Updates: container-hooks to v0.7.0

.github/workflows/gha-e2e-tests.yaml

@@ -16,7 +16,7 @@ env:
   TARGET_ORG: actions-runner-controller
   TARGET_REPO: arc_e2e_test_dummy
   IMAGE_NAME: "arc-test-image"
-  IMAGE_VERSION: "0.12.0"
+  IMAGE_VERSION: "0.11.0"
 
 concurrency:
   # This will make sure we only apply the concurrency limits on pull requests

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.24.3 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.24.0 as builder
 
 WORKDIR /workspace
 
@@ -30,7 +30,7 @@ ARG TARGETPLATFORM TARGETOS TARGETARCH TARGETVARIANT VERSION=dev COMMIT_SHA=dev
 # to avoid https://github.com/moby/buildkit/issues/2334
 # We can use docker layer cache so the build is fast enogh anyway
 # We also use per-platform GOCACHE for the same reason.
-ENV GOCACHE="/build/${TARGETPLATFORM}/root/.cache/go-build"
+ENV GOCACHE /build/${TARGETPLATFORM}/root/.cache/go-build
 
 # Build
 RUN --mount=target=. \

Makefile

@@ -6,7 +6,7 @@ endif
 DOCKER_USER ?= $(shell echo ${DOCKER_IMAGE_NAME} | cut -d / -f1)
 VERSION ?= dev
 COMMIT_SHA = $(shell git rev-parse HEAD)
-RUNNER_VERSION ?= 2.325.0
+RUNNER_VERSION ?= 2.323.0
 TARGETPLATFORM ?= $(shell arch)
 RUNNER_NAME ?= ${DOCKER_USER}/actions-runner
 RUNNER_TAG  ?= ${VERSION}

apis/actions.github.com/v1alpha1/appconfig/appconfig.go

@@ -1,89 +0,0 @@
-package appconfig
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"strconv"
-
-	corev1 "k8s.io/api/core/v1"
-)
-
-type AppConfig struct {
-	AppID             string `json:"github_app_id"`
-	AppInstallationID int64  `json:"github_app_installation_id"`
-	AppPrivateKey     string `json:"github_app_private_key"`
-
-	Token string `json:"github_token"`
-}
-
-func (c *AppConfig) tidy() *AppConfig {
-	if len(c.Token) > 0 {
-		return &AppConfig{
-			Token: c.Token,
-		}
-	}
-
-	return &AppConfig{
-		AppID:             c.AppID,
-		AppInstallationID: c.AppInstallationID,
-		AppPrivateKey:     c.AppPrivateKey,
-	}
-}
-
-func (c *AppConfig) Validate() error {
-	if c == nil {
-		return fmt.Errorf("missing app config")
-	}
-	hasToken := len(c.Token) > 0
-	hasGitHubAppAuth := c.hasGitHubAppAuth()
-	if hasToken && hasGitHubAppAuth {
-		return fmt.Errorf("both PAT and GitHub App credentials provided. should only provide one")
-	}
-	if !hasToken && !hasGitHubAppAuth {
-		return fmt.Errorf("no credentials provided: either a PAT or GitHub App credentials should be provided")
-	}
-
-	return nil
-}
-
-func (c *AppConfig) hasGitHubAppAuth() bool {
-	return len(c.AppID) > 0 && c.AppInstallationID > 0 && len(c.AppPrivateKey) > 0
-}
-
-func FromSecret(secret *corev1.Secret) (*AppConfig, error) {
-	var appInstallationID int64
-	if v := string(secret.Data["github_app_installation_id"]); v != "" {
-		val, err := strconv.ParseInt(v, 10, 64)
-		if err != nil {
-			return nil, err
-		}
-		appInstallationID = val
-	}
-
-	cfg := &AppConfig{
-		Token:             string(secret.Data["github_token"]),
-		AppID:             string(secret.Data["github_app_id"]),
-		AppInstallationID: appInstallationID,
-		AppPrivateKey:     string(secret.Data["github_app_private_key"]),
-	}
-
-	if err := cfg.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate config: %v", err)
-	}
-
-	return cfg.tidy(), nil
-}
-
-func FromJSONString(v string) (*AppConfig, error) {
-	var appConfig AppConfig
-	if err := json.NewDecoder(bytes.NewBufferString(v)).Decode(&appConfig); err != nil {
-		return nil, err
-	}
-
-	if err := appConfig.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate app config decoded from string: %w", err)
-	}
-
-	return appConfig.tidy(), nil
-}

apis/actions.github.com/v1alpha1/appconfig/appconfig_test.go

@@ -1,152 +0,0 @@
-package appconfig
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-)
-
-func TestAppConfigValidate_invalid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"empty": {},
-		"token and app config": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-			Token:             "token",
-		},
-		"app id not set": {
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-		"app installation id not set": {
-			AppID:         "2",
-			AppPrivateKey: "private key",
-		},
-		"private key empty": {
-			AppID:             "2",
-			AppInstallationID: 1,
-			AppPrivateKey:     "",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.Error(t, err)
-		})
-	}
-}
-
-func TestAppConfigValidate_valid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"token": {
-			Token: "token",
-		},
-		"app ID": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.NoError(t, err)
-		})
-	}
-}
-
-func TestAppConfigFromSecret_invalid(t *testing.T) {
-	tt := map[string]map[string]string{
-		"empty": {},
-		"token and app provided": {
-			"github_token":              "token",
-			"github_app_id":             "2",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-		"invalid app id": {
-			"github_app_id":             "abc",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-		"invalid app installation_id": {
-			"github_app_id":             "1",
-			"githu_app_installation_id": "abc",
-			"github_app_private_key":    "private key",
-		},
-		"empty private key": {
-			"github_app_id":             "1",
-			"githu_app_installation_id": "2",
-			"github_app_private_key":    "",
-		},
-	}
-
-	for name, data := range tt {
-		t.Run(name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				StringData: data,
-			}
-
-			appConfig, err := FromSecret(secret)
-			assert.Error(t, err)
-			assert.Nil(t, appConfig)
-		})
-	}
-}
-
-func TestAppConfigFromSecret_valid(t *testing.T) {
-	tt := map[string]map[string]string{
-		"with token": {
-			"github_token": "token",
-		},
-		"app config": {
-			"github_app_id":             "2",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-	}
-
-	for name, data := range tt {
-		t.Run(name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				StringData: data,
-			}
-
-			appConfig, err := FromSecret(secret)
-			assert.Error(t, err)
-			assert.Nil(t, appConfig)
-		})
-	}
-}
-
-func TestAppConfigFromString_valid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"token": {
-			Token: "token",
-		},
-		"app ID": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			bytes, err := json.Marshal(cfg)
-			require.NoError(t, err)
-
-			got, err := FromJSONString(string(bytes))
-			require.NoError(t, err)
-
-			want := cfg.tidy()
-			assert.Equal(t, want, got)
-		})
-	}
-}

apis/actions.github.com/v1alpha1/autoscalinglistener_types.go

@@ -59,10 +59,7 @@ type AutoscalingListenerSpec struct {
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
 
 	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
-	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
 
 	// +optional
 	Metrics *MetricsConfig `json:"metrics,omitempty"`
@@ -90,6 +87,7 @@ type AutoscalingListener struct {
 }
 
 // +kubebuilder:object:root=true
+
 // AutoscalingListenerList contains a list of AutoscalingListener
 type AutoscalingListenerList struct {
 	metav1.TypeMeta `json:",inline"`

apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go

@@ -24,7 +24,6 @@ import (
 	"strings"
 
 	"github.com/actions/actions-runner-controller/hash"
-	"github.com/actions/actions-runner-controller/vault"
 	"golang.org/x/net/http/httpproxy"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -70,10 +69,7 @@ type AutoscalingRunnerSetSpec struct {
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
 
 	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
-	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
 
 	// Required
 	Template corev1.PodTemplateSpec `json:"template,omitempty"`
@@ -93,12 +89,12 @@ type AutoscalingRunnerSetSpec struct {
 	MinRunners *int `json:"minRunners,omitempty"`
 }
 
-type TLSConfig struct {
+type GitHubServerTLSConfig struct {
 	// Required
 	CertificateFrom *TLSCertificateSource `json:"certificateFrom,omitempty"`
 }
 
-func (c *TLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error)) (*x509.CertPool, error) {
+func (c *GitHubServerTLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error)) (*x509.CertPool, error) {
 	if c.CertificateFrom == nil {
 		return nil, fmt.Errorf("certificateFrom not specified")
 	}
@@ -146,7 +142,7 @@ type ProxyConfig struct {
 	NoProxy []string `json:"noProxy,omitempty"`
 }
 
-func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secret, error)) (*httpproxy.Config, error) {
+func (c *ProxyConfig) toHTTPProxyConfig(secretFetcher func(string) (*corev1.Secret, error)) (*httpproxy.Config, error) {
 	config := &httpproxy.Config{
 		NoProxy: strings.Join(c.NoProxy, ","),
 	}
@@ -205,7 +201,7 @@ func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secr
 }
 
 func (c *ProxyConfig) ToSecretData(secretFetcher func(string) (*corev1.Secret, error)) (map[string][]byte, error) {
-	config, err := c.ToHTTPProxyConfig(secretFetcher)
+	config, err := c.toHTTPProxyConfig(secretFetcher)
 	if err != nil {
 		return nil, err
 	}
@@ -219,7 +215,7 @@ func (c *ProxyConfig) ToSecretData(secretFetcher func(string) (*corev1.Secret, e
 }
 
 func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, error)) (func(*http.Request) (*url.URL, error), error) {
-	config, err := c.ToHTTPProxyConfig(secretFetcher)
+	config, err := c.toHTTPProxyConfig(secretFetcher)
 	if err != nil {
 		return nil, err
 	}
@@ -239,26 +235,6 @@ type ProxyServerConfig struct {
 	CredentialSecretRef string `json:"credentialSecretRef,omitempty"`
 }
 
-type VaultConfig struct {
-	// +optional
-	Type vault.VaultType `json:"type,omitempty"`
-	// +optional
-	AzureKeyVault *AzureKeyVaultConfig `json:"azureKeyVault,omitempty"`
-	// +optional
-	Proxy *ProxyConfig `json:"proxy,omitempty"`
-}
-
-type AzureKeyVaultConfig struct {
-	// +required
-	URL string `json:"url,omitempty"`
-	// +required
-	TenantID string `json:"tenantId,omitempty"`
-	// +required
-	ClientID string `json:"clientId,omitempty"`
-	// +required
-	CertificatePath string `json:"certificatePath,omitempty"`
-}
-
 // MetricsConfig holds configuration parameters for each metric type
 type MetricsConfig struct {
 	// +optional
@@ -309,33 +285,6 @@ func (ars *AutoscalingRunnerSet) ListenerSpecHash() string {
 	return hash.ComputeTemplateHash(&spec)
 }
 
-func (ars *AutoscalingRunnerSet) GitHubConfigSecret() string {
-	return ars.Spec.GitHubConfigSecret
-}
-
-func (ars *AutoscalingRunnerSet) GitHubConfigUrl() string {
-	return ars.Spec.GitHubConfigUrl
-}
-
-func (ars *AutoscalingRunnerSet) GitHubProxy() *ProxyConfig {
-	return ars.Spec.Proxy
-}
-
-func (ars *AutoscalingRunnerSet) GitHubServerTLS() *TLSConfig {
-	return ars.Spec.GitHubServerTLS
-}
-
-func (ars *AutoscalingRunnerSet) VaultConfig() *VaultConfig {
-	return ars.Spec.VaultConfig
-}
-
-func (ars *AutoscalingRunnerSet) VaultProxy() *ProxyConfig {
-	if ars.Spec.VaultConfig != nil {
-		return ars.Spec.VaultConfig.Proxy
-	}
-	return nil
-}
-
 func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 	type runnerSetSpec struct {
 		GitHubConfigUrl    string
@@ -343,7 +292,7 @@ func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 		RunnerGroup        string
 		RunnerScaleSetName string
 		Proxy              *ProxyConfig
-		GitHubServerTLS    *TLSConfig
+		GitHubServerTLS    *GitHubServerTLSConfig
 		Template           corev1.PodTemplateSpec
 	}
 	spec := &runnerSetSpec{

apis/actions.github.com/v1alpha1/ephemeralrunner_types.go

@@ -67,33 +67,6 @@ func (er *EphemeralRunner) HasContainerHookConfigured() bool {
 	return false
 }
 
-func (er *EphemeralRunner) GitHubConfigSecret() string {
-	return er.Spec.GitHubConfigSecret
-}
-
-func (er *EphemeralRunner) GitHubConfigUrl() string {
-	return er.Spec.GitHubConfigUrl
-}
-
-func (er *EphemeralRunner) GitHubProxy() *ProxyConfig {
-	return er.Spec.Proxy
-}
-
-func (er *EphemeralRunner) GitHubServerTLS() *TLSConfig {
-	return er.Spec.GitHubServerTLS
-}
-
-func (er *EphemeralRunner) VaultConfig() *VaultConfig {
-	return er.Spec.VaultConfig
-}
-
-func (er *EphemeralRunner) VaultProxy() *ProxyConfig {
-	if er.Spec.VaultConfig != nil {
-		return er.Spec.VaultConfig.Proxy
-	}
-	return nil
-}
-
 // EphemeralRunnerSpec defines the desired state of EphemeralRunner
 type EphemeralRunnerSpec struct {
 	// +required
@@ -102,9 +75,6 @@ type EphemeralRunnerSpec struct {
 	// +required
 	GitHubConfigSecret string `json:"githubConfigSecret,omitempty"`
 
-	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
 	// +required
 	RunnerScaleSetId int `json:"runnerScaleSetId,omitempty"`
 
@@ -115,7 +85,7 @@ type EphemeralRunnerSpec struct {
 	ProxySecretRef string `json:"proxySecretRef,omitempty"`
 
 	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
 
 	corev1.PodTemplateSpec `json:",inline"`
 }
@@ -149,7 +119,7 @@ type EphemeralRunnerStatus struct {
 	RunnerJITConfig string `json:"runnerJITConfig,omitempty"`
 
 	// +optional
-	Failures map[string]metav1.Time `json:"failures,omitempty"`
+	Failures map[string]bool `json:"failures,omitempty"`
 
 	// +optional
 	JobRequestId int64 `json:"jobRequestId,omitempty"`
@@ -167,20 +137,6 @@ type EphemeralRunnerStatus struct {
 	JobDisplayName string `json:"jobDisplayName,omitempty"`
 }
 
-func (s *EphemeralRunnerStatus) LastFailure() metav1.Time {
-	var maxTime metav1.Time
-	if len(s.Failures) == 0 {
-		return maxTime
-	}
-
-	for _, ts := range s.Failures {
-		if ts.After(maxTime.Time) {
-			maxTime = ts
-		}
-	}
-	return maxTime
-}
-
 // +kubebuilder:object:root=true
 
 // EphemeralRunnerList contains a list of EphemeralRunner

apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go

@@ -60,35 +60,9 @@ type EphemeralRunnerSet struct {
 	Status EphemeralRunnerSetStatus `json:"status,omitempty"`
 }
 
-func (ers *EphemeralRunnerSet) GitHubConfigSecret() string {
-	return ers.Spec.EphemeralRunnerSpec.GitHubConfigSecret
-}
-
-func (ers *EphemeralRunnerSet) GitHubConfigUrl() string {
-	return ers.Spec.EphemeralRunnerSpec.GitHubConfigUrl
-}
-
-func (ers *EphemeralRunnerSet) GitHubProxy() *ProxyConfig {
-	return ers.Spec.EphemeralRunnerSpec.Proxy
-}
-
-func (ers *EphemeralRunnerSet) GitHubServerTLS() *TLSConfig {
-	return ers.Spec.EphemeralRunnerSpec.GitHubServerTLS
-}
-
-func (ers *EphemeralRunnerSet) VaultConfig() *VaultConfig {
-	return ers.Spec.EphemeralRunnerSpec.VaultConfig
-}
-
-func (ers *EphemeralRunnerSet) VaultProxy() *ProxyConfig {
-	if ers.Spec.EphemeralRunnerSpec.VaultConfig != nil {
-		return ers.Spec.EphemeralRunnerSpec.VaultConfig.Proxy
-	}
-	return nil
-}
+// +kubebuilder:object:root=true
 
 // EphemeralRunnerSetList contains a list of EphemeralRunnerSet
-// +kubebuilder:object:root=true
 type EphemeralRunnerSetList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`

apis/actions.github.com/v1alpha1/tls_config_test.go

@@ -17,7 +17,7 @@ import (
 
 func TestGitHubServerTLSConfig_ToCertPool(t *testing.T) {
 	t.Run("returns an error if CertificateFrom not specified", func(t *testing.T) {
-		c := &v1alpha1.TLSConfig{
+		c := &v1alpha1.GitHubServerTLSConfig{
 			CertificateFrom: nil,
 		}
 
@@ -29,7 +29,7 @@ func TestGitHubServerTLSConfig_ToCertPool(t *testing.T) {
 	})
 
 	t.Run("returns an error if CertificateFrom.ConfigMapKeyRef not specified", func(t *testing.T) {
-		c := &v1alpha1.TLSConfig{
+		c := &v1alpha1.GitHubServerTLSConfig{
 			CertificateFrom: &v1alpha1.TLSCertificateSource{},
 		}
 
@@ -41,7 +41,7 @@ func TestGitHubServerTLSConfig_ToCertPool(t *testing.T) {
 	})
 
 	t.Run("returns a valid cert pool with correct configuration", func(t *testing.T) {
-		c := &v1alpha1.TLSConfig{
+		c := &v1alpha1.GitHubServerTLSConfig{
 			CertificateFrom: &v1alpha1.TLSCertificateSource{
 				ConfigMapKeyRef: &v1.ConfigMapKeySelector{
 					LocalObjectReference: v1.LocalObjectReference{

apis/actions.github.com/v1alpha1/version.go

@@ -1,72 +0,0 @@
-package v1alpha1
-
-import "strings"
-
-func IsVersionAllowed(resourceVersion, buildVersion string) bool {
-	if buildVersion == "dev" || resourceVersion == buildVersion || strings.HasPrefix(buildVersion, "canary-") {
-		return true
-	}
-
-	rv, ok := parseSemver(resourceVersion)
-	if !ok {
-		return false
-	}
-	bv, ok := parseSemver(buildVersion)
-	if !ok {
-		return false
-	}
-	return rv.major == bv.major && rv.minor == bv.minor
-}
-
-type semver struct {
-	major string
-	minor string
-}
-
-func parseSemver(v string) (p semver, ok bool) {
-	if v == "" {
-		return
-	}
-	p.major, v, ok = parseInt(v)
-	if !ok {
-		return p, false
-	}
-	if v == "" {
-		p.minor = "0"
-		return p, true
-	}
-	if v[0] != '.' {
-		return p, false
-	}
-	p.minor, v, ok = parseInt(v[1:])
-	if !ok {
-		return p, false
-	}
-	if v == "" {
-		return p, true
-	}
-	if v[0] != '.' {
-		return p, false
-	}
-	if _, _, ok = parseInt(v[1:]); !ok {
-		return p, false
-	}
-	return p, true
-}
-
-func parseInt(v string) (t, rest string, ok bool) {
-	if v == "" {
-		return
-	}
-	if v[0] < '0' || '9' < v[0] {
-		return
-	}
-	i := 1
-	for i < len(v) && '0' <= v[i] && v[i] <= '9' {
-		i++
-	}
-	if v[0] == '0' && i != 1 {
-		return
-	}
-	return v[:i], v[i:], true
-}

apis/actions.github.com/v1alpha1/version_test.go

@@ -1,60 +0,0 @@
-package v1alpha1_test
-
-import (
-	"testing"
-
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIsVersionAllowed(t *testing.T) {
-	t.Parallel()
-	tt := map[string]struct {
-		resourceVersion string
-		buildVersion    string
-		want            bool
-	}{
-		"dev should always be allowed": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "dev",
-			want:            true,
-		},
-		"resourceVersion is not semver": {
-			resourceVersion: "dev",
-			buildVersion:    "0.11.0",
-			want:            false,
-		},
-		"buildVersion is not semver": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "NA",
-			want:            false,
-		},
-		"major version mismatch": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "1.11.0",
-			want:            false,
-		},
-		"minor version mismatch": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "0.10.0",
-			want:            false,
-		},
-		"patch version mismatch": {
-			resourceVersion: "0.11.1",
-			buildVersion:    "0.11.0",
-			want:            true,
-		},
-		"arbitrary version match": {
-			resourceVersion: "abc",
-			buildVersion:    "abc",
-			want:            true,
-		},
-	}
-
-	for name, tc := range tt {
-		t.Run(name, func(t *testing.T) {
-			got := v1alpha1.IsVersionAllowed(tc.resourceVersion, tc.buildVersion)
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}

apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go

@@ -22,7 +22,6 @@ package v1alpha1
 
 import (
 	"k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
@@ -100,12 +99,7 @@ func (in *AutoscalingListenerSpec) DeepCopyInto(out *AutoscalingListenerSpec) {
 	}
 	if in.GitHubServerTLS != nil {
 		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
+		*out = new(GitHubServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.Metrics != nil {
@@ -214,12 +208,7 @@ func (in *AutoscalingRunnerSetSpec) DeepCopyInto(out *AutoscalingRunnerSetSpec)
 	}
 	if in.GitHubServerTLS != nil {
 		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
+		*out = new(GitHubServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	in.Template.DeepCopyInto(&out.Template)
@@ -270,21 +259,6 @@ func (in *AutoscalingRunnerSetStatus) DeepCopy() *AutoscalingRunnerSetStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *AzureKeyVaultConfig) DeepCopyInto(out *AzureKeyVaultConfig) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureKeyVaultConfig.
-func (in *AzureKeyVaultConfig) DeepCopy() *AzureKeyVaultConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(AzureKeyVaultConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CounterMetric) DeepCopyInto(out *CounterMetric) {
 	*out = *in
@@ -457,19 +431,14 @@ func (in *EphemeralRunnerSetStatus) DeepCopy() *EphemeralRunnerSetStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *EphemeralRunnerSpec) DeepCopyInto(out *EphemeralRunnerSpec) {
 	*out = *in
-	if in.GitHubServerTLS != nil {
-		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.Proxy != nil {
 		in, out := &in.Proxy, &out.Proxy
 		*out = new(ProxyConfig)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
+	if in.GitHubServerTLS != nil {
+		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
+		*out = new(GitHubServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	in.PodTemplateSpec.DeepCopyInto(&out.PodTemplateSpec)
@@ -490,9 +459,9 @@ func (in *EphemeralRunnerStatus) DeepCopyInto(out *EphemeralRunnerStatus) {
 	*out = *in
 	if in.Failures != nil {
 		in, out := &in.Failures, &out.Failures
-		*out = make(map[string]metav1.Time, len(*in))
+		*out = make(map[string]bool, len(*in))
 		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
+			(*out)[key] = val
 		}
 	}
 }
@@ -527,6 +496,26 @@ func (in *GaugeMetric) DeepCopy() *GaugeMetric {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GitHubServerTLSConfig) DeepCopyInto(out *GitHubServerTLSConfig) {
+	*out = *in
+	if in.CertificateFrom != nil {
+		in, out := &in.CertificateFrom, &out.CertificateFrom
+		*out = new(TLSCertificateSource)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubServerTLSConfig.
+func (in *GitHubServerTLSConfig) DeepCopy() *GitHubServerTLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(GitHubServerTLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HistogramMetric) DeepCopyInto(out *HistogramMetric) {
 	*out = *in
@@ -679,48 +668,3 @@ func (in *TLSCertificateSource) DeepCopy() *TLSCertificateSource {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
-	*out = *in
-	if in.CertificateFrom != nil {
-		in, out := &in.CertificateFrom, &out.CertificateFrom
-		*out = new(TLSCertificateSource)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
-func (in *TLSConfig) DeepCopy() *TLSConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(TLSConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VaultConfig) DeepCopyInto(out *VaultConfig) {
-	*out = *in
-	if in.AzureKeyVault != nil {
-		in, out := &in.AzureKeyVault, &out.AzureKeyVault
-		*out = new(AzureKeyVaultConfig)
-		**out = **in
-	}
-	if in.Proxy != nil {
-		in, out := &in.Proxy, &out.Proxy
-		*out = new(ProxyConfig)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VaultConfig.
-func (in *VaultConfig) DeepCopy() *VaultConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(VaultConfig)
-	in.DeepCopyInto(out)
-	return out
-}

charts/actions-runner-controller/README.md

@@ -44,7 +44,7 @@ All additional docs are kept in the `docs/` folder, this README is solely for do
 | `image.pullPolicy`                                        | The pull policy of the controller image                                                                                                   | IfNotPresent                                                                                    |
 | `metrics.serviceMonitor.enable`                           | Deploy serviceMonitor kind for for use with prometheus-operator CRDs                                                                      | false                                                                                           |
 | `metrics.serviceMonitor.interval`                         | Configure the interval that Prometheus should scrap the controller's metrics                                                              | 1m                                                                                              |
-| `metrics.serviceMonitor.namespace`                        | Namespace which Prometheus is running in                                                                                                  | `Release.Namespace` (the default namespace of the helm chart).                                  |
+| `metrics.serviceMonitor.namespace                         | Namespace which Prometheus is running in                                                                                                  | `Release.Namespace` (the default namespace of the helm chart).                                  |
 | `metrics.serviceMonitor.timeout`                          | Configure the timeout the timeout of Prometheus scrapping.                                                                                | 30s                                                                                             |
 | `metrics.serviceAnnotations`                              | Set annotations for the provisioned metrics service resource                                                                              |                                                                                                 |
 | `metrics.port`                                            | Set port of metrics service                                                                                                               | 8443                                                                                            |

charts/gha-runner-scale-set-controller/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.12.0
+version: 0.11.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.12.0"
+appVersion: "0.11.0"
 
 home: https://github.com/actions/actions-runner-controller
 

charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml

@@ -7863,53 +7863,6 @@ spec:
                         - containers
                       type: object
                   type: object
-                vaultConfig:
-                  properties:
-                    azureKeyVault:
-                      properties:
-                        certificatePath:
-                          type: string
-                        clientId:
-                          type: string
-                        tenantId:
-                          type: string
-                        url:
-                          type: string
-                      required:
-                        - certificatePath
-                        - clientId
-                        - tenantId
-                        - url
-                      type: object
-                    proxy:
-                      properties:
-                        http:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        https:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        noProxy:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type:
-                      description: |-
-                        VaultType represents the type of vault that can be used in the application.
-                        It is used to identify which vault integration should be used to resolve secrets.
-                      type: string
-                  type: object
               type: object
             status:
               description: AutoscalingListenerStatus defines the observed state of AutoscalingListener

charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml

@@ -15504,53 +15504,6 @@ spec:
                         - containers
                       type: object
                   type: object
-                vaultConfig:
-                  properties:
-                    azureKeyVault:
-                      properties:
-                        certificatePath:
-                          type: string
-                        clientId:
-                          type: string
-                        tenantId:
-                          type: string
-                        url:
-                          type: string
-                      required:
-                        - certificatePath
-                        - clientId
-                        - tenantId
-                        - url
-                      type: object
-                    proxy:
-                      properties:
-                        http:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        https:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        noProxy:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type:
-                      description: |-
-                        VaultType represents the type of vault that can be used in the application.
-                        It is used to identify which vault integration should be used to resolve secrets.
-                      type: string
-                  type: object
               type: object
             status:
               description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet

charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml

@@ -7784,53 +7784,6 @@ spec:
                   required:
                     - containers
                   type: object
-                vaultConfig:
-                  properties:
-                    azureKeyVault:
-                      properties:
-                        certificatePath:
-                          type: string
-                        clientId:
-                          type: string
-                        tenantId:
-                          type: string
-                        url:
-                          type: string
-                      required:
-                        - certificatePath
-                        - clientId
-                        - tenantId
-                        - url
-                      type: object
-                    proxy:
-                      properties:
-                        http:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        https:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        noProxy:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type:
-                      description: |-
-                        VaultType represents the type of vault that can be used in the application.
-                        It is used to identify which vault integration should be used to resolve secrets.
-                      type: string
-                  type: object
               required:
                 - githubConfigSecret
                 - githubConfigUrl
@@ -7841,8 +7794,7 @@ spec:
               properties:
                 failures:
                   additionalProperties:
-                    format: date-time
-                    type: string
+                    type: boolean
                   type: object
                 jobDisplayName:
                   type: string

charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml

@@ -7778,53 +7778,6 @@ spec:
                       required:
                         - containers
                       type: object
-                    vaultConfig:
-                      properties:
-                        azureKeyVault:
-                          properties:
-                            certificatePath:
-                              type: string
-                            clientId:
-                              type: string
-                            tenantId:
-                              type: string
-                            url:
-                              type: string
-                          required:
-                            - certificatePath
-                            - clientId
-                            - tenantId
-                            - url
-                          type: object
-                        proxy:
-                          properties:
-                            http:
-                              properties:
-                                credentialSecretRef:
-                                  type: string
-                                url:
-                                  description: Required
-                                  type: string
-                              type: object
-                            https:
-                              properties:
-                                credentialSecretRef:
-                                  type: string
-                                url:
-                                  description: Required
-                                  type: string
-                              type: object
-                            noProxy:
-                              items:
-                                type: string
-                              type: array
-                          type: object
-                        type:
-                          description: |-
-                            VaultType represents the type of vault that can be used in the application.
-                            It is used to identify which vault integration should be used to resolve secrets.
-                          type: string
-                      type: object
                   required:
                     - githubConfigSecret
                     - githubConfigUrl

charts/gha-runner-scale-set/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.12.0
+version: 0.11.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.12.0"
+appVersion: "0.11.0"
 
 home: https://github.com/actions/actions-runner-controller
 

charts/gha-runner-scale-set/templates/_helpers.tpl

@@ -106,17 +106,6 @@ env:
     value: "123"
 securityContext:
   privileged: true
-{{- if (ge (.Capabilities.KubeVersion.Minor | int) 29) }}
-restartPolicy: Always
-startupProbe:
-  exec:
-    command:
-      - docker
-      - info
-    initialDelaySeconds: 0
-    failureThreshold: 24
-    periodSeconds: 5
-{{- end }}
 volumeMounts:
   - name: work
     mountPath: /home/runner/_work

charts/gha-runner-scale-set/templates/autoscalingrunnerset.yaml

@@ -45,7 +45,6 @@ metadata:
     {{- if and (ne $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
     actions.github.com/cleanup-no-permission-service-account-name: {{ include "gha-runner-scale-set.noPermissionServiceAccountName" . }}
     {{- end }}
-
 spec:
   githubConfigUrl: {{ required ".Values.githubConfigUrl is required" (trimSuffix "/" .Values.githubConfigUrl) }}
   githubConfigSecret: {{ include "gha-runner-scale-set.githubsecret" . }}
@@ -66,24 +65,6 @@ spec:
     {{- end }}
   {{- end }}
 
