Added ACTIONS_RUNNER_INJECT_RUNNER_SERVICE_ACCOUNT environment variable

packages/k8s/src/hooks/constants.ts

@@ -39,6 +39,10 @@ export function getSecretName(): string {
   )}-secret-${uuidv4().substring(0, STEP_POD_NAME_SUFFIX_LENGTH)}`
 }
 
+export function shouldInjectRunnerServiceAccount(): boolean {
+  return process.env.ACTIONS_RUNNER_INJECT_RUNNER_SERVICE_ACCOUNT === 'true'
+}
+
 export const MAX_POD_NAME_LENGTH = 63
 export const STEP_POD_NAME_SUFFIX_LENGTH = 8
 export const CONTAINER_EXTENSION_PREFIX = '$'

packages/k8s/src/k8s/index.ts

@@ -8,14 +8,16 @@ import {
   getSecretName,
   getStepPodName,
   getVolumeClaimName,
-  RunnerInstanceLabel
+  RunnerInstanceLabel,
+  shouldInjectRunnerServiceAccount
 } from '../hooks/constants'
 import {
   PodPhase,
   mergePodSpecWithOptions,
   mergeObjectMeta,
   useKubeScheduler,
-  fixArgs
+  fixArgs,
+  getCurrentServiceAccountName
 } from './utils'
 
 const kc = new k8s.KubeConfig()
@@ -125,6 +127,10 @@ export async function createPod(
     mergePodSpecWithOptions(appPod.spec, extension.spec)
   }
 
+  if (shouldInjectRunnerServiceAccount()) {
+    appPod.spec.serviceAccountName = await getCurrentServiceAccountName(k8sApi)
+  }
+
   const { body } = await k8sApi.createNamespacedPod(namespace(), appPod)
   return body
 }
@@ -557,6 +563,7 @@ export function namespace(): string {
 class BackOffManager {
   private backOffSeconds = 1
   totalTime = 0
+
   constructor(private throwAfterSeconds?: number) {
     if (!throwAfterSeconds || throwAfterSeconds < 0) {
       this.throwAfterSeconds = undefined

packages/k8s/src/k8s/utils.ts

@@ -5,8 +5,11 @@ import * as core from '@actions/core'
 import { Mount } from 'hooklib'
 import * as path from 'path'
 import { v1 as uuidv4 } from 'uuid'
-import { POD_VOLUME_NAME } from './index'
-import { CONTAINER_EXTENSION_PREFIX } from '../hooks/constants'
+import { namespace, POD_VOLUME_NAME } from './index'
+import {
+  CONTAINER_EXTENSION_PREFIX,
+  getRunnerPodName
+} from '../hooks/constants'
 import * as shlex from 'shlex'
 
 export const DEFAULT_CONTAINER_ENTRY_POINT_ARGS = [`-f`, `/dev/null`]
@@ -294,3 +297,17 @@ function mergeLists<T>(base?: T[], from?: T[]): T[] {
 export function fixArgs(args: string[]): string[] {
   return shlex.split(args.join(' '))
 }
+
+export async function getCurrentServiceAccountName(
+  kubernetesApiClient: k8s.CoreV1Api
+): Promise<string | undefined> {
+  try {
+    const { body } = await kubernetesApiClient.readNamespacedPod(
+      getRunnerPodName(),
+      namespace()
+    )
+    return body.spec?.serviceAccountName
+  } catch (e) {
+    core.error(e as Error)
+  }
+}