3676b4bd4ccc113cfb Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Fri, 25 Sep 2026 23:49:26 +0100 Subject: [PATCH 2/4] feat(arc): use an existing image pull Secret without managing it github_runner_arc_manage_image_pull_secret separates the pull Secret from the App and heartbeat Secrets that github_runner_arc_manage_secrets covers, and follows it unless set, so existing configurations behave as before. When false, the role writes no pull Secret in any namespace, needs no registry credential, skips the image pull check, and checks before changing anything that the Secret named by github_runner_arc_image_pull_secret_name exists. This suits a pull Secret that something else mints and keeps current, such as one made from a GitHub App installation token. With github_runner_arc_manage_secrets false the role no longer resolves an installation ID either, since it only goes into the App Secret the role does not write, so an org needs no private_key in that case. --- roles/github_runner_arc/README.md | 3 ++- roles/github_runner_arc/defaults/main.yml | 7 +++++-- .../tasks/check_existing_secrets.yml | 16 ++++++++++------ roles/github_runner_arc/tasks/check_secrets.yml | 9 +++++++-- roles/github_runner_arc/tasks/install_org.yml | 4 +++- .../github_runner_arc/tasks/install_platform.yml | 2 +- .../tasks/install_scale_set_profile.yml | 2 +- roles/github_runner_arc/tasks/main.yml | 6 +++--- 8 files changed, 32 insertions(+), 17 deletions(-) diff --git a/roles/github_runner_arc/README.md b/roles/github_runner_arc/README.md index b27301b..d350a6d 100644 --- a/roles/github_runner_arc/README.md +++ b/roles/github_runner_arc/README.md @@ -28,7 +28,8 @@ Before touching the cluster the role then checks the secrets it is about to writ - `github_runner_arc_listener_probes_enabled`: readiness and liveness probes on each listener's metrics endpoint, so a listener that starts and then fails its GitHub authentication is not counted ready during a rollout. Needs metrics on. - `github_runner_arc_node_label_key`, `github_runner_arc_node_label_value`: when the key is set, the controller, listeners and runner pods are restricted to nodes carrying the label. The role labels the nodes named in `github_runner_arc_labelled_nodes`. - `github_runner_arc_ghcr_username`, `github_runner_arc_ghcr_token`, `github_runner_arc_heartbeat_gh_token`: secrets, as plain variables. -- `github_runner_arc_manage_secrets`: `false` stops the role writing the App and pull Secrets, and instead checks before any change that each namespace already holds them. +- `github_runner_arc_manage_secrets`: `false` stops the role writing the App Secrets and `heartbeat-gh-token`, and instead checks before any change that they already exist. The role then needs no `private_key` or `installation_id`. +- `github_runner_arc_manage_image_pull_secret`: `false` stops the role writing the pull Secret, so an existing one named `github_runner_arc_image_pull_secret_name` is used as it is, for example one that something else mints from a GitHub App installation token. No pull credential is needed and the pull check is skipped; the role checks the Secret exists. Follows `github_runner_arc_manage_secrets` unless set. - `github_runner_arc_image_pull_registry`, `github_runner_arc_image_pull_secret_name`, `github_runner_arc_verify_image_pull`: the pull Secret's registry and name, and whether to prove the credential before writing it. - `github_runner_arc_heartbeat_gist_id`: install the fleet-health platform from this host, refreshing this gist. `github_runner_arc_heartbeat_bootstrap_gist`, `github_runner_arc_heartbeat_gist_description` and `github_runner_arc_heartbeat_gist_consumer` control the bootstrap described above. - `github_runner_arc_autoscaler_usable_budget_gi`, `github_runner_arc_autoscaler_max_ceiling`, `github_runner_arc_autoscaler_floor`: required when a profile sets `autoscale: true` and the platform is installed. The floor must equal the autoscaled profile's `maxRunners`, which every Helm upgrade reverts to. The other `github_runner_arc_autoscaler_*` and `github_runner_arc_heartbeat_*` settings have defaults; see `defaults/main.yml`. diff --git a/roles/github_runner_arc/defaults/main.yml b/roles/github_runner_arc/defaults/main.yml index 9ca80fc..18a3151 100644 --- a/roles/github_runner_arc/defaults/main.yml +++ b/roles/github_runner_arc/defaults/main.yml @@ -37,10 +37,13 @@ github_runner_arc_labelled_nodes: [] # Secrets, as plain variables from any source Ansible reads: github_runner_arc_ghcr_username and github_runner_arc_ghcr_token (a registry pull credential for the runner and platform images) and github_runner_arc_heartbeat_gh_token (a PAT with gist scope), plus each org's private_key above. No