actions-runner secret

[lifeofmoo]

Hello,

We are also experiencing similar to issues #105 #122 #166

2021-03-04T12:03:01.119Z ERROR controller-runtime.manager.controller.githubactionrunner Reconciler error {
"reconciler group": "garo.tietoevry.com", "reconciler kind": "GithubActionRunner", "name": "runner-pool", "namespace": "act
ions-runner", "error": "Secret "actions-runner" not found"}
github.com/go-logr/zapr.(*zapLogger).Error

Unlike all the other reporters though, we have setup the Operator App as a github app, rather then PAT.

Our runners yaml file is literal copy of your sample file. Except we update the org value in line 12 & 52

The setup:

• namespace: github-actions-runner-operator has the github-runner-app secret which was created with the below and referenced in the operator deployment file.

kubectl create secret generic github-runner-app --from-literal=GITHUB_APP_INTEGRATION_ID=<app_id> --from-file=GITHUB_APP_PRIVATE_KEY=<private_key>

The second namespace is: actions-runner and this is where the runners yaml sample file has been deployed.

image version is:

pullPolicy: IfNotPresent
tag: v0.8.6

Any pointers would be much appreciated.

[lifeofmoo]

Say we create the "missing secret" like so:

kubectl create secret generic actions-runner --from-literal=GITHUB_APP_INTEGRATION_ID=<app_id> --from-file=GITHUB_APP_PRIVATE_KEY=<private_key>

we then see this error:

r": "actions-runner/runner-pool"}
2021-03-04T12:31:03.446Z DEBUG controller-runtime.manager.events Warning {"object": {"kind":"GithubActionRun
ner","namespace":"actions-runner","name":"runner-pool","uid":"4dcd5363-4de7-4dce-8297-dae48b0ce19f","apiVersion":"garo.tiet
oevry.com/v1alpha1","resourceVersion":"104280116"}, "reason": "ProcessingError", "message": "could not parse private key: I
nvalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key"}
2021-03-04T12:31:03.462Z ERROR controller-runtime.manager.controller.githubactionrunner Reconciler error {
"reconciler group": "garo.tietoevry.com", "reconciler kind": "GithubActionRunner", "name": "runner-pool", "namespace": "act
ions-runner", "error": "could not parse private key: Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key"}
github.com/go-logr/zapr.(*zapLogger).Error

[BastianM3]

Say we create the "missing secret" like so:

kubectl create secret generic actions-runner --from-literal=GITHUB_APP_INTEGRATION_ID=<app_id> --from-file=GITHUB_APP_PRIVATE_KEY=<private_key>

we then see this error:

r": "actions-runner/runner-pool"}
2021-03-04T12:31:03.446Z DEBUG controller-runtime.manager.events Warning {"object": {"kind":"GithubActionRun
ner","namespace":"actions-runner","name":"runner-pool","uid":"4dcd5363-4de7-4dce-8297-dae48b0ce19f","apiVersion":"garo.tiet
oevry.com/v1alpha1","resourceVersion":"104280116"}, "reason": "ProcessingError", "message": "could not parse private key: I
nvalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key"}
2021-03-04T12:31:03.462Z ERROR controller-runtime.manager.controller.githubactionrunner Reconciler error {
"reconciler group": "garo.tietoevry.com", "reconciler kind": "GithubActionRunner", "name": "runner-pool", "namespace": "act
ions-runner", "error": "could not parse private key: Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key"}
github.com/go-logr/zapr.(*zapLogger).Error

Going through setup myself as well. I ended up provisioning that secret through Terraform, outside of the chart to keep the PEM out of TF.

When creating the secret the way you mentioned, was the GitHub App's PEM file base64 encoded? It should be :) @lifeofmoo

[lifeofmoo]

Hi @BastianM3 ,

The PEM file in the command wasn't base64 encoded as I assumed it becomes base64 encoded when it's created as an Opaque secret object.

A few questions around this:

1. The --from-file=GITHUB_APP_PRIVATE_KEY=pem.file -> are you saying this pem file should be the BASE64 version?

so a format like:

aaEJrRm1xTlU3bllOckV2Q2FQV2JDVlFGMgpJSE9WaEdyMmVnK2pMbEZJanRmTS9JdVRLeDRJ
IFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

As apposed to the 'raw' format?

-----BEGIN RSA PRIVATE KEY-----
xxxxxxxxx
-----END RSA PRIVATE KEY----

Because then we're saying the secret has been base64 encoded for a second time. So when decrypted/read by the controller it's render out the original encoded string as:

aaEJrRm1xTlU3bllOckV2Q2FQV2JDVlFGMgpJSE9WaEdyMmVnK2pMbEZJanRmTS9JdVRLeDRJ
IFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

And not as the RAW key file.

-----BEGIN RSA PRIVATE KEY-----
xxxxxxxxx
-----END RSA PRIVATE KEY----

2. The "PEM" for both secrets, are they meant to be the same but just created in two different namespaces?

[fnikolov]

For what is worth I am seeing the same issue Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key
GH enterprise, using GH app and the Helm chart.

[fnikolov]

I got over the error by adding the private key to the last section of the values.yaml for the operator helm chart

nodeSelector:
  NodeType: devops

github:
  # If you run github-enterprise, then change the endpoint as appropriate
  apiEndpoint: https://github.company.com/api/v3

envFrom:
- secretRef:
    name: github-runner-app

githubapp:
  enabled: true
  integrationId: "10"
  privateKey: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEowIBAAKCAQEAsRWgIfRfhHQ1ycwIb4++ZcR4p2lWt0Gr6nyH
    ..........
    VaxFiyL5SOiAa6PSKyGmpfYgJS5Rn2xpXKVN3UMP0At9rfXAGC3w
    -----END RSA PRIVATE KEY-----
  existingSecret: ""

Now I have different error no installation found for "ORG" but this I believe is due to the way I have setup the GH app.

[IanMoroney]

For everyone who is having issues in this thread, I have managed to resolve all of my similar issues.

Secret "actions-runner" not found
The readme is missing the fact that the secret needs to be created in the same namespace that the operator is installed in.
So add -n github-actions-runner-operator to the create secret command.

are you saying this pem file should be the BASE64 version
The pem file should not be in base64 format.

Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key
This happens because the readme is missing two things that need to be set when installing the helm chart for the operator:

helm upgrade --install github-actions-runner-operator evryfs-oss/github-actions-runner-operator --namespace github-actions-runner-operator --set githubapp.existingSecret=github-runner-app --set githubapp.enabled=true

no installation found for "ORG"
This issue happens because the readme is missing an important instruction after creating the github app.
You need to install the app. (it can be done from the github app in the developer section after creating it.

[lifeofmoo]

I've ditched this from my clusters now in favour of: https://github.com/actions-runner-controller/actions-runner-controller.

All the best.

GitHub

GitHub - actions-runner-controller/actions-runner-controller: Kubernetes controller for GitHub Actions self-hosted runners

Kubernetes controller for GitHub Actions self-hosted runners - GitHub - actions-runner-controller/actions-runner-controller: Kubernetes controller for GitHub Actions self-hosted runners