-  {{- if and .Values.keyVault .Values.keyVault.type }}
-  vaultConfig:
-    type: {{ .Values.keyVault.type }}
-    {{- if .Values.keyVault.proxy }}
-    proxy: {{- toYaml .Values.keyVault.proxy | nindent 6 }}
-    {{- end }}
-    {{- if eq .Values.keyVault.type "azure_key_vault" }}
-    azureKeyVault:
-      url: {{ .Values.keyVault.azureKeyVault.url }}
-      tenantId: {{ .Values.keyVault.azureKeyVault.tenantId }}
-      clientId: {{ .Values.keyVault.azureKeyVault.clientId }}
-      certificatePath: {{ .Values.keyVault.azureKeyVault.certificatePath }}
-      secretKey: {{ .Values.keyVault.azureKeyVault.secretKey }}
-    {{- else }}
-    {{- fail "Unsupported keyVault type: " .Values.keyVault.type }}
-    {{- end }}
-  {{- end }}
-
   {{- if .Values.proxy }}
   proxy:
     {{- if .Values.proxy.http }}
@@ -168,10 +149,6 @@ spec:
       - name: init-dind-externals
         {{- include "gha-runner-scale-set.dind-init-container" . | nindent 8 }}
         {{- end }}
-        {{- if (ge (.Capabilities.KubeVersion.Minor | int) 29) }}
-      - name: dind
-        {{- include "gha-runner-scale-set.dind-container" . | nindent 8 }}
-        {{- end }}
         {{- with .Values.template.spec.initContainers }}
       {{- toYaml . | nindent 6 }}
         {{- end }}
@@ -180,10 +157,8 @@ spec:
       {{- if eq $containerMode.type "dind" }}
       - name: runner
         {{- include "gha-runner-scale-set.dind-runner-container" . | nindent 8 }}
-        {{- if not (ge (.Capabilities.KubeVersion.Minor | int) 29) }}
       - name: dind
         {{- include "gha-runner-scale-set.dind-container" . | nindent 8 }}
-        {{- end }}
       {{- include "gha-runner-scale-set.non-runner-non-dind-containers" . | nindent 6 }}
       {{- else if eq $containerMode.type "kubernetes" }}
       - name: runner

charts/gha-runner-scale-set/tests/template_test.go

@@ -728,20 +728,20 @@ func TestTemplateRenderedAutoScalingRunnerSet_DinD_ExtraInitContainers(t *testin
 	var ars v1alpha1.AutoscalingRunnerSet
 	helm.UnmarshalK8SYaml(t, output, &ars)
 
-	assert.Len(t, ars.Spec.Template.Spec.InitContainers, 4, "InitContainers should be 4")
-	assert.Equal(t, "kube-init", ars.Spec.Template.Spec.InitContainers[2].Name, "InitContainers[1] Name should be kube-init")
-	assert.Equal(t, "runner-image:latest", ars.Spec.Template.Spec.InitContainers[2].Image, "InitContainers[1] Image should be runner-image:latest")
-	assert.Equal(t, "sudo", ars.Spec.Template.Spec.InitContainers[2].Command[0], "InitContainers[1] Command[0] should be sudo")
-	assert.Equal(t, "chown", ars.Spec.Template.Spec.InitContainers[2].Command[1], "InitContainers[1] Command[1] should be chown")
-	assert.Equal(t, "-R", ars.Spec.Template.Spec.InitContainers[2].Command[2], "InitContainers[1] Command[2] should be -R")
-	assert.Equal(t, "1001:123", ars.Spec.Template.Spec.InitContainers[2].Command[3], "InitContainers[1] Command[3] should be 1001:123")
-	assert.Equal(t, "/home/runner/_work", ars.Spec.Template.Spec.InitContainers[2].Command[4], "InitContainers[1] Command[4] should be /home/runner/_work")
-	assert.Equal(t, "work", ars.Spec.Template.Spec.InitContainers[2].VolumeMounts[0].Name, "InitContainers[1] VolumeMounts[0] Name should be work")
-	assert.Equal(t, "/home/runner/_work", ars.Spec.Template.Spec.InitContainers[2].VolumeMounts[0].MountPath, "InitContainers[1] VolumeMounts[0] MountPath should be /home/runner/_work")
+	assert.Len(t, ars.Spec.Template.Spec.InitContainers, 3, "InitContainers should be 3")
+	assert.Equal(t, "kube-init", ars.Spec.Template.Spec.InitContainers[1].Name, "InitContainers[1] Name should be kube-init")
+	assert.Equal(t, "runner-image:latest", ars.Spec.Template.Spec.InitContainers[1].Image, "InitContainers[1] Image should be runner-image:latest")
+	assert.Equal(t, "sudo", ars.Spec.Template.Spec.InitContainers[1].Command[0], "InitContainers[1] Command[0] should be sudo")
+	assert.Equal(t, "chown", ars.Spec.Template.Spec.InitContainers[1].Command[1], "InitContainers[1] Command[1] should be chown")
+	assert.Equal(t, "-R", ars.Spec.Template.Spec.InitContainers[1].Command[2], "InitContainers[1] Command[2] should be -R")
+	assert.Equal(t, "1001:123", ars.Spec.Template.Spec.InitContainers[1].Command[3], "InitContainers[1] Command[3] should be 1001:123")
+	assert.Equal(t, "/home/runner/_work", ars.Spec.Template.Spec.InitContainers[1].Command[4], "InitContainers[1] Command[4] should be /home/runner/_work")
+	assert.Equal(t, "work", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[0].Name, "InitContainers[1] VolumeMounts[0] Name should be work")
+	assert.Equal(t, "/home/runner/_work", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[0].MountPath, "InitContainers[1] VolumeMounts[0] MountPath should be /home/runner/_work")
 
-	assert.Equal(t, "ls", ars.Spec.Template.Spec.InitContainers[3].Name, "InitContainers[2] Name should be ls")
-	assert.Equal(t, "ubuntu:latest", ars.Spec.Template.Spec.InitContainers[3].Image, "InitContainers[2] Image should be ubuntu:latest")
-	assert.Equal(t, "ls", ars.Spec.Template.Spec.InitContainers[3].Command[0], "InitContainers[2] Command[0] should be ls")
+	assert.Equal(t, "ls", ars.Spec.Template.Spec.InitContainers[2].Name, "InitContainers[2] Name should be ls")
+	assert.Equal(t, "ubuntu:latest", ars.Spec.Template.Spec.InitContainers[2].Image, "InitContainers[2] Image should be ubuntu:latest")
+	assert.Equal(t, "ls", ars.Spec.Template.Spec.InitContainers[2].Command[0], "InitContainers[2] Command[0] should be ls")
 }
 
 func TestTemplateRenderedAutoScalingRunnerSet_DinD_ExtraVolumes(t *testing.T) {
@@ -860,26 +860,13 @@ func TestTemplateRenderedAutoScalingRunnerSet_EnableDinD(t *testing.T) {
 
 	assert.NotNil(t, ars.Spec.Template.Spec, "Template.Spec should not be nil")
 
-	assert.Len(t, ars.Spec.Template.Spec.InitContainers, 2, "Template.Spec should have 2 init container")
+	assert.Len(t, ars.Spec.Template.Spec.InitContainers, 1, "Template.Spec should have 1 init container")
 	assert.Equal(t, "init-dind-externals", ars.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "ghcr.io/actions/actions-runner:latest", ars.Spec.Template.Spec.InitContainers[0].Image)
 	assert.Equal(t, "cp", ars.Spec.Template.Spec.InitContainers[0].Command[0])
 	assert.Equal(t, "-r /home/runner/externals/. /home/runner/tmpDir/", strings.Join(ars.Spec.Template.Spec.InitContainers[0].Args, " "))
 
-	assert.Equal(t, "dind", ars.Spec.Template.Spec.InitContainers[1].Name)
-	assert.Equal(t, "docker:dind", ars.Spec.Template.Spec.InitContainers[1].Image)
-	assert.True(t, *ars.Spec.Template.Spec.InitContainers[1].SecurityContext.Privileged)
-	assert.Len(t, ars.Spec.Template.Spec.InitContainers[1].VolumeMounts, 3, "The dind container should have 3 volume mounts, dind-sock, work and externals")
-	assert.Equal(t, "work", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[0].Name)
-	assert.Equal(t, "/home/runner/_work", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[0].MountPath)
-
-	assert.Equal(t, "dind-sock", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[1].Name)
-	assert.Equal(t, "/var/run", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[1].MountPath)
-
-	assert.Equal(t, "dind-externals", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[2].Name)
-	assert.Equal(t, "/home/runner/externals", ars.Spec.Template.Spec.InitContainers[1].VolumeMounts[2].MountPath)
-
-	assert.Len(t, ars.Spec.Template.Spec.Containers, 1, "Template.Spec should have 1 container")
+	assert.Len(t, ars.Spec.Template.Spec.Containers, 2, "Template.Spec should have 2 container")
 	assert.Equal(t, "runner", ars.Spec.Template.Spec.Containers[0].Name)
 	assert.Equal(t, "ghcr.io/actions/actions-runner:latest", ars.Spec.Template.Spec.Containers[0].Image)
 	assert.Len(t, ars.Spec.Template.Spec.Containers[0].Env, 2, "The runner container should have 2 env vars, DOCKER_HOST and RUNNER_WAIT_FOR_DOCKER_IN_SECONDS")
@@ -896,6 +883,19 @@ func TestTemplateRenderedAutoScalingRunnerSet_EnableDinD(t *testing.T) {
 	assert.Equal(t, "dind-sock", ars.Spec.Template.Spec.Containers[0].VolumeMounts[1].Name)
 	assert.Equal(t, "/var/run", ars.Spec.Template.Spec.Containers[0].VolumeMounts[1].MountPath)
 
+	assert.Equal(t, "dind", ars.Spec.Template.Spec.Containers[1].Name)
+	assert.Equal(t, "docker:dind", ars.Spec.Template.Spec.Containers[1].Image)
+	assert.True(t, *ars.Spec.Template.Spec.Containers[1].SecurityContext.Privileged)
+	assert.Len(t, ars.Spec.Template.Spec.Containers[1].VolumeMounts, 3, "The dind container should have 3 volume mounts, dind-sock, work and externals")
+	assert.Equal(t, "work", ars.Spec.Template.Spec.Containers[1].VolumeMounts[0].Name)
+	assert.Equal(t, "/home/runner/_work", ars.Spec.Template.Spec.Containers[1].VolumeMounts[0].MountPath)
+
+	assert.Equal(t, "dind-sock", ars.Spec.Template.Spec.Containers[1].VolumeMounts[1].Name)
+	assert.Equal(t, "/var/run", ars.Spec.Template.Spec.Containers[1].VolumeMounts[1].MountPath)
+
+	assert.Equal(t, "dind-externals", ars.Spec.Template.Spec.Containers[1].VolumeMounts[2].Name)
+	assert.Equal(t, "/home/runner/externals", ars.Spec.Template.Spec.Containers[1].VolumeMounts[2].MountPath)
+
 	assert.Len(t, ars.Spec.Template.Spec.Volumes, 3, "Volumes should be 3")
 	assert.Equal(t, "dind-sock", ars.Spec.Template.Spec.Volumes[0].Name, "Volume name should be dind-sock")
 	assert.Equal(t, "dind-externals", ars.Spec.Template.Spec.Volumes[1].Name, "Volume name should be dind-externals")
@@ -1158,7 +1158,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 			ars := render(t, options)
 
 			require.NotNil(t, ars.Spec.GitHubServerTLS)
-			expected := &v1alpha1.TLSConfig{
+			expected := &v1alpha1.GitHubServerTLSConfig{
 				CertificateFrom: &v1alpha1.TLSCertificateSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
@@ -1218,7 +1218,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 			ars := render(t, options)
 
 			require.NotNil(t, ars.Spec.GitHubServerTLS)
-			expected := &v1alpha1.TLSConfig{
+			expected := &v1alpha1.GitHubServerTLSConfig{
 				CertificateFrom: &v1alpha1.TLSCertificateSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
@@ -1278,7 +1278,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 			ars := render(t, options)
 
 			require.NotNil(t, ars.Spec.GitHubServerTLS)
-			expected := &v1alpha1.TLSConfig{
+			expected := &v1alpha1.GitHubServerTLSConfig{
 				CertificateFrom: &v1alpha1.TLSCertificateSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
@@ -1338,7 +1338,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 			ars := render(t, options)
 
 			require.NotNil(t, ars.Spec.GitHubServerTLS)
-			expected := &v1alpha1.TLSConfig{
+			expected := &v1alpha1.GitHubServerTLSConfig{
 				CertificateFrom: &v1alpha1.TLSCertificateSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
@@ -1394,7 +1394,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 			ars := render(t, options)
 
 			require.NotNil(t, ars.Spec.GitHubServerTLS)
-			expected := &v1alpha1.TLSConfig{
+			expected := &v1alpha1.GitHubServerTLSConfig{
 				CertificateFrom: &v1alpha1.TLSCertificateSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
@@ -1450,7 +1450,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 			ars := render(t, options)
 
 			require.NotNil(t, ars.Spec.GitHubServerTLS)
-			expected := &v1alpha1.TLSConfig{
+			expected := &v1alpha1.GitHubServerTLSConfig{
 				CertificateFrom: &v1alpha1.TLSCertificateSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{
@@ -1826,7 +1826,7 @@ func TestTemplateRenderedAutoScalingRunnerSet_DinDMergePodSpec(t *testing.T) {
 	var ars v1alpha1.AutoscalingRunnerSet
 	helm.UnmarshalK8SYaml(t, output, &ars)
 
-	assert.Len(t, ars.Spec.Template.Spec.Containers, 1, "There should be 1 containers")
+	assert.Len(t, ars.Spec.Template.Spec.Containers, 2, "There should be 2 containers")
 	assert.Equal(t, "runner", ars.Spec.Template.Spec.Containers[0].Name, "Container name should be runner")
 	assert.Equal(t, "250m", ars.Spec.Template.Spec.Containers[0].Resources.Limits.Cpu().String(), "CPU Limit should be set")
 	assert.Equal(t, "64Mi", ars.Spec.Template.Spec.Containers[0].Resources.Limits.Memory().String(), "Memory Limit should be set")
@@ -2468,43 +2468,3 @@ func TestNamespaceOverride(t *testing.T) {
 		})
 	}
 }
-
-func TestAutoscalingRunnerSetCustomAnnotationsAndLabelsApplied(t *testing.T) {
-	t.Parallel()
-
-	// Path to the helm chart we will test
-	helmChartPath, err := filepath.Abs("../../gha-runner-scale-set")
-	require.NoError(t, err)
-
-	releaseName := "test-runners"
-	namespaceName := "test-" + strings.ToLower(random.UniqueId())
-
-	options := &helm.Options{
-		Logger: logger.Discard,
-		SetValues: map[string]string{
-			"githubConfigUrl":                                              "https://github.com/actions",
-			"githubConfigSecret.github_token":                              "gh_token12345",
-			"controllerServiceAccount.name":                                "arc",
-			"controllerServiceAccount.namespace":                           "arc-system",
-			"annotations.actions\\.github\\.com/vault":                     "azure_key_vault",
-			"annotations.actions\\.github\\.com/cleanup-manager-role-name": "not-propagated",
-			"labels.custom":                                                "custom",
-			"labels.app\\.kubernetes\\.io/component":                       "not-propagated",
-		},
-		KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
-	}
-
-	output := helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/autoscalingrunnerset.yaml"})
-
-	var autoscalingRunnerSet v1alpha1.AutoscalingRunnerSet
-	helm.UnmarshalK8SYaml(t, output, &autoscalingRunnerSet)
-
-	vault := autoscalingRunnerSet.Annotations["actions.github.com/vault"]
-	assert.Equal(t, "azure_key_vault", vault)
-
-	custom := autoscalingRunnerSet.Labels["custom"]
-	assert.Equal(t, "custom", custom)
-
-	assert.NotEqual(t, "not-propagated", autoscalingRunnerSet.Annotations["actions.github.com/cleanup-manager-role-name"])
-	assert.NotEqual(t, "not-propagated", autoscalingRunnerSet.Labels["app.kubernetes.io/component"])
-}

charts/gha-runner-scale-set/values.yaml

@@ -6,7 +6,7 @@ githubConfigUrl: ""
 ## You can choose to supply:
 ##   A) a PAT token,
 ##   B) a GitHub App, or
-##   C) a pre-defined secret.
+##   C) a pre-defined Kubernetes secret.
 ## The syntax for each of these variations is documented below.
 ## (Variation A) When using a PAT token, the syntax is as follows:
 githubConfigSecret:
@@ -17,7 +17,6 @@ githubConfigSecret:
 ## (Variation B) When using a GitHub App, the syntax is as follows:
 # githubConfigSecret:
 #   # NOTE: IDs MUST be strings, use quotes
-#   # The github_app_id can be an app_id or the client_id
 #   github_app_id: ""
 #   github_app_installation_id: ""
 #   github_app_private_key: |
@@ -28,11 +27,8 @@ githubConfigSecret:
 #      .
 #      private key line N
 #
-## (Variation C) When using a pre-defined secret.
-## The secret can be pulled either directly from Kubernetes, or from the vault, depending on configuration.
-## Kubernetes secret in the same namespace that the gha-runner-scale-set is going to deploy.
-## On the other hand, if the vault is configured, secret name will be used to fetch the app configuration.
-## The syntax is as follows:
+## (Variation C) When using a pre-defined Kubernetes secret in the same namespace that the gha-runner-scale-set is going to deploy,
+## the syntax is as follows:
 # githubConfigSecret: pre-defined-secret
 ## Notes on using pre-defined Kubernetes secrets:
 ##   You need to make sure your predefined secret has all the required secret data set properly.
@@ -88,26 +84,6 @@ githubConfigSecret:
 #       key: ca.crt
 #   runnerMountPath: /usr/local/share/ca-certificates/
 
-# keyVault:
-  # Available values: "azure_key_vault"
-  # type: ""
-  # Configuration related to azure key vault
-  # azure_key_vault:
-  #   url: ""
-  #   client_id: ""
-  #   tenant_id: ""
-  #   certificate_path: ""
-    # proxy:
-    #   http:
-    #     url: http://proxy.com:1234
-    #     credentialSecretRef: proxy-auth # a secret with `username` and `password` keys
-    #   https:
-    #     url: http://proxy.com:1234
-    #     credentialSecretRef: proxy-auth # a secret with `username` and `password` keys
-    #   noProxy:
-    #     - example.com
-    #     - example.org
-
 ## Container mode is an object that provides out-of-box configuration
 ## for dind and kubernetes mode. Template will be modified as documented under the
 ## template object.
@@ -154,7 +130,7 @@ githubConfigSecret:
 #   counters:
 #     gha_started_jobs_total:
 #       labels:
-#         ["repository", "organization", "enterprise", "job_name", "event_name", "job_workflow_ref"]
+#         ["repository", "organization", "enterprise", "job_name", "event_name"]
 #     gha_completed_jobs_total:
 #       labels:
 #         [
@@ -164,7 +140,6 @@ githubConfigSecret:
 #           "job_name",
 #           "event_name",
 #           "job_result",
-#           "job_workflow_ref",
 #         ]
 #   gauges:
 #     gha_assigned_jobs:
@@ -186,7 +161,7 @@ githubConfigSecret:
 #   histograms:
 #     gha_job_startup_duration_seconds:
 #       labels:
-#         ["repository", "organization", "enterprise", "job_name", "event_name","job_workflow_ref"]
+#         ["repository", "organization", "enterprise", "job_name", "event_name"]
 #       buckets:
 #         [
 #           0.01,
@@ -244,7 +219,6 @@ githubConfigSecret:
 #           "job_name",
 #           "event_name",
 #           "job_result",
-#           "job_workflow_ref"
 #         ]
 #       buckets:
 #         [
@@ -309,6 +283,18 @@ template:
   ##       volumeMounts:
   ##         - name: dind-externals
   ##           mountPath: /home/runner/tmpDir
+  ##     containers:
+  ##     - name: runner
+  ##       image: ghcr.io/actions/actions-runner:latest
+  ##       command: ["/home/runner/run.sh"]
+  ##       env:
+  ##         - name: DOCKER_HOST
+  ##           value: unix:///var/run/docker.sock
+  ##       volumeMounts:
+  ##         - name: work
+  ##           mountPath: /home/runner/_work
+  ##         - name: dind-sock
+  ##           mountPath: /var/run
   ##     - name: dind
   ##       image: docker:dind
   ##       args:
@@ -320,29 +306,13 @@ template:
   ##           value: "123"
   ##       securityContext:
   ##         privileged: true
-  ##       restartPolicy: Always
-  ##       startupProbe:
-  ##         exec:
-  ##           command:
-  ##             - docker
-  ##             - info
-  ##           initialDelaySeconds: 0
-  ##           failureThreshold: 24
-  ##           periodSeconds: 5
-  ##     containers:
-  ##     - name: runner
-  ##       image: ghcr.io/actions/actions-runner:latest
-  ##       command: ["/home/runner/run.sh"]
-  ##       env:
-  ##         - name: DOCKER_HOST
-  ##           value: unix:///var/run/docker.sock
-  ##         - name: RUNNER_WAIT_FOR_DOCKER_IN_SECONDS
-  ##           value: "120"
   ##       volumeMounts:
   ##         - name: work
   ##           mountPath: /home/runner/_work
   ##         - name: dind-sock
   ##           mountPath: /var/run
+  ##         - name: dind-externals
+  ##           mountPath: /home/runner/externals
   ##     volumes:
   ##     - name: work
   ##       emptyDir: {}

cmd/ghalistener/app/app.go

@@ -17,7 +17,7 @@ import (
 // App is responsible for initializing required components and running the app.
 type App struct {
 	// configured fields
-	config *config.Config
+	config config.Config
 	logger logr.Logger
 
 	// initialized fields
@@ -38,12 +38,8 @@ type Worker interface {
 }
 
 func New(config config.Config) (*App, error) {
-	if err := config.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate config: %w", err)
-	}
-
 	app := &App{
-		config: &config,
+		config: config,
 	}
 
 	ghConfig, err := actions.ParseGitHubConfigFromURL(config.ConfigureUrl)
@@ -73,8 +69,8 @@ func New(config config.Config) (*App, error) {
 			Repository:        ghConfig.Repository,
 			ServerAddr:        config.MetricsAddr,
 			ServerEndpoint:    config.MetricsEndpoint,
-			Metrics:           config.Metrics,
 			Logger:            app.logger.WithName("metrics exporter"),
+			Metrics:           *config.Metrics,
 		})
 	}
 

cmd/ghalistener/config/config.go

@@ -1,7 +1,6 @@
 package config
 
 import (
-	"context"
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
@@ -10,26 +9,19 @@ import (
 	"os"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/actions/actions-runner-controller/build"
 	"github.com/actions/actions-runner-controller/github/actions"
 	"github.com/actions/actions-runner-controller/logging"
-	"github.com/actions/actions-runner-controller/vault"
-	"github.com/actions/actions-runner-controller/vault/azurekeyvault"
 	"github.com/go-logr/logr"
 	"golang.org/x/net/http/httpproxy"
 )
 
 type Config struct {
-	ConfigureUrl   string          `json:"configure_url"`
-	VaultType      vault.VaultType `json:"vault_type"`
-	VaultLookupKey string          `json:"vault_lookup_key"`
-	// If the VaultType is set to "azure_key_vault", this field must be populated.
-	AzureKeyVaultConfig *azurekeyvault.Config `json:"azure_key_vault,omitempty"`
-	// AppConfig contains the GitHub App configuration.
-	// It is initially set to nil if VaultType is set.
-	// Otherwise, it is populated with the GitHub App credentials from the GitHub secret.
-	*appconfig.AppConfig
+	ConfigureUrl                string                  `json:"configure_url"`
+	AppID                       int64                   `json:"app_id"`
+	AppInstallationID           int64                   `json:"app_installation_id"`
+	AppPrivateKey               string                  `json:"app_private_key"`
+	Token                       string                  `json:"token"`
 	EphemeralRunnerSetNamespace string                  `json:"ephemeral_runner_set_namespace"`
 	EphemeralRunnerSetName      string                  `json:"ephemeral_runner_set_name"`
 	MaxRunners                  int                     `json:"max_runners"`
@@ -44,58 +36,23 @@ type Config struct {
 	Metrics                     *v1alpha1.MetricsConfig `json:"metrics"`
 }
 