defaults. -# false means the role does not write the App or pull Secrets itself, and instead checks before changing anything that each profile's namespace already holds -github-app and the pull secret (and that the platform namespace holds the pull secret and heartbeat-gh-token). +# false means the role does not write the App Secrets or heartbeat-gh-token itself (and needs no private_key or installation_id), and instead checks before changing anything that each profile's namespace already holds its App Secret (and that the platform namespace holds heartbeat-gh-token). github_runner_arc_manage_secrets: true -# Registry the pull Secret authenticates to, and its name in each namespace. +# Whether the role writes the image pull Secret named below into each namespace from github_runner_arc_ghcr_username and github_runner_arc_ghcr_token. false uses a pull Secret something else creates and keeps current, such as one minted from a GitHub App installation token: the role then needs no pull credential, skips the image pull check, and only checks the Secret exists before changing anything. Follows github_runner_arc_manage_secrets unless set. +github_runner_arc_manage_image_pull_secret: "{{ github_runner_arc_manage_secrets }}" + +# Registry the pull Secret authenticates to, and its name in each namespace, whether the role writes it or uses an existing one. github_runner_arc_image_pull_registry: "ghcr.io" github_runner_arc_image_pull_secret_name: "ghcr-pull" diff --git a/roles/github_runner_arc/tasks/check_existing_secrets.yml b/roles/github_runner_arc/tasks/check_existing_secrets.yml index b46a727..395950e 100644 --- a/roles/github_runner_arc/tasks/check_existing_secrets.yml +++ b/roles/github_runner_arc/tasks/check_existing_secrets.yml @@ -1,5 +1,5 @@ --- -# With github_runner_arc_manage_secrets false the role writes no Secrets, so each one the releases and Deployments reference must already exist. Checked before anything is installed: a missing App Secret otherwise shows up as a listener that never registers, and a missing pull Secret as pods in ImagePullBackOff with a registry "denied" that reads like a wrong image tag. +# With github_runner_arc_manage_secrets false the role writes no App or heartbeat Secrets, and with github_runner_arc_manage_image_pull_secret false no pull Secret, so each one the releases and Deployments reference that the role does not write must already exist. Checked before anything is installed: a missing App Secret otherwise shows up as a listener that never registers, and a missing pull Secret as pods in ImagePullBackOff with a registry "denied" that reads like a wrong image tag. - name: Look up each Secret this host's releases and Deployments reference kubernetes.core.k8s_info: @@ -8,10 +8,14 @@ name: "{{ item.1 }}" loop: >- {{ - github_runner_arc_local.profiles | map(attribute='namespace') | zip(github_runner_arc_local.profiles | map(attribute='app_secret')) | list - + github_runner_arc_local.profiles | map(attribute='namespace') | product([github_runner_arc_image_pull_secret_name]) | list - + ([github_runner_arc_platform_namespace] | product([github_runner_arc_image_pull_secret_name, 'heartbeat-gh-token']) | list - if github_runner_arc_heartbeat_gist_id | length > 0 else []) + (github_runner_arc_local.profiles | map(attribute='namespace') | zip(github_runner_arc_local.profiles | map(attribute='app_secret')) | list + if not (github_runner_arc_manage_secrets | bool) else []) + + (github_runner_arc_local.profiles | map(attribute='namespace') | product([github_runner_arc_image_pull_secret_name]) | list + if not (github_runner_arc_manage_image_pull_secret | bool) else []) + + ([github_runner_arc_platform_namespace] | product([github_runner_arc_image_pull_secret_name]) | list + if github_runner_arc_heartbeat_gist_id | length > 0 and not (github_runner_arc_manage_image_pull_secret | bool) else []) + + ([github_runner_arc_platform_namespace] | product(['heartbeat-gh-token']) | list + if github_runner_arc_heartbeat_gist_id | length > 0 and not (github_runner_arc_manage_secrets | bool) else []) }} loop_control: label: "{{ item.0 }}/{{ item.1 }}" @@ -21,7 +25,7 @@ ansible.builtin.fail: msg: >- Secret {{ item.item.1 }} does not exist in namespace {{ item.item.0 }}. - github_runner_arc_manage_secrets is false, so create it first: an App Secret holds github_app_id, github_app_installation_id and github_app_private_key; + The role is not managing it (github_runner_arc_manage_secrets or github_runner_arc_manage_image_pull_secret is false), so create it first: an App Secret holds github_app_id, github_app_installation_id and github_app_private_key; a pull Secret has type kubernetes.io/dockerconfigjson; heartbeat-gh-token holds