Description
Hello,
I am implementing this solution on my cluster, where the following pod security policy is applied: https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml
As described in the Kubernetes documentation, the policy is authorised with this cluster role:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: psp:restricted
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- restricted
and this cluster role binding:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: default:restricted
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: psp:restricted
subjects:
- kind: Group
name: system:authenticated
apiGroup: rbac.authorization.k8s.io
Besides the pod security policy, I have more than a node group and I would like to have the pods of the actions-runner-system namespace running in the non-production-nodegroup node group.
In order to have your controller-manager deployment creating a pod successfully, I had to add the following rows at the end of its definition:
...
securityContext:
runAsUser: 1000
fsGroup: 1000
nodeSelector:
eks.amazonaws.com/nodegroup: non-production-nodegroup
Then I have created a runner deployment, which needed some tweaks for the pod security policy and the node selector:
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
name: example-runnerdeploy
namespace: actions-runner-system
spec:
replicas: 1
template:
spec:
repository: my-organisation/my-repository
containers:
- name: summerwind-runner
image: summerwind/actions-runner
env:
- name: RUNNER_NAME
value: summerwind-runner
- name: RUNNER_REPO
value: my-organisation/my-repository
- name: RUNNER_TOKEN
valueFrom:
secretKeyRef:
name: controller-manager
key: github_token
volumeMounts:
- name: runner-externals
mountPath: /runner/externals
securityContext:
privileged: false
runAsUser: 1000
fsGroup: 1000
volumes:
- name: runner-externals
emptyDir: {}
nodeSelector:
eks.amazonaws.com/nodegroup: non-production-nodegroup
As you can see, I had to add explicitly the envs and the volumes to have the runner and its pod running in the cluster.
Unfortunately it is not enough to have the self-hosted runner in GitHub. In the runner's pod I can find the following in the logs:
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
.path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Starting Runner listener with startup type: service
Started listener process
Started running service
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
The last 5 rows are repeated infinitely.
As far as I can understand, it tries to run the pod with root privileges, but the pod security context doesn't allow it.
Is there a way to have the self-hosted runners created from a Kubernetes cluster with pod security policies? The node selector does not seem to cause troubles, but I had to adapt your solution to use it.
It would be great to have support for both the security policies and the node selectors in the future Helm chart. Thanks in advance.