-func Read(ctx context.Context, configPath string) (*Config, error) {
-	f, err := os.Open(configPath)
+func Read(path string) (Config, error) {
+	f, err := os.Open(path)
 	if err != nil {
-		return nil, err
+		return Config{}, err
 	}
 	defer f.Close()
 
 	var config Config
 	if err := json.NewDecoder(f).Decode(&config); err != nil {
-		return nil, fmt.Errorf("failed to decode config: %w", err)
+		return Config{}, fmt.Errorf("failed to decode config: %w", err)
 	}
 
-	var vault vault.Vault
-	switch config.VaultType {
-	case "":
-		if err := config.Validate(); err != nil {
-			return nil, fmt.Errorf("failed to validate configuration: %v", err)
-		}
-
-		return &config, nil
-	case "azure_key_vault":
-		akv, err := azurekeyvault.New(*config.AzureKeyVaultConfig)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create Azure Key Vault client: %w", err)
-		}
-
-		vault = akv
-	default:
-		return nil, fmt.Errorf("unsupported vault type: %s", config.VaultType)
-	}
-
-	appConfigRaw, err := vault.GetSecret(ctx, config.VaultLookupKey)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get app config from vault: %w", err)
-	}
-
-	appConfig, err := appconfig.FromJSONString(appConfigRaw)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read app config from string: %v", err)
-	}
-
-	config.AppConfig = appConfig
-
 	if err := config.Validate(); err != nil {
-		return nil, fmt.Errorf("config validation failed: %w", err)
+		return Config{}, fmt.Errorf("failed to validate config: %w", err)
 	}
 
-	if ctx.Err() != nil {
-		return nil, ctx.Err()
-	}
-
-	return &config, nil
+	return config, nil
 }
 
 // Validate checks the configuration for errors.
@@ -105,30 +62,26 @@ func (c *Config) Validate() error {
 	}
 
 	if len(c.EphemeralRunnerSetNamespace) == 0 || len(c.EphemeralRunnerSetName) == 0 {
-		return fmt.Errorf("EphemeralRunnerSetNamespace %q or EphemeralRunnerSetName %q is missing", c.EphemeralRunnerSetNamespace, c.EphemeralRunnerSetName)
+		return fmt.Errorf("EphemeralRunnerSetNamespace '%s' or EphemeralRunnerSetName '%s' is missing", c.EphemeralRunnerSetNamespace, c.EphemeralRunnerSetName)
 	}
 
 	if c.RunnerScaleSetId == 0 {
-		return fmt.Errorf(`RunnerScaleSetId "%d" is missing`, c.RunnerScaleSetId)
+		return fmt.Errorf("RunnerScaleSetId '%d' is missing", c.RunnerScaleSetId)
 	}
 
 	if c.MaxRunners < c.MinRunners {
-		return fmt.Errorf(`MinRunners "%d" cannot be greater than MaxRunners "%d"`, c.MinRunners, c.MaxRunners)
+		return fmt.Errorf("MinRunners '%d' cannot be greater than MaxRunners '%d'", c.MinRunners, c.MaxRunners)
 	}
 
-	if c.VaultType != "" {
-		if err := c.VaultType.Validate(); err != nil {
-			return fmt.Errorf("VaultType validation failed: %w", err)
-		}
-		if c.VaultLookupKey == "" {
-			return fmt.Errorf("VaultLookupKey is required when VaultType is set to %q", c.VaultType)
-		}
+	hasToken := len(c.Token) > 0
+	hasPrivateKeyConfig := c.AppID > 0 && c.AppPrivateKey != ""
+
+	if !hasToken && !hasPrivateKeyConfig {
+		return fmt.Errorf("GitHub auth credential is missing, token length: '%d', appId: '%d', installationId: '%d', private key length: '%d", len(c.Token), c.AppID, c.AppInstallationID, len(c.AppPrivateKey))
 	}
 
-	if c.VaultType == "" && c.VaultLookupKey == "" {
-		if err := c.AppConfig.Validate(); err != nil {
-			return fmt.Errorf("AppConfig validation failed: %w", err)
-		}
+	if hasToken && hasPrivateKeyConfig {
+		return fmt.Errorf("only one GitHub auth method supported at a time. Have both PAT and App auth: token length: '%d', appId: '%d', installationId: '%d', private key length: '%d", len(c.Token), c.AppID, c.AppInstallationID, len(c.AppPrivateKey))
 	}
 
 	return nil

cmd/ghalistener/config/config_client_test.go

@@ -9,7 +9,6 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/actions/actions-runner-controller/cmd/ghalistener/config"
 	"github.com/actions/actions-runner-controller/github/actions"
 	"github.com/actions/actions-runner-controller/github/actions/testserver"
@@ -54,9 +53,7 @@ func TestCustomerServerRootCA(t *testing.T) {
 	config := config.Config{
 		ConfigureUrl: server.ConfigURLForOrg("myorg"),
 		ServerRootCA: certsString,
-		AppConfig: &appconfig.AppConfig{
-			Token: "token",
-		},
+		Token:        "token",
 	}
 
 	client, err := config.ActionsClient(logr.Discard())
@@ -83,9 +80,7 @@ func TestProxySettings(t *testing.T) {
 
 		config := config.Config{
 			ConfigureUrl: "https://github.com/org/repo",
-			AppConfig: &appconfig.AppConfig{
-				Token: "token",
-			},
+			Token:        "token",
 		}
 
 		client, err := config.ActionsClient(logr.Discard())
@@ -115,9 +110,7 @@ func TestProxySettings(t *testing.T) {
 
 		config := config.Config{
 			ConfigureUrl: "https://github.com/org/repo",
-			AppConfig: &appconfig.AppConfig{
-				Token: "token",
-			},
+			Token:        "token",
 		}
 
 		client, err := config.ActionsClient(logr.Discard(), actions.WithRetryMax(0))
@@ -152,9 +145,7 @@ func TestProxySettings(t *testing.T) {
 
 		config := config.Config{
 			ConfigureUrl: "https://github.com/org/repo",
-			AppConfig: &appconfig.AppConfig{
-				Token: "token",
-			},
+			Token:        "token",
 		}
 
 		client, err := config.ActionsClient(logr.Discard())

cmd/ghalistener/config/config_test.go

@@ -0,0 +1,92 @@
+package config
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConfigValidationMinMax(t *testing.T) {
+	config := &Config{
+		ConfigureUrl:                "github.com/some_org/some_repo",
+		EphemeralRunnerSetNamespace: "namespace",
+		EphemeralRunnerSetName:      "deployment",
+		RunnerScaleSetId:            1,
+		MinRunners:                  5,
+		MaxRunners:                  2,
+		Token:                       "token",
+	}
+	err := config.Validate()
+	assert.ErrorContains(t, err, "MinRunners '5' cannot be greater than MaxRunners '2", "Expected error about MinRunners > MaxRunners")
+}
+
+func TestConfigValidationMissingToken(t *testing.T) {
+	config := &Config{
+		ConfigureUrl:                "github.com/some_org/some_repo",
+		EphemeralRunnerSetNamespace: "namespace",
+		EphemeralRunnerSetName:      "deployment",
+		RunnerScaleSetId:            1,
+	}
+	err := config.Validate()
+	expectedError := fmt.Sprintf("GitHub auth credential is missing, token length: '%d', appId: '%d', installationId: '%d', private key length: '%d", len(config.Token), config.AppID, config.AppInstallationID, len(config.AppPrivateKey))
+	assert.ErrorContains(t, err, expectedError, "Expected error about missing auth")
+}
+
+func TestConfigValidationAppKey(t *testing.T) {
+	config := &Config{
+		AppID:                       1,
+		AppInstallationID:           10,
+		ConfigureUrl:                "github.com/some_org/some_repo",
+		EphemeralRunnerSetNamespace: "namespace",
+		EphemeralRunnerSetName:      "deployment",
+		RunnerScaleSetId:            1,
+	}
+	err := config.Validate()
+	expectedError := fmt.Sprintf("GitHub auth credential is missing, token length: '%d', appId: '%d', installationId: '%d', private key length: '%d", len(config.Token), config.AppID, config.AppInstallationID, len(config.AppPrivateKey))
+	assert.ErrorContains(t, err, expectedError, "Expected error about missing auth")
+}
+
+func TestConfigValidationOnlyOneTypeOfCredentials(t *testing.T) {
+	config := &Config{
+		AppID:                       1,
+		AppInstallationID:           10,
+		AppPrivateKey:               "asdf",
+		Token:                       "asdf",
+		ConfigureUrl:                "github.com/some_org/some_repo",
+		EphemeralRunnerSetNamespace: "namespace",
+		EphemeralRunnerSetName:      "deployment",
+		RunnerScaleSetId:            1,
+	}
+	err := config.Validate()
+	expectedError := fmt.Sprintf("only one GitHub auth method supported at a time. Have both PAT and App auth: token length: '%d', appId: '%d', installationId: '%d', private key length: '%d", len(config.Token), config.AppID, config.AppInstallationID, len(config.AppPrivateKey))
+	assert.ErrorContains(t, err, expectedError, "Expected error about missing auth")
+}
+
+func TestConfigValidation(t *testing.T) {
+	config := &Config{
+		ConfigureUrl:                "https://github.com/actions",
+		EphemeralRunnerSetNamespace: "namespace",
+		EphemeralRunnerSetName:      "deployment",
+		RunnerScaleSetId:            1,
+		MinRunners:                  1,
+		MaxRunners:                  5,
+		Token:                       "asdf",
+	}
+
+	err := config.Validate()
+
+	assert.NoError(t, err, "Expected no error")
+}
+
+func TestConfigValidationConfigUrl(t *testing.T) {
+	config := &Config{
+		EphemeralRunnerSetNamespace: "namespace",
+		EphemeralRunnerSetName:      "deployment",
+		RunnerScaleSetId:            1,
+	}
+
+	err := config.Validate()
+
+	assert.ErrorContains(t, err, "GitHubConfigUrl is not provided", "Expected error about missing ConfigureUrl")
+}

cmd/ghalistener/config/config_validation_test.go

@@ -1,170 +0,0 @@
-package config
-
-import (
-	"testing"
-
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
-	"github.com/actions/actions-runner-controller/vault"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestConfigValidationMinMax(t *testing.T) {
-	config := &Config{
-		ConfigureUrl:                "github.com/some_org/some_repo",
-		EphemeralRunnerSetNamespace: "namespace",
-		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetId:            1,
-		MinRunners:                  5,
-		MaxRunners:                  2,
-		AppConfig: &appconfig.AppConfig{
-			Token: "token",
-		},
-	}
-	err := config.Validate()
-	assert.ErrorContains(t, err, `MinRunners "5" cannot be greater than MaxRunners "2"`, "Expected error about MinRunners > MaxRunners")
-}
-
-func TestConfigValidationMissingToken(t *testing.T) {
-	config := &Config{
-		ConfigureUrl:                "github.com/some_org/some_repo",
-		EphemeralRunnerSetNamespace: "namespace",
-		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetId:            1,
-	}
-	err := config.Validate()
-	expectedError := "AppConfig validation failed: missing app config"
-	assert.ErrorContains(t, err, expectedError, "Expected error about missing auth")
-}
-
-func TestConfigValidationAppKey(t *testing.T) {
-	t.Parallel()
-
-	t.Run("app id integer", func(t *testing.T) {
-		t.Parallel()
-		config := &Config{
-			AppConfig: &appconfig.AppConfig{
-				AppID:             "1",
-				AppInstallationID: 10,
-			},
-			ConfigureUrl:                "github.com/some_org/some_repo",
-			EphemeralRunnerSetNamespace: "namespace",
-			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetId:            1,
-		}
-		err := config.Validate()
-		expectedError := "AppConfig validation failed: no credentials provided: either a PAT or GitHub App credentials should be provided"
-		assert.ErrorContains(t, err, expectedError, "Expected error about missing auth")
-	})
-
-	t.Run("app id as client id", func(t *testing.T) {
-		t.Parallel()
-		config := &Config{
-			AppConfig: &appconfig.AppConfig{
-				AppID:             "Iv23f8doAlphaNumer1c",
-				AppInstallationID: 10,
-			},
-			ConfigureUrl:                "github.com/some_org/some_repo",
-			EphemeralRunnerSetNamespace: "namespace",
-			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetId:            1,
-		}
-		err := config.Validate()
-		expectedError := "AppConfig validation failed: no credentials provided: either a PAT or GitHub App credentials should be provided"
-		assert.ErrorContains(t, err, expectedError, "Expected error about missing auth")
-	})
-}
-
-func TestConfigValidationOnlyOneTypeOfCredentials(t *testing.T) {
-	config := &Config{
-		AppConfig: &appconfig.AppConfig{
-			AppID:             "1",
-			AppInstallationID: 10,
-			AppPrivateKey:     "asdf",
-			Token:             "asdf",
-		},
-		ConfigureUrl:                "github.com/some_org/some_repo",
-		EphemeralRunnerSetNamespace: "namespace",
-		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetId:            1,
-	}
-	err := config.Validate()
-	expectedError := "AppConfig validation failed: both PAT and GitHub App credentials provided. should only provide one"
-	assert.ErrorContains(t, err, expectedError, "Expected error about missing auth")
-}
-
-func TestConfigValidation(t *testing.T) {
-	config := &Config{
-		ConfigureUrl:                "https://github.com/actions",
-		EphemeralRunnerSetNamespace: "namespace",
-		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetId:            1,
-		MinRunners:                  1,
-		MaxRunners:                  5,
-		AppConfig: &appconfig.AppConfig{
-			Token: "asdf",
-		},
-	}
-
-	err := config.Validate()
-
-	assert.NoError(t, err, "Expected no error")
-}
-
-func TestConfigValidationConfigUrl(t *testing.T) {
-	config := &Config{
-		EphemeralRunnerSetNamespace: "namespace",
-		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetId:            1,
-	}
-
-	err := config.Validate()
-
-	assert.ErrorContains(t, err, "GitHubConfigUrl is not provided", "Expected error about missing ConfigureUrl")
-}
-
-func TestConfigValidationWithVaultConfig(t *testing.T) {
-	t.Run("valid", func(t *testing.T) {
-		config := &Config{
-			ConfigureUrl:                "https://github.com/actions",
-			EphemeralRunnerSetNamespace: "namespace",
-			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetId:            1,
-			MinRunners:                  1,
-			MaxRunners:                  5,
-			VaultType:                   vault.VaultTypeAzureKeyVault,
-			VaultLookupKey:              "testkey",
-		}
-		err := config.Validate()
-		assert.NoError(t, err, "Expected no error for valid vault type")
-	})
-
-	t.Run("invalid vault type", func(t *testing.T) {
-		config := &Config{
-			ConfigureUrl:                "https://github.com/actions",
-			EphemeralRunnerSetNamespace: "namespace",
-			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetId:            1,
-			MinRunners:                  1,
-			MaxRunners:                  5,
-			VaultType:                   vault.VaultType("invalid_vault_type"),
-			VaultLookupKey:              "testkey",
-		}
-		err := config.Validate()
-		assert.ErrorContains(t, err, `unknown vault type: "invalid_vault_type"`, "Expected error for invalid vault type")
-	})
-
-	t.Run("vault type set without lookup key", func(t *testing.T) {
-		config := &Config{
-			ConfigureUrl:                "https://github.com/actions",
-			EphemeralRunnerSetNamespace: "namespace",
-			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetId:            1,
-			MinRunners:                  1,
-			MaxRunners:                  5,
-			VaultType:                   vault.VaultTypeAzureKeyVault,
-			VaultLookupKey:              "",
-		}
-		err := config.Validate()
-		assert.ErrorContains(t, err, `VaultLookupKey is required when VaultType is set to "azure_key_vault"`, "Expected error for vault type without lookup key")
-	})
-}

cmd/ghalistener/main.go

@@ -13,27 +13,26 @@ import (
 )
 
 func main() {
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer stop()
-
 	configPath, ok := os.LookupEnv("LISTENER_CONFIG_PATH")
 	if !ok {
 		fmt.Fprintf(os.Stderr, "Error: LISTENER_CONFIG_PATH environment variable is not set\n")
 		os.Exit(1)
 	}
-
-	config, err := config.Read(ctx, configPath)
+	config, err := config.Read(configPath)
 	if err != nil {
 		log.Printf("Failed to read config: %v", err)
 		os.Exit(1)
 	}
 
-	app, err := app.New(*config)
+	app, err := app.New(config)
 	if err != nil {
 		log.Printf("Failed to initialize app: %v", err)
 		os.Exit(1)
 	}
 
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
 	if err := app.Run(ctx); err != nil {
 		log.Printf("Application returned an error: %v", err)
 		os.Exit(1)

cmd/ghalistener/metrics/metrics.go

@@ -21,7 +21,6 @@ const (
 	labelKeyOrganization            = "organization"
 	labelKeyRepository              = "repository"
 	labelKeyJobName                 = "job_name"
-	labelKeyJobWorkflowRef          = "job_workflow_ref"
 	labelKeyEventName               = "event_name"
 	labelKeyJobResult               = "job_result"
 )
@@ -76,12 +75,11 @@ var metricsHelp = metricsHelpRegistry{
 
 func (e *exporter) jobLabels(jobBase *actions.JobMessageBase) prometheus.Labels {
 	return prometheus.Labels{
-		labelKeyEnterprise:     e.scaleSetLabels[labelKeyEnterprise],
-		labelKeyOrganization:   jobBase.OwnerName,
-		labelKeyRepository:     jobBase.RepositoryName,
-		labelKeyJobName:        jobBase.JobDisplayName,
-		labelKeyJobWorkflowRef: jobBase.JobWorkflowRef,
-		labelKeyEventName:      jobBase.EventName,
+		labelKeyEnterprise:   e.scaleSetLabels[labelKeyEnterprise],
+		labelKeyOrganization: jobBase.OwnerName,
+		labelKeyRepository:   jobBase.RepositoryName,
+		labelKeyJobName:      jobBase.JobDisplayName,
+		labelKeyEventName:    jobBase.EventName,
 	}
 }
 
@@ -154,148 +152,13 @@ type ExporterConfig struct {
 	ServerAddr        string
 	ServerEndpoint    string
 	Logger            logr.Logger
-	Metrics           *v1alpha1.MetricsConfig
-}
-
-var defaultMetrics = v1alpha1.MetricsConfig{
-	Counters: map[string]*v1alpha1.CounterMetric{
-		MetricStartedJobsTotal: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyJobName,
-				labelKeyEventName,
-			},
-		},
-		MetricCompletedJobsTotal: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyJobName,
-				labelKeyEventName,
-				labelKeyJobResult,
-			},
-		},
-	},
-	Gauges: map[string]*v1alpha1.GaugeMetric{
-		MetricAssignedJobs: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-		MetricRunningJobs: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-		MetricRegisteredRunners: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-		MetricBusyRunners: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-		MetricMinRunners: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-		MetricMaxRunners: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-		MetricDesiredRunners: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-		MetricIdleRunners: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyRunnerScaleSetName,
-				labelKeyRunnerScaleSetNamespace,
-			},
-		},
-	},
-	Histograms: map[string]*v1alpha1.HistogramMetric{
-		MetricJobStartupDurationSeconds: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyJobName,
-				labelKeyEventName,
-			},
-			Buckets: defaultRuntimeBuckets,
-		},
-		MetricJobExecutionDurationSeconds: {
-			Labels: []string{
-				labelKeyEnterprise,
-				labelKeyOrganization,
-				labelKeyRepository,
-				labelKeyJobName,
-				labelKeyEventName,
-				labelKeyJobResult,
-			},
-			Buckets: defaultRuntimeBuckets,
-		},
-	},
-}
-
-func (e *ExporterConfig) defaults() {
-	if e.ServerAddr == "" {
-		e.ServerAddr = ":8080"
-	}
-	if e.ServerEndpoint == "" {
-		e.ServerEndpoint = "/metrics"
-	}
-	if e.Metrics == nil {
-		defaultMetrics := defaultMetrics
-		e.Metrics = &defaultMetrics
-	}
+	Metrics           v1alpha1.MetricsConfig
 }
 
 func NewExporter(config ExporterConfig) ServerExporter {
-	config.defaults()
 	reg := prometheus.NewRegistry()
 
-	metrics := installMetrics(*config.Metrics, reg, config.Logger)
+	metrics := installMetrics(config.Metrics, reg, config.Logger)
 
 	mux := http.NewServeMux()
 	mux.Handle(

cmd/ghalistener/metrics/metrics_test.go

@@ -7,7 +7,6 @@ import (
 	"github.com/go-logr/logr"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestInstallMetrics(t *testing.T) {
@@ -87,179 +86,3 @@ func TestInstallMetrics(t *testing.T) {
 	assert.Equal(t, duration.config.Labels, metricsConfig.Histograms[MetricJobStartupDurationSeconds].Labels)
 	assert.Equal(t, duration.config.Buckets, defaultRuntimeBuckets)
 }
-
-func TestNewExporter(t *testing.T) {
-	t.Run("with defaults metrics applied", func(t *testing.T) {
-		config := ExporterConfig{
-			ScaleSetName:      "test-scale-set",
-			ScaleSetNamespace: "test-namespace",
-			Enterprise:        "",
-			Organization:      "org",
-			Repository:        "repo",
-			ServerAddr:        ":6060",
-			ServerEndpoint:    "/metrics",
-			Logger:            logr.Discard(),
-			Metrics:           nil, // when metrics is nil, all default metrics should be registered
-		}
-
-		exporter, ok := NewExporter(config).(*exporter)
-		require.True(t, ok, "expected exporter to be of type *exporter")
-		require.NotNil(t, exporter)
-
-		reg := prometheus.NewRegistry()
-		wantMetrics := installMetrics(defaultMetrics, reg, config.Logger)
-
-		assert.Equal(t, len(wantMetrics.counters), len(exporter.counters))
-		for k, v := range wantMetrics.counters {
-			assert.Contains(t, exporter.counters, k)
-			assert.Equal(t, v.config, exporter.counters[k].config)
-		}
-
-		assert.Equal(t, len(wantMetrics.gauges), len(exporter.gauges))
-		for k, v := range wantMetrics.gauges {
-			assert.Contains(t, exporter.gauges, k)
-			assert.Equal(t, v.config, exporter.gauges[k].config)
-		}
-
-		assert.Equal(t, len(wantMetrics.histograms), len(exporter.histograms))
-		for k, v := range wantMetrics.histograms {
-			assert.Contains(t, exporter.histograms, k)
-			assert.Equal(t, v.config, exporter.histograms[k].config)
-		}
-
-		require.NotNil(t, exporter.srv)
-		assert.Equal(t, config.ServerAddr, exporter.srv.Addr)
-	})
-
-	t.Run("with default server URL", func(t *testing.T) {
-		config := ExporterConfig{
-			ScaleSetName:      "test-scale-set",
-			ScaleSetNamespace: "test-namespace",
-			Enterprise:        "",
-			Organization:      "org",
-			Repository:        "repo",
-			ServerAddr:        "", // empty ServerAddr should default to ":8080"
-			ServerEndpoint:    "",
-			Logger:            logr.Discard(),
-			Metrics:           nil, // when metrics is nil, all default metrics should be registered
-		}
-
-		exporter, ok := NewExporter(config).(*exporter)
-		require.True(t, ok, "expected exporter to be of type *exporter")
-		require.NotNil(t, exporter)
-
-		reg := prometheus.NewRegistry()
-		wantMetrics := installMetrics(defaultMetrics, reg, config.Logger)
-
-		assert.Equal(t, len(wantMetrics.counters), len(exporter.counters))
-		for k, v := range wantMetrics.counters {
-			assert.Contains(t, exporter.counters, k)
-			assert.Equal(t, v.config, exporter.counters[k].config)
-		}
-
-		assert.Equal(t, len(wantMetrics.gauges), len(exporter.gauges))
-		for k, v := range wantMetrics.gauges {
-			assert.Contains(t, exporter.gauges, k)
-			assert.Equal(t, v.config, exporter.gauges[k].config)
-		}
-
-		assert.Equal(t, len(wantMetrics.histograms), len(exporter.histograms))
-		for k, v := range wantMetrics.histograms {
-			assert.Contains(t, exporter.histograms, k)
-			assert.Equal(t, v.config, exporter.histograms[k].config)
-		}
-
-		require.NotNil(t, exporter.srv)
-		assert.Equal(t, exporter.srv.Addr, ":8080")
-	})
-
-	t.Run("with metrics configured", func(t *testing.T) {
-		metricsConfig := v1alpha1.MetricsConfig{
-			Counters: map[string]*v1alpha1.CounterMetric{
-				MetricStartedJobsTotal: {
-					Labels: []string{labelKeyRepository},
-				},
-			},
-			Gauges: map[string]*v1alpha1.GaugeMetric{
-				MetricAssignedJobs: {
-					Labels: []string{labelKeyRepository},
-				},
-			},
-			Histograms: map[string]*v1alpha1.HistogramMetric{
-				MetricJobExecutionDurationSeconds: {
-					Labels:  []string{labelKeyRepository},
-					Buckets: []float64{0.1, 1},
-				},
-			},
-		}
-
-		config := ExporterConfig{
-			ScaleSetName:      "test-scale-set",
-			ScaleSetNamespace: "test-namespace",
-			Enterprise:        "",
-			Organization:      "org",
-			Repository:        "repo",
-			ServerAddr:        ":6060",
-			ServerEndpoint:    "/metrics",
-			Logger:            logr.Discard(),
-			Metrics:           &metricsConfig,
-		}
-
-		exporter, ok := NewExporter(config).(*exporter)
-		require.True(t, ok, "expected exporter to be of type *exporter")
-		require.NotNil(t, exporter)
-
-		reg := prometheus.NewRegistry()
-		wantMetrics := installMetrics(metricsConfig, reg, config.Logger)
-
-		assert.Equal(t, len(wantMetrics.counters), len(exporter.counters))
-		for k, v := range wantMetrics.counters {
-			assert.Contains(t, exporter.counters, k)
-			assert.Equal(t, v.config, exporter.counters[k].config)
-		}
-
-		assert.Equal(t, len(wantMetrics.gauges), len(exporter.gauges))
-		for k, v := range wantMetrics.gauges {
-			assert.Contains(t, exporter.gauges, k)
-			assert.Equal(t, v.config, exporter.gauges[k].config)
-		}
-
-		assert.Equal(t, len(wantMetrics.histograms), len(exporter.histograms))
-		for k, v := range wantMetrics.histograms {
-			assert.Contains(t, exporter.histograms, k)
-			assert.Equal(t, v.config, exporter.histograms[k].config)
-		}
-
-		require.NotNil(t, exporter.srv)
-		assert.Equal(t, config.ServerAddr, exporter.srv.Addr)
-	})
-}
-
-func TestExporterConfigDefaults(t *testing.T) {
-	config := ExporterConfig{
-		ScaleSetName:      "test-scale-set",
-		ScaleSetNamespace: "test-namespace",
-		Enterprise:        "",
-		Organization:      "org",
-		Repository:        "repo",
-		ServerAddr:        "",
-		ServerEndpoint:    "",
-		Logger:            logr.Discard(),
-		Metrics:           nil, // when metrics is nil, all default metrics should be registered
-	}
-
-	config.defaults()
-	want := ExporterConfig{
-		ScaleSetName:      "test-scale-set",
-		ScaleSetNamespace: "test-namespace",
-		Enterprise:        "",
-		Organization:      "org",
-		Repository:        "repo",
-		ServerAddr:        ":8080",    // default server address
-		ServerEndpoint:    "/metrics", // default server endpoint
-		Logger:            logr.Discard(),
-		Metrics:           &defaultMetrics, // when metrics is nil, all default metrics should be registered
-	}
-
-	assert.Equal(t, want, config)
-}

config/crd/bases/actions.github.com_autoscalinglisteners.yaml

@@ -7863,53 +7863,6 @@ spec:
                         - containers
                       type: object
                   type: object
-                vaultConfig:
-                  properties:
-                    azureKeyVault:
-                      properties:
-                        certificatePath:
-                          type: string
-                        clientId:
-                          type: string
-                        tenantId:
-                          type: string
-                        url:
-                          type: string
-                      required:
-                        - certificatePath
-                        - clientId
-                        - tenantId
-                        - url
-                      type: object
-                    proxy:
-                      properties:
-                        http:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        https:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        noProxy:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type:
-                      description: |-
-                        VaultType represents the type of vault that can be used in the application.
-                        It is used to identify which vault integration should be used to resolve secrets.
-                      type: string
-                  type: object
               type: object
             status:
               description: AutoscalingListenerStatus defines the observed state of AutoscalingListener

config/crd/bases/actions.github.com_autoscalingrunnersets.yaml

@@ -15504,53 +15504,6 @@ spec:
                         - containers
                       type: object
                   type: object
-                vaultConfig:
-                  properties:
-                    azureKeyVault:
-                      properties:
-                        certificatePath:
-                          type: string
-                        clientId:
-                          type: string
-                        tenantId:
-                          type: string
-                        url:
-                          type: string
-                      required:
-                        - certificatePath
-                        - clientId
-                        - tenantId
-                        - url
-                      type: object
-                    proxy:
-                      properties:
-                        http:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        https:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        noProxy:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type:
-                      description: |-
-                        VaultType represents the type of vault that can be used in the application.
-                        It is used to identify which vault integration should be used to resolve secrets.
-                      type: string
-                  type: object
               type: object
             status:
               description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet

config/crd/bases/actions.github.com_ephemeralrunners.yaml

@@ -7784,53 +7784,6 @@ spec:
                   required:
                     - containers
                   type: object
-                vaultConfig:
-                  properties:
-                    azureKeyVault:
-                      properties:
-                        certificatePath:
-                          type: string
-                        clientId:
-                          type: string
-                        tenantId:
-                          type: string
-                        url:
-                          type: string
-                      required:
-                        - certificatePath
-                        - clientId
-                        - tenantId
-                        - url
-                      type: object
-                    proxy:
-                      properties:
-                        http:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        https:
-                          properties:
-                            credentialSecretRef:
-                              type: string
-                            url:
-                              description: Required
-                              type: string
-                          type: object
-                        noProxy:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type:
-                      description: |-
-                        VaultType represents the type of vault that can be used in the application.
-                        It is used to identify which vault integration should be used to resolve secrets.
-                      type: string
-                  type: object
               required:
                 - githubConfigSecret
                 - githubConfigUrl
@@ -7841,8 +7794,7 @@ spec:
               properties:
                 failures:
                   additionalProperties:
-                    format: date-time
-                    type: string
+                    type: boolean
                   type: object
                 jobDisplayName:
                   type: string

config/crd/bases/actions.github.com_ephemeralrunnersets.yaml

@@ -7778,53 +7778,6 @@ spec:
                       required:
                         - containers
                       type: object
-                    vaultConfig:
-                      properties:
-                        azureKeyVault:
-                          properties:
-                            certificatePath:
-                              type: string
-                            clientId:
-                              type: string
-                            tenantId:
-                              type: string
-                            url:
-                              type: string
-                          required:
-                            - certificatePath
-                            - clientId
-                            - tenantId
-                            - url
-                          type: object
-                        proxy:
-                          properties:
-                            http:
-                              properties:
-                                credentialSecretRef:
-                                  type: string
-                                url:
-                                  description: Required
-                                  type: string
-                              type: object
-                            https:
-                              properties:
-                                credentialSecretRef:
-                                  type: string
-                                url:
-                                  description: Required
-                                  type: string
-                              type: object
-                            noProxy:
-                              items:
-                                type: string
-                              type: array
-                          type: object
-                        type:
-                          description: |-
-                            VaultType represents the type of vault that can be used in the application.
-                            It is used to identify which vault integration should be used to resolve secrets.
-                          type: string
-                      type: object
                   required:
                     - githubConfigSecret
                     - githubConfigUrl

controllers/actions.github.com/autoscalinglistener_controller.go

@@ -32,7 +32,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	v1alpha1 "github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/actions/actions-runner-controller/controllers/actions.github.com/metrics"
 	"github.com/actions/actions-runner-controller/github/actions"
 	hash "github.com/actions/actions-runner-controller/hash"
@@ -129,24 +128,41 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 		return ctrl.Result{}, err
 	}
 
-	appConfig, err := r.GetAppConfig(ctx, &autoscalingRunnerSet)
-	if err != nil {
-		log.Error(
-			err,
-			"Failed to get app config for AutoscalingRunnerSet.",
-			"namespace",
-			autoscalingRunnerSet.Namespace,
-			"name",
-			autoscalingRunnerSet.GitHubConfigSecret,
-		)
+	// Check if the GitHub config secret exists
+	secret := new(corev1.Secret)
+	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: autoscalingListener.Spec.GitHubConfigSecret}, secret); err != nil {
+		log.Error(err, "Failed to find GitHub config secret.",
+			"namespace", autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
+			"name", autoscalingListener.Spec.GitHubConfigSecret)
 		return ctrl.Result{}, err
 	}
 
+	// Create a mirror secret in the same namespace as the AutoscalingListener
+	mirrorSecret := new(corev1.Secret)
+	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Namespace, Name: scaleSetListenerSecretMirrorName(autoscalingListener)}, mirrorSecret); err != nil {
+		if !kerrors.IsNotFound(err) {
+			log.Error(err, "Unable to get listener secret mirror", "namespace", autoscalingListener.Namespace, "name", scaleSetListenerSecretMirrorName(autoscalingListener))
+			return ctrl.Result{}, err
+		}
+
+		// Create a mirror secret for the listener pod in the Controller namespace for listener pod to use
+		log.Info("Creating a mirror listener secret for the listener pod")
+		return r.createSecretsForListener(ctx, autoscalingListener, secret, log)
+	}
+
+	// make sure the mirror secret is up to date
+	mirrorSecretDataHash := mirrorSecret.Labels["secret-data-hash"]
+	secretDataHash := hash.ComputeTemplateHash(secret.Data)
+	if mirrorSecretDataHash != secretDataHash {
+		log.Info("Updating mirror listener secret for the listener pod", "mirrorSecretDataHash", mirrorSecretDataHash, "secretDataHash", secretDataHash)
+		return r.updateSecretsForListener(ctx, secret, mirrorSecret, log)
+	}
+
 	// Make sure the runner scale set listener service account is created for the listener pod in the controller namespace
 	serviceAccount := new(corev1.ServiceAccount)
-	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Namespace, Name: autoscalingListener.Name}, serviceAccount); err != nil {
+	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Namespace, Name: scaleSetListenerServiceAccountName(autoscalingListener)}, serviceAccount); err != nil {
 		if !kerrors.IsNotFound(err) {
-			log.Error(err, "Unable to get listener service accounts", "namespace", autoscalingListener.Namespace, "name", autoscalingListener.Name)
+			log.Error(err, "Unable to get listener service accounts", "namespace", autoscalingListener.Namespace, "name", scaleSetListenerServiceAccountName(autoscalingListener))
 			return ctrl.Result{}, err
 		}
 
@@ -159,9 +175,9 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 
 	// Make sure the runner scale set listener role is created in the AutoscalingRunnerSet namespace
 	listenerRole := new(rbacv1.Role)
-	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: autoscalingListener.Name}, listenerRole); err != nil {
+	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: scaleSetListenerRoleName(autoscalingListener)}, listenerRole); err != nil {
 		if !kerrors.IsNotFound(err) {
-			log.Error(err, "Unable to get listener role", "namespace", autoscalingListener.Spec.AutoscalingRunnerSetNamespace, "name", autoscalingListener.Name)
+			log.Error(err, "Unable to get listener role", "namespace", autoscalingListener.Spec.AutoscalingRunnerSetNamespace, "name", scaleSetListenerRoleName(autoscalingListener))
 			return ctrl.Result{}, err
 		}
 
@@ -181,9 +197,9 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 
 	// Make sure the runner scale set listener role binding is created
 	listenerRoleBinding := new(rbacv1.RoleBinding)
-	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: autoscalingListener.Name}, listenerRoleBinding); err != nil {
+	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: scaleSetListenerRoleName(autoscalingListener)}, listenerRoleBinding); err != nil {
 		if !kerrors.IsNotFound(err) {
-			log.Error(err, "Unable to get listener role binding", "namespace", autoscalingListener.Spec.AutoscalingRunnerSetNamespace, "name", autoscalingListener.Name)
+			log.Error(err, "Unable to get listener role binding", "namespace", autoscalingListener.Spec.AutoscalingRunnerSetNamespace, "name", scaleSetListenerRoleName(autoscalingListener))
 			return ctrl.Result{}, err
 		}
 
@@ -223,7 +239,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 
 		// Create a listener pod in the controller namespace
 		log.Info("Creating a listener pod")
-		return r.createListenerPod(ctx, &autoscalingRunnerSet, autoscalingListener, serviceAccount, appConfig, log)
+		return r.createListenerPod(ctx, &autoscalingRunnerSet, autoscalingListener, serviceAccount, mirrorSecret, log)
 	}
 
 	cs := listenerContainerStatus(listenerPod)
@@ -244,19 +260,6 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 				log.Error(err, "Unable to delete the listener pod", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
 				return ctrl.Result{}, err
 			}
-
-			// delete the listener config secret as well, so it gets recreated when the listener pod is recreated, with any new data if it exists
-			var configSecret corev1.Secret
-			err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Namespace, Name: scaleSetListenerConfigName(autoscalingListener)}, &configSecret)
-			switch {
-			case err == nil && configSecret.DeletionTimestamp.IsZero():
-				log.Info("Deleting the listener config secret")
-				if err := r.Delete(ctx, &configSecret); err != nil {
-					return ctrl.Result{}, fmt.Errorf("failed to delete listener config secret: %w", err)
-				}
-			case !kerrors.IsNotFound(err):
-				return ctrl.Result{}, fmt.Errorf("failed to get the listener config secret: %w", err)
-			}
 		}
 		return ctrl.Result{}, nil
 	case cs.State.Running != nil:
@@ -327,7 +330,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 	}
 
 	listenerRoleBinding := new(rbacv1.RoleBinding)
-	err = r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: autoscalingListener.Name}, listenerRoleBinding)
+	err = r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: scaleSetListenerRoleName(autoscalingListener)}, listenerRoleBinding)
 	switch {
 	case err == nil:
 		if listenerRoleBinding.DeletionTimestamp.IsZero() {
@@ -343,7 +346,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 	logger.Info("Listener role binding is deleted")
 
 	listenerRole := new(rbacv1.Role)
-	err = r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: autoscalingListener.Name}, listenerRole)
+	err = r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, Name: scaleSetListenerRoleName(autoscalingListener)}, listenerRole)
 	switch {
 	case err == nil:
 		if listenerRole.DeletionTimestamp.IsZero() {
@@ -360,7 +363,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 
 	logger.Info("Cleaning up the listener service account")
 	listenerSa := new(corev1.ServiceAccount)
-	err = r.Get(ctx, types.NamespacedName{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, listenerSa)
+	err = r.Get(ctx, types.NamespacedName{Name: scaleSetListenerServiceAccountName(autoscalingListener), Namespace: autoscalingListener.Namespace}, listenerSa)
 	switch {
 	case err == nil:
 		if listenerSa.DeletionTimestamp.IsZero() {
@@ -395,7 +398,7 @@ func (r *AutoscalingListenerReconciler) createServiceAccountForListener(ctx cont
 	return ctrl.Result{}, nil
 }
 
-func (r *AutoscalingListenerReconciler) createListenerPod(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, autoscalingListener *v1alpha1.AutoscalingListener, serviceAccount *corev1.ServiceAccount, appConfig *appconfig.AppConfig, logger logr.Logger) (ctrl.Result, error) {
+func (r *AutoscalingListenerReconciler) createListenerPod(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, autoscalingListener *v1alpha1.AutoscalingListener, serviceAccount *corev1.ServiceAccount, secret *corev1.Secret, logger logr.Logger) (ctrl.Result, error) {
 	var envs []corev1.EnvVar
 	if autoscalingListener.Spec.Proxy != nil {
 		httpURL := corev1.EnvVar{
@@ -464,7 +467,7 @@ func (r *AutoscalingListenerReconciler) createListenerPod(ctx context.Context, a
 
 		logger.Info("Creating listener config secret")
 
-		podConfig, err := r.newScaleSetListenerConfig(autoscalingListener, appConfig, metricsConfig, cert)
+		podConfig, err := r.newScaleSetListenerConfig(autoscalingListener, secret, metricsConfig, cert)
 		if err != nil {
 			logger.Error(err, "Failed to build listener config secret")
 			return ctrl.Result{}, err
@@ -483,7 +486,7 @@ func (r *AutoscalingListenerReconciler) createListenerPod(ctx context.Context, a
 		return ctrl.Result{Requeue: true}, nil
 	}
 
-	newPod, err := r.newScaleSetListenerPod(autoscalingListener, &podConfig, serviceAccount, metricsConfig, envs...)
+	newPod, err := r.newScaleSetListenerPod(autoscalingListener, &podConfig, serviceAccount, secret, metricsConfig, envs...)
 	if err != nil {
 		logger.Error(err, "Failed to build listener pod")
 		return ctrl.Result{}, err
@@ -542,6 +545,23 @@ func (r *AutoscalingListenerReconciler) certificate(ctx context.Context, autosca
 	return certificate, nil
 }
 
+func (r *AutoscalingListenerReconciler) createSecretsForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, secret *corev1.Secret, logger logr.Logger) (ctrl.Result, error) {
+	newListenerSecret := r.newScaleSetListenerSecretMirror(autoscalingListener, secret)
+
+	if err := ctrl.SetControllerReference(autoscalingListener, newListenerSecret, r.Scheme); err != nil {
+		return ctrl.Result{}, err
+	}
+
+	logger.Info("Creating listener secret", "namespace", newListenerSecret.Namespace, "name", newListenerSecret.Name)
+	if err := r.Create(ctx, newListenerSecret); err != nil {
+		logger.Error(err, "Unable to create listener secret", "namespace", newListenerSecret.Namespace, "name", newListenerSecret.Name)
+		return ctrl.Result{}, err
+	}
+
+	logger.Info("Created listener secret", "namespace", newListenerSecret.Namespace, "name", newListenerSecret.Name)
+	return ctrl.Result{Requeue: true}, nil
+}
+
 func (r *AutoscalingListenerReconciler) createProxySecret(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (ctrl.Result, error) {
 	data, err := autoscalingListener.Spec.Proxy.ToSecretData(func(s string) (*corev1.Secret, error) {
 		var secret corev1.Secret
@@ -581,6 +601,22 @@ func (r *AutoscalingListenerReconciler) createProxySecret(ctx context.Context, a
 	return ctrl.Result{Requeue: true}, nil
 }
 
+func (r *AutoscalingListenerReconciler) updateSecretsForListener(ctx context.Context, secret *corev1.Secret, mirrorSecret *corev1.Secret, logger logr.Logger) (ctrl.Result, error) {
+	dataHash := hash.ComputeTemplateHash(secret.Data)
+	updatedMirrorSecret := mirrorSecret.DeepCopy()
+	updatedMirrorSecret.Labels["secret-data-hash"] = dataHash
+	updatedMirrorSecret.Data = secret.Data
+
+	logger.Info("Updating listener mirror secret", "namespace", updatedMirrorSecret.Namespace, "name", updatedMirrorSecret.Name, "hash", dataHash)
+	if err := r.Update(ctx, updatedMirrorSecret); err != nil {
+		logger.Error(err, "Unable to update listener mirror secret", "namespace", updatedMirrorSecret.Namespace, "name", updatedMirrorSecret.Name)
+		return ctrl.Result{}, err
+	}
+
+	logger.Info("Updated listener mirror secret", "namespace", updatedMirrorSecret.Namespace, "name", updatedMirrorSecret.Name, "hash", dataHash)
+	return ctrl.Result{Requeue: true}, nil
+}
+
 func (r *AutoscalingListenerReconciler) createRoleForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (ctrl.Result, error) {
 	newRole := r.newScaleSetListenerRole(autoscalingListener)
 

controllers/actions.github.com/autoscalinglistener_controller_test.go

@@ -14,8 +14,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 
-	ghalistenerconfig "github.com/actions/actions-runner-controller/cmd/ghalistener/config"
-	"github.com/actions/actions-runner-controller/github/actions/fake"
+	listenerconfig "github.com/actions/actions-runner-controller/cmd/ghalistener/config"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
@@ -44,17 +43,10 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 		autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient)
 		configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
-		secretResolver := NewSecretResolver(mgr.GetClient(), fake.NewMultiClient())
-
-		rb := ResourceBuilder{
-			SecretResolver: secretResolver,
-		}
-
 		controller := &AutoscalingListenerReconciler{
-			Client:          mgr.GetClient(),
-			Scheme:          mgr.GetScheme(),
-			Log:             logf.Log,
-			ResourceBuilder: rb,
+			Client: mgr.GetClient(),
+			Scheme: mgr.GetScheme(),
+			Log:    logf.Log,
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -142,25 +134,37 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 				autoscalingListenerTestTimeout,
 				autoscalingListenerTestInterval).Should(BeEquivalentTo(autoscalingListenerFinalizerName), "AutoScalingListener should have a finalizer")
 
+			// Check if secret is created
+			mirrorSecret := new(corev1.Secret)
+			Eventually(
+				func() (string, error) {
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerSecretMirrorName(autoscalingListener), Namespace: autoscalingListener.Namespace}, mirrorSecret)
+					if err != nil {
+						return "", err
+					}
+					return string(mirrorSecret.Data["github_token"]), nil
+				},
+				autoscalingListenerTestTimeout,
+				autoscalingListenerTestInterval).Should(BeEquivalentTo(autoscalingListenerTestGitHubToken), "Mirror secret should be created")
+
 			// Check if service account is created
 			serviceAccount := new(corev1.ServiceAccount)
 			Eventually(
 				func() (string, error) {
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, serviceAccount)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerServiceAccountName(autoscalingListener), Namespace: autoscalingListener.Namespace}, serviceAccount)
 					if err != nil {
 						return "", err
 					}
 					return serviceAccount.Name, nil
 				},
 				autoscalingListenerTestTimeout,
-				autoscalingListenerTestInterval,
-			).Should(BeEquivalentTo(autoscalingListener.Name), "Service account should be created")
+				autoscalingListenerTestInterval).Should(BeEquivalentTo(scaleSetListenerServiceAccountName(autoscalingListener)), "Service account should be created")
 
 			// Check if role is created
 			role := new(rbacv1.Role)
 			Eventually(
 				func() ([]rbacv1.PolicyRule, error) {
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, role)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerRoleName(autoscalingListener), Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, role)
 					if err != nil {
 						return nil, err
 					}
@@ -174,7 +178,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 			roleBinding := new(rbacv1.RoleBinding)
 			Eventually(
 				func() (string, error) {
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, roleBinding)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerRoleName(autoscalingListener), Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, roleBinding)
 					if err != nil {
 						return "", err
 					}
@@ -182,7 +186,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 					return roleBinding.RoleRef.Name, nil
 				},
 				autoscalingListenerTestTimeout,
-				autoscalingListenerTestInterval).Should(BeEquivalentTo(autoscalingListener.Name), "Rolebinding should be created")
+				autoscalingListenerTestInterval).Should(BeEquivalentTo(scaleSetListenerRoleName(autoscalingListener)), "Rolebinding should be created")
 
 			// Check if pod is created
 			pod := new(corev1.Pod)
@@ -244,7 +248,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 			Eventually(
 				func() bool {
 					roleBinding := new(rbacv1.RoleBinding)
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, roleBinding)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerRoleName(autoscalingListener), Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, roleBinding)
 					return kerrors.IsNotFound(err)
 				},
 				autoscalingListenerTestTimeout,
@@ -255,7 +259,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 			Eventually(
 				func() bool {
 					role := new(rbacv1.Role)
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, role)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerRoleName(autoscalingListener), Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, role)
 					return kerrors.IsNotFound(err)
 				},
 				autoscalingListenerTestTimeout,
@@ -336,7 +340,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 			role := new(rbacv1.Role)
 			Eventually(
 				func() ([]rbacv1.PolicyRule, error) {
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, role)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerRoleName(autoscalingListener), Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace}, role)
 					if err != nil {
 						return nil, err
 					}
@@ -347,7 +351,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 				autoscalingListenerTestInterval).Should(BeEquivalentTo(rulesForListenerRole([]string{updated.Spec.EphemeralRunnerSetName})), "Role should be updated")
 		})
 
-		It("It should re-create pod and config secret whenever listener container is terminated", func() {
+		It("It should re-create pod whenever listener container is terminated", func() {
 			// Waiting for the pod is created
 			pod := new(corev1.Pod)
 			Eventually(
@@ -363,18 +367,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 				autoscalingListenerTestInterval,
 			).Should(BeEquivalentTo(autoscalingListener.Name), "Pod should be created")
 
-			secret := new(corev1.Secret)
-			Eventually(
-				func() error {
-					return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerConfigName(autoscalingListener), Namespace: autoscalingListener.Namespace}, secret)
-				},
-				autoscalingListenerTestTimeout,
-				autoscalingListenerTestInterval,
-			).Should(Succeed(), "Config secret should be created")
-
 			oldPodUID := string(pod.UID)
-			oldSecretUID := string(secret.UID)
-
 			updated := pod.DeepCopy()
 			updated.Status.ContainerStatuses = []corev1.ContainerStatus{
 				{
@@ -403,21 +396,75 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 				autoscalingListenerTestTimeout,
 				autoscalingListenerTestInterval,
 			).ShouldNot(BeEquivalentTo(oldPodUID), "Pod should be re-created")
+		})
 
-			// Check if config secret is re-created
+		It("It should update mirror secrets to match secret used by AutoScalingRunnerSet", func() {
+			// Waiting for the pod is created
+			pod := new(corev1.Pod)
 			Eventually(
 				func() (string, error) {
-					secret := new(corev1.Secret)
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerConfigName(autoscalingListener), Namespace: autoscalingListener.Namespace}, secret)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, pod)
 					if err != nil {
 						return "", err
 					}
 
-					return string(secret.UID), nil
+					return pod.Name, nil
 				},
 				autoscalingListenerTestTimeout,
-				autoscalingListenerTestInterval,
-			).ShouldNot(BeEquivalentTo(oldSecretUID), "Config secret should be re-created")
+				autoscalingListenerTestInterval).Should(BeEquivalentTo(autoscalingListener.Name), "Pod should be created")
+
+			// Update the secret
+			updatedSecret := configSecret.DeepCopy()
+			updatedSecret.Data["github_token"] = []byte(autoscalingListenerTestGitHubToken + "_updated")
+			err := k8sClient.Update(ctx, updatedSecret)
+			Expect(err).NotTo(HaveOccurred(), "failed to update test secret")
+
+			updatedPod := pod.DeepCopy()
+			// Ignore status running and consult the container state
+			updatedPod.Status.Phase = corev1.PodRunning
+			updatedPod.Status.ContainerStatuses = []corev1.ContainerStatus{
+				{
+					Name: autoscalingListenerContainerName,
+					State: corev1.ContainerState{
+						Terminated: &corev1.ContainerStateTerminated{
+							ExitCode: 1,
+						},
+					},
+				},
+			}
+			err = k8sClient.Status().Update(ctx, updatedPod)
+			Expect(err).NotTo(HaveOccurred(), "failed to update test pod to failed")
+
+			// Check if mirror secret is updated with right data
+			mirrorSecret := new(corev1.Secret)
+			Eventually(
+				func() (map[string][]byte, error) {
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerSecretMirrorName(autoscalingListener), Namespace: autoscalingListener.Namespace}, mirrorSecret)
+					if err != nil {
+						return nil, err
+					}
+
+					return mirrorSecret.Data, nil
+				},
+				autoscalingListenerTestTimeout,
+				autoscalingListenerTestInterval).Should(BeEquivalentTo(updatedSecret.Data), "Mirror secret should be updated")
+
+			// Check if we re-created a new pod
+			Eventually(
+				func() error {
+					latestPod := new(corev1.Pod)
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, latestPod)
+					if err != nil {
+						return err
+					}
+					if latestPod.UID == pod.UID {
+						return fmt.Errorf("Pod should be recreated")
+					}
+
+					return nil
+				},
+				autoscalingListenerTestTimeout,
+				autoscalingListenerTestInterval).Should(Succeed(), "Pod should be recreated")
 		})
 	})
 })
@@ -460,17 +507,10 @@ var _ = Describe("Test AutoScalingListener customization", func() {
 		autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient)
 		configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
-		secretResolver := NewSecretResolver(mgr.GetClient(), fake.NewMultiClient())
-
-		rb := ResourceBuilder{
-			SecretResolver: secretResolver,
-		}
-
 		controller := &AutoscalingListenerReconciler{
-			Client:          mgr.GetClient(),
-			Scheme:          mgr.GetScheme(),
-			Log:             logf.Log,
-			ResourceBuilder: rb,
+			Client: mgr.GetClient(),
+			Scheme: mgr.GetScheme(),
+			Log:    logf.Log,
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -740,17 +780,11 @@ var _ = Describe("Test AutoScalingListener controller with proxy", func() {
 		ctx = context.Background()
 		autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient)
 		configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
-		secretResolver := NewSecretResolver(mgr.GetClient(), fake.NewMultiClient())
-
-		rb := ResourceBuilder{
-			SecretResolver: secretResolver,
-		}
 
 		controller := &AutoscalingListenerReconciler{
-			Client:          mgr.GetClient(),
-			Scheme:          mgr.GetScheme(),
-			Log:             logf.Log,
-			ResourceBuilder: rb,
+			Client: mgr.GetClient(),
+			Scheme: mgr.GetScheme(),
+			Log:    logf.Log,
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -943,17 +977,10 @@ var _ = Describe("Test AutoScalingListener controller with template modification
 		autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient)
 		configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
-		secretResolver := NewSecretResolver(mgr.GetClient(), fake.NewMultiClient())
-
-		rb := ResourceBuilder{
-			SecretResolver: secretResolver,
-		}
-
 		controller := &AutoscalingListenerReconciler{
-			Client:          mgr.GetClient(),
-			Scheme:          mgr.GetScheme(),
-			Log:             logf.Log,
-			ResourceBuilder: rb,
+			Client: mgr.GetClient(),
+			Scheme: mgr.GetScheme(),
+			Log:    logf.Log,
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1046,12 +1073,6 @@ var _ = Describe("Test GitHub Server TLS configuration", func() {
 		autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient)
 		configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
-		secretResolver := NewSecretResolver(mgr.GetClient(), fake.NewMultiClient())
-
-		rb := ResourceBuilder{
-			SecretResolver: secretResolver,
-		}
-
 		cert, err := os.ReadFile(filepath.Join(
 			"../../",
 			"github",
@@ -1073,10 +1094,9 @@ var _ = Describe("Test GitHub Server TLS configuration", func() {
 		Expect(err).NotTo(HaveOccurred(), "failed to create configmap with root CAs")
 
 		controller := &AutoscalingListenerReconciler{
-			Client:          mgr.GetClient(),
-			Scheme:          mgr.GetScheme(),
-			Log:             logf.Log,
-			ResourceBuilder: rb,
+			Client: mgr.GetClient(),
+			Scheme: mgr.GetScheme(),
+			Log:    logf.Log,
 		}
 		err = controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1091,7 +1111,7 @@ var _ = Describe("Test GitHub Server TLS configuration", func() {
 			Spec: v1alpha1.AutoscalingRunnerSetSpec{
 				GitHubConfigUrl:    "https://github.com/owner/repo",
 				GitHubConfigSecret: configSecret.Name,
-				GitHubServerTLS: &v1alpha1.TLSConfig{
+				GitHubServerTLS: &v1alpha1.GitHubServerTLSConfig{
 					CertificateFrom: &v1alpha1.TLSCertificateSource{
 						ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 							LocalObjectReference: corev1.LocalObjectReference{
@@ -1127,7 +1147,7 @@ var _ = Describe("Test GitHub Server TLS configuration", func() {
 			Spec: v1alpha1.AutoscalingListenerSpec{
 				GitHubConfigUrl:    "https://github.com/owner/repo",
 				GitHubConfigSecret: configSecret.Name,
-				GitHubServerTLS: &v1alpha1.TLSConfig{
+				GitHubServerTLS: &v1alpha1.GitHubServerTLSConfig{
 					CertificateFrom: &v1alpha1.TLSCertificateSource{
 						ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 							LocalObjectReference: corev1.LocalObjectReference{
@@ -1171,7 +1191,7 @@ var _ = Describe("Test GitHub Server TLS configuration", func() {
 
 					g.Expect(config.Data["config.json"]).ToNot(BeEmpty(), "listener configuration file should not be empty")
 
-					var listenerConfig ghalistenerconfig.Config
+					var listenerConfig listenerconfig.Config
 					err = json.Unmarshal(config.Data["config.json"], &listenerConfig)
 					g.Expect(err).NotTo(HaveOccurred(), "failed to parse listener configuration file")
 

controllers/actions.github.com/autoscalingrunnerset_controller.go

@@ -151,7 +151,7 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl
 		return ctrl.Result{}, nil
 	}
 
-	if !v1alpha1.IsVersionAllowed(autoscalingRunnerSet.Labels[LabelKeyKubernetesVersion], build.Version) {
+	if autoscalingRunnerSet.Labels[LabelKeyKubernetesVersion] != build.Version {
 		if err := r.Delete(ctx, autoscalingRunnerSet); err != nil {
 			log.Error(err, "Failed to delete autoscaling runner set on version mismatch",
 				"buildVersion", build.Version,
@@ -207,6 +207,14 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl
 		return r.updateRunnerScaleSetName(ctx, autoscalingRunnerSet, log)
 	}
 
+	secret := new(corev1.Secret)
+	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingRunnerSet.Namespace, Name: autoscalingRunnerSet.Spec.GitHubConfigSecret}, secret); err != nil {
+		log.Error(err, "Failed to find GitHub config secret.",
+			"namespace", autoscalingRunnerSet.Namespace,
+			"name", autoscalingRunnerSet.Spec.GitHubConfigSecret)
+		return ctrl.Result{}, err
+	}
+
 	existingRunnerSets, err := r.listEphemeralRunnerSets(ctx, autoscalingRunnerSet)
 	if err != nil {
 		log.Error(err, "Failed to list existing ephemeral runner sets")
@@ -394,12 +402,12 @@ func (r *AutoscalingRunnerSetReconciler) removeFinalizersFromDependentResources(
 
 func (r *AutoscalingRunnerSetReconciler) createRunnerScaleSet(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, logger logr.Logger) (ctrl.Result, error) {
 	logger.Info("Creating a new runner scale set")
-	actionsClient, err := r.GetActionsService(ctx, autoscalingRunnerSet)
+	actionsClient, err := r.actionsClientFor(ctx, autoscalingRunnerSet)
 	if len(autoscalingRunnerSet.Spec.RunnerScaleSetName) == 0 {
 		autoscalingRunnerSet.Spec.RunnerScaleSetName = autoscalingRunnerSet.Name
 	}
 	if err != nil {
-		logger.Error(err, "Failed to initialize Actions service client for creating a new runner scale set", "error", err.Error())
+		logger.Error(err, "Failed to initialize Actions service client for creating a new runner scale set")
 		return ctrl.Result{}, err
 	}
 
@@ -490,7 +498,7 @@ func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetRunnerGroup(ctx con
 		return ctrl.Result{}, err
 	}
 
-	actionsClient, err := r.GetActionsService(ctx, autoscalingRunnerSet)
+	actionsClient, err := r.actionsClientFor(ctx, autoscalingRunnerSet)
 	if err != nil {
 		logger.Error(err, "Failed to initialize Actions service client for updating a existing runner scale set")
 		return ctrl.Result{}, err
@@ -538,7 +546,7 @@ func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetName(ctx context.Co
 		return ctrl.Result{}, nil
 	}
 
-	actionsClient, err := r.GetActionsService(ctx, autoscalingRunnerSet)
+	actionsClient, err := r.actionsClientFor(ctx, autoscalingRunnerSet)
 	if err != nil {
 		logger.Error(err, "Failed to initialize Actions service client for updating a existing runner scale set")
 		return ctrl.Result{}, err
@@ -589,7 +597,7 @@ func (r *AutoscalingRunnerSetReconciler) deleteRunnerScaleSet(ctx context.Contex
 		return nil
 	}
 
-	actionsClient, err := r.GetActionsService(ctx, autoscalingRunnerSet)
+	actionsClient, err := r.actionsClientFor(ctx, autoscalingRunnerSet)
 	if err != nil {
 		logger.Error(err, "Failed to initialize Actions service client for updating a existing runner scale set")
 		return err
@@ -668,6 +676,74 @@ func (r *AutoscalingRunnerSetReconciler) listEphemeralRunnerSets(ctx context.Con
 	return &EphemeralRunnerSets{list: list}, nil
 }
 
+func (r *AutoscalingRunnerSetReconciler) actionsClientFor(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet) (actions.ActionsService, error) {
+	var configSecret corev1.Secret
+	if err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingRunnerSet.Namespace, Name: autoscalingRunnerSet.Spec.GitHubConfigSecret}, &configSecret); err != nil {
+		return nil, fmt.Errorf("failed to find GitHub config secret: %w", err)
+	}
+
+	opts, err := r.actionsClientOptionsFor(ctx, autoscalingRunnerSet)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get actions client options: %w", err)
+	}
+
+	return r.ActionsClient.GetClientFromSecret(
+		ctx,
+		autoscalingRunnerSet.Spec.GitHubConfigUrl,
+		autoscalingRunnerSet.Namespace,
+		configSecret.Data,
+		opts...,
+	)
+}
+
+func (r *AutoscalingRunnerSetReconciler) actionsClientOptionsFor(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet) ([]actions.ClientOption, error) {
+	var options []actions.ClientOption
+
+	if autoscalingRunnerSet.Spec.Proxy != nil {
+		proxyFunc, err := autoscalingRunnerSet.Spec.Proxy.ProxyFunc(func(s string) (*corev1.Secret, error) {
+			var secret corev1.Secret
+			err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingRunnerSet.Namespace, Name: s}, &secret)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get proxy secret %s: %w", s, err)
+			}
+
+			return &secret, nil
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to get proxy func: %w", err)
+		}
+
+		options = append(options, actions.WithProxy(proxyFunc))
+	}
+
+	tlsConfig := autoscalingRunnerSet.Spec.GitHubServerTLS
+	if tlsConfig != nil {
+		pool, err := tlsConfig.ToCertPool(func(name, key string) ([]byte, error) {
+			var configmap corev1.ConfigMap
+			err := r.Get(
+				ctx,
+				types.NamespacedName{
+					Namespace: autoscalingRunnerSet.Namespace,
+					Name:      name,
+				},
+				&configmap,
+			)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get configmap %s: %w", name, err)
+			}
+
+			return []byte(configmap.Data[key]), nil
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to get tls config: %w", err)
+		}
+
+		options = append(options, actions.WithRootCAs(pool))
+	}
+
+	return options, nil
+}
+
 // SetupWithManager sets up the controller with the Manager.
 func (r *AutoscalingRunnerSetReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).

controllers/actions.github.com/autoscalingrunnerset_controller_test.go

@@ -70,12 +70,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() {
 			Log:                                logf.Log,
 			ControllerNamespace:                autoscalingNS.Name,
 			DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-			ResourceBuilder: ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   k8sClient,
-					multiClient: fake.NewMultiClient(),
-				},
-			},
+			ActionsClient:                      fake.NewMultiClient(),
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -682,40 +677,33 @@ var _ = Describe("Test AutoScalingController updates", Ordered, func() {
 			autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient)
 			configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
-			multiClient := fake.NewMultiClient(
-				fake.WithDefaultClient(
-					fake.NewFakeClient(
-						fake.WithUpdateRunnerScaleSet(
-							&actions.RunnerScaleSet{
-								Id:                 1,
-								Name:               "testset_update",
-								RunnerGroupId:      1,
-								RunnerGroupName:    "testgroup",
-								Labels:             []actions.Label{{Type: "test", Name: "test"}},
-								RunnerSetting:      actions.RunnerSetting{},
-								CreatedOn:          time.Now(),
-								RunnerJitConfigUrl: "test.test.test",
-								Statistics:         nil,
-							},
-							nil,
-						),
-					),
-					nil,
-				),
-			)
-
 			controller := &AutoscalingRunnerSetReconciler{
 				Client:                             mgr.GetClient(),
 				Scheme:                             mgr.GetScheme(),
 				Log:                                logf.Log,
 				ControllerNamespace:                autoscalingNS.Name,
 				DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient:   k8sClient,
-						multiClient: multiClient,
-					},
-				},
+				ActionsClient: fake.NewMultiClient(
+					fake.WithDefaultClient(
+						fake.NewFakeClient(
+							fake.WithUpdateRunnerScaleSet(
+								&actions.RunnerScaleSet{
+									Id:                 1,
+									Name:               "testset_update",
+									RunnerGroupId:      1,
+									RunnerGroupName:    "testgroup",
+									Labels:             []actions.Label{{Type: "test", Name: "test"}},
+									RunnerSetting:      actions.RunnerSetting{},
+									CreatedOn:          time.Now(),
+									RunnerJitConfigUrl: "test.test.test",
+									Statistics:         nil,
+								},
+								nil,
+							),
+						),
+						nil,
+					),
+				),
 			}
 			err := controller.SetupWithManager(mgr)
 			Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -830,12 +818,7 @@ var _ = Describe("Test AutoscalingController creation failures", Ordered, func()
 				Log:                                logf.Log,
 				ControllerNamespace:                autoscalingNS.Name,
 				DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient:   k8sClient,
-						multiClient: fake.NewMultiClient(),
-					},
-				},
+				ActionsClient:                      fake.NewMultiClient(),
 			}
 			err := controller.SetupWithManager(mgr)
 			Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -954,19 +937,14 @@ var _ = Describe("Test client optional configuration", Ordered, func() {
 			ctx = context.Background()
 			autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient)
 			configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
-			multiClient := actions.NewMultiClient(logr.Discard())
+
 			controller = &AutoscalingRunnerSetReconciler{
 				Client:                             mgr.GetClient(),
 				Scheme:                             mgr.GetScheme(),
 				Log:                                logf.Log,
 				ControllerNamespace:                autoscalingNS.Name,
 				DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient:   k8sClient,
-						multiClient: multiClient,
-					},
-				},
+				ActionsClient:                      actions.NewMultiClient(logr.Discard()),
 			}
 
 			err := controller.SetupWithManager(mgr)
@@ -1149,12 +1127,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() {
 				Log:                                logf.Log,
 				ControllerNamespace:                autoscalingNS.Name,
 				DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient:   k8sClient,
-						multiClient: fake.NewMultiClient(),
-					},
-				},
+				ActionsClient:                      fake.NewMultiClient(),
 			}
 			err = controller.SetupWithManager(mgr)
 			Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1163,10 +1136,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() {
 		})
 
 		It("should be able to make requests to a server using root CAs", func() {
-			controller.SecretResolver = &SecretResolver{
-				k8sClient:   k8sClient,
-				multiClient: actions.NewMultiClient(logr.Discard()),
-			}
+			controller.ActionsClient = actions.NewMultiClient(logr.Discard())
 
 			certsFolder := filepath.Join(
 				"../../",
@@ -1201,7 +1171,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() {
 				Spec: v1alpha1.AutoscalingRunnerSetSpec{
 					GitHubConfigUrl:    server.ConfigURLForOrg("my-org"),
 					GitHubConfigSecret: configSecret.Name,
-					GitHubServerTLS: &v1alpha1.TLSConfig{
+					GitHubServerTLS: &v1alpha1.GitHubServerTLSConfig{
 						CertificateFrom: &v1alpha1.TLSCertificateSource{
 							ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 								LocalObjectReference: corev1.LocalObjectReference{
@@ -1254,7 +1224,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() {
 				Spec: v1alpha1.AutoscalingRunnerSetSpec{
 					GitHubConfigUrl:    "https://github.com/owner/repo",
 					GitHubConfigSecret: configSecret.Name,
-					GitHubServerTLS: &v1alpha1.TLSConfig{
+					GitHubServerTLS: &v1alpha1.GitHubServerTLSConfig{
 						CertificateFrom: &v1alpha1.TLSCertificateSource{
 							ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 								LocalObjectReference: corev1.LocalObjectReference{
@@ -1318,7 +1288,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() {
 				Spec: v1alpha1.AutoscalingRunnerSetSpec{
 					GitHubConfigUrl:    "https://github.com/owner/repo",
 					GitHubConfigSecret: configSecret.Name,
-					GitHubServerTLS: &v1alpha1.TLSConfig{
+					GitHubServerTLS: &v1alpha1.GitHubServerTLSConfig{
 						CertificateFrom: &v1alpha1.TLSCertificateSource{
 							ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 								LocalObjectReference: corev1.LocalObjectReference{
@@ -1391,12 +1361,7 @@ var _ = Describe("Test external permissions cleanup", Ordered, func() {
 			Log:                                logf.Log,
 			ControllerNamespace:                autoscalingNS.Name,
 			DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-			ResourceBuilder: ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   k8sClient,
-					multiClient: fake.NewMultiClient(),
-				},
-			},
+			ActionsClient:                      fake.NewMultiClient(),
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1554,12 +1519,7 @@ var _ = Describe("Test external permissions cleanup", Ordered, func() {
 			Log:                                logf.Log,
 			ControllerNamespace:                autoscalingNS.Name,
 			DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-			ResourceBuilder: ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   k8sClient,
-					multiClient: fake.NewMultiClient(),
-				},
-			},
+			ActionsClient:                      fake.NewMultiClient(),
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1767,12 +1727,7 @@ var _ = Describe("Test resource version and build version mismatch", func() {
 			Log:                                logf.Log,
 			ControllerNamespace:                autoscalingNS.Name,
 			DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc",
-			ResourceBuilder: ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   k8sClient,
-					multiClient: fake.NewMultiClient(),
-				},
-			},
+			ActionsClient:                      fake.NewMultiClient(),
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")

controllers/actions.github.com/ephemeralrunner_controller.go

@@ -28,7 +28,6 @@ import (
 	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -45,24 +44,12 @@ const (
 // EphemeralRunnerReconciler reconciles a EphemeralRunner object
 type EphemeralRunnerReconciler struct {
 	client.Client
-	Log    logr.Logger
-	Scheme *runtime.Scheme
+	Log           logr.Logger
+	Scheme        *runtime.Scheme
+	ActionsClient actions.MultiClient
 	ResourceBuilder
 }
 
-// precompute backoff durations for failed ephemeral runners
-// the len(failedRunnerBackoff) must be equal to maxFailures + 1
-var failedRunnerBackoff = []time.Duration{
-	0,
-	5 * time.Second,
-	10 * time.Second,
-	20 * time.Second,
-	40 * time.Second,
-	80 * time.Second,
-}
-
-const maxFailures = 5
-
 // +kubebuilder:rbac:groups=actions.github.com,resources=ephemeralrunners,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=actions.github.com,resources=ephemeralrunners/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=actions.github.com,resources=ephemeralrunners/finalizers,verbs=get;list;watch;create;update;patch;delete
@@ -186,29 +173,6 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		}
 	}
 
-	if len(ephemeralRunner.Status.Failures) > maxFailures {
-		log.Info(fmt.Sprintf("EphemeralRunner has failed more than %d times. Deleting ephemeral runner so it can be re-created", maxFailures))
-		if err := r.Delete(ctx, ephemeralRunner); err != nil {
-			log.Error(fmt.Errorf("failed to delete ephemeral runner after %d failures: %w", maxFailures, err), "Failed to delete ephemeral runner")
-			return ctrl.Result{}, err
-		}
-
-		return ctrl.Result{}, nil
-	}
-
-	now := metav1.Now()
-	lastFailure := ephemeralRunner.Status.LastFailure()
-	backoffDuration := failedRunnerBackoff[len(ephemeralRunner.Status.Failures)]
-	nextReconciliation := lastFailure.Add(backoffDuration)
-	if !lastFailure.IsZero() && now.Before(&metav1.Time{Time: nextReconciliation}) {
-		log.Info("Backing off the next reconciliation due to failure",
-			"lastFailure", lastFailure,
-			"nextReconciliation", nextReconciliation,
-			"requeueAfter", nextReconciliation.Sub(now.Time),
-		)
-		return ctrl.Result{RequeueAfter: now.Sub(nextReconciliation)}, nil
-	}
-
 	secret := new(corev1.Secret)
 	if err := r.Get(ctx, req.NamespacedName, secret); err != nil {
 		if !kerrors.IsNotFound(err) {
@@ -232,28 +196,39 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 	pod := new(corev1.Pod)
 	if err := r.Get(ctx, req.NamespacedName, pod); err != nil {
-		if !kerrors.IsNotFound(err) {
+		switch {
+		case !kerrors.IsNotFound(err):
 			log.Error(err, "Failed to fetch the pod")
 			return ctrl.Result{}, err
-		}
 
-		// Pod was not found. Create if the pod has never been created
-		log.Info("Creating new EphemeralRunner pod.")
-		result, err := r.createPod(ctx, ephemeralRunner, secret, log)
-		switch {
-		case err == nil:
-			return result, nil
-		case kerrors.IsInvalid(err) || kerrors.IsForbidden(err):
-			log.Error(err, "Failed to create a pod due to unrecoverable failure")
-			errMessage := fmt.Sprintf("Failed to create the pod: %v", err)
-			if err := r.markAsFailed(ctx, ephemeralRunner, errMessage, ReasonInvalidPodFailure, log); err != nil {
+		case len(ephemeralRunner.Status.Failures) > 5:
+			log.Info("EphemeralRunner has failed more than 5 times. Marking it as failed")
+			errMessage := fmt.Sprintf("Pod has failed to start more than 5 times: %s", pod.Status.Message)
+			if err := r.markAsFailed(ctx, ephemeralRunner, errMessage, ReasonTooManyPodFailures, log); err != nil {
 				log.Error(err, "Failed to set ephemeral runner to phase Failed")
 				return ctrl.Result{}, err
 			}
 			return ctrl.Result{}, nil
+
 		default:
-			log.Error(err, "Failed to create the pod")
-			return ctrl.Result{}, err
+			// Pod was not found. Create if the pod has never been created
+			log.Info("Creating new EphemeralRunner pod.")
+			result, err := r.createPod(ctx, ephemeralRunner, secret, log)
+			switch {
+			case err == nil:
+				return result, nil
+			case kerrors.IsInvalid(err) || kerrors.IsForbidden(err):
+				log.Error(err, "Failed to create a pod due to unrecoverable failure")
+				errMessage := fmt.Sprintf("Failed to create the pod: %v", err)
+				if err := r.markAsFailed(ctx, ephemeralRunner, errMessage, ReasonInvalidPodFailure, log); err != nil {
+					log.Error(err, "Failed to set ephemeral runner to phase Failed")
+					return ctrl.Result{}, err
+				}
+				return ctrl.Result{}, nil
+			default:
+				log.Error(err, "Failed to create the pod")
+				return ctrl.Result{}, err
+			}
 		}
 	}
 
@@ -509,9 +484,9 @@ func (r *EphemeralRunnerReconciler) deletePodAsFailed(ctx context.Context, ephem
 	log.Info("Updating ephemeral runner status to track the failure count")
 	if err := patchSubResource(ctx, r.Status(), ephemeralRunner, func(obj *v1alpha1.EphemeralRunner) {
 		if obj.Status.Failures == nil {
-			obj.Status.Failures = make(map[string]metav1.Time)
+			obj.Status.Failures = make(map[string]bool)
 		}
-		obj.Status.Failures[string(pod.UID)] = metav1.Now()
+		obj.Status.Failures[string(pod.UID)] = true
 		obj.Status.Ready = false
 		obj.Status.Reason = pod.Status.Reason
 		obj.Status.Message = pod.Status.Message
@@ -528,7 +503,7 @@ func (r *EphemeralRunnerReconciler) deletePodAsFailed(ctx context.Context, ephem
 func (r *EphemeralRunnerReconciler) updateStatusWithRunnerConfig(ctx context.Context, ephemeralRunner *v1alpha1.EphemeralRunner, log logr.Logger) (*ctrl.Result, error) {
 	// Runner is not registered with the service. We need to register it first
 	log.Info("Creating ephemeral runner JIT config")
-	actionsClient, err := r.GetActionsService(ctx, ephemeralRunner)
+	actionsClient, err := r.actionsClientFor(ctx, ephemeralRunner)
 	if err != nil {
 		return &ctrl.Result{}, fmt.Errorf("failed to get actions client for generating JIT config: %w", err)
 	}
@@ -752,10 +727,77 @@ func (r *EphemeralRunnerReconciler) updateRunStatusFromPod(ctx context.Context,
 	return nil
 }
 
+func (r *EphemeralRunnerReconciler) actionsClientFor(ctx context.Context, runner *v1alpha1.EphemeralRunner) (actions.ActionsService, error) {
+	secret := new(corev1.Secret)
+	if err := r.Get(ctx, types.NamespacedName{Namespace: runner.Namespace, Name: runner.Spec.GitHubConfigSecret}, secret); err != nil {
+		return nil, fmt.Errorf("failed to get secret: %w", err)
+	}
+
+	opts, err := r.actionsClientOptionsFor(ctx, runner)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get actions client options: %w", err)
+	}
+
+	return r.ActionsClient.GetClientFromSecret(
+		ctx,
+		runner.Spec.GitHubConfigUrl,
+		runner.Namespace,
+		secret.Data,
+		opts...,
+	)
+}
+
+func (r *EphemeralRunnerReconciler) actionsClientOptionsFor(ctx context.Context, runner *v1alpha1.EphemeralRunner) ([]actions.ClientOption, error) {
+	var opts []actions.ClientOption
+	if runner.Spec.Proxy != nil {
+		proxyFunc, err := runner.Spec.Proxy.ProxyFunc(func(s string) (*corev1.Secret, error) {
+			var secret corev1.Secret
+			err := r.Get(ctx, types.NamespacedName{Namespace: runner.Namespace, Name: s}, &secret)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get proxy secret %s: %w", s, err)
+			}
+
+			return &secret, nil
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to get proxy func: %w", err)
+		}
+
+		opts = append(opts, actions.WithProxy(proxyFunc))
+	}
+
+	tlsConfig := runner.Spec.GitHubServerTLS
+	if tlsConfig != nil {
+		pool, err := tlsConfig.ToCertPool(func(name, key string) ([]byte, error) {
+			var configmap corev1.ConfigMap
+			err := r.Get(
+				ctx,
+				types.NamespacedName{
+					Namespace: runner.Namespace,
+					Name:      name,
+				},
+				&configmap,
+			)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get configmap %s: %w", name, err)
+			}
+
+			return []byte(configmap.Data[key]), nil
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to get tls config: %w", err)
+		}
+
+		opts = append(opts, actions.WithRootCAs(pool))
+	}
+
+	return opts, nil
+}
+
 // runnerRegisteredWithService checks if the runner is still registered with the service
 // Returns found=false and err=nil if ephemeral runner does not exist in GitHub service and should be deleted
 func (r EphemeralRunnerReconciler) runnerRegisteredWithService(ctx context.Context, runner *v1alpha1.EphemeralRunner, log logr.Logger) (found bool, err error) {
-	actionsClient, err := r.GetActionsService(ctx, runner)
+	actionsClient, err := r.actionsClientFor(ctx, runner)
 	if err != nil {
 		return false, fmt.Errorf("failed to get Actions client for ScaleSet: %w", err)
 	}
@@ -782,7 +824,7 @@ func (r EphemeralRunnerReconciler) runnerRegisteredWithService(ctx context.Conte
 }
 
 func (r *EphemeralRunnerReconciler) deleteRunnerFromService(ctx context.Context, ephemeralRunner *v1alpha1.EphemeralRunner, log logr.Logger) error {
-	client, err := r.GetActionsService(ctx, ephemeralRunner)
+	client, err := r.actionsClientFor(ctx, ephemeralRunner)
 	if err != nil {
 		return fmt.Errorf("failed to get actions client for runner: %w", err)
 	}

controllers/actions.github.com/ephemeralrunner_controller_test.go

@@ -30,7 +30,7 @@ import (
 
 const (
 	ephemeralRunnerTimeout  = time.Second * 20
-	ephemeralRunnerInterval = time.Millisecond * 10
+	ephemeralRunnerInterval = time.Millisecond * 250
 	runnerImage             = "ghcr.io/actions/actions-runner:latest"
 )
 
@@ -107,15 +107,10 @@ var _ = Describe("EphemeralRunner", func() {
 			configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
 			controller = &EphemeralRunnerReconciler{
-				Client: mgr.GetClient(),
-				Scheme: mgr.GetScheme(),
-				Log:    logf.Log,
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient:   mgr.GetClient(),
-						multiClient: fake.NewMultiClient(),
-					},
-				},
+				Client:        mgr.GetClient(),
+				Scheme:        mgr.GetScheme(),
+				Log:           logf.Log,
+				ActionsClient: fake.NewMultiClient(),
 			}
 
 			err := controller.SetupWithManager(mgr)
@@ -533,26 +528,44 @@ var _ = Describe("EphemeralRunner", func() {
 			).Should(BeEquivalentTo(""))
 		})
 
-		It("It should eventually delete ephemeral runner after consecutive failures", func() {
+		It("It should not re-create pod indefinitely", func() {
 			updated := new(v1alpha1.EphemeralRunner)
+			pod := new(corev1.Pod)
 			Eventually(
-				func() error {
-					return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, updated)
+				func() (bool, error) {
+					err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, updated)
+					if err != nil {
+						return false, err
+					}
+
+					err = k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod)
+					if err != nil {
+						if kerrors.IsNotFound(err) && len(updated.Status.Failures) > 5 {
+							return true, nil
+						}
+
+						return false, err
+					}
+
+					pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{
+						Name: v1alpha1.EphemeralRunnerContainerName,
+						State: corev1.ContainerState{
+							Terminated: &corev1.ContainerStateTerminated{
+								ExitCode: 1,
+							},
+						},
+					})
+					err = k8sClient.Status().Update(ctx, pod)
+					Expect(err).To(BeNil(), "Failed to update pod status")
+					return false, fmt.Errorf("pod haven't failed for 5 times.")
 				},
 				ephemeralRunnerTimeout,
 				ephemeralRunnerInterval,
-			).Should(Succeed(), "failed to get ephemeral runner")
-
-			failEphemeralRunnerPod := func() *corev1.Pod {
-				pod := new(corev1.Pod)
-				Eventually(
-					func() error {
-						return k8sClient.Get(ctx, client.ObjectKey{Name: updated.Name, Namespace: updated.Namespace}, pod)
-					},
-					ephemeralRunnerTimeout,
-					ephemeralRunnerInterval,
-				).Should(Succeed(), "failed to get ephemeral runner pod")
+			).Should(BeEquivalentTo(true), "we should stop creating pod after 5 failures")
 
+			// In case we still have pod created due to controller-runtime cache delay, mark the container as exited
+			err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod)
+			if err == nil {
 				pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{
 					Name: v1alpha1.EphemeralRunnerContainerName,
 					State: corev1.ContainerState{
@@ -563,70 +576,25 @@ var _ = Describe("EphemeralRunner", func() {
 				})
 				err := k8sClient.Status().Update(ctx, pod)
 				Expect(err).To(BeNil(), "Failed to update pod status")
-
-				return pod
 			}
 
-			for i := range 5 {
-				pod := failEphemeralRunnerPod()
+			// EphemeralRunner should failed with reason TooManyPodFailures
+			Eventually(func() (string, error) {
+				err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, updated)
+				if err != nil {
+					return "", err
+				}
+				return updated.Status.Reason, nil
+			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo("TooManyPodFailures"), "Reason should be TooManyPodFailures")
 
-				Eventually(
-					func() (int, error) {
-						err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, updated)
-						if err != nil {
-							return 0, err
-						}
-						return len(updated.Status.Failures), nil
-					},
-					ephemeralRunnerTimeout,
-					ephemeralRunnerInterval,
-				).Should(BeEquivalentTo(i + 1))
-
-				Eventually(
-					func() error {
-						nextPod := new(corev1.Pod)
-						err := k8sClient.Get(ctx, client.ObjectKey{Name: pod.Name, Namespace: pod.Namespace}, nextPod)
-						if err != nil {
-							return err
-						}
-						if nextPod.UID != pod.UID {
-							return nil
-						}
-						return fmt.Errorf("pod not recreated")
-					},
-				).WithTimeout(20*time.Second).WithPolling(10*time.Millisecond).Should(Succeed(), "pod should be recreated")
-
-				Eventually(
-					func() (bool, error) {
-						pod := new(corev1.Pod)
-						err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod)
-						if err != nil {
-							return false, err
-						}
-						for _, cs := range pod.Status.ContainerStatuses {
-							if cs.Name == v1alpha1.EphemeralRunnerContainerName {
-								return cs.State.Terminated == nil, nil
-							}
-						}
-
-						return true, nil
-					},
-				).WithTimeout(20*time.Second).WithPolling(10*time.Millisecond).Should(BeEquivalentTo(true), "pod should be terminated")
-			}
-
-			failEphemeralRunnerPod()
-
-			Eventually(
-				func() (bool, error) {
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, updated)
-					if kerrors.IsNotFound(err) {
-						return true, nil
-					}
-					return false, err
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeTrue(), "Ephemeral runner should eventually be deleted")
+			// EphemeralRunner should not have any pod
+			Eventually(func() (bool, error) {
+				err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod)
+				if err == nil {
+					return false, nil
+				}
+				return kerrors.IsNotFound(err), nil
+			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true))
 		})
 
 		It("It should re-create pod on eviction", func() {
@@ -794,27 +762,22 @@ var _ = Describe("EphemeralRunner", func() {
 				Client: mgr.GetClient(),
 				Scheme: mgr.GetScheme(),
 				Log:    logf.Log,
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient: mgr.GetClient(),
-						multiClient: fake.NewMultiClient(
-							fake.WithDefaultClient(
-								fake.NewFakeClient(
-									fake.WithGetRunner(
-										nil,
-										&actions.ActionsError{
-											StatusCode: http.StatusNotFound,
-											Err: &actions.ActionsExceptionError{
-												ExceptionName: "AgentNotFoundException",
-											},
-										},
-									),
-								),
+				ActionsClient: fake.NewMultiClient(
+					fake.WithDefaultClient(
+						fake.NewFakeClient(
+							fake.WithGetRunner(
 								nil,
+								&actions.ActionsError{
+									StatusCode: http.StatusNotFound,
+									Err: &actions.ActionsExceptionError{
+										ExceptionName: "AgentNotFoundException",
+									},
+								},
 							),
 						),
-					},
-				},
+						nil,
+					),
+				),
 			}
 			err := controller.SetupWithManager(mgr)
 			Expect(err).To(BeNil(), "failed to setup controller")
@@ -871,15 +834,10 @@ var _ = Describe("EphemeralRunner", func() {
 			configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoScalingNS.Name)
 
 			controller = &EphemeralRunnerReconciler{
-				Client: mgr.GetClient(),
-				Scheme: mgr.GetScheme(),
-				Log:    logf.Log,
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient:   mgr.GetClient(),
-						multiClient: fake.NewMultiClient(),
-					},
-				},
+				Client:        mgr.GetClient(),
+				Scheme:        mgr.GetScheme(),
+				Log:           logf.Log,
+				ActionsClient: fake.NewMultiClient(),
 			}
 			err := controller.SetupWithManager(mgr)
 			Expect(err).To(BeNil(), "failed to setup controller")
@@ -889,12 +847,7 @@ var _ = Describe("EphemeralRunner", func() {
 
 		It("uses an actions client with proxy transport", func() {
 			// Use an actual client
-			controller.ResourceBuilder = ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   mgr.GetClient(),
-					multiClient: actions.NewMultiClient(logr.Discard()),
-				},
-			}
+			controller.ActionsClient = actions.NewMultiClient(logr.Discard())
 
 			proxySuccessfulllyCalled := false
 			proxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1045,15 +998,10 @@ var _ = Describe("EphemeralRunner", func() {
 			Expect(err).NotTo(HaveOccurred(), "failed to create configmap with root CAs")
 
 			controller = &EphemeralRunnerReconciler{
-				Client: mgr.GetClient(),
-				Scheme: mgr.GetScheme(),
-				Log:    logf.Log,
-				ResourceBuilder: ResourceBuilder{
-					SecretResolver: &SecretResolver{
-						k8sClient:   mgr.GetClient(),
-						multiClient: fake.NewMultiClient(),
-					},
-				},
+				Client:        mgr.GetClient(),
+				Scheme:        mgr.GetScheme(),
+				Log:           logf.Log,
+				ActionsClient: fake.NewMultiClient(),
 			}
 
 			err = controller.SetupWithManager(mgr)
@@ -1084,16 +1032,11 @@ var _ = Describe("EphemeralRunner", func() {
 			server.StartTLS()
 
 			// Use an actual client
-			controller.ResourceBuilder = ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   mgr.GetClient(),
-					multiClient: actions.NewMultiClient(logr.Discard()),
-				},
-			}
+			controller.ActionsClient = actions.NewMultiClient(logr.Discard())
 
 			ephemeralRunner := newExampleRunner("test-runner", autoScalingNS.Name, configSecret.Name)
 			ephemeralRunner.Spec.GitHubConfigUrl = server.ConfigURLForOrg("my-org")
-			ephemeralRunner.Spec.GitHubServerTLS = &v1alpha1.TLSConfig{
+			ephemeralRunner.Spec.GitHubServerTLS = &v1alpha1.GitHubServerTLSConfig{
 				CertificateFrom: &v1alpha1.TLSCertificateSource{
 					ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 						LocalObjectReference: corev1.LocalObjectReference{

controllers/actions.github.com/ephemeralrunnerset_controller.go

@@ -331,7 +331,7 @@ func (r *EphemeralRunnerSetReconciler) cleanUpEphemeralRunners(ctx context.Conte
 		return false, nil
 	}
 
-	actionsClient, err := r.GetActionsService(ctx, ephemeralRunnerSet)
+	actionsClient, err := r.actionsClientFor(ctx, ephemeralRunnerSet)
 	if err != nil {
 		return false, err
 	}
@@ -439,7 +439,7 @@ func (r *EphemeralRunnerSetReconciler) deleteIdleEphemeralRunners(ctx context.Co
 		log.Info("No pending or running ephemeral runners running at this time for scale down")
 		return nil
 	}
-	actionsClient, err := r.GetActionsService(ctx, ephemeralRunnerSet)
+	actionsClient, err := r.actionsClientFor(ctx, ephemeralRunnerSet)
 	if err != nil {
 		return fmt.Errorf("failed to create actions client for ephemeral runner replica set: %w", err)
 	}
@@ -502,6 +502,73 @@ func (r *EphemeralRunnerSetReconciler) deleteEphemeralRunnerWithActionsClient(ct
 	return true, nil
 }
 
+func (r *EphemeralRunnerSetReconciler) actionsClientFor(ctx context.Context, rs *v1alpha1.EphemeralRunnerSet) (actions.ActionsService, error) {
+	secret := new(corev1.Secret)
+	if err := r.Get(ctx, types.NamespacedName{Namespace: rs.Namespace, Name: rs.Spec.EphemeralRunnerSpec.GitHubConfigSecret}, secret); err != nil {
+		return nil, fmt.Errorf("failed to get secret: %w", err)
+	}
+
+	opts, err := r.actionsClientOptionsFor(ctx, rs)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get actions client options: %w", err)
+	}
+
+	return r.ActionsClient.GetClientFromSecret(
+		ctx,
+		rs.Spec.EphemeralRunnerSpec.GitHubConfigUrl,
+		rs.Namespace,
+		secret.Data,
+		opts...,
+	)
+}
+
+func (r *EphemeralRunnerSetReconciler) actionsClientOptionsFor(ctx context.Context, rs *v1alpha1.EphemeralRunnerSet) ([]actions.ClientOption, error) {
+	var opts []actions.ClientOption
+	if rs.Spec.EphemeralRunnerSpec.Proxy != nil {
+		proxyFunc, err := rs.Spec.EphemeralRunnerSpec.Proxy.ProxyFunc(func(s string) (*corev1.Secret, error) {
+			var secret corev1.Secret
+			err := r.Get(ctx, types.NamespacedName{Namespace: rs.Namespace, Name: s}, &secret)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get secret %s: %w", s, err)
+			}
+
+			return &secret, nil
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to get proxy func: %w", err)
+		}
+
+		opts = append(opts, actions.WithProxy(proxyFunc))
+	}
+
+	tlsConfig := rs.Spec.EphemeralRunnerSpec.GitHubServerTLS
+	if tlsConfig != nil {
+		pool, err := tlsConfig.ToCertPool(func(name, key string) ([]byte, error) {
+			var configmap corev1.ConfigMap
+			err := r.Get(
+				ctx,
+				types.NamespacedName{
+					Namespace: rs.Namespace,
+					Name:      name,
+				},
+				&configmap,
+			)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get configmap %s: %w", name, err)
+			}
+
+			return []byte(configmap.Data[key]), nil
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to get tls config: %w", err)
+		}
+
+		opts = append(opts, actions.WithRootCAs(pool))
+	}
+
+	return opts, nil
+}
+
 // SetupWithManager sets up the controller with the Manager.
 func (r *EphemeralRunnerSetReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).

controllers/actions.github.com/ephemeralrunnerset_controller_test.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"testing"
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
@@ -22,7 +21,6 @@ import (
 	"github.com/go-logr/logr"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
@@ -37,10 +35,6 @@ const (
 	ephemeralRunnerSetTestGitHubToken = "gh_token"
 )
 
-func TestPrecomputedConstants(t *testing.T) {
-	require.Equal(t, len(failedRunnerBackoff), maxFailures+1)
-}
-
 var _ = Describe("Test EphemeralRunnerSet controller", func() {
 	var ctx context.Context
 	var mgr ctrl.Manager
@@ -54,15 +48,10 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 		configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
 		controller := &EphemeralRunnerSetReconciler{
-			Client: mgr.GetClient(),
-			Scheme: mgr.GetScheme(),
-			Log:    logf.Log,
-			ResourceBuilder: ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   mgr.GetClient(),
-					multiClient: fake.NewMultiClient(),
-				},
-			},
+			Client:        mgr.GetClient(),
+			Scheme:        mgr.GetScheme(),
+			Log:           logf.Log,
+			ActionsClient: fake.NewMultiClient(),
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1109,15 +1098,10 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func(
 		configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name)
 
 		controller := &EphemeralRunnerSetReconciler{
-			Client: mgr.GetClient(),
-			Scheme: mgr.GetScheme(),
-			Log:    logf.Log,
-			ResourceBuilder: ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   mgr.GetClient(),
-					multiClient: actions.NewMultiClient(logr.Discard()),
-				},
-			},
+			Client:        mgr.GetClient(),
+			Scheme:        mgr.GetScheme(),
+			Log:           logf.Log,
+			ActionsClient: actions.NewMultiClient(logr.Discard()),
 		}
 		err := controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1413,15 +1397,10 @@ var _ = Describe("Test EphemeralRunnerSet controller with custom root CA", func(
 		Expect(err).NotTo(HaveOccurred(), "failed to create configmap with root CAs")
 
 		controller := &EphemeralRunnerSetReconciler{
-			Client: mgr.GetClient(),
-			Scheme: mgr.GetScheme(),
-			Log:    logf.Log,
-			ResourceBuilder: ResourceBuilder{
-				SecretResolver: &SecretResolver{
-					k8sClient:   mgr.GetClient(),
-					multiClient: actions.NewMultiClient(logr.Discard()),
-				},
-			},
+			Client:        mgr.GetClient(),
+			Scheme:        mgr.GetScheme(),
+			Log:           logf.Log,
+			ActionsClient: actions.NewMultiClient(logr.Discard()),
 		}
 		err = controller.SetupWithManager(mgr)
 		Expect(err).NotTo(HaveOccurred(), "failed to setup controller")
@@ -1460,7 +1439,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with custom root CA", func(
 				EphemeralRunnerSpec: v1alpha1.EphemeralRunnerSpec{
 					GitHubConfigUrl:    server.ConfigURLForOrg("my-org"),
 					GitHubConfigSecret: configSecret.Name,
-					GitHubServerTLS: &v1alpha1.TLSConfig{
+					GitHubServerTLS: &v1alpha1.GitHubServerTLSConfig{
 						CertificateFrom: &v1alpha1.TLSCertificateSource{
 							ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
 								LocalObjectReference: corev1.LocalObjectReference{

controllers/actions.github.com/resourcebuilder.go

@@ -5,20 +5,17 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"math"
 	"net"
 	"strconv"
 	"strings"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/actions/actions-runner-controller/build"
-	ghalistenerconfig "github.com/actions/actions-runner-controller/cmd/ghalistener/config"
+	listenerconfig "github.com/actions/actions-runner-controller/cmd/ghalistener/config"
 	"github.com/actions/actions-runner-controller/github/actions"
 	"github.com/actions/actions-runner-controller/hash"
 	"github.com/actions/actions-runner-controller/logging"
-	"github.com/actions/actions-runner-controller/vault/azurekeyvault"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -74,7 +71,6 @@ func SetListenerEntrypoint(entrypoint string) {
 
 type ResourceBuilder struct {
 	ExcludeLabelPropagationPrefixes []string
-	*SecretResolver
 }
 
 // boolPtr returns a pointer to a bool value
@@ -124,7 +120,6 @@ func (b *ResourceBuilder) newAutoScalingListener(autoscalingRunnerSet *v1alpha1.
 		Spec: v1alpha1.AutoscalingListenerSpec{
 			GitHubConfigUrl:               autoscalingRunnerSet.Spec.GitHubConfigUrl,
 			GitHubConfigSecret:            autoscalingRunnerSet.Spec.GitHubConfigSecret,
-			VaultConfig:                   autoscalingRunnerSet.VaultConfig(),
 			RunnerScaleSetId:              runnerScaleSetId,
 			AutoscalingRunnerSetNamespace: autoscalingRunnerSet.Namespace,
 			AutoscalingRunnerSetName:      autoscalingRunnerSet.Name,
@@ -164,7 +159,7 @@ func (lm *listenerMetricsServerConfig) containerPort() (corev1.ContainerPort, er
 	}, nil
 }
 
-func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha1.AutoscalingListener, appConfig *appconfig.AppConfig, metricsConfig *listenerMetricsServerConfig, cert string) (*corev1.Secret, error) {
+func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha1.AutoscalingListener, secret *corev1.Secret, metricsConfig *listenerMetricsServerConfig, cert string) (*corev1.Secret, error) {
 	var (
 		metricsAddr     = ""
 		metricsEndpoint = ""
@@ -174,8 +169,30 @@ func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha
 		metricsEndpoint = metricsConfig.endpoint
 	}
 
-	config := ghalistenerconfig.Config{
+	var appID int64
+	if id, ok := secret.Data["github_app_id"]; ok {
+		var err error
+		appID, err = strconv.ParseInt(string(id), 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert github_app_id to int: %v", err)
+		}
+	}
+
+	var appInstallationID int64
+	if id, ok := secret.Data["github_app_installation_id"]; ok {
+		var err error
+		appInstallationID, err = strconv.ParseInt(string(id), 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert github_app_installation_id to int: %v", err)
+		}
+	}
+
+	config := listenerconfig.Config{
 		ConfigureUrl:                autoscalingListener.Spec.GitHubConfigUrl,
+		AppID:                       appID,
+		AppInstallationID:           appInstallationID,
+		AppPrivateKey:               string(secret.Data["github_app_private_key"]),
+		Token:                       string(secret.Data["github_token"]),
 		EphemeralRunnerSetNamespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
 		EphemeralRunnerSetName:      autoscalingListener.Spec.EphemeralRunnerSetName,
 		MaxRunners:                  autoscalingListener.Spec.MaxRunners,
@@ -190,24 +207,6 @@ func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha
 		Metrics:                     autoscalingListener.Spec.Metrics,
 	}
 
-	vault := autoscalingListener.Spec.VaultConfig
-	if vault == nil {
-		config.AppConfig = appConfig
-	} else {
-		config.VaultType = vault.Type
-		config.VaultLookupKey = autoscalingListener.Spec.GitHubConfigSecret
-		config.AzureKeyVaultConfig = &azurekeyvault.Config{
-			TenantID:        vault.AzureKeyVault.TenantID,
-			ClientID:        vault.AzureKeyVault.ClientID,
-			URL:             vault.AzureKeyVault.URL,
-			CertificatePath: vault.AzureKeyVault.CertificatePath,
-		}
-	}
-
-	if err := config.Validate(); err != nil {
-		return nil, fmt.Errorf("invalid listener config: %w", err)
-	}
-
 	var buf bytes.Buffer
 	if err := json.NewEncoder(&buf).Encode(config); err != nil {
 		return nil, fmt.Errorf("failed to encode config: %w", err)
@@ -224,7 +223,7 @@ func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha
 	}, nil
 }
 
-func (b *ResourceBuilder) newScaleSetListenerPod(autoscalingListener *v1alpha1.AutoscalingListener, podConfig *corev1.Secret, serviceAccount *corev1.ServiceAccount, metricsConfig *listenerMetricsServerConfig, envs ...corev1.EnvVar) (*corev1.Pod, error) {
+func (b *ResourceBuilder) newScaleSetListenerPod(autoscalingListener *v1alpha1.AutoscalingListener, podConfig *corev1.Secret, serviceAccount *corev1.ServiceAccount, secret *corev1.Secret, metricsConfig *listenerMetricsServerConfig, envs ...corev1.EnvVar) (*corev1.Pod, error) {
 	listenerEnv := []corev1.EnvVar{
 		{
 			Name:  "LISTENER_CONFIG_PATH",
@@ -279,7 +278,9 @@ func (b *ResourceBuilder) newScaleSetListenerPod(autoscalingListener *v1alpha1.A
 	}
 
 	labels := make(map[string]string, len(autoscalingListener.Labels))
-	maps.Copy(labels, autoscalingListener.Labels)
+	for key, val := range autoscalingListener.Labels {
+		labels[key] = val
+	}
 
 	newRunnerScaleSetListenerPod := &corev1.Pod{
 		TypeMeta: metav1.TypeMeta{
@@ -428,7 +429,7 @@ func mergeListenerContainer(base, from *corev1.Container) {
 func (b *ResourceBuilder) newScaleSetListenerServiceAccount(autoscalingListener *v1alpha1.AutoscalingListener) *corev1.ServiceAccount {
 	return &corev1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      autoscalingListener.Name,
+			Name:      scaleSetListenerServiceAccountName(autoscalingListener),
 			Namespace: autoscalingListener.Namespace,
 			Labels: b.mergeLabels(autoscalingListener.Labels, map[string]string{
 				LabelKeyGitHubScaleSetNamespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
@@ -443,7 +444,7 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1.
 	rulesHash := hash.ComputeTemplateHash(&rules)
 	newRole := &rbacv1.Role{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      autoscalingListener.Name,
+			Name:      scaleSetListenerRoleName(autoscalingListener),
 			Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
 			Labels: b.mergeLabels(autoscalingListener.Labels, map[string]string{
 				LabelKeyGitHubScaleSetNamespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
@@ -477,7 +478,7 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1
 
 	newRoleBinding := &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      autoscalingListener.Name,
+			Name:      scaleSetListenerRoleName(autoscalingListener),
 			Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
 			Labels: b.mergeLabels(autoscalingListener.Labels, map[string]string{
 				LabelKeyGitHubScaleSetNamespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
@@ -495,6 +496,25 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1
 	return newRoleBinding
 }
 
+func (b *ResourceBuilder) newScaleSetListenerSecretMirror(autoscalingListener *v1alpha1.AutoscalingListener, secret *corev1.Secret) *corev1.Secret {
+	dataHash := hash.ComputeTemplateHash(&secret.Data)
+
+	newListenerSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      scaleSetListenerSecretMirrorName(autoscalingListener),
+			Namespace: autoscalingListener.Namespace,
+			Labels: b.mergeLabels(autoscalingListener.Labels, map[string]string{
+				LabelKeyGitHubScaleSetNamespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace,
+				LabelKeyGitHubScaleSetName:      autoscalingListener.Spec.AutoscalingRunnerSetName,
+				"secret-data-hash":              dataHash,
+			}),
+		},
+		Data: secret.DeepCopy().Data,
+	}
+
+	return newListenerSecret
+}
+
 func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet) (*v1alpha1.EphemeralRunnerSet, error) {
 	runnerScaleSetId, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIdAnnotationKey])
 	if err != nil {
@@ -547,7 +567,6 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A
 				Proxy:              autoscalingRunnerSet.Spec.Proxy,
 				GitHubServerTLS:    autoscalingRunnerSet.Spec.GitHubServerTLS,
 				PodTemplateSpec:    autoscalingRunnerSet.Spec.Template,
-				VaultConfig:        autoscalingRunnerSet.VaultConfig(),
 			},
 		},
 	}
@@ -569,7 +588,6 @@ func (b *ResourceBuilder) newEphemeralRunner(ephemeralRunnerSet *v1alpha1.Epheme
 	for key, val := range ephemeralRunnerSet.Annotations {
 		annotations[key] = val
 	}
-
 	annotations[AnnotationKeyPatchID] = strconv.Itoa(ephemeralRunnerSet.Spec.PatchID)
 	return &v1alpha1.EphemeralRunner{
 		TypeMeta: metav1.TypeMeta{},
@@ -695,6 +713,30 @@ func scaleSetListenerName(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet) s
 	return fmt.Sprintf("%v-%v-listener", autoscalingRunnerSet.Name, namespaceHash)
 }
 
+func scaleSetListenerServiceAccountName(autoscalingListener *v1alpha1.AutoscalingListener) string {
+	namespaceHash := hash.FNVHashString(autoscalingListener.Spec.AutoscalingRunnerSetNamespace)
+	if len(namespaceHash) > 8 {
+		namespaceHash = namespaceHash[:8]
+	}
+	return fmt.Sprintf("%v-%v-listener", autoscalingListener.Spec.AutoscalingRunnerSetName, namespaceHash)
+}
+
+func scaleSetListenerRoleName(autoscalingListener *v1alpha1.AutoscalingListener) string {
+	namespaceHash := hash.FNVHashString(autoscalingListener.Spec.AutoscalingRunnerSetNamespace)
+	if len(namespaceHash) > 8 {
+		namespaceHash = namespaceHash[:8]
+	}
+	return fmt.Sprintf("%v-%v-listener", autoscalingListener.Spec.AutoscalingRunnerSetName, namespaceHash)
+}
+
+func scaleSetListenerSecretMirrorName(autoscalingListener *v1alpha1.AutoscalingListener) string {
+	namespaceHash := hash.FNVHashString(autoscalingListener.Spec.AutoscalingRunnerSetNamespace)
+	if len(namespaceHash) > 8 {
+		namespaceHash = namespaceHash[:8]
+	}
+	return fmt.Sprintf("%v-%v-listener", autoscalingListener.Spec.AutoscalingRunnerSetName, namespaceHash)
+}
+
 func proxyListenerSecretName(autoscalingListener *v1alpha1.AutoscalingListener) string {
 	namespaceHash := hash.FNVHashString(autoscalingListener.Spec.AutoscalingRunnerSetNamespace)
 	if len(namespaceHash) > 8 {

controllers/actions.github.com/resourcebuilder_test.go

@@ -82,7 +82,12 @@ func TestLabelPropagation(t *testing.T) {
 			Name: "test",
 		},
 	}
-	listenerPod, err := b.newScaleSetListenerPod(listener, &corev1.Secret{}, listenerServiceAccount, nil)
+	listenerSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test",
+		},
+	}
+	listenerPod, err := b.newScaleSetListenerPod(listener, &corev1.Secret{}, listenerServiceAccount, listenerSecret, nil)
 	require.NoError(t, err)
 	assert.Equal(t, listenerPod.Labels, listener.Labels)
 

controllers/actions.github.com/secret_resolver.go

@@ -1,280 +0,0 @@
-package actionsgithubcom
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strings"
-
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
-	"github.com/actions/actions-runner-controller/github/actions"
-	"github.com/actions/actions-runner-controller/vault"
-	"github.com/actions/actions-runner-controller/vault/azurekeyvault"
-	"golang.org/x/net/http/httpproxy"
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-type SecretResolver struct {
-	k8sClient   client.Client
-	multiClient actions.MultiClient
-}
-
-type SecretResolverOption func(*SecretResolver)
-
-func NewSecretResolver(k8sClient client.Client, multiClient actions.MultiClient, opts ...SecretResolverOption) *SecretResolver {
-	if k8sClient == nil {
-		panic("k8sClient must not be nil")
-	}
-
-	secretResolver := &SecretResolver{
-		k8sClient:   k8sClient,
-		multiClient: multiClient,
-	}
-
-	for _, opt := range opts {
-		opt(secretResolver)
-	}
-
-	return secretResolver
-}
-
-type ActionsGitHubObject interface {
-	client.Object
-	GitHubConfigUrl() string
-	GitHubConfigSecret() string
-	GitHubProxy() *v1alpha1.ProxyConfig
-	GitHubServerTLS() *v1alpha1.TLSConfig
-	VaultConfig() *v1alpha1.VaultConfig
-	VaultProxy() *v1alpha1.ProxyConfig
-}
-
-func (sr *SecretResolver) GetAppConfig(ctx context.Context, obj ActionsGitHubObject) (*appconfig.AppConfig, error) {
-	resolver, err := sr.resolverForObject(ctx, obj)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get resolver for object: %v", err)
-	}
-
-	appConfig, err := resolver.appConfig(ctx, obj.GitHubConfigSecret())
-	if err != nil {
-		return nil, fmt.Errorf("failed to resolve app config: %v", err)
-	}
-
-	return appConfig, nil
-}
-
-func (sr *SecretResolver) GetActionsService(ctx context.Context, obj ActionsGitHubObject) (actions.ActionsService, error) {
-	resolver, err := sr.resolverForObject(ctx, obj)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get resolver for object: %v", err)
-	}
-
-	appConfig, err := resolver.appConfig(ctx, obj.GitHubConfigSecret())
-	if err != nil {
-		return nil, fmt.Errorf("failed to resolve app config: %v", err)
-	}
-
-	var clientOptions []actions.ClientOption
-	if proxy := obj.GitHubProxy(); proxy != nil {
-		config := &httpproxy.Config{
-			NoProxy: strings.Join(proxy.NoProxy, ","),
-		}
-
-		if proxy.HTTP != nil {
-			u, err := url.Parse(proxy.HTTP.Url)
-			if err != nil {
-				return nil, fmt.Errorf("failed to parse proxy http url %q: %w", proxy.HTTP.Url, err)
-			}
-
-			if ref := proxy.HTTP.CredentialSecretRef; ref != "" {
-				u.User, err = resolver.proxyCredentials(ctx, ref)
-				if err != nil {
-					return nil, fmt.Errorf("failed to resolve proxy credentials: %v", err)
-				}
-			}
-
-			config.HTTPProxy = u.String()
-		}
-
-		if proxy.HTTPS != nil {
-			u, err := url.Parse(proxy.HTTPS.Url)
-			if err != nil {
-				return nil, fmt.Errorf("failed to parse proxy https url %q: %w", proxy.HTTPS.Url, err)
-			}
-
-			if ref := proxy.HTTPS.CredentialSecretRef; ref != "" {
-				u.User, err = resolver.proxyCredentials(ctx, ref)
-				if err != nil {
-					return nil, fmt.Errorf("failed to resolve proxy credentials: %v", err)
-				}
-			}
-
-			config.HTTPSProxy = u.String()
-		}
-
-		proxyFunc := func(req *http.Request) (*url.URL, error) {
-			return config.ProxyFunc()(req.URL)
-		}
-
-		clientOptions = append(clientOptions, actions.WithProxy(proxyFunc))
-	}
-
-	tlsConfig := obj.GitHubServerTLS()
-	if tlsConfig != nil {
-		pool, err := tlsConfig.ToCertPool(func(name, key string) ([]byte, error) {
-			var configmap corev1.ConfigMap
-			err := sr.k8sClient.Get(
-				ctx,
-				types.NamespacedName{
-					Namespace: obj.GetNamespace(),
-					Name:      name,
-				},
-				&configmap,
-			)
-			if err != nil {
-				return nil, fmt.Errorf("failed to get configmap %s: %w", name, err)
-			}
-
-			return []byte(configmap.Data[key]), nil
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to get tls config: %w", err)
-		}
-
-		clientOptions = append(clientOptions, actions.WithRootCAs(pool))
-	}
-
-	return sr.multiClient.GetClientFor(
-		ctx,
-		obj.GitHubConfigUrl(),
-		appConfig,
-		obj.GetNamespace(),
-		clientOptions...,
-	)
-}
-
-func (sr *SecretResolver) resolverForObject(ctx context.Context, obj ActionsGitHubObject) (resolver, error) {
-	vaultConfig := obj.VaultConfig()
-	if vaultConfig == nil || vaultConfig.Type == "" {
-		return &k8sResolver{
-			namespace: obj.GetNamespace(),
-			client:    sr.k8sClient,
-		}, nil
-	}
-
-	var proxy *httpproxy.Config
-	if vaultProxy := obj.VaultProxy(); vaultProxy != nil {
-		p, err := vaultProxy.ToHTTPProxyConfig(func(s string) (*corev1.Secret, error) {
-			var secret corev1.Secret
-			err := sr.k8sClient.Get(ctx, types.NamespacedName{Name: s, Namespace: obj.GetNamespace()}, &secret)
-			if err != nil {
-				return nil, fmt.Errorf("failed to get secret %s: %w", s, err)
-			}
-			return &secret, nil
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to create proxy config: %v", err)
-		}
-		proxy = p
-	}
-
-	switch vaultConfig.Type {
-	case vault.VaultTypeAzureKeyVault:
-		akv, err := azurekeyvault.New(azurekeyvault.Config{
-			TenantID:        vaultConfig.AzureKeyVault.TenantID,
-			ClientID:        vaultConfig.AzureKeyVault.ClientID,
-			URL:             vaultConfig.AzureKeyVault.URL,
-			CertificatePath: vaultConfig.AzureKeyVault.CertificatePath,
-			Proxy:           proxy,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to create Azure Key Vault client: %v", err)
-		}
-		return &vaultResolver{
-			vault: akv,
-		}, nil
-
-	default:
-		return nil, fmt.Errorf("unknown vault type %q", vaultConfig.Type)
-	}
-}
-
-type resolver interface {
-	appConfig(ctx context.Context, key string) (*appconfig.AppConfig, error)
-	proxyCredentials(ctx context.Context, key string) (*url.Userinfo, error)
-}
-
-type k8sResolver struct {
-	namespace string
-	client    client.Client
-}
-
-func (r *k8sResolver) appConfig(ctx context.Context, key string) (*appconfig.AppConfig, error) {
-	nsName := types.NamespacedName{
-		Namespace: r.namespace,
-		Name:      key,
-	}
-	secret := new(corev1.Secret)
-	if err := r.client.Get(
-		ctx,
-		nsName,
-		secret,
-	); err != nil {
-		return nil, fmt.Errorf("failed to get kubernetes secret: %q", nsName.String())
-	}
-
-	return appconfig.FromSecret(secret)
-}
-
-func (r *k8sResolver) proxyCredentials(ctx context.Context, key string) (*url.Userinfo, error) {
-	nsName := types.NamespacedName{Namespace: r.namespace, Name: key}
-	secret := new(corev1.Secret)
-	if err := r.client.Get(
-		ctx,
-		nsName,
-		secret,
-	); err != nil {
-		return nil, fmt.Errorf("failed to get kubernetes secret: %q", nsName.String())
-	}
-
-	return url.UserPassword(
-		string(secret.Data["username"]),
-		string(secret.Data["password"]),
-	), nil
-}
-
-type vaultResolver struct {
-	vault vault.Vault
-}
-
-func (r *vaultResolver) appConfig(ctx context.Context, key string) (*appconfig.AppConfig, error) {
-	val, err := r.vault.GetSecret(ctx, key)
-	if err != nil {
-		return nil, fmt.Errorf("failed to resolve secret: %v", err)
-	}
-
-	return appconfig.FromJSONString(val)
-}
-
-func (r *vaultResolver) proxyCredentials(ctx context.Context, key string) (*url.Userinfo, error) {
-	val, err := r.vault.GetSecret(ctx, key)
-	if err != nil {
-		return nil, fmt.Errorf("failed to resolve secret: %v", err)
-	}
-
-	type info struct {
-		Username string `json:"username"`
-		Password string `json:"password"`
-	}
-
-	var i info
-	if err := json.Unmarshal([]byte(val), &i); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal info: %v", err)
-	}
-
-	return url.UserPassword(i.Username, i.Password), nil
-}

controllers/actions.github.com/suite_test.go

@@ -20,7 +20,6 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-	"time"
 
 	"github.com/onsi/ginkgo/config"
 
@@ -80,15 +79,6 @@ var _ = BeforeSuite(func() {
 	k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme})
 	Expect(err).ToNot(HaveOccurred())
 	Expect(k8sClient).ToNot(BeNil())
-
-	failedRunnerBackoff = []time.Duration{
-		20 * time.Millisecond,
-		20 * time.Millisecond,
-		20 * time.Millisecond,
-		20 * time.Millisecond,
-		20 * time.Millisecond,
-		20 * time.Millisecond,
-	}
 })
 
 var _ = AfterSuite(func() {

controllers/actions.summerwind.net/autoscaling.go

@@ -130,7 +130,7 @@ func (r *HorizontalRunnerAutoscalerReconciler) suggestReplicasByQueuedAndInProgr
 			jobs, resp, err := ghc.Actions.ListWorkflowJobs(context.TODO(), user, repoName, runID, &opt)
 			if err != nil {
 				r.Log.Error(err, "Error listing workflow jobs")
-				return // err
+				return //err
 			}
 			allJobs = append(allJobs, jobs.Jobs...)
 			if resp.NextPage == 0 {

docs/gha-runner-scale-set-controller/README.md

@@ -43,29 +43,6 @@ You can follow [this troubleshooting guide](https://docs.github.com/en/actions/h
 
 ## Changelog
 
-### 0.12.0
-
-1. Allow use of client id as an app id [#4057](https://github.com/actions/actions-runner-controller/pull/4057)
-1. Relax version requirements to allow patch version mismatch [#4080](https://github.com/actions/actions-runner-controller/pull/4080)
-1. Refactor resource naming removing unnecessary calculations [#4076](https://github.com/actions/actions-runner-controller/pull/4076)
-1. Fix busy runners metric [#4016](https://github.com/actions/actions-runner-controller/pull/4016)
-1. Include more context to errors raised by github/actions client [#4032](https://github.com/actions/actions-runner-controller/pull/4032)
-1. Revised dashboard [#4022](https://github.com/actions/actions-runner-controller/pull/4022)
-1. feat(helm): move dind to sidecar [#3842](https://github.com/actions/actions-runner-controller/pull/3842)
-1. Pin third party actions [#3981](https://github.com/actions/actions-runner-controller/pull/3981)
-1. Fix docker lint warnings [#4074](https://github.com/actions/actions-runner-controller/pull/4074)
-1. Bump the gomod group across 1 directory with 7 updates [#4008](https://github.com/actions/actions-runner-controller/pull/4008)
-1. Bump go version [#4075](https://github.com/actions/actions-runner-controller/pull/4075)
-1. Add job_workflow_ref label to listener metrics [#4054](https://github.com/actions/actions-runner-controller/pull/4054)
-1. Bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 [#4118](https://github.com/actions/actions-runner-controller/pull/4118)
-1. Avoid nil point when config.Metrics is nil and expose all metrics if none are configured [#4101](https://github.com/actions/actions-runner-controller/pull/4101)
-1. Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 [#4120](https://github.com/actions/actions-runner-controller/pull/4120)
-1. Add startup probe to dind side-car [#4117](https://github.com/actions/actions-runner-controller/pull/4117)
-1. Delete config secret when listener pod gets deleted [#4033](https://github.com/actions/actions-runner-controller/pull/4033)
-1. Add response body to error when fetching access token [#4005](https://github.com/actions/actions-runner-controller/pull/4005)
-1. Azure Key Vault integration to resolve secrets [#4090](https://github.com/actions/actions-runner-controller/pull/4090)
-1. Create backoff mechanism for failed runners and allow re-creation of failed ephemeral runners [#4059](https://github.com/actions/actions-runner-controller/pull/4059)
-
 ### 0.11.0
 
 1. Add events role permission to leader_election_role [#3988](https://github.com/actions/actions-runner-controller/pull/3988)

docs/gha-runner-scale-set-controller/samples/grafana-dashboard/README.md

@@ -1,11 +1,6 @@
 # Visualizing Autoscaling Runner Scale Set metrics with Grafana
 
-With the metrics support introduced in [gha-runner-scale-set-0.5.0](https://github.com/actions/actions-runner-controller/releases/tag/gha-runner-scale-set-0.5.0), you can visualize the autoscaling behavior of your runner scale set with your tool of choice. 
-
-This sample dashboard shows how to visualize the metrics with [Grafana](https://grafana.com/).
-
-> [!NOTE]
-> We do not intend to provide a supported ARC dashboard. This is simply a reference and a demonstration for how you could leverage the metrics emitted by the controller-manager and listeners to visualize the autoscaling behavior of your runner scale set. We offer no promises of future upgrades to this sample.
+With metrics introduced in [gha-runner-scale-set-0.5.0](https://github.com/actions/actions-runner-controller/releases/tag/gha-runner-scale-set-0.5.0), you can now visualize the autoscaling behavior of your runner scale set with your tool of choice. This sample shows how to visualize the metrics with [Grafana](https://grafana.com/).
 
 ## Demo
 
@@ -13,43 +8,12 @@ This sample dashboard shows how to visualize the metrics with [Grafana](https://
 
 ## Setup
 
+We do not intend to provide a supported ARC dashboard. This is simply a reference and a demonstration for how you could leverage the metrics emitted by the controller-manager and listeners to visualize the autoscaling behavior of your runner scale set. We offer no promises of future upgrades to this sample.
+
 1. Make sure to have [Grafana](https://grafana.com/docs/grafana/latest/installation/) and [Prometheus](https://prometheus.io/docs/prometheus/latest/installation/) running in your cluster.
 2. Make sure that Prometheus is properly scraping the metrics endpoints of the controller-manager and listeners.
 3. Import the [dashboard](ARC-Autoscaling-Runner-Set-Monitoring_1692627561838.json) into Grafana.
 
-## Required metrics
-
-This sample relies on the suggestion listener metrics configuration in the scale set [values.yaml](https://github.com/actions/actions-runner-controller/blob/ea27448da51385470b1ce67150aa695cfa45fd3f/charts/gha-runner-scale-set/values.yaml#L129-L270).
-
-The following metrics are required to be scraped by Prometheus in order to populate the dashboard:
-
-| Metric | Required labels | Source |
-| ------ | ----------- | -----|
-| container_fs_writes_bytes_total | namespace | cAdvisor
-| container_fs_reads_bytes_total | namespace | cAdvisor
-| container_memory_working_set_bytes | namespace | cAdvisor
-| controller_runtime_active_workers | controller | ARC Controller
-| controller_runtime_reconcile_time_seconds_sum | namespace | ARC Controller
-| controller_runtime_reconcile_errors_total | namespace | ARC Controller
-| gha_assigned_jobs | actions_github_com_scale_set_name, namespace | ARC Controller
-| gha_controller_failed_ephemeral_runners | name, namespace | ARC Controller
-| gha_controller_pending_ephemeral_runners | name, namespace | ARC Controller
-| gha_controller_running_ephemeral_runners | name, namespace | ARC Controller
-| gha_controller_running_listeners | namespace | ARC Controller
-| gha_desired_runners | actions_github_com_scale_set_name, namespace | ARC Listener
-| gha_idle_runners | actions_github_com_scale_set_name, namespace | ARC Listener
-| gha_job_execution_duration_seconds_bucket | actions_github_com_scale_set_name, actions_github_com_scale_set_namespace | ARC Listener
-| gha_job_startup_duration_seconds_bucket | actions_github_com_scale_set_name, actions_github_com_scale_set_namespace | ARC Listener
-| gha_registered_runners | actions_github_com_scale_set_name, namespace | ARC Listener
-| gha_running_jobs | actions_github_com_scale_set_name, actions_github_com_scale_set_namespace | ARC Listener
-| kube_pod_container_status_ready | namespace | kube-state-metrics
-| kube_pod_container_status_terminated_reason | namespace, reason | kube-state-metrics
-| kube_pod_container_status_waiting | namespace | kube-state-metrics
-| rest_client_requests_total | code, method, namespace | ARC Controller
-| scrape_duration_seconds | | prometheus
-| workqueue_depth | name, namespace | ARC Controller
-| workqueue_queue_duration_seconds_sum | namespace | ARC Controller
-
 ## Details
 
 This dashboard demonstrates some of the metrics provided by ARC and the underlying Kubernetes runtime. It provides a sample visualization of the behavior of the runner scale set, the ARC controllers, and the listeners. This should not be considered a comprehensive dashboard; it is a starting point that can be used with other metrics and logs to understand the health of the cluster. Review the [GitHub documentation detailing the Actions Runner Controller metrics and how to enable them](https://docs.github.com/en/enterprise-server@3.10/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/deploying-runner-scale-sets-with-actions-runner-controller#enabling-metrics).
@@ -58,25 +22,16 @@ The dashboard includes the following metrics:
 
 | Label                            | Description                                         |
 | -------------------------------- | ----------------------------------------------------|
-| Startup Duration                 | Heat map of the wait time before a job starts, with the colors indicating the increase in the number of jobs in that time bucket. An increasing time can indicate that the cluster is resource constrained and may need additional nodes or resources to handle the load. |
-| Execution Duration                 | Heat map of the execution time for a job, with the colors indicating the increase in the number of jobs in that time bucket. Time can be affected by the number of steps in the job, the allocated CPU, and whether there is resource contention on the node that is impacting performance |
-| Assigned Jobs                    | The number of jobs that have been assigned to the listener. This is the number of jobs that the listener is responsible for providing a runner to process. |
-| Desired Runners                  | The number of runners that the listener is requesting from the controller. This is the number of runners required to process the assigned jobs and provide idle runners. It is limited by the configured maximum runner count for the scale set. |
-| Idle Runners                     | The total number of ephemeral runners that are available to accept jobs across all selected scale sets. Keeping a pool of idle runners can enable a faster start time under load, but excessive idle runners will consume resources and can prevent nodes from scaling down. |
-| Running Jobs | The number of runners that are currently processing jobs. |
-| Failed Runners                   | The total number of ephemeral runners that have failed to properly start. This may require reviewing the custom resource and logs to identify and resolve the root causes. Common causes include resource issues and failure to pull the required image. |
-| Listeners                 | The number of listeners currently running and attempting to manage jobs for the scale set. This should match the number of scale sets deployed. |
-| Pending Runners                  | The total number of ephemeral runners that ARC has requested and is waiting for Kubernetes to provide in a running state. If the Kubernetes API server is responsive, this will typically match the number of runner pods that are in a pending state. This number includes requests for runner pods that have not yet been scheduled. When this number is higher than the number of runner pods in a pending state, it can indicate performance issues. |
-| Registered Runners               | The total number of ephemeral runners that have been successfully registered. |
-| Active Runners | The total number of runners that are active and either available or processing jobs. |
-| Out of Memory | The number of containers that have been terminated by the OOMKiller. This can indicate that the requests/ limits for one or more pods on the node were configured improperly, allowing pods to request more memory than the node had available. |
-| Peak Container Memory | The maximum amount of memory used by any container in a given namespace during the selected time. This can be used for tuning the memory limits for the pods and for alerts as containers get close to their limits.
-| Container I/O | Shows the number of bytes read and written to the container filesystem. This can be used to identify if the container is reading or writing a large amount of data to the filesystem, which can impact performance. |
-| Container Pod Status | Shows the number of containers in each status (waiting, running, terminated, ready). This can be used to identify if there are a large number of containers that are failing to start or are in a waiting state. |
-| Reconcile time              | The time to perform a single reconciliation task from a controller's work queue. This metric reflects the time it takes for ARC to complete each step in the processing of creating, managing, and cleaning up runners. As this increases, it can indicate resource contention, processing delays, or delays from the API server. |
-| Workqueue Queue Duration | The time items spent in the work queue for a controller before being processed. This is often related to the work queue depth; as the number of items increases, it can take an increasing amount of time for an item to be processed. |
+| Active listeners                 | The number of listeners currently running and attempting to manage jobs for the scale set. This should match the number of scale sets deployed. |
+| Runner States                    | Displays the number of runners in a given state. The finished and deleted states are not included in this panel. |
+| Failed (total)                   | The total number of ephemeral runners that have failed to properly start. This may require reviewing the custom resource and logs to identify and resolve the root causes. Common causes include resource issues and failure to pull the required image. |
+| Pending (total)                  | The total number of ephemeral runners that ARC has requested and is waiting for Kubernetes to provide in a running state. If the Kubernetes API server is responsive, this will typically match the number of runner pods that are in a pending state. This number includes requests for runner pods that have not yet been scheduled. When this number is higher than the number of runner pods in a pending state, it can indicate performance issues with the API server and resource contention. |
+| Idle (total)                     | The total number of ephemeral runners that are available to accept jobs across all scale sets. Keeping a pool of idle runners can enable a faster start time under load, but excessive idle runners will consume resources and can prevent nodes from scaling down. |
+| Total assigned jobs per listener | The number of workflow jobs acquired and assigned to the listener. The listener must provide supporting runners to complete these jobs. Once jobs are assigned, they cannot be delegated to other listeners and must be processed by the scale set or cancelled. |
+| Assigned vs running jobs         | Compares the number of jobs assigned against the number of runners that are currently processing jobs. When running jobs is less than assigned jobs, it can indicate that ARC is waiting on Kubernetes to provide and start additional runners. |
+| Average startup duration         | The average time in seconds between when jobs are assigned and when a runner accepts the job and begins processing. An increasing duration can indicate that the cluster has resource contention or a lack of available nodes for scheduling jobs |
+| Average execution duration       | The average time in seconds that runners are taking to complete a job. Changes in this value reflect the efficiency of workflow jobs and the pod configuration. If the value is decreasing without changes to the job, it can indicate resource contention or CPU throttling. |
 | Reconciliation errors            | Reconciliation is the process of a controller ensuring the desired state and actual state of the resources match. Each time an event occurs on a resource watched by the controller, the controller is required to indicate if the new state matches the desired state. Kubernetes adds a task to the work queue for the controller to perform this reconciliation. Errors indicate that controller has not achieved a desired state and is requesting Kubernetes to queue another request for reconciliation. Ideally, this number remains close to zero. An increasing number can indicate resource contention or delays processing API server requests. This reflects Kubernetes resources that ARC is waiting to be provided or in the necessary state. As a concrete example, ARC will request the creation of a secret prior to creating the pod. If the response indicates the secret is not immediately ready, ARC will requeue the reconciliation task with the error details, incrementing this count. |
-| Workqueue depth                  | The number of tasks that Kubernetes has queued for the ARC controllers to process. This includes reconciliation requests and tasks initiated by the controller. Managing a runner requires multiple steps to prepare, create, update, and delete the runner, its resources, and the ARC custom resources. As each step is completed (or trigger reconciliation), new tasks are queued for processing. The controller will then use one or more workers to process these tasks in the order they were queued. As the depth increases, it indicates more tasks awaiting time from the controller. Growth indicates increasing work and may reflect Kubernetes resource contention or processing latencies. Each request for a new runner will result in multiple tasks being added to the work queue to prepare and create the runner and the related ARC custom resources. |
-| Active Workers | The number of workers that are actively processing tasks in the work queue. If the queue is empty, then there may be no workers required to process the tasks. The number of workers for the ephemeral runner is configurable in the scale set values file. |
-| API Calls | Shows the number of calls to the API server by status code and HTTP method. The method indicates the type of activity being performed, while the status code indicates the result of the activity. Error codes of 500 and above often indicate a Kubernetes issue. | 
+| Reconciliation time              | A histogram reflecting the time in seconds to perform a single reconciliation task from the controller's work queue. A histogram counts the number of requests that are processed within a given bucket of time. This metric reflects the time it takes for ARC to complete each step in the processing of creating, managing, and cleaning up runners. As this increases, it can indicate resource contention or processing delays within Kubernetes or the API server. This displays shows an average, which may hide larger or smaller times that are occurring in the processing. |
+| Workqueue depth                  | The number of tasks that Kubernetes queued for the ARC controllers to process. This includes reconciliation requests and tasks from ARC. ARC sequentially processes a work queue of single, small task to avoid concurrency issues. Managing a runner requires multiple steps to prepare, create, update, and delete the runner, its resources, and the ARC custom resources. As each step is completed (or trigger reconciliation), new tasks are queued for processing. As the depth increases, it indicates more tasks awaiting time from the controller. Growth indicates increasing work and may indicate Kubernetes resource contention or processing latencies. Each request for a new runner will result in multiple tasks being added to the work queue to prepare and create the runner and the related ARC custom resources. |
 | Scrape Duration (seconds)        | The amount of time required for Prometheus to read the configured metrics from components in the cluster. An increasing number may indicate a lack of resources for Prometheus and a risk of the process exceeding the configured timeout, leading to lost metrics data.  | 

github/actions/client.go

@@ -1060,15 +1060,10 @@ func (c *Client) fetchAccessToken(ctx context.Context, gitHubConfigURL string, c
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusCreated {
-		errMsg := fmt.Sprintf("failed to get access token for GitHub App auth (%v)", resp.Status)
-		if body, err := io.ReadAll(resp.Body); err == nil {
-			errMsg = fmt.Sprintf("%s: %s", errMsg, string(body))
-		}
-
 		return nil, &GitHubAPIError{
 			StatusCode: resp.StatusCode,
 			RequestID:  resp.Header.Get(HeaderGitHubRequestID),
-			Err:        errors.New(errMsg),
+			Err:        fmt.Errorf("failed to get access token for GitHub App auth: %v", resp.Status),
 		}
 	}
 
@@ -1217,7 +1212,7 @@ func createJWTForGitHubApp(appAuth *GitHubAppAuth) (string, error) {
 	claims := &jwt.RegisteredClaims{
 		IssuedAt:  jwt.NewNumericDate(issuedAt),
 		ExpiresAt: jwt.NewNumericDate(expiresAt),
-		Issuer:    appAuth.AppID,
+		Issuer:    strconv.FormatInt(appAuth.AppID, 10),
 	}
 
 	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)

github/actions/fake/multi_client.go

@@ -3,7 +3,6 @@ package fake
 import (
 	"context"
 
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/actions/actions-runner-controller/github/actions"
 )
 
@@ -35,6 +34,10 @@ func NewMultiClient(opts ...MultiClientOption) actions.MultiClient {
 	return f
 }
 
-func (f *fakeMultiClient) GetClientFor(ctx context.Context, githubConfigURL string, appConfig *appconfig.AppConfig, namespace string, options ...actions.ClientOption) (actions.ActionsService, error) {
+func (f *fakeMultiClient) GetClientFor(ctx context.Context, githubConfigURL string, creds actions.ActionsAuth, namespace string, options ...actions.ClientOption) (actions.ActionsService, error) {
+	return f.defaultClient, f.defaultErr
+}
+
+func (f *fakeMultiClient) GetClientFromSecret(ctx context.Context, githubConfigURL, namespace string, secretData actions.KubernetesSecretData, options ...actions.ClientOption) (actions.ActionsService, error) {
 	return f.defaultClient, f.defaultErr
 }

github/actions/identifier_test.go

@@ -57,7 +57,7 @@ func TestClient_Identifier(t *testing.T) {
 		}
 		defaultAppCreds := &actions.ActionsAuth{
 			AppCreds: &actions.GitHubAppAuth{
-				AppID:             "123",
+				AppID:             123,
 				AppInstallationID: 123,
 				AppPrivateKey:     "private key",
 			},
@@ -90,7 +90,7 @@ func TestClient_Identifier(t *testing.T) {
 				old:  defaultAppCreds,
 				new: &actions.ActionsAuth{
 					AppCreds: &actions.GitHubAppAuth{
-						AppID:             "456",
+						AppID:             456,
 						AppInstallationID: 456,
 						AppPrivateKey:     "new private key",
 					},

github/actions/multi_client.go

@@ -3,14 +3,15 @@ package actions
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"sync"
 
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/go-logr/logr"
 )
 
 type MultiClient interface {
-	GetClientFor(ctx context.Context, githubConfigURL string, appConfig *appconfig.AppConfig, namespace string, options ...ClientOption) (ActionsService, error)
+	GetClientFor(ctx context.Context, githubConfigURL string, creds ActionsAuth, namespace string, options ...ClientOption) (ActionsService, error)
+	GetClientFromSecret(ctx context.Context, githubConfigURL, namespace string, secretData KubernetesSecretData, options ...ClientOption) (ActionsService, error)
 }
 
 type multiClient struct {
@@ -22,8 +23,7 @@ type multiClient struct {
 }
 
 type GitHubAppAuth struct {
-	// AppID is the ID or the Client ID of the application
-	AppID             string
+	AppID             int64
 	AppInstallationID int64
 	AppPrivateKey     string
 }
@@ -49,22 +49,15 @@ func NewMultiClient(logger logr.Logger) MultiClient {
 	}
 }
 
-func (m *multiClient) GetClientFor(ctx context.Context, githubConfigURL string, appConfig *appconfig.AppConfig, namespace string, options ...ClientOption) (ActionsService, error) {
+func (m *multiClient) GetClientFor(ctx context.Context, githubConfigURL string, creds ActionsAuth, namespace string, options ...ClientOption) (ActionsService, error) {
 	m.logger.Info("retrieve actions client", "githubConfigURL", githubConfigURL, "namespace", namespace)
 
-	if err := appConfig.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate app config: %w", err)
+	if creds.Token == "" && creds.AppCreds == nil {
+		return nil, fmt.Errorf("no credentials provided. either a PAT or GitHub App credentials should be provided")
 	}
 
-	var creds ActionsAuth
-	if len(appConfig.Token) > 0 {
-		creds.Token = appConfig.Token
-	} else {
-		creds.AppCreds = &GitHubAppAuth{
-			AppID:             appConfig.AppID,
-			AppInstallationID: appConfig.AppInstallationID,
-			AppPrivateKey:     appConfig.AppPrivateKey,
-		}
+	if creds.Token != "" && creds.AppCreds != nil {
+		return nil, fmt.Errorf("both PAT and GitHub App credentials provided. should only provide one")
 	}
 
 	client, err := NewClient(
@@ -75,7 +68,7 @@ func (m *multiClient) GetClientFor(ctx context.Context, githubConfigURL string,
 		}, options...)...,
 	)
 	if err != nil {
-		return nil, fmt.Errorf("failed to instantiate new client: %w", err)
+		return nil, err
 	}
 
 	m.mu.Lock()
@@ -100,3 +93,47 @@ func (m *multiClient) GetClientFor(ctx context.Context, githubConfigURL string,
 
 	return client, nil
 }
+
+type KubernetesSecretData map[string][]byte
+
+func (m *multiClient) GetClientFromSecret(ctx context.Context, githubConfigURL, namespace string, secretData KubernetesSecretData, options ...ClientOption) (ActionsService, error) {
+	if len(secretData) == 0 {
+		return nil, fmt.Errorf("must provide secret data with either PAT or GitHub App Auth")
+	}
+
+	token := string(secretData["github_token"])
+	hasToken := len(token) > 0
+
+	appID := string(secretData["github_app_id"])
+	appInstallationID := string(secretData["github_app_installation_id"])
+	appPrivateKey := string(secretData["github_app_private_key"])
+	hasGitHubAppAuth := len(appID) > 0 && len(appInstallationID) > 0 && len(appPrivateKey) > 0
+
+	if hasToken && hasGitHubAppAuth {
+		return nil, fmt.Errorf("must provide secret with only PAT or GitHub App Auth to avoid ambiguity in client behavior")
+	}
+
+	if !hasToken && !hasGitHubAppAuth {
+		return nil, fmt.Errorf("neither PAT nor GitHub App Auth credentials provided in secret")
+	}
+
+	auth := ActionsAuth{}
+
+	if hasToken {
+		auth.Token = token
+		return m.GetClientFor(ctx, githubConfigURL, auth, namespace, options...)
+	}
+
+	parsedAppID, err := strconv.ParseInt(appID, 10, 64)
+	if err != nil {
+		return nil, err
+	}
+
+	parsedAppInstallationID, err := strconv.ParseInt(appInstallationID, 10, 64)
+	if err != nil {
+		return nil, err
+	}
+
+	auth.AppCreds = &GitHubAppAuth{AppID: parsedAppID, AppInstallationID: parsedAppInstallationID, AppPrivateKey: appPrivateKey}
+	return m.GetClientFor(ctx, githubConfigURL, auth, namespace, options...)
+}

github/actions/multi_client_test.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/go-logr/logr"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -24,13 +23,10 @@ func TestMultiClientCaching(t *testing.T) {
 
 	defaultNamespace := "default"
 	defaultConfigURL := "https://github.com/org/repo"
-	defaultCreds := &appconfig.AppConfig{
+	defaultCreds := &ActionsAuth{
 		Token: "token",
 	}
-	defaultAuth := ActionsAuth{
-		Token: defaultCreds.Token,
-	}
-	client, err := NewClient(defaultConfigURL, &defaultAuth)
+	client, err := NewClient(defaultConfigURL, defaultCreds)
 	require.NoError(t, err)
 
 	multiClient.clients[ActionsClientKey{client.Identifier(), defaultNamespace}] = client
@@ -39,7 +35,7 @@ func TestMultiClientCaching(t *testing.T) {
 	cachedClient, err := multiClient.GetClientFor(
 		ctx,
 		defaultConfigURL,
-		defaultCreds,
+		*defaultCreds,
 		defaultNamespace,
 	)
 	require.NoError(t, err)
@@ -51,7 +47,7 @@ func TestMultiClientCaching(t *testing.T) {
 	newClient, err := multiClient.GetClientFor(
 		ctx,
 		defaultConfigURL,
-		defaultCreds,
+		*defaultCreds,
 		otherNamespace,
 	)
 	require.NoError(t, err)
@@ -67,7 +63,7 @@ func TestMultiClientOptions(t *testing.T) {
 	defaultConfigURL := "https://github.com/org/repo"
 
 	t.Run("GetClientFor", func(t *testing.T) {
-		defaultCreds := &appconfig.AppConfig{
+		defaultCreds := &ActionsAuth{
 			Token: "token",
 		}
 
@@ -75,7 +71,7 @@ func TestMultiClientOptions(t *testing.T) {
 		service, err := multiClient.GetClientFor(
 			ctx,
 			defaultConfigURL,
-			defaultCreds,
+			*defaultCreds,
 			defaultNamespace,
 		)
 		service.SetUserAgent(testUserAgent)
@@ -87,6 +83,27 @@ func TestMultiClientOptions(t *testing.T) {
 		require.NoError(t, err)
 		assert.Equal(t, testUserAgent.String(), req.Header.Get("User-Agent"))
 	})
+
+	t.Run("GetClientFromSecret", func(t *testing.T) {
+		secret := map[string][]byte{
+			"github_token": []byte("token"),
+		}
+
+		multiClient := NewMultiClient(logger)
+		service, err := multiClient.GetClientFromSecret(
+			ctx,
+			defaultConfigURL,
+			defaultNamespace,
+			secret,
+		)
+		service.SetUserAgent(testUserAgent)
+		require.NoError(t, err)
+
+		client := service.(*Client)
+		req, err := client.NewGitHubAPIRequest(ctx, "GET", "/test", nil)
+		require.NoError(t, err)
+		assert.Equal(t, testUserAgent.String(), req.Header.Get("User-Agent"))
+	})
 }
 
 func TestCreateJWT(t *testing.T) {
@@ -120,7 +137,7 @@ etFcaQuTHEZyRhhJ4BU=
 -----END PRIVATE KEY-----`
 
 	auth := &GitHubAppAuth{
-		AppID:         "123",
+		AppID:         123,
 		AppPrivateKey: key,
 	}
 	jwt, err := createJWTForGitHubApp(auth)

go.mod

@@ -1,11 +1,7 @@
 module github.com/actions/actions-runner-controller
 
-go 1.24.3
-
+go 1.24.0
 require (
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0
 	github.com/bradleyfalzon/ghinstallation/v2 v2.14.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/evanphx/json-patch v5.9.11+incompatible
@@ -42,9 +38,6 @@ require (
 
 require (
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 // indirect
 	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
@@ -86,7 +79,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/boombuler/barcode v1.0.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/cloudflare/circl v1.6.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
@@ -101,7 +94,6 @@ require (
 	github.com/go-sql-driver/mysql v1.9.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/gonvenience/bunt v1.4.0 // indirect
 	github.com/gonvenience/idem v0.0.1 // indirect
@@ -128,7 +120,6 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-ciede2000 v0.0.0-20170301095244-782e8c62fec3 // indirect
@@ -142,7 +133,6 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/pquerna/otp v1.4.0 // indirect

go.sum

@@ -1,22 +1,5 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/Azure/azure-sdk-for-go v51.0.0+incompatible h1:p7blnyJSjJqf5jflHbSGhIhEpXIgIFmYZNg5uwqweso=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0 h1:g0EZJwz7xkXQiZAI5xi9f3WWFYBlX1CPTrR+NDToRkQ=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0/go.mod h1:XCW7KnZet0Opnr7HccfUw1PLc4CjHqpcaxW8DHklNkQ=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1 h1:1mvYtZfWQAnwNah/C+Z+Jb9rQH95LPE2vlmMuWAHJk8=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1/go.mod h1:75I/mXtme1JyWFtz8GocPHVFyH421IBoZErnO16dd0k=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1 h1:Bk5uOhSAenHyR5P61D/NzeQCv+4fEVV8mOkJ82NqpWw=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1/go.mod h1:QZ4pw3or1WPmRBxf0cHd1tknzrT54WPBOQoGutCPvSU=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0 h1:WLUIpeyv04H0RCcQHaA4TNoyrQ39Ox7V+re+iaqzTe0=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0/go.mod h1:hd8hTTIY3VmUVPRHNH7GVCHO3SHgXkJKZHReby/bnUQ=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 h1:eXnN9kaS8TiDwXjoie3hMRLuwdUBUMW9KRgOqB3mCaw=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0/go.mod h1:XIpam8wumeZ5rVMuhdDQLMfIPDf1WO3IzrCRO3e3e3o=
-github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
-github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 h1:kYRSnvJju5gYVyhkij+RTJ/VR6QIUaCfWeaFm2ycsjQ=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
 github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
@@ -106,16 +89,14 @@ github.com/bradleyfalzon/ghinstallation/v2 v2.14.0 h1:0D4vKCHOvYrDU8u61TnE2JfNT4
 github.com/bradleyfalzon/ghinstallation/v2 v2.14.0/go.mod h1:LOVmdZYVZ8jqdr4n9wWm1ocDiMz9IfMGfRkaYC1a52A=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
-github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
+github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
 github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
@@ -153,8 +134,6 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
@@ -236,8 +215,6 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
-github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6 h1:IsMZxCuZqKuao2vNdfD82fjjgPLfyHLpR41Z88viRWs=
-github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6/go.mod h1:3VeWNIJaW+O5xpRQbPp0Ybqu1vJd/pm7s2F473HRrkw=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
@@ -292,8 +269,6 @@ github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7J
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
 github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -309,8 +284,6 @@ github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E=
-github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
 github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -382,7 +355,6 @@ golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=

main.go

@@ -274,18 +274,10 @@ func main() {
 			log.WithName("actions-clients"),
 		)
 
-		secretResolver := actionsgithubcom.NewSecretResolver(
-			mgr.GetClient(),
-			actionsMultiClient,
-		)
-
 		rb := actionsgithubcom.ResourceBuilder{
 			ExcludeLabelPropagationPrefixes: excludeLabelPropagationPrefixes,
-			SecretResolver:                  secretResolver,
 		}
 
-		log.Info("Resource builder initializing")
-
 		if err = (&actionsgithubcom.AutoscalingRunnerSetReconciler{
 			Client:                             mgr.GetClient(),
 			Log:                                log.WithName("AutoscalingRunnerSet").WithValues("version", build.Version),
@@ -305,6 +297,7 @@ func main() {
 			Client:          mgr.GetClient(),
 			Log:             log.WithName("EphemeralRunner").WithValues("version", build.Version),
 			Scheme:          mgr.GetScheme(),
+			ActionsClient:   actionsMultiClient,
 			ResourceBuilder: rb,
 		}).SetupWithManager(mgr, actionsgithubcom.WithMaxConcurrentReconciles(opts.RunnerMaxConcurrentReconciles)); err != nil {
 			log.Error(err, "unable to create controller", "controller", "EphemeralRunner")
@@ -315,6 +308,7 @@ func main() {
 			Client:          mgr.GetClient(),
 			Log:             log.WithName("EphemeralRunnerSet").WithValues("version", build.Version),
 			Scheme:          mgr.GetScheme(),
+			ActionsClient:   actionsMultiClient,
 			PublishMetrics:  metricsAddr != "0",
 			ResourceBuilder: rb,
 		}).SetupWithManager(mgr); err != nil {

runner/Makefile

@@ -6,7 +6,7 @@ DIND_ROOTLESS_RUNNER_NAME ?= ${DOCKER_USER}/actions-runner-dind-rootless
 OS_IMAGE ?= ubuntu-22.04
 TARGETPLATFORM ?= $(shell arch)
 
-RUNNER_VERSION ?= 2.325.0
+RUNNER_VERSION ?= 2.323.0
 RUNNER_CONTAINER_HOOKS_VERSION ?= 0.7.0
 DOCKER_VERSION ?= 24.0.7
 

runner/VERSION

@@ -1,2 +1,2 @@
-RUNNER_VERSION=2.325.0
+RUNNER_VERSION=2.323.0
 RUNNER_CONTAINER_HOOKS_VERSION=0.7.0

test/e2e/e2e_test.go

@@ -36,7 +36,7 @@ var (
 
 	testResultCMNamePrefix = "test-result-"
 
-	RunnerVersion               = "2.325.0"
+	RunnerVersion               = "2.323.0"
 	RunnerContainerHooksVersion = "0.7.0"
 )
 
@@ -1106,7 +1106,7 @@ func installActionsWorkflow(t *testing.T, testName, runnerLabel, testResultCMNam
 				testing.Step{
 					Uses: "actions/setup-go@v3",
 					With: &testing.With{
-						GoVersion: "1.24.3",
+						GoVersion: "1.24.0",
 					},
 				},
 			)

test_e2e_arc/arc_jobs_test.go

@@ -126,6 +126,7 @@ func TestARCJobs(t *testing.T) {
 		if !success {
 			t.Fatal("Expected pods count did not match available pods count during job run.")
 		}
+
 	},
 	)
 	t.Run("Get available pods after job run", func(t *testing.T) {

vault/azurekeyvault/azurekeyvault.go

@@ -1,39 +0,0 @@
-package azurekeyvault
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
-)
-
-// AzureKeyVault is a struct that holds the Azure Key Vault client.
-type AzureKeyVault struct {
-	client *azsecrets.Client
-}
-
-func New(cfg Config) (*AzureKeyVault, error) {
-	if err := cfg.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate config: %v", err)
-	}
-
-	client, err := cfg.Client()
-	if err != nil {
-		return nil, fmt.Errorf("failed to create azsecrets client from config: %v", err)
-	}
-
-	return &AzureKeyVault{client: client}, nil
-}
-
-// GetSecret retrieves a secret from Azure Key Vault.
-func (v *AzureKeyVault) GetSecret(ctx context.Context, name string) (string, error) {
-	secret, err := v.client.GetSecret(ctx, name, "", nil)
-	if err != nil {
-		return "", fmt.Errorf("failed to get secret: %w", err)
-	}
-	if secret.Value == nil {
-		return "", fmt.Errorf("secret value is nil")
-	}
-
-	return *secret.Value, nil
-}

vault/azurekeyvault/config.go

@@ -1,120 +0,0 @@
-package azurekeyvault
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"net/url"
-	"os"
-	"time"
-
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
-	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
-	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
-	"github.com/hashicorp/go-retryablehttp"
-	"golang.org/x/net/http/httpproxy"
-)
-
-// AzureKeyVault is a struct that holds the Azure Key Vault client.
-type Config struct {
-	TenantID        string            `json:"tenant_id"`
-	ClientID        string            `json:"client_id"`
-	URL             string            `json:"url"`
-	CertificatePath string            `json:"certificate_path"`
-	Proxy           *httpproxy.Config `json:"proxy,omitempty"`
-}
-
-func (c *Config) Validate() error {
-	if c.TenantID == "" {
-		return errors.New("tenant_id is not set")
-	}
-	if c.ClientID == "" {
-		return errors.New("client_id is not set")
-	}
-	if _, err := url.ParseRequestURI(c.URL); err != nil {
-		return fmt.Errorf("failed to parse url: %v", err)
-	}
-
-	if c.CertificatePath == "" {
-		return errors.New("cert path must be provided")
-	}
-
-	if _, err := os.Stat(c.CertificatePath); err != nil {
-		return fmt.Errorf("cert path %q does not exist: %v", c.CertificatePath, err)
-	}
-
-	if c.Proxy != nil {
-		if c.Proxy.HTTPProxy == "" && c.Proxy.HTTPSProxy == "" && c.Proxy.NoProxy == "" {
-			return errors.New("proxy configuration is empty, at least one proxy must be set")
-		}
-	}
-
-	return nil
-}
-
-// Client creates a new Azure Key Vault client using the provided configuration.
-func (c *Config) Client() (*azsecrets.Client, error) {
-	return c.certClient()
-}
-
-func (c *Config) certClient() (*azsecrets.Client, error) {
-	data, err := os.ReadFile(c.CertificatePath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read cert file from path %q: %v", c.CertificatePath, err)
-	}
-
-	certs, key, err := azidentity.ParseCertificates(data, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse certificates: %w", err)
-	}
-
-	httpClient, err := c.httpClient()
-	if err != nil {
-		return nil, fmt.Errorf("failed to instantiate http client: %v", err)
-	}
-
-	cred, err := azidentity.NewClientCertificateCredential(
-		c.TenantID,
-		c.ClientID,
-		certs,
-		key,
-		&azidentity.ClientCertificateCredentialOptions{
-			ClientOptions: policy.ClientOptions{
-				Transport: httpClient,
-			},
-		},
-	)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create client certificate credential: %v", err)
-	}
-
-	client, err := azsecrets.NewClient(c.URL, cred, &azsecrets.ClientOptions{
-		ClientOptions: policy.ClientOptions{
-			Transport: httpClient,
-		},
-	})
-	if err != nil {
-		return nil, fmt.Errorf("failed to instantiate client for azsecrets: %v", err)
-	}
-
-	return client, nil
-}
-
-func (c *Config) httpClient() (*http.Client, error) {
-	retryClient := retryablehttp.NewClient()
-	retryClient.RetryMax = 4
-	retryClient.RetryWaitMax = 30 * time.Second
-	retryClient.HTTPClient.Timeout = 5 * time.Minute
-
-	transport, ok := retryClient.HTTPClient.Transport.(*http.Transport)
-	if !ok {
-		return nil, fmt.Errorf("failed to get http transport")
-	}
-	if c.Proxy != nil {
-		transport.Proxy = func(req *http.Request) (*url.URL, error) {
-			return c.Proxy.ProxyFunc()(req.URL)
-		}
-	}
-
-	return retryClient.StandardClient(), nil
-}

vault/azurekeyvault/config_test.go

@@ -1,99 +0,0 @@
-package azurekeyvault
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/net/http/httpproxy"
-)
-
-func TestConfigValidate_invalid(t *testing.T) {
-	tenantID := "tenantID"
-	clientID := "clientID"
-	url := "https://example.com"
-
-	cp, err := os.CreateTemp("", "")
-	require.NoError(t, err)
-	err = cp.Close()
-	require.NoError(t, err)
-	certPath := cp.Name()
-
-	t.Cleanup(func() {
-		os.Remove(certPath)
-	})
-
-	tt := map[string]*Config{
-		"empty": {},
-		"no tenant id": {
-			TenantID:        "",
-			ClientID:        clientID,
-			URL:             url,
-			CertificatePath: certPath,
-		},
-		"no client id": {
-			TenantID:        tenantID,
-			ClientID:        "",
-			URL:             url,
-			CertificatePath: certPath,
-		},
-		"no url": {
-			TenantID:        tenantID,
-			ClientID:        clientID,
-			URL:             "",
-			CertificatePath: certPath,
-		},
-		"no jwt and no cert path": {
-			TenantID:        tenantID,
-			ClientID:        clientID,
-			URL:             url,
-			CertificatePath: "",
-		},
-		"invalid proxy": {
-			TenantID:        tenantID,
-			ClientID:        clientID,
-			URL:             url,
-			CertificatePath: certPath,
-			Proxy:           &httpproxy.Config{},
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.Error(t, err)
-		})
-	}
-}
-
-func TestValidate_valid(t *testing.T) {
-	tenantID := "tenantID"
-	clientID := "clientID"
-	url := "https://example.com"
-
-	certPath, err := filepath.Abs("testdata/server.crt")
-	require.NoError(t, err)
-
-	tt := map[string]*Config{
-		"with cert": {
-			TenantID:        tenantID,
-			ClientID:        clientID,
-			URL:             url,
-			CertificatePath: certPath,
-		},
-		"without proxy": {
-			TenantID:        tenantID,
-			ClientID:        clientID,
-			URL:             url,
-			CertificatePath: certPath,
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.NoError(t, err)
-		})
-	}
-}

vault/azurekeyvault/testdata/server.crt

@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDOjCCAiKgAwIBAgIUQr7R8yN5+2and6ucUOPF6oIbD48wDQYJKoZIhvcNAQEL
-BQAwFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTI1MDIyODEyMDEzMFoXDTI2
-MDcxMzEyMDEzMFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0B
-AQEFAAOCAQ8AMIIBCgKCAQEA4oL2hAPQlDVaNJru5fIstkpoVSuam0vpswC7ciRc
-XQRjF3q8kjtIA7+jdySsKJqOLGnybDX3awvRyKMEjq11IfnZLjZc+FzTlA+x4z0h
-MHb0GiBFXKNzrExGI9F0KEPtFxcMIqZ119LY2ReexxWkZBQYlgTepaevp71za4c2
-n4Zy1+0iS5+uklZ4ANKMTBGlN76Qgt530VnpNiIeUbiUzY58Vx4q7kFcUv/oSz8p
-rbXr+/GGpAjrOc6/JsezRE8YK2po60dvV80TJ2Jt6pduvF7OSQnq/v4mJl1xuXKl
-Byo9HLbeu3BuVRWQs2/EwEzx5kX3Ugysl9Bm44K2yKe9/QIDAQABo4GAMH4wHwYD
-VR0jBBgwFoAUfd/q0BY4fkVBV3X+HWzXH0toW08wCQYDVR0TBAIwADALBgNVHQ8E
-BAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0RBAgwBocEfwAAATAdBgNV
-HQ4EFgQUe0rTTfWjho3hgeLTnajTCpddo2MwDQYJKoZIhvcNAQELBQADggEBAIR2
-5zkA7rPnddxCunsz8Jjq3wyhR/KiAFz+RGeFeiXDkF2fWr7QIQ9KbFbv8tpfXR7P
-B75bY0sXwutHMB2sZDi92cH5sthNBfp19fI35cxcU4oTPxp4UZJKEiA3Qx8y73CX
-NJu1009nPdOJNlIboDGAFdZ5SH6RCh+YcQZ68kjHPWBIpXxLbs9FN3QmpbAvtLh1
-PoPaSy7IjKmxm1u+Lf6tyIn2IiB3MiynaB3OKvbkLCseM/5SZKMk6WKSDWopOCJr
-xciPOc+yeLz5I2Omn0uViOIIciqjlgxncWAyNtDgvJcecwqB2cPiIhk6GY0QZ1uM
-e7KoqGzWXvWLqJ13a9U=
------END CERTIFICATE-----

vault/vault.go

@@ -1,38 +0,0 @@
-package vault
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/actions/actions-runner-controller/vault/azurekeyvault"
-)
-
-// Vault is the interface every vault implementation needs to adhere to
-type Vault interface {
-	GetSecret(ctx context.Context, name string) (string, error)
-}
-
-// VaultType represents the type of vault that can be used in the application.
-// It is used to identify which vault integration should be used to resolve secrets.
-type VaultType string
-
-// VaultType is the type of vault supported
-const (
-	VaultTypeAzureKeyVault VaultType = "azure_key_vault"
-)
-
-func (t VaultType) String() string {
-	return string(t)
-}
-
-func (t VaultType) Validate() error {
-	switch t {
-	case VaultTypeAzureKeyVault:
-		return nil
-	default:
-		return fmt.Errorf("unknown vault type: %q", t)
-	}
-}
-
-// Compile-time checks
-var _ Vault = (*azurekeyvault.AzureKeyVault)(nil)