a gist-scoped GitHub token under the key token. loop: "{{ github_runner_arc_existing_secrets.results }}" loop_control: diff --git a/roles/github_runner_arc/tasks/check_secrets.yml b/roles/github_runner_arc/tasks/check_secrets.yml index 27edec9..e653c2a 100644 --- a/roles/github_runner_arc/tasks/check_secrets.yml +++ b/roles/github_runner_arc/tasks/check_secrets.yml @@ -12,16 +12,21 @@ loop_control: loop_var: org label: "{{ org.name }}" - when: org.private_key | default('') is not search('-----BEGIN [A-Z ]*PRIVATE KEY-----') + when: + - github_runner_arc_manage_secrets | bool + - org.private_key | default('') is not search('-----BEGIN [A-Z ]*PRIVATE KEY-----') - name: Fail when the image pull credential is missing ansible.builtin.fail: msg: github_runner_arc_ghcr_username and github_runner_arc_ghcr_token must both be set to write the {{ github_runner_arc_image_pull_secret_name }} pull Secret. - when: (github_runner_arc_ghcr_username | default('')) | length == 0 or (github_runner_arc_ghcr_token | default('')) | length == 0 + when: + - github_runner_arc_manage_image_pull_secret | bool + - (github_runner_arc_ghcr_username | default('')) | length == 0 or (github_runner_arc_ghcr_token | default('')) | length == 0 - name: Fail when the heartbeat's GitHub token is missing ansible.builtin.fail: msg: github_runner_arc_heartbeat_gh_token (a GitHub token with gist scope) must be set to install the fleet-health platform. when: + - github_runner_arc_manage_secrets | bool - github_runner_arc_heartbeat_gist_id | length > 0 - (github_runner_arc_heartbeat_gh_token | default('')) | length == 0 diff --git a/roles/github_runner_arc/tasks/install_org.yml b/roles/github_runner_arc/tasks/install_org.yml index f2c8d24..bc45253 100644 --- a/roles/github_runner_arc/tasks/install_org.yml +++ b/roles/github_runner_arc/tasks/install_org.yml @@ -1,14 +1,16 @@ --- # Included once per org from main.yml, with `org` set to its github_runner_arc_orgs entry. Resolves the installation id once per org, then installs each of the org's scale-set profiles through install_scale_set_profile.yml. +# The installation ID only goes into the App Secret, so it is not resolved when the role does not write that Secret. - name: Resolve the installation ID of {{ org.name }} ansible.builtin.include_tasks: resolve_installation_id.yml - when: (org.installation_id | default('')) | length == 0 + when: github_runner_arc_manage_secrets | bool and (org.installation_id | default('')) | length == 0 - name: Set the effective installation ID of {{ org.name }} # Read directly by name: resolve_installation_id.yml sets this with a plain set_fact and no delegate_facts, so it attaches to this host, not to the localhost it delegated to. ansible.builtin.set_fact: github_runner_arc_installation_id: "{{ github_runner_arc_resolved_installation_id | default(org.installation_id) }}" + when: github_runner_arc_manage_secrets | bool - name: Install/upgrade each scale-set profile of {{ org.name }} ansible.builtin.include_tasks: install_scale_set_profile.yml diff --git a/roles/github_runner_arc/tasks/install_platform.yml b/roles/github_runner_arc/tasks/install_platform.yml index 4653b97..e91fad7 100644 --- a/roles/github_runner_arc/tasks/install_platform.yml +++ b/roles/github_runner_arc/tasks/install_platform.yml @@ -258,7 +258,7 @@ kubernetes.core.k8s: definition: "{{ lookup('ansible.builtin.template', 'image-pull-secret.yaml.j2', template_vars={'namespace': github_runner_arc_platform_namespace}) | from_yaml }}" no_log: true - when: github_runner_arc_manage_secrets | bool + when: github_runner_arc_manage_image_pull_secret | bool - name: "Platform: install/upgrade the heartbeat Deployment" kubernetes.core.k8s: diff --git a/roles/github_runner_arc/tasks/install_scale_set_profile.yml b/roles/github_runner_arc/tasks/install_scale_set_profile.yml index 20256ca..c83c34b 100644 --- a/roles/github_runner_arc/tasks/install_scale_set_profile.yml +++ b/roles/github_runner_arc/tasks/install_scale_set_profile.yml @@ -29,7 +29,7 @@ kubernetes.core.k8s: definition: "{{ lookup('ansible.builtin.template', 'image-pull-secret.yaml.j2', template_vars={'namespace': profile.namespace}) | from_yaml }}" no_log: true - when: github_runner_arc_manage_secrets | bool + when: github_runner_arc_manage_image_pull_secret | bool - name: Install/upgrade the scale-set release for {{ profile.label }} # runnerScaleSetName is left to default to the release name: it is the scale set's registration identity on GitHub, so two releases sharing it make the second one's listener crash-loop registering a duplicate. scaleSetLabels is the pooling mechanism instead: an extra label every profile's runners carry alongside their own unique one, so runs-on: