Make EphemeralRunnerController MaxConcurrentReconciles configurable

.github/actions/execute-assert-arc-e2e/action.yaml

@@ -0,0 +1,202 @@
+name: 'Execute and Assert ARC E2E Test Action'
+description: 'Queue E2E test workflow and assert workflow run result to be succeed'
+
+inputs:
+  auth-token:
+    description: 'GitHub access token to queue workflow run'
+    required: true
+  repo-owner:
+    description: "The repository owner name that has the test workflow file, ex: actions"
+    required: true
+  repo-name:
+    description: "The repository name that has the test workflow file, ex: test"
+    required: true
+  workflow-file:
+    description: 'The file name of the workflow yaml, ex: test.yml'
+    required: true
+  arc-name:
+    description: 'The name of the configured gha-runner-scale-set'
+    required: true
+  arc-namespace:
+    description: 'The namespace of the configured gha-runner-scale-set'
+    required: true
+  arc-controller-namespace:
+    description: 'The namespace of the configured gha-runner-scale-set-controller'
+    required: true
+  wait-to-finish:
+    description: 'Wait for the workflow run to finish'
+    required: true
+    default: "true"
+  wait-to-running:
+    description: 'Wait for the workflow run to start running'
+    required: true
+    default: "false"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Queue test workflow
+      shell: bash
+      id: queue_workflow
+      run: |
+        queue_time=`date +%FT%TZ`
+        echo "queue_time=$queue_time" >> $GITHUB_OUTPUT
+        curl -X POST https://api.github.com/repos/${{inputs.repo-owner}}/${{inputs.repo-name}}/actions/workflows/${{inputs.workflow-file}}/dispatches \
+        -H "Accept: application/vnd.github.v3+json" \
+        -H "Authorization: token ${{inputs.auth-token}}" \
+        -d '{"ref": "main", "inputs": { "arc_name": "${{inputs.arc-name}}" } }'
+
+    - name: Fetch workflow run & job ids
+      uses: actions/github-script@v7
+      id: query_workflow
+      with:
+        script: |
+          // Try to find the workflow run triggered by the previous step using the workflow_dispatch event.
+          // - Find recently create workflow runs in the test repository
+          // - For each workflow run, list its workflow job and see if the job's labels contain `inputs.arc-name`
+          // - Since the inputs.arc-name should be unique per e2e workflow run, once we find the job with the label, we find the workflow that we just triggered.
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_id = '${{inputs.workflow-file}}'
+          let workflow_run_id = 0
+          let workflow_job_id = 0
+          let workflow_run_html_url = ""
+          let count = 0
+          while (count++<12) {
+            await sleep(10 * 1000);
+            let listRunResponse = await github.rest.actions.listWorkflowRuns({
+              owner: owner,
+              repo: repo,
+              workflow_id: workflow_id,
+              created: '>${{steps.queue_workflow.outputs.queue_time}}'
+            })
+            if (listRunResponse.data.total_count > 0) {
+              console.log(`Found some new workflow runs for ${workflow_id}`)
+              for (let i = 0; i<listRunResponse.data.total_count; i++) {
+                let workflowRun = listRunResponse.data.workflow_runs[i]
+                console.log(`Check if workflow run ${workflowRun.id} is triggered by us.`)
+                let listJobResponse = await github.rest.actions.listJobsForWorkflowRun({
+                  owner: owner,
+                  repo: repo,
+                  run_id: workflowRun.id
+                })
+                console.log(`Workflow run ${workflowRun.id} has ${listJobResponse.data.total_count} jobs.`)
+                if (listJobResponse.data.total_count > 0) {
+                  for (let j = 0; j<listJobResponse.data.total_count; j++) {
+                    let workflowJob = listJobResponse.data.jobs[j]
+                    console.log(`Check if workflow job ${workflowJob.id} is triggered by us.`)
+                    console.log(JSON.stringify(workflowJob.labels));
+                    if (workflowJob.labels.includes('${{inputs.arc-name}}')) {
+                      console.log(`Workflow job ${workflowJob.id} (Run id: ${workflowJob.run_id}) is triggered by us.`)
+                      workflow_run_id = workflowJob.run_id
+                      workflow_job_id = workflowJob.id
+                      workflow_run_html_url = workflowRun.html_url
+                      break
+                    }
+                  }
+                }
+
+                if (workflow_job_id > 0) {
+                  break;
+                }
+              }
+            }
+
+            if (workflow_job_id > 0) {
+              break;
+            }
+          }
+          if (workflow_job_id == 0) {
+            core.setFailed(`Can't find workflow run and workflow job triggered to 'runs-on ${{inputs.arc-name}}'`)
+          } else {
+            core.setOutput('workflow_run', workflow_run_id);
+            core.setOutput('workflow_job', workflow_job_id);
+            core.setOutput('workflow_run_url', workflow_run_html_url);
+          }
+
+    - name: Generate summary about the triggered workflow run
+      shell: bash
+      run: |
+        cat <<-EOF > $GITHUB_STEP_SUMMARY
+        | **Triggered workflow run** |
+        |:--------------------------:|
+        | ${{steps.query_workflow.outputs.workflow_run_url}} |
+        EOF
+
+    - name: Wait for workflow to start running
+      if: inputs.wait-to-running == 'true' && inputs.wait-to-finish == 'false'
+      uses: actions/github-script@v7
+      with:
+        script: |
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_run_id = ${{steps.query_workflow.outputs.workflow_run}}
+          const workflow_job_id = ${{steps.query_workflow.outputs.workflow_job}}
+          let count = 0
+          while (count++<10) {
+            await sleep(30 * 1000);
+            let getRunResponse = await github.rest.actions.getWorkflowRun({
+              owner: owner,
+              repo: repo,
+              run_id: workflow_run_id
+            })
+            console.log(`${getRunResponse.data.html_url}: ${getRunResponse.data.status} (${getRunResponse.data.conclusion})`);
+            if (getRunResponse.data.status == 'in_progress') {
+              console.log(`Workflow run is in progress.`)
+              return
+            }
+          }
+          core.setFailed(`The triggered workflow run didn't start properly using ${{inputs.arc-name}}`)
+
+    - name: Wait for workflow to finish successfully
+      if: inputs.wait-to-finish == 'true'
+      uses: actions/github-script@v7
+      with:
+        script: |
+          // Wait 5 minutes and make sure the workflow run we triggered completed with result 'success'
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_run_id = ${{steps.query_workflow.outputs.workflow_run}}
+          const workflow_job_id = ${{steps.query_workflow.outputs.workflow_job}}
+          let count = 0
+          while (count++<10) {
+            await sleep(30 * 1000);
+            let getRunResponse = await github.rest.actions.getWorkflowRun({
+              owner: owner,
+              repo: repo,
+              run_id: workflow_run_id
+            })
+            console.log(`${getRunResponse.data.html_url}: ${getRunResponse.data.status} (${getRunResponse.data.conclusion})`);
+            if (getRunResponse.data.status == 'completed') {
+              if ( getRunResponse.data.conclusion == 'success') {
+                console.log(`Workflow run finished properly.`)
+                return
+              } else {
+                core.setFailed(`The triggered workflow run finish with result ${getRunResponse.data.conclusion}`)
+                return
+              }
+            }
+          }
+          core.setFailed(`The triggered workflow run didn't finish properly using ${{inputs.arc-name}}`)
+
+    - name: cleanup
+      if: inputs.wait-to-finish == 'true'
+      shell: bash
+      run: |
+        helm uninstall ${{ inputs.arc-name }} --namespace ${{inputs.arc-namespace}} --debug
+        kubectl wait --timeout=30s --for=delete AutoScalingRunnerSet -n ${{inputs.arc-namespace}} -l app.kubernetes.io/instance=${{ inputs.arc-name }}
+
+    - name: Gather logs and cleanup
+      shell: bash
+      if: always()
+      run: |
+        kubectl logs deployment/arc-gha-rs-controller -n ${{inputs.arc-controller-namespace}}

.github/actions/setup-arc-e2e/action.yaml

@@ -0,0 +1,63 @@
+name: 'Setup ARC E2E Test Action'
+description: 'Build controller image, create kind cluster, load the image, and exchange ARC configure token.'
+
+inputs:
+  app-id:
+    description: 'GitHub App Id for exchange access token'
+    required: true
+  app-pk:
+    description: "GitHub App private key for exchange access token"
+    required: true
+  image-name:
+    description: "Local docker image name for building"
+    required: true
+  image-tag:
+    description: "Tag of ARC Docker image for building"
+    required: true
+  target-org:
+    description: "The test organization for ARC e2e test"
+    required: true
+
+outputs:
+  token:
+    description: 'Token to use for configure ARC'
+    value: ${{steps.config-token.outputs.token}}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+          # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
+          # BuildKit v0.11 which has a bug causing intermittent 
+          # failures pushing images to GHCR
+          version: v0.9.1
+          driver-opts: image=moby/buildkit:v0.10.6
+
+    - name: Build controller image
+      uses: docker/build-push-action@v5
+      with:
+        file: Dockerfile
+        platforms: linux/amd64
+        load: true
+        build-args: |
+          DOCKER_IMAGE_NAME=${{inputs.image-name}}
+          VERSION=${{inputs.image-tag}} 
+        tags: |
+          ${{inputs.image-name}}:${{inputs.image-tag}}
+        no-cache: true
+
+    - name: Create minikube cluster and load image
+      shell: bash
+      run: |
+        minikube start
+        minikube image load ${{inputs.image-name}}:${{inputs.image-tag}}
+
+    - name: Get configure token
+      id: config-token
+      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
+      with:
+        application_id: ${{ inputs.app-id }}
+        application_private_key: ${{ inputs.app-pk }}
+        organization: ${{ inputs.target-org}}

.github/actions/setup-docker-environment/action.yaml

@@ -0,0 +1,47 @@
+name: "Setup Docker"
+
+inputs:
+  username:
+    description: "Username"
+    required: true
+  password:
+    description: "Password"
+    required: true
+  ghcr_username:
+    description: "GHCR username. Usually set from the github.actor variable"
+    required: true
+  ghcr_password:
+    description: "GHCR password. Usually set from the secrets.GITHUB_TOKEN variable"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Get Short SHA
+      id: vars
+      run: |
+        echo "sha_short=${GITHUB_SHA::7}" >> $GITHUB_ENV
+      shell: bash
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        version: latest
+
+    - name: Login to DockerHub
+      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.password != ''  }}
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}
+
+    - name: Login to GitHub Container Registry
+      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ghcr_password != ''  }}
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ inputs.ghcr_username }}
+        password: ${{ inputs.ghcr_password }}

.github/dependabot.yml

@@ -9,15 +9,3 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
-    groups:
-      gomod:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns:
-          - "*"

.github/workflows/arc-publish-chart.yaml

@@ -5,18 +5,18 @@ name: Publish ARC Helm Charts
 on:
   push:
     branches:
-      - master
+    - master
     paths:
-      - "charts/**"
+    - 'charts/**'
-      - ".github/workflows/arc-publish-chart.yaml"
+    - '.github/workflows/arc-publish-chart.yaml'
-      - "!charts/actions-runner-controller/docs/**"
+    - '!charts/actions-runner-controller/docs/**'
-      - "!charts/gha-runner-scale-set-controller/**"
+    - '!charts/gha-runner-scale-set-controller/**'
-      - "!charts/gha-runner-scale-set/**"
+    - '!charts/gha-runner-scale-set/**'
-      - "!**.md"
+    - '!**.md'
   workflow_dispatch:
     inputs:
       force:
-        description: "Force publish even if the chart version is not bumped"
+        description: 'Force publish even if the chart version is not bumped'
         type: boolean
         required: true
         default: false
@@ -39,86 +39,86 @@ jobs:
     outputs:
       publish-chart: ${{ steps.publish-chart-step.outputs.publish }}
     steps:
-      - name: Checkout
+    - name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
-        with:
+      with:
-          fetch-depth: 0
+        fetch-depth: 0
 
-      - name: Set up Helm
+    - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
-        with:
+      with:
-          version: ${{ env.HELM_VERSION }}
+        version: ${{ env.HELM_VERSION }}
 
-      - name: Set up kube-score
+    - name: Set up kube-score
-        run: |
+      run: |
-          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+        wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
-          chmod 755 kube-score
+        chmod 755 kube-score
 
-      - name: Kube-score generated manifests
+    - name: Kube-score generated manifests
-        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score - --ignore-test pod-networkpolicy --ignore-test deployment-has-poddisruptionbudget --ignore-test deployment-has-host-podantiaffinity --ignore-test container-security-context --ignore-test pod-probes --ignore-test container-image-tag --enable-optional-test container-security-context-privileged --enable-optional-test container-security-context-readonlyrootfilesystem
+      run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score - --ignore-test pod-networkpolicy --ignore-test deployment-has-poddisruptionbudget --ignore-test deployment-has-host-podantiaffinity --ignore-test container-security-context --ignore-test pod-probes --ignore-test container-image-tag --enable-optional-test container-security-context-privileged --enable-optional-test container-security-context-readonlyrootfilesystem
 
-      # python is a requirement for the chart-testing action below (supports yamllint among other tests)
+    # python is a requirement for the chart-testing action below (supports yamllint among other tests)
-      - uses: actions/setup-python@v6
+    - uses: actions/setup-python@v5
-        with:
+      with:
-          python-version: "3.11"
+        python-version: '3.11'
 
-      - name: Set up chart-testing
+    - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+      uses: helm/chart-testing-action@v2.6.0
 
-      - name: Run chart-testing (list-changed)
+    - name: Run chart-testing (list-changed)
-        id: list-changed
+      id: list-changed
-        run: |
+      run: |
-          changed=$(ct list-changed --config charts/.ci/ct-config.yaml)
+        changed=$(ct list-changed --config charts/.ci/ct-config.yaml)
-          if [[ -n "$changed" ]]; then
+        if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
+          echo "changed=true" >> $GITHUB_OUTPUT
-          fi
+        fi
 
-      - name: Run chart-testing (lint)
+    - name: Run chart-testing (lint)
-        run: |
+      run: |
-          ct lint --config charts/.ci/ct-config.yaml
+        ct lint --config charts/.ci/ct-config.yaml
 
-      - name: Create kind cluster
+    - name: Create kind cluster
-        if: steps.list-changed.outputs.changed == 'true'
+      if: steps.list-changed.outputs.changed == 'true'
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+      uses: helm/kind-action@v1.4.0
 
-      # We need cert-manager already installed in the cluster because we assume the CRDs exist
+    # We need cert-manager already installed in the cluster because we assume the CRDs exist
-      - name: Install cert-manager
+    - name: Install cert-manager
-        if: steps.list-changed.outputs.changed == 'true'
+      if: steps.list-changed.outputs.changed == 'true'
-        run: |
+      run: |
-          helm repo add jetstack https://charts.jetstack.io --force-update
+        helm repo add jetstack https://charts.jetstack.io --force-update
-          helm install cert-manager jetstack/cert-manager --set installCRDs=true --wait
+        helm install cert-manager jetstack/cert-manager --set installCRDs=true --wait
 
-      - name: Run chart-testing (install)
+    - name: Run chart-testing (install)
-        if: steps.list-changed.outputs.changed == 'true'
+      if: steps.list-changed.outputs.changed == 'true'
-        run: ct install --config charts/.ci/ct-config.yaml
+      run: ct install --config charts/.ci/ct-config.yaml
 
-      # WARNING: This relies on the latest release being at the top of the JSON from GitHub and a clean chart.yaml
+    # WARNING: This relies on the latest release being at the top of the JSON from GitHub and a clean chart.yaml
-      - name: Check if Chart Publish is Needed
+    - name: Check if Chart Publish is Needed
-        id: publish-chart-step
+      id: publish-chart-step
-        run: |
+      run: |
-          CHART_TEXT=$(curl -fs https://raw.githubusercontent.com/${{ github.repository }}/master/charts/actions-runner-controller/Chart.yaml)
+        CHART_TEXT=$(curl -fs https://raw.githubusercontent.com/${{ github.repository }}/master/charts/actions-runner-controller/Chart.yaml)
-          NEW_CHART_VERSION=$(echo "$CHART_TEXT" | grep version: | cut -d ' ' -f 2)
+        NEW_CHART_VERSION=$(echo "$CHART_TEXT" | grep version: | cut -d ' ' -f 2)
-          RELEASE_LIST=$(curl -fs https://api.github.com/repos/${{ github.repository }}/releases  | jq .[].tag_name | grep actions-runner-controller | cut -d '"' -f 2 | cut -d '-' -f 4)
+        RELEASE_LIST=$(curl -fs https://api.github.com/repos/${{ github.repository }}/releases  | jq .[].tag_name | grep actions-runner-controller | cut -d '"' -f 2 | cut -d '-' -f 4)
-          LATEST_RELEASED_CHART_VERSION=$(echo $RELEASE_LIST | cut -d ' ' -f 1)
+        LATEST_RELEASED_CHART_VERSION=$(echo $RELEASE_LIST | cut -d ' ' -f 1)
 
-          echo "CHART_VERSION_IN_MASTER=$NEW_CHART_VERSION" >> $GITHUB_ENV
+        echo "CHART_VERSION_IN_MASTER=$NEW_CHART_VERSION" >> $GITHUB_ENV
-          echo "LATEST_CHART_VERSION=$LATEST_RELEASED_CHART_VERSION" >> $GITHUB_ENV
+        echo "LATEST_CHART_VERSION=$LATEST_RELEASED_CHART_VERSION" >> $GITHUB_ENV
 
-          # Always publish if force is true
+        # Always publish if force is true
-          if [[ $NEW_CHART_VERSION != $LATEST_RELEASED_CHART_VERSION || "${{ inputs.force }}" == "true" ]]; then
+        if [[ $NEW_CHART_VERSION != $LATEST_RELEASED_CHART_VERSION || "${{ inputs.force }}" == "true" ]]; then
-            echo "publish=true" >> $GITHUB_OUTPUT
+          echo "publish=true" >> $GITHUB_OUTPUT
-          else
+        else
-            echo "publish=false" >> $GITHUB_OUTPUT
+          echo "publish=false" >> $GITHUB_OUTPUT
-          fi
+        fi
 
-      - name: Job summary
+    - name: Job summary
-        run: |
+      run: |
-          echo "Chart linting has been completed." >> $GITHUB_STEP_SUMMARY
+        echo "Chart linting has been completed." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Status:**" >> $GITHUB_STEP_SUMMARY
+        echo "**Status:**" >> $GITHUB_STEP_SUMMARY
-          echo "- chart version in master: ${{ env.CHART_VERSION_IN_MASTER }}" >> $GITHUB_STEP_SUMMARY
+        echo "- chart version in master: ${{ env.CHART_VERSION_IN_MASTER }}" >> $GITHUB_STEP_SUMMARY
-          echo "- latest chart version: ${{ env.LATEST_CHART_VERSION }}" >> $GITHUB_STEP_SUMMARY
+        echo "- latest chart version: ${{ env.LATEST_CHART_VERSION }}" >> $GITHUB_STEP_SUMMARY
-          echo "- publish new chart: ${{ steps.publish-chart-step.outputs.publish }}" >> $GITHUB_STEP_SUMMARY
+        echo "- publish new chart: ${{ steps.publish-chart-step.outputs.publish }}" >> $GITHUB_STEP_SUMMARY
 
   publish-chart:
     if: needs.lint-chart.outputs.publish-chart == 'true'
@@ -133,80 +133,80 @@ jobs:
       CHART_TARGET_BRANCH: master
 
     steps:
-      - name: Checkout
+    - name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
-        with:
+      with:
-          fetch-depth: 0
+        fetch-depth: 0
 
-      - name: Configure Git
+    - name: Configure Git
-        run: |
+      run: |
-          git config user.name "$GITHUB_ACTOR"
+        git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
-      - name: Get Token
+    - name: Get Token
-        id: get_workflow_token
+      id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
-        with:
+      with:
-          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
+        application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
-          application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}
+        application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}
-          organization: ${{ env.CHART_TARGET_ORG }}
+        organization: ${{ env.CHART_TARGET_ORG }}
 
-      - name: Install chart-releaser
+    - name: Install chart-releaser
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f
+      uses: helm/chart-releaser-action@v1.4.1
-        with:
+      with:
-          install_only: true
+        install_only: true
-          install_dir: ${{ github.workspace }}/bin
+        install_dir: ${{ github.workspace }}/bin
 
-      - name: Package and upload release assets
+    - name: Package and upload release assets
-        run: |
+      run: |
-          cr package \
+        cr package \
-            ${{ github.workspace }}/charts/actions-runner-controller/ \
+          ${{ github.workspace }}/charts/actions-runner-controller/ \
-            --package-path .cr-release-packages
+          --package-path .cr-release-packages
 
-          cr upload \
+        cr upload \
-            --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
+          --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
-            --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
+          --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
-            --package-path .cr-release-packages \
+          --package-path .cr-release-packages \
-            --token ${{ secrets.GITHUB_TOKEN }}
+          --token ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Generate updated index.yaml
+    - name: Generate updated index.yaml
-        run: |
+      run: |
-          cr index \
+        cr index \
-            --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
+          --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
-            --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
+          --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
-            --index-path ${{ github.workspace }}/index.yaml \
+          --index-path ${{ github.workspace }}/index.yaml \
-            --token ${{ secrets.GITHUB_TOKEN }} \
+          --token ${{ secrets.GITHUB_TOKEN }} \
-            --push \
+          --push \
-            --pages-branch 'gh-pages' \
+          --pages-branch 'gh-pages' \
-            --pages-index-path 'index.yaml'
+          --pages-index-path 'index.yaml'
 
-      # Chart Release was never intended to publish to a different repo
+    # Chart Release was never intended to publish to a different repo
-      # this workaround is intended to move the index.yaml to the target repo
+    # this workaround is intended to move the index.yaml to the target repo
-      # where the github pages are hosted
+    # where the github pages are hosted
-      - name: Checkout target repository
+    - name: Checkout target repository
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
-        with:
+      with:
-          repository: ${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}
+        repository: ${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}
-          path: ${{ env.CHART_TARGET_REPO }}
+        path: ${{ env.CHART_TARGET_REPO }}
-          ref: ${{ env.CHART_TARGET_BRANCH }}
+        ref: ${{ env.CHART_TARGET_BRANCH }}
-          token: ${{ steps.get_workflow_token.outputs.token }}
+        token: ${{ steps.get_workflow_token.outputs.token }}
 
-      - name: Copy index.yaml
+    - name: Copy index.yaml
-        run: |
+      run: |
-          cp ${{ github.workspace }}/index.yaml ${{ env.CHART_TARGET_REPO }}/actions-runner-controller/index.yaml
+        cp ${{ github.workspace }}/index.yaml ${{ env.CHART_TARGET_REPO }}/actions-runner-controller/index.yaml
 
-      - name: Commit and push to target repository
+    - name: Commit and push to target repository
-        run: |
+      run: |
-          git config user.name "$GITHUB_ACTOR"
+        git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-          git add .
+        git add .
-          git commit -m "Update index.yaml"
+        git commit -m "Update index.yaml"
-          git push
+        git push
-        working-directory: ${{ github.workspace }}/${{ env.CHART_TARGET_REPO }}
+      working-directory: ${{ github.workspace }}/${{ env.CHART_TARGET_REPO }}
 
-      - name: Job summary
+    - name: Job summary
-        run: |
+      run: |
-          echo "New helm chart has been published" >> $GITHUB_STEP_SUMMARY
+        echo "New helm chart has been published" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Status:**" >> $GITHUB_STEP_SUMMARY
+        echo "**Status:**" >> $GITHUB_STEP_SUMMARY
-          echo "- New [index.yaml](https://github.com/${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}/tree/master/actions-runner-controller) pushed" >> $GITHUB_STEP_SUMMARY
+        echo "- New [index.yaml](https://github.com/${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}/tree/master/actions-runner-controller) pushed" >> $GITHUB_STEP_SUMMARY

.github/workflows/arc-publish.yaml

@@ -9,17 +9,17 @@ on:
   workflow_dispatch:
     inputs:
       release_tag_name:
-        description: "Tag name of the release to publish"
+        description: 'Tag name of the release to publish'
         required: true
       push_to_registries:
-        description: "Push images to registries"
+        description: 'Push images to registries'
         required: true
         type: boolean
         default: false
 
 permissions:
-  contents: write
+ contents: write
-  packages: write
+ packages: write
 
 env:
   TARGET_ORG: actions-runner-controller
@@ -39,15 +39,17 @@ jobs:
     if: ${{ !startsWith(github.event.inputs.release_tag_name, 'gha-runner-scale-set-') }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
 
       - name: Install tools
         run: |
-
+          curl -L -O https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.2.0/kubebuilder_2.2.0_linux_amd64.tar.gz
+          tar zxvf kubebuilder_2.2.0_linux_amd64.tar.gz
+          sudo mv kubebuilder_2.2.0_linux_amd64 /usr/local/kubebuilder
           curl -s https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh | bash
           sudo mv kustomize /usr/local/bin
           curl -L -O https://github.com/tcnksm/ghr/releases/download/v0.13.0/ghr_v0.13.0_linux_amd64.tar.gz
@@ -71,7 +73,7 @@ jobs:
 
       - name: Get Token
         id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
         with:
           application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
           application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}

.github/workflows/arc-release-runners.yaml

@@ -1,6 +1,4 @@
 name: Release ARC Runner Images
-permissions:
-  contents: read
 
 # Revert to https://github.com/actions-runner-controller/releases#releases
 # for details on why we use this approach
@@ -9,17 +7,17 @@ on:
   # are available to the workflow run
   push:
     branches:
-      - "master"
+      - 'master'
     paths:
-      - "runner/VERSION"
+      - 'runner/VERSION'
-      - ".github/workflows/arc-release-runners.yaml"
+      - '.github/workflows/arc-release-runners.yaml'
 
 env:
   # Safeguard to prevent pushing images to registeries after build
   PUSH_TO_REGISTRIES: true
   TARGET_ORG: actions-runner-controller
   TARGET_WORKFLOW: release-runners.yaml
-  DOCKER_VERSION: 28.0.4
+  DOCKER_VERSION: 24.0.7
 
 concurrency:
   group: ${{ github.workflow }}
@@ -30,7 +28,7 @@ jobs:
     name: Trigger Build and Push of Runner Images
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Get runner version
         id: versions
         run: |
@@ -41,7 +39,7 @@ jobs:
 
       - name: Get Token
         id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
         with:
           application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
           application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}

.github/workflows/arc-update-runners-scheduled.yaml

@@ -1,9 +1,6 @@
 # This workflows polls releases from actions/runner and in case of a new one it
 # updates files containing runner version and opens a pull request.
 name: Runner Updates Check (Scheduled Job)
-permissions:
-  pull-requests: write
-  contents: write
 
 on:
   schedule:
@@ -24,7 +21,7 @@ jobs:
       container_hooks_current_version: ${{ steps.container_hooks_versions.outputs.container_hooks_current_version }}
       container_hooks_latest_version: ${{ steps.container_hooks_versions.outputs.container_hooks_latest_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Get runner current and latest versions
         id: runner_versions
@@ -53,8 +50,6 @@ jobs:
   # it sets a PR name as output.
   check_pr:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     needs: check_versions
     if: needs.check_versions.outputs.runner_current_version != needs.check_versions.outputs.runner_latest_version || needs.check_versions.outputs.container_hooks_current_version != needs.check_versions.outputs.container_hooks_latest_version
     outputs:
@@ -69,7 +64,7 @@ jobs:
           echo "CONTAINER_HOOKS_CURRENT_VERSION=${{ needs.check_versions.outputs.container_hooks_current_version }}"
           echo "CONTAINER_HOOKS_LATEST_VERSION=${{ needs.check_versions.outputs.container_hooks_latest_version }}"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: PR Name
         id: pr_name
@@ -124,7 +119,7 @@ jobs:
       PR_NAME: ${{ needs.check_pr.outputs.pr_name }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: New branch
         run: git checkout -b update-runner-"$(date +%Y-%m-%d)"

.github/workflows/arc-validate-chart.yaml

@@ -5,20 +5,20 @@ on:
     branches:
       - master
     paths:
-      - "charts/**"
+      - 'charts/**'
-      - ".github/workflows/arc-validate-chart.yaml"
+      - '.github/workflows/arc-validate-chart.yaml'
-      - "!charts/actions-runner-controller/docs/**"
+      - '!charts/actions-runner-controller/docs/**'
-      - "!**.md"
+      - '!**.md'
-      - "!charts/gha-runner-scale-set-controller/**"
+      - '!charts/gha-runner-scale-set-controller/**'
-      - "!charts/gha-runner-scale-set/**"
+      - '!charts/gha-runner-scale-set/**'
   push:
     paths:
-      - "charts/**"
+      - 'charts/**'
-      - ".github/workflows/arc-validate-chart.yaml"
+      - '.github/workflows/arc-validate-chart.yaml'
-      - "!charts/actions-runner-controller/docs/**"
+      - '!charts/actions-runner-controller/docs/**'
-      - "!**.md"
+      - '!**.md'
-      - "!charts/gha-runner-scale-set-controller/**"
+      - '!charts/gha-runner-scale-set-controller/**'
-      - "!charts/gha-runner-scale-set/**"
+      - '!charts/gha-runner-scale-set/**'
   workflow_dispatch:
 env:
   KUBE_SCORE_VERSION: 1.10.0
@@ -40,22 +40,39 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
+      - name: Set up kube-score
+        run: |
+          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+          chmod 755 kube-score
+
+      - name: Kube-score generated manifests
+        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score -
+              --ignore-test pod-networkpolicy
+              --ignore-test deployment-has-poddisruptionbudget
+              --ignore-test deployment-has-host-podantiaffinity
+              --ignore-test container-security-context
+              --ignore-test pod-probes
+              --ignore-test container-image-tag
+              --enable-optional-test container-security-context-privileged
+              --enable-optional-test container-security-context-readonlyrootfilesystem
+
       # python is a requirement for the chart-testing action below (supports yamllint among other tests)
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: '3.11'
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@v2.6.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -70,7 +87,7 @@ jobs:
           ct lint --config charts/.ci/ct-config.yaml
 
       - name: Create kind cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+        uses: helm/kind-action@v1.4.0
         if: steps.list-changed.outputs.changed == 'true'
 
       # We need cert-manager already installed in the cluster because we assume the CRDs exist

.github/workflows/arc-validate-runners.yaml

@@ -3,17 +3,17 @@ name: Validate ARC Runners
 on:
   pull_request:
     branches:
-      - "**"
+      - '**'
     paths:
-      - "runner/**"
+      - 'runner/**'
-      - "test/startup/**"
+      - 'test/startup/**'
-      - "!**.md"
+      - '!**.md'
 
 permissions:
   contents: read
 
 concurrency:
-  # This will make sure we only apply the concurrency limits on pull requests
+  # This will make sure we only apply the concurrency limits on pull requests 
   # but not pushes to master branch by making the concurrency group name unique
   # for pushes
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -24,17 +24,29 @@ jobs:
     name: runner / shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - name: "Run shellcheck"
+      - name: shellcheck
-        run: make shellcheck
+        uses: reviewdog/action-shellcheck@v1
-
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          path: "./runner"
+          pattern: |
+            *.sh
+            *.bash
+            update-status
+          # Make this consistent with `make shellsheck`
+          shellcheck_flags: "--shell bash --source-path runner"
+          exclude: "./.git/*"
+          check_all_files_with_shebangs: "false"
+          # Set this to "true" once we addressed all the shellcheck findings
+          fail_on_error: "false"
   test-runner-entrypoint:
     name: Test entrypoint
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+    - name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
 
-      - name: Run tests
+    - name: Run tests
-        run: |
+      run: |
-          make acceptance/runner/startup
+        make acceptance/runner/startup

.github/workflows/gha-publish-chart.yaml

@@ -4,37 +4,27 @@ on:
   workflow_dispatch:
     inputs:
       ref:
-        description: "The branch, tag or SHA to cut a release from"
+        description: 'The branch, tag or SHA to cut a release from'
         required: false
         type: string
-        default: ""
+        default: ''
       release_tag_name:
-        description: "The name to tag the controller image with"
+        description: 'The name to tag the controller image with'
         required: true
         type: string
-        default: "canary"
+        default: 'canary'
       push_to_registries:
-        description: "Push images to registries"
+        description: 'Push images to registries'
         required: true
         type: boolean
         default: false
       publish_gha_runner_scale_set_controller_chart:
-        description: "Publish new helm chart for gha-runner-scale-set-controller"
+        description: 'Publish new helm chart for gha-runner-scale-set-controller'
-        required: true
-        type: boolean
-        default: false
-      publish_gha_runner_scale_set_controller_experimental_chart:
-        description: "Publish new helm chart for gha-runner-scale-set-controller-experimental"
         required: true
         type: boolean
         default: false
       publish_gha_runner_scale_set_chart:
-        description: "Publish new helm chart for gha-runner-scale-set"
+        description: 'Publish new helm chart for gha-runner-scale-set'
-        required: true
-        type: boolean
-        default: false
-      publish_gha_runner_scale_set_experimental_chart:
-        description: "Publish new helm chart for gha-runner-scale-set-experimental"
         required: true
         type: boolean
         default: false
@@ -55,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -82,10 +72,10 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@v3
         with:
           # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
           # BuildKit v0.11 which has a bug causing intermittent
@@ -94,14 +84,14 @@ jobs:
           driver-opts: image=moby/buildkit:v0.10.6
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build & push controller image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@v5
         with:
           file: Dockerfile
           platforms: linux/amd64,linux/arm64
@@ -110,6 +100,8 @@ jobs:
           tags: |
             ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/gha-runner-scale-set-controller:${{ inputs.release_tag_name }}
             ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/gha-runner-scale-set-controller:${{ inputs.release_tag_name }}-${{ steps.resolve_parameters.outputs.short_sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Job summary
         run: |
@@ -129,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -148,7 +140,8 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
@@ -169,54 +162,6 @@ jobs:
           echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
           echo "- gha-runner-scale-set-controller Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY
 
-  publish-helm-chart-gha-runner-scale-set-controller-experimental:
-    if: ${{ inputs.publish_gha_runner_scale_set_controller_experimental_chart == true }}
-    needs: build-push-image
-    name: Publish Helm chart for gha-runner-scale-set-controller-experimental
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # If inputs.ref is empty, it'll resolve to the default branch
-          ref: ${{ inputs.ref }}
-
-      - name: Resolve parameters
-        id: resolve_parameters
-        run: |
-          resolvedRef="${{ inputs.ref }}"
-          if [ -z "$resolvedRef" ]
-          then
-            resolvedRef="${{ github.ref }}"
-          fi
-          echo "resolved_ref=$resolvedRef" >> $GITHUB_OUTPUT
-          echo "INFO: Resolving short SHA for $resolvedRef"
-          echo "short_sha=$(git rev-parse --short $resolvedRef)" >> $GITHUB_OUTPUT
-          echo "INFO: Normalizing repository name (lowercase)"
-          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
-
-      - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
-        with:
-          version: ${{ env.HELM_VERSION }}
-
-      - name: Publish new helm chart for gha-runner-scale-set-controller-experimental
-        run: |
-          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
-          GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG=$(cat charts/gha-runner-scale-set-controller-experimental/Chart.yaml | grep version: | cut -d " " -d '"' -f 2)
-          echo "GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG=${GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG}" >> $GITHUB_ENV
-          helm package charts/gha-runner-scale-set-controller-experimental/ --version="${GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG}"
-          helm push gha-runner-scale-set-controller-experimental-"${GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG}".tgz oci://ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/actions-runner-controller-charts
-
-      - name: Job summary
-        run: |
-          echo "New helm chart for gha-runner-scale-set-controller-experimental published successfully!" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Parameters:**" >> $GITHUB_STEP_SUMMARY
-          echo "- Ref: ${{ steps.resolve_parameters.outputs.resolved_ref }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
-          echo "- gha-runner-scale-set-controller-experimental Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY
-
   publish-helm-chart-gha-runner-scale-set:
     if: ${{ inputs.publish_gha_runner_scale_set_chart == true }}
     needs: build-push-image
@@ -224,7 +169,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -243,7 +188,8 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
@@ -264,52 +210,3 @@ jobs:
           echo "- Ref: ${{ steps.resolve_parameters.outputs.resolvedRef }}" >> $GITHUB_STEP_SUMMARY
           echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
           echo "- gha-runner-scale-set Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY
-
-  publish-helm-chart-gha-runner-scale-set-experimental:
-    if: ${{ inputs.publish_gha_runner_scale_set_experimental_chart == true }}
-    needs: build-push-image
-    name: Publish Helm chart for gha-runner-scale-set-experimental
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # If inputs.ref is empty, it'll resolve to the default branch
-          ref: ${{ inputs.ref }}
-
-      - name: Resolve parameters
-        id: resolve_parameters
-        run: |
-          resolvedRef="${{ inputs.ref }}"
-          if [ -z "$resolvedRef" ]
-          then
-            resolvedRef="${{ github.ref }}"
-          fi
-          echo "resolved_ref=$resolvedRef" >> $GITHUB_OUTPUT
-          echo "INFO: Resolving short SHA for $resolvedRef"
-          echo "short_sha=$(git rev-parse --short $resolvedRef)" >> $GITHUB_OUTPUT
-          echo "INFO: Normalizing repository name (lowercase)"
-          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
-
-      - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
-        with:
-          version: ${{ env.HELM_VERSION }}
-
-      - name: Publish new helm chart for gha-runner-scale-set-experimental
-        run: |
-          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
-
-          GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG=$(cat charts/gha-runner-scale-set-experimental/Chart.yaml | grep version: | cut -d " " -d '"' -f 2)
-          echo "GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG=${GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG}" >> $GITHUB_ENV
-          helm package charts/gha-runner-scale-set-experimental/ --version="${GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG}"
-          helm push gha-runner-scale-set-experimental-"${GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG}".tgz oci://ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/actions-runner-controller-charts
-
-      - name: Job summary
-        run: |
-          echo "New helm chart for gha-runner-scale-set-experimental published successfully!" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Parameters:**" >> $GITHUB_STEP_SUMMARY
-          echo "- Ref: ${{ steps.resolve_parameters.outputs.resolved_ref }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
-          echo "- gha-runner-scale-set-experimental Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/gha-validate-chart.yaml

@@ -5,20 +5,20 @@ on:
     branches:
       - master
     paths:
-      - "charts/**"
+      - 'charts/**'
-      - ".github/workflows/gha-validate-chart.yaml"
+      - '.github/workflows/gha-validate-chart.yaml'
-      - "!charts/actions-runner-controller/**"
+      - '!charts/actions-runner-controller/**'
-      - "!**.md"
+      - '!**.md'
   push:
     paths:
-      - "charts/**"
+      - 'charts/**'
-      - ".github/workflows/gha-validate-chart.yaml"
+      - '.github/workflows/gha-validate-chart.yaml'
-      - "!charts/actions-runner-controller/**"
+      - '!charts/actions-runner-controller/**'
-      - "!**.md"
+      - '!**.md'
   workflow_dispatch:
 env:
   KUBE_SCORE_VERSION: 1.16.1
-  HELM_VERSION: v3.19.4
+  HELM_VERSION: v3.8.0
 
 permissions:
   contents: read
@@ -36,22 +36,39 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
+      - name: Set up kube-score
+        run: |
+          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+          chmod 755 kube-score
+
+      - name: Kube-score generated manifests
+        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score -
+              --ignore-test pod-networkpolicy
+              --ignore-test deployment-has-poddisruptionbudget
+              --ignore-test deployment-has-host-podantiaffinity
+              --ignore-test container-security-context
+              --ignore-test pod-probes
+              --ignore-test container-image-tag
+              --enable-optional-test container-security-context-privileged
+              --enable-optional-test container-security-context-readonlyrootfilesystem
+
       # python is a requirement for the chart-testing action below (supports yamllint among other tests)
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: '3.11'
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@v2.6.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -61,39 +78,19 @@ jobs:
           if [[ -n "$changed" ]]; then
             echo "changed=true" >> $GITHUB_OUTPUT
           fi
-          echo "changed_charts<<EOF" >> $GITHUB_OUTPUT
-          echo "$changed" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Install helm-unittest
-        if: |
-          contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-controller-experimental') ||
-          contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-experimental')
-        run: |
-          helm plugin install https://github.com/helm-unittest/helm-unittest.git
-
-      - name: Run helm-unittest (gha-runner-scale-set-controller-experimental)
-        if: contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-controller-experimental')
-        run: |
-          helm unittest ./charts/gha-runner-scale-set-controller-experimental/
-
-      - name: Run helm-unittest (gha-runner-scale-set-experimental)
-        if: contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-experimental')
-        run: |
-          helm unittest ./charts/gha-runner-scale-set-experimental/
 
       - name: Run chart-testing (lint)
         run: |
           ct lint --config charts/.ci/ct-config-gha.yaml
 
       - name: Set up docker buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@v3
         if: steps.list-changed.outputs.changed == 'true'
         with:
           version: latest
 
       - name: Build controller image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@v5
         if: steps.list-changed.outputs.changed == 'true'
         with:
           file: Dockerfile
@@ -108,7 +105,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Create kind cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+        uses: helm/kind-action@v1.4.0
         if: steps.list-changed.outputs.changed == 'true'
         with:
           cluster_name: chart-testing
@@ -116,31 +113,13 @@ jobs:
       - name: Load image into cluster
         if: steps.list-changed.outputs.changed == 'true'
         run: |
-          export DOCKER_IMAGE_NAME=test-arc
+            export DOCKER_IMAGE_NAME=test-arc
-          export VERSION=dev
+            export VERSION=dev
-          export IMG_RESULT=load
+            export IMG_RESULT=load
-          make docker-buildx
+            make docker-buildx
-          kind load docker-image test-arc:dev --name chart-testing
+            kind load docker-image test-arc:dev --name chart-testing
 
       - name: Run chart-testing (install)
         if: steps.list-changed.outputs.changed == 'true'
         run: |
           ct install --config charts/.ci/ct-config-gha.yaml
-  test-chart:
-    name: Test Chart
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: Test gha-runner-scale-set
-        run: go test ./charts/gha-runner-scale-set/...
-      - name: Test gha-runner-scale-set-controller
-        run: go test ./charts/gha-runner-scale-set-controller/...
-      - name: Test gha-runner-scale-set-experimental
-        run: go test ./charts/gha-runner-scale-set-experimental/...
-      - name: Test gha-runner-scale-set-controller-experimental
-        run: go test ./charts/gha-runner-scale-set-controller-experimental/...

.github/workflows/global-publish-canary.yaml

@@ -7,30 +7,30 @@ on:
     branches:
       - master
     paths-ignore:
-      - "**.md"
+      - '**.md'
-      - ".github/actions/**"
+      - '.github/actions/**'
-      - ".github/ISSUE_TEMPLATE/**"
+      - '.github/ISSUE_TEMPLATE/**'
-      - ".github/workflows/e2e-test-dispatch-workflow.yaml"
+      - '.github/workflows/e2e-test-dispatch-workflow.yaml'
-      - ".github/workflows/gha-e2e-tests.yaml"
+      - '.github/workflows/gha-e2e-tests.yaml'
-      - ".github/workflows/arc-publish.yaml"
+      - '.github/workflows/arc-publish.yaml'
-      - ".github/workflows/arc-publish-chart.yaml"
+      - '.github/workflows/arc-publish-chart.yaml'
-      - ".github/workflows/gha-publish-chart.yaml"
+      - '.github/workflows/gha-publish-chart.yaml'
-      - ".github/workflows/arc-release-runners.yaml"
+      - '.github/workflows/arc-release-runners.yaml'
-      - ".github/workflows/global-run-codeql.yaml"
+      - '.github/workflows/global-run-codeql.yaml'
-      - ".github/workflows/global-run-first-interaction.yaml"
+      - '.github/workflows/global-run-first-interaction.yaml'
-      - ".github/workflows/global-run-stale.yaml"
+      - '.github/workflows/global-run-stale.yaml'
-      - ".github/workflows/arc-update-runners-scheduled.yaml"
+      - '.github/workflows/arc-update-runners-scheduled.yaml'
-      - ".github/workflows/validate-arc.yaml"
+      - '.github/workflows/validate-arc.yaml'
-      - ".github/workflows/arc-validate-chart.yaml"
+      - '.github/workflows/arc-validate-chart.yaml'
-      - ".github/workflows/gha-validate-chart.yaml"
+      - '.github/workflows/gha-validate-chart.yaml'
-      - ".github/workflows/arc-validate-runners.yaml"
+      - '.github/workflows/arc-validate-runners.yaml'
-      - ".github/dependabot.yml"
+      - '.github/dependabot.yml'
-      - ".github/RELEASE_NOTE_TEMPLATE.md"
+      - '.github/RELEASE_NOTE_TEMPLATE.md'
-      - "runner/**"
+      - 'runner/**'
-      - ".gitignore"
+      - '.gitignore'
-      - "PROJECT"
+      - 'PROJECT'
-      - "LICENSE"
+      - 'LICENSE'
-      - "Makefile"
+      - 'Makefile'
 
 # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps
 permissions:
@@ -55,11 +55,11 @@ jobs:
       TARGET_REPO: actions-runner-controller
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Get Token
         id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
         with:
           application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
           application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}
@@ -90,10 +90,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -110,16 +110,16 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@v3
         with:
           version: latest
 
       # Unstable builds - run at your own risk
       - name: Build and Push
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: ./Dockerfile

.github/workflows/global-run-codeql.yaml

@@ -25,20 +25,20 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v2
         with:
-          languages: go, actions
+          languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v2

.github/workflows/global-run-first-interaction.yaml

@@ -1,10 +1,5 @@
 name: First Interaction
 
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
 on:
   issues:
     types: [opened]
@@ -16,19 +11,19 @@ jobs:
   check_for_first_interaction:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - uses: actions/first-interaction@v3
+      - uses: actions/first-interaction@main
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          issue_message: |
+          issue-message: |
             Hello! Thank you for filing an issue.
 
             The maintainers will triage your issue shortly.
 
             In the meantime, please take a look at the [troubleshooting guide](https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md) for bug reports.
-
+            
             If this is a feature request, please review our [contribution guidelines](https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md).
-          pr_message: |
+          pr-message: |
             Hello! Thank you for your contribution.
 
             Please review our [contribution guidelines](https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md) to understand the project's testing and code conventions.

.github/workflows/global-run-stale.yaml

@@ -14,7 +14,7 @@ jobs:
       issues: write         # for actions/stale to close stale issues
       pull-requests: write  # for actions/stale to close stale PRs
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v6
         with:
           stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
           # turn off stale for both issues and PRs

.github/workflows/go.yaml

@@ -4,16 +4,16 @@ on:
     branches:
       - master
     paths:
-      - ".github/workflows/go.yaml"
+      - '.github/workflows/go.yaml'
-      - "**.go"
+      - '**.go'
-      - "go.mod"
+      - 'go.mod'
-      - "go.sum"
+      - 'go.sum'
   pull_request:
     paths:
-      - ".github/workflows/go.yaml"
+      - '.github/workflows/go.yaml'
-      - "**.go"
+      - '**.go'
-      - "go.mod"
+      - 'go.mod'
-      - "go.sum"
+      - 'go.sum'
 
 permissions:
   contents: read
@@ -29,10 +29,10 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
           cache: false
       - name: fmt
         run: go fmt ./...
@@ -42,58 +42,47 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
           cache: false
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
+        uses: golangci/golangci-lint-action@v6
         with:
           only-new-issues: true
-          version: v2.11.2
+          version: v1.55.2
 
   generate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
           cache: false
       - name: Generate
         run: make generate
       - name: Check diff
         run: git diff --exit-code
 
-  mocks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: "Run mockery"
-        run: go tool github.com/vektra/mockery/v3
-      - name: Check diff
-        run: git diff --exit-code
-
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
       - run: make manifests
       - name: Check diff
         run: git diff --exit-code
-      - name: Setup envtest
+      - name: Install kubebuilder
         run: |
-          go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(go list -m -f '{{ .Version }}' sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $2, $3}')
+          curl -D headers.txt -fsL "https://storage.googleapis.com/kubebuilder-tools/kubebuilder-tools-1.26.1-linux-amd64.tar.gz" -o kubebuilder-tools
-          ENVTEST_K8S_VERSION=$(go list -m -f '{{ .Version }}' k8s.io/api | awk -F'[v.]' '{printf "1.%d", $3}')
+          echo "$(grep -i etag headers.txt -m 1 | cut -d'"' -f2) kubebuilder-tools" > sum
-          echo "KUBEBUILDER_ASSETS=$(setup-envtest use ${ENVTEST_K8S_VERSION} -p path)" >> $GITHUB_ENV
+          md5sum -c sum
+          tar -zvxf kubebuilder-tools
+          sudo mv kubebuilder /usr/local/
       - name: Run go tests
         run: |
           go test -short `go list ./... | grep -v ./test_e2e_arc`

.gitignore

@@ -34,5 +34,5 @@ bin
 # OS
 .DS_STORE
 
-
+/test-assets
 /.tools

.golangci.yaml

@@ -1,18 +1,19 @@
-version: "2"
 run:
-  timeout: 5m
+  timeout: 3m
-linters:
+output:
-  settings:
+  formats:
-    errcheck:
+    - format: github-actions
-      exclude-functions:
+      path: stdout
-        - (net/http.ResponseWriter).Write
+linters-settings:
-        - (*net/http.Server).Shutdown
+  errcheck:
-        - (*github.com/actions/actions-runner-controller/simulator.VisibleRunnerGroups).Add
+    exclude-functions:
-        - (*github.com/actions/actions-runner-controller/testing.Kind).Stop
+      - (net/http.ResponseWriter).Write
-  exclusions:
+      - (*net/http.Server).Shutdown
-    presets:
+      - (*github.com/actions/actions-runner-controller/simulator.VisibleRunnerGroups).Add
-      - std-error-handling
+      - (*github.com/actions/actions-runner-controller/testing.Kind).Stop
-    rules:
+issues:
-      - linters:
+  exclude-rules:
-          - staticcheck
+    - path: controllers/suite_test.go
-        text: "QF1008:"
+      linters:
+        - staticcheck
+      text: "SA1019"

.mockery.yaml

@@ -1,17 +0,0 @@
-all: false
-dir: "{{.InterfaceDir}}"
-filename: mocks_test.go
-force-file-write: true
-formatter: goimports
-log-level: info
-structname: "{{.Mock}}{{.InterfaceName}}"
-pkgname: "{{.SrcPackageName}}"
-recursive: false
-template: testify
-packages:
-  github.com/actions/actions-runner-controller/cmd/ghalistener/metrics:
-    config:
-      all: true
-  github.com/actions/actions-runner-controller/controllers/actions.github.com:
-    config:
-      all: true

CODEOWNERS

@@ -1,2 +1,2 @@
 # actions-runner-controller maintainers
-* @mumoshu @toast-gear @actions/actions-launch @actions/actions-compute @nikola-jokic @rentziass @steve-glass
+* @mumoshu @toast-gear @actions/actions-launch @nikola-jokic @rentziass

CONTRIBUTING.md

@@ -102,19 +102,22 @@ A set of example pipelines (./acceptance/pipelines) are provided in this reposit
 When raising a PR please run the relevant suites to prove your change hasn't broken anything.
 
 #### Running Ginkgo Tests
+
 You can run the integration test suite that is written in Ginkgo with:
 
 ```shell
 make test-with-deps
 ```
 
-This will install `setup-envtest`, download the required envtest binaries (etcd, kube-apiserver, kubectl), and then run `go test`.
+This will firstly install a few binaries required to setup the integration test environment and then runs `go test` to start the Ginkgo test.
 
-If you don't want to use `make`, install the envtest binaries using `setup-envtest`:
+If you don't want to use `make`, like when you're running tests from your IDE, install required binaries to `/usr/local/kubebuilder/bin`.
+That's the directory in which controller-runtime's `envtest` framework locates the binaries.
 
 ```shell
-go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+sudo mkdir -p /usr/local/kubebuilder/bin
-export KUBEBUILDER_ASSETS=$(setup-envtest use -p path)
+make kube-apiserver etcd
+sudo mv test-assets/{etcd,kube-apiserver} /usr/local/kubebuilder/bin/
 go test -v -run TestAPIs github.com/actions/actions-runner-controller/controllers/actions.summerwind.net
 ```
 

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.26.1 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.22.4 as builder
 
 WORKDIR /workspace
 
@@ -30,17 +30,18 @@ ARG TARGETPLATFORM TARGETOS TARGETARCH TARGETVARIANT VERSION=dev COMMIT_SHA=dev
 # to avoid https://github.com/moby/buildkit/issues/2334
 # We can use docker layer cache so the build is fast enogh anyway
 # We also use per-platform GOCACHE for the same reason.
-ENV GOCACHE="/build/${TARGETPLATFORM}/root/.cache/go-build"
+ENV GOCACHE /build/${TARGETPLATFORM}/root/.cache/go-build
 
 # Build
 RUN --mount=target=. \
-    --mount=type=cache,mode=0777,target=${GOCACHE} \
+  --mount=type=cache,mode=0777,target=${GOCACHE} \
-    export GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT#v} && \
+  export GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT#v} && \
-    go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/manager main.go && \
+  go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/manager main.go && \
-    go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/ghalistener ./cmd/ghalistener && \
+  go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/github-runnerscaleset-listener ./cmd/githubrunnerscalesetlistener && \
-    go build -trimpath -ldflags="-s -w" -o /out/github-webhook-server ./cmd/githubwebhookserver && \
+  go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/ghalistener ./cmd/ghalistener && \
-    go build -trimpath -ldflags="-s -w" -o /out/actions-metrics-server ./cmd/actionsmetricsserver && \
+  go build -trimpath -ldflags="-s -w" -o /out/github-webhook-server ./cmd/githubwebhookserver && \
-    go build -trimpath -ldflags="-s -w" -o /out/sleep ./cmd/sleep
+  go build -trimpath -ldflags="-s -w" -o /out/actions-metrics-server ./cmd/actionsmetricsserver && \
+  go build -trimpath -ldflags="-s -w" -o /out/sleep ./cmd/sleep
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
@@ -51,6 +52,7 @@ WORKDIR /
 COPY --from=builder /out/manager .
 COPY --from=builder /out/github-webhook-server .
 COPY --from=builder /out/actions-metrics-server .
+COPY --from=builder /out/github-runnerscaleset-listener .
 COPY --from=builder /out/ghalistener .
 COPY --from=builder /out/sleep .
 

Makefile

@@ -6,7 +6,7 @@ endif
 DOCKER_USER ?= $(shell echo ${DOCKER_IMAGE_NAME} | cut -d / -f1)
 VERSION ?= dev
 COMMIT_SHA = $(shell git rev-parse HEAD)
-RUNNER_VERSION ?= 2.333.0
+RUNNER_VERSION ?= 2.319.1
 TARGETPLATFORM ?= $(shell arch)
 RUNNER_NAME ?= ${DOCKER_USER}/actions-runner
 RUNNER_TAG  ?= ${VERSION}
@@ -20,10 +20,10 @@ KUBECONTEXT ?= kind-acceptance
 CLUSTER ?= acceptance
 CERT_MANAGER_VERSION ?= v1.1.1
 KUBE_RBAC_PROXY_VERSION ?= v0.11.0
-SHELLCHECK_VERSION ?= 0.10.0
+SHELLCHECK_VERSION ?= 0.8.0
 
 # Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
-CRD_OPTIONS ?= "crd:generateEmbeddedObjectMeta=true,allowDangerousTypes=true"
+CRD_OPTIONS ?= "crd:generateEmbeddedObjectMeta=true"
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -32,15 +32,21 @@ else
 GOBIN=$(shell go env GOBIN)
 endif
 
+TEST_ASSETS=$(PWD)/test-assets
 TOOLS_PATH=$(PWD)/.tools
 
 OS_NAME := $(shell uname -s | tr A-Z a-z)
 
-# ENVTEST_VERSION is the version of controller-runtime release branch to fetch the envtest setup script
+# The etcd packages that coreos maintain use different extensions for each *nix OS on their github release page.
-ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
+# ETCD_EXTENSION: the storage format file extension listed on the release page.
-# ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries
+# EXTRACT_COMMAND: the  appropriate CLI command for extracting this file format.
-ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
+ifeq ($(OS_NAME), darwin)
-ENVTEST ?= $(GOBIN)/setup-envtest
+ETCD_EXTENSION:=zip
+EXTRACT_COMMAND:=unzip
+else
+ETCD_EXTENSION:=tar.gz
+EXTRACT_COMMAND:=tar -xzf
+endif
 
 # default list of platforms for which multiarch image is built
 ifeq (${PLATFORMS}, )
@@ -62,27 +68,26 @@ endif
 all: manager
 
 lint:
-	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v2.11.2 golangci-lint run
+	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v1.57.2 golangci-lint run
 
 GO_TEST_ARGS ?= -short
 
-
 # Run tests
-test: generate fmt vet manifests shellcheck setup-envtest
+test: generate fmt vet manifests shellcheck
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
+	go test $(GO_TEST_ARGS) `go list ./... | grep -v ./test_e2e_arc` -coverprofile cover.out
-	  go test $(GO_TEST_ARGS) `go list ./... | grep -v ./test_e2e_arc` -coverprofile cover.out
+	go test -fuzz=Fuzz -fuzztime=10s -run=Fuzz* ./controllers/actions.summerwind.net
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
-	  go test -fuzz=Fuzz -fuzztime=10s -run=Fuzz* ./controllers/actions.summerwind.net
 
-test-with-deps: setup-envtest
+test-with-deps: kube-apiserver etcd kubectl
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
+	# See https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/envtest#pkg-constants
+	TEST_ASSET_KUBE_APISERVER=$(KUBE_APISERVER_BIN) \
+	TEST_ASSET_ETCD=$(ETCD_BIN) \
+	TEST_ASSET_KUBECTL=$(KUBECTL_BIN) \
 	  make test
 
-
 # Build manager binary
 manager: generate fmt vet
 	go build -o bin/manager main.go
-	go build -o bin/github-runnerscaleset-listener ./cmd/ghalistener
+	go build -o bin/github-runnerscaleset-listener ./cmd/githubrunnerscalesetlistener
 
 # Run against the configured Kubernetes cluster in ~/.kube/config
 run: generate fmt vet manifests
@@ -112,6 +117,9 @@ manifests: manifests-gen-crds chart-crds
 
 manifests-gen-crds: controller-gen yq
 	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	for YAMLFILE in config/crd/bases/actions*.yaml; do \
+		$(YQ) '.spec.preserveUnknownFields = false' --inplace "$$YAMLFILE" ; \
+	done
 	make manifests-gen-crds-fix DELETE_KEY=x-kubernetes-list-type
 	make manifests-gen-crds-fix DELETE_KEY=x-kubernetes-list-map-keys
 
@@ -177,10 +185,6 @@ chart-crds:
 	cp config/crd/bases/actions.github.com_autoscalinglisteners.yaml charts/gha-runner-scale-set-controller/crds/
 	cp config/crd/bases/actions.github.com_ephemeralrunnersets.yaml charts/gha-runner-scale-set-controller/crds/
 	cp config/crd/bases/actions.github.com_ephemeralrunners.yaml charts/gha-runner-scale-set-controller/crds/
-	cp config/crd/bases/actions.github.com_autoscalingrunnersets.yaml charts/gha-runner-scale-set-controller-experimental/crds/
-	cp config/crd/bases/actions.github.com_autoscalinglisteners.yaml charts/gha-runner-scale-set-controller-experimental/crds/
-	cp config/crd/bases/actions.github.com_ephemeralrunnersets.yaml charts/gha-runner-scale-set-controller-experimental/crds/
-	cp config/crd/bases/actions.github.com_ephemeralrunners.yaml charts/gha-runner-scale-set-controller-experimental/crds/
 	rm charts/actions-runner-controller/crds/actions.github.com_autoscalingrunnersets.yaml
 	rm charts/actions-runner-controller/crds/actions.github.com_autoscalinglisteners.yaml
 	rm charts/actions-runner-controller/crds/actions.github.com_ephemeralrunnersets.yaml
@@ -200,7 +204,7 @@ generate: controller-gen
 
 # Run shellcheck on runner scripts
 shellcheck: shellcheck-install
-	$(TOOLS_PATH)/shellcheck --shell bash --source-path runner runner/*.sh runner/update-status hack/*.sh
+	$(TOOLS_PATH)/shellcheck --shell bash --source-path runner runner/*.sh hack/*.sh
 
 docker-buildx:
 	export DOCKER_CLI_EXPERIMENTAL=enabled ;\
@@ -209,6 +213,8 @@ docker-buildx:
 		docker buildx create --platform ${PLATFORMS} --name container-builder --use;\
 	fi
 	docker buildx build --platform ${PLATFORMS} \
+		--build-arg RUNNER_VERSION=${RUNNER_VERSION} \
+		--build-arg DOCKER_VERSION=${DOCKER_VERSION} \
 		--build-arg VERSION=${VERSION} \
 		--build-arg COMMIT_SHA=${COMMIT_SHA} \
 		-t "${DOCKER_IMAGE_NAME}:${VERSION}" \
@@ -294,10 +300,6 @@ acceptance/runner/startup:
 e2e:
 	go test -count=1 -v -timeout 600s -run '^TestE2E$$' ./test/e2e
 
-.PHONY: gha-e2e
-gha-e2e:
-	bash hack/e2e-test.sh
-
 # Upload release file to GitHub.
 github-release: release
 	ghr ${VERSION} release/
@@ -308,7 +310,7 @@ github-release: release
 # Otherwise we get errors like the below:
 #   Error: failed to install CRD crds/actions.summerwind.dev_runnersets.yaml: CustomResourceDefinition.apiextensions.k8s.io "runnersets.actions.summerwind.dev" is invalid: [spec.validation.openAPIV3Schema.properties[spec].properties[template].properties[spec].properties[containers].items.properties[ports].items.properties[protocol].default: Required value: this property is in x-kubernetes-list-map-keys, so it must have a default or be a required property, spec.validation.openAPIV3Schema.properties[spec].properties[template].properties[spec].properties[initContainers].items.properties[ports].items.properties[protocol].default: Required value: this property is in x-kubernetes-list-map-keys, so it must have a default or be a required property]
 #
-# Note that controller-gen newer than 0.8.1 is needed due to https://github.com/kubernetes-sigs/controller-tools/issues/448
+# Note that controller-gen newer than 0.6.1 is needed due to https://github.com/kubernetes-sigs/controller-tools/issues/448
 # Otherwise ObjectMeta embedded in Spec results in empty on the storage.
 controller-gen:
 ifeq (, $(shell which controller-gen))
@@ -318,7 +320,7 @@ ifeq (, $(wildcard $(GOBIN)/controller-gen))
 	CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\
 	cd $$CONTROLLER_GEN_TMP_DIR ;\
 	go mod init tmp ;\
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.20.1 ;\
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0 ;\
 	rm -rf $$CONTROLLER_GEN_TMP_DIR ;\
 	}
 endif
@@ -363,29 +365,68 @@ ifeq (, $(wildcard $(TOOLS_PATH)/shellcheck))
 endif
 SHELLCHECK=$(TOOLS_PATH)/shellcheck
 
-# find or download envtest
+# find or download etcd
-envtest:
+etcd:
-ifeq (, $(shell which setup-envtest))
+ifeq (, $(shell which etcd))
-ifeq (, $(wildcard $(GOBIN)/setup-envtest))
+ifeq (, $(wildcard $(TEST_ASSETS)/etcd))
 	@{ \
-	set -e ;\
+	set -xe ;\
-	ENVTEST_TMP_DIR=$$(mktemp -d) ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
-	cd $$ENVTEST_TMP_DIR ;\
+	cd $$INSTALL_TMP_DIR ;\
-	go mod init tmp ;\
+	wget https://github.com/coreos/etcd/releases/download/v3.4.22/etcd-v3.4.22-$(OS_NAME)-amd64.$(ETCD_EXTENSION);\
-	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(ENVTEST_VERSION) ;\
+	mkdir -p $(TEST_ASSETS) ;\
-	rm -rf $$ENVTEST_TMP_DIR ;\
+	$(EXTRACT_COMMAND) etcd-v3.4.22-$(OS_NAME)-amd64.$(ETCD_EXTENSION) ;\
+	mv etcd-v3.4.22-$(OS_NAME)-amd64/etcd $(TEST_ASSETS)/etcd ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
 	}
-endif
+ETCD_BIN=$(TEST_ASSETS)/etcd
-ENVTEST=$(GOBIN)/setup-envtest
 else
-ENVTEST=$(shell which setup-envtest)
+ETCD_BIN=$(TEST_ASSETS)/etcd
+endif
+else
+ETCD_BIN=$(shell which etcd)
 endif
 
-.PHONY: setup-envtest
+# find or download kube-apiserver
-setup-envtest: envtest
+kube-apiserver:
-	@echo "Setting up envtest binaries for Kubernetes version $(ENVTEST_K8S_VERSION)..."
+ifeq (, $(shell which kube-apiserver))
-	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path || { \
+ifeq (, $(wildcard $(TEST_ASSETS)/kube-apiserver))
-		echo "Error: Failed to set up envtest binaries for version $(ENVTEST_K8S_VERSION)."; \
+	@{ \
-		exit 1; \
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.2/kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mkdir -p $(TEST_ASSETS) ;\
+	tar zxvf kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mv kubebuilder_2.3.2_$(OS_NAME)_amd64/bin/kube-apiserver $(TEST_ASSETS)/kube-apiserver ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
 	}
+KUBE_APISERVER_BIN=$(TEST_ASSETS)/kube-apiserver
+else
+KUBE_APISERVER_BIN=$(TEST_ASSETS)/kube-apiserver
+endif
+else
+KUBE_APISERVER_BIN=$(shell which kube-apiserver)
+endif
 
+# find or download kubectl
+kubectl:
+ifeq (, $(shell which kubectl))
+ifeq (, $(wildcard $(TEST_ASSETS)/kubectl))
+	@{ \
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.2/kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mkdir -p $(TEST_ASSETS) ;\
+	tar zxvf kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mv kubebuilder_2.3.2_$(OS_NAME)_amd64/bin/kubectl $(TEST_ASSETS)/kubectl ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
+	}
+KUBECTL_BIN=$(TEST_ASSETS)/kubectl
+else
+KUBECTL_BIN=$(TEST_ASSETS)/kubectl
+endif
+else
+KUBECTL_BIN=$(shell which kubectl)
+endif

README.md

@@ -11,22 +11,21 @@ Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates and s
 With ARC, you can create runner scale sets that automatically scale based on the number of workflows running in your repository, organization, or enterprise. Because controlled runners can be ephemeral and based on containers, new runner instances can scale up or down rapidly and cleanly. For more information about autoscaling, see ["Autoscaling with self-hosted runners."](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners)
 
 You can set up ARC on Kubernetes using Helm, then create and run a workflow that uses runner scale sets. For more information about runner scale sets, see ["Deploying runner scale sets with Actions Runner Controller."](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/deploying-runner-scale-sets-with-actions-runner-controller#runner-scale-set)
-
 ## People
 
 Actions Runner Controller (ARC) is an open-source project currently developed and maintained in collaboration with the GitHub Actions team, external maintainers @mumoshu and @toast-gear, various [contributors](https://github.com/actions/actions-runner-controller/graphs/contributors), and the [awesome community](https://github.com/actions/actions-runner-controller/discussions).
 
 If you think the project is awesome and is adding value to your business, please consider directly sponsoring [community maintainers](https://github.com/sponsors/actions-runner-controller) and individual contributors via GitHub Sponsors.
 
-If you are already the employer of one of the contributors, sponsoring via GitHub Sponsors might not be an option. Just support them by other means!
+In case you are already the employer of one of contributors, sponsoring via GitHub Sponsors might not be an option. Just support them in other means!
 
 See [the sponsorship dashboard](https://github.com/sponsors/actions-runner-controller) for the former and the current sponsors.
 
 ## Getting Started
 
-To give ARC a try with just a handful of commands, please refer to the [Quickstart guide](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/quickstart-for-actions-runner-controller).
+To give ARC a try with just a handful of commands, Please refer to the [Quickstart guide](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/quickstart-for-actions-runner-controller).
 
-For an overview of ARC, please refer to [About ARC](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller).
+For an overview of ARC, please refer to [About ARC](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller)
 
 With the introduction of [autoscaling runner scale sets](https://github.com/actions/actions-runner-controller/discussions/2775), the existing [autoscaling modes](./docs/automatically-scaling-runners.md) are now legacy. The legacy modes have certain use cases and will continue to be maintained by the community only.
 
@@ -38,7 +37,7 @@ ARC documentation is available on [docs.github.com](https://docs.github.com/en/a
 
 ### Legacy documentation
 
-The following documentation is for the legacy autoscaling modes that continue to be maintained by the community:
+The following documentation is for the legacy autoscaling modes that continue to be maintained by the community
 
 - [Quickstart guide](/docs/quickstart.md)
 - [About ARC](/docs/about-arc.md)

acceptance/pipelines/eks-integration-tests.yaml

@@ -5,23 +5,22 @@ on:
 
 env:
   IRSA_ROLE_ARN:
-  ASSUME_ROLE_ARN:
+  ASSUME_ROLE_ARN: 
-  AWS_REGION:
+  AWS_REGION: 
 
 jobs:
   assume-role-in-runner-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
       - name: Test aws-actions/configure-aws-credentials Action
-        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
+        uses: aws-actions/configure-aws-credentials@v1
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ env.ASSUME_ROLE_ARN }}
           role-duration-seconds: 900
   assume-role-in-container-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
-    container:
+    container: 
       image: amazon/aws-cli
       env:
         AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
@@ -30,8 +29,7 @@ jobs:
         - /var/run/secrets/eks.amazonaws.com/serviceaccount/token:/var/run/secrets/eks.amazonaws.com/serviceaccount/token
     steps:
       - name: Test aws-actions/configure-aws-credentials Action in container
-        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
+        uses: aws-actions/configure-aws-credentials@v1
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ env.ASSUME_ROLE_ARN }}

acceptance/pipelines/runner-integration-tests.yaml

@@ -8,8 +8,8 @@ env:
 
 jobs:
   run-step-in-container-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
-    container:
+    container: 
       image: alpine
     steps:
       - name: Test we are working in the container
@@ -21,7 +21,7 @@ jobs:
               exit 1
           fi
   setup-python-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
       - name: Print native Python environment
         run: |
@@ -41,12 +41,12 @@ jobs:
             echo "Python version detected : $(python --version 2>&1)"
           fi
   setup-node-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
       - uses: actions/setup-node@v2
         with:
-          node-version: "12"
+          node-version: '12'
-      - name: Test actions/setup-node works
+      - name: Test actions/setup-node works 
         run: |
           VERSION=$(node --version | cut -c 2- | cut -d '.' -f1)
           if [[ $VERSION != '12' ]]; then
@@ -57,14 +57,13 @@ jobs:
             echo "Node version detected : $(node --version 2>&1)"
           fi
   setup-ruby-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
-      # https://github.com/ruby/setup-ruby/releases/tag/v1.227.0
+      - uses: ruby/setup-ruby@v1
-      - uses: ruby/setup-ruby@1a615958ad9d422dd932dc1d5823942ee002799f
         with:
           ruby-version: 3.0
           bundler-cache: true
-      - name: Test ruby/setup-ruby works
+      - name: Test ruby/setup-ruby works 
         run: |
           VERSION=$(ruby --version | cut -d ' ' -f2 | cut -d '.' -f1-2)
           if [[ $VERSION != '3.0' ]]; then
@@ -75,8 +74,8 @@ jobs:
               echo "Ruby version detected : $(ruby --version 2>&1)"
           fi
   python-shell-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
-    steps:
+    steps:      
       - name: Test Python shell works
         run: |
           import os

apis/actions.github.com/v1alpha1/appconfig/appconfig.go

@@ -1,89 +0,0 @@
-package appconfig
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"strconv"
-
-	corev1 "k8s.io/api/core/v1"
-)
-
-type AppConfig struct {
-	AppID             string `json:"github_app_id"`
-	AppInstallationID int64  `json:"github_app_installation_id"`
-	AppPrivateKey     string `json:"github_app_private_key"`
-
-	Token string `json:"github_token"`
-}
-
-func (c *AppConfig) tidy() *AppConfig {
-	if len(c.Token) > 0 {
-		return &AppConfig{
-			Token: c.Token,
-		}
-	}
-
-	return &AppConfig{
-		AppID:             c.AppID,
-		AppInstallationID: c.AppInstallationID,
-		AppPrivateKey:     c.AppPrivateKey,
-	}
-}
-
-func (c *AppConfig) Validate() error {
-	if c == nil {
-		return fmt.Errorf("missing app config")
-	}
-	hasToken := len(c.Token) > 0
-	hasGitHubAppAuth := c.hasGitHubAppAuth()
-	if hasToken && hasGitHubAppAuth {
-		return fmt.Errorf("both PAT and GitHub App credentials provided. should only provide one")
-	}
-	if !hasToken && !hasGitHubAppAuth {
-		return fmt.Errorf("no credentials provided: either a PAT or GitHub App credentials should be provided")
-	}
-
-	return nil
-}
-
-func (c *AppConfig) hasGitHubAppAuth() bool {
-	return len(c.AppID) > 0 && c.AppInstallationID > 0 && len(c.AppPrivateKey) > 0
-}
-
-func FromSecret(secret *corev1.Secret) (*AppConfig, error) {
-	var appInstallationID int64
-	if v := string(secret.Data["github_app_installation_id"]); v != "" {
-		val, err := strconv.ParseInt(v, 10, 64)
-		if err != nil {
-			return nil, err
-		}
-		appInstallationID = val
-	}
-
-	cfg := &AppConfig{
-		Token:             string(secret.Data["github_token"]),
-		AppID:             string(secret.Data["github_app_id"]),
-		AppInstallationID: appInstallationID,
-		AppPrivateKey:     string(secret.Data["github_app_private_key"]),
-	}
-
-	if err := cfg.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate config: %v", err)
-	}
-
-	return cfg.tidy(), nil
-}
-
-func FromJSONString(v string) (*AppConfig, error) {
-	var appConfig AppConfig
-	if err := json.NewDecoder(bytes.NewBufferString(v)).Decode(&appConfig); err != nil {
-		return nil, err
-	}
-
-	if err := appConfig.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate app config decoded from string: %w", err)
-	}
-
-	return appConfig.tidy(), nil
-}

apis/actions.github.com/v1alpha1/appconfig/appconfig_test.go

@@ -1,152 +0,0 @@
-package appconfig
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-)
-
-func TestAppConfigValidate_invalid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"empty": {},
-		"token and app config": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-			Token:             "token",
-		},
-		"app id not set": {
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-		"app installation id not set": {
-			AppID:         "2",
-			AppPrivateKey: "private key",
-		},
-		"private key empty": {
-			AppID:             "2",
-			AppInstallationID: 1,
-			AppPrivateKey:     "",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.Error(t, err)
-		})
-	}
-}
-
-func TestAppConfigValidate_valid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"token": {
-			Token: "token",
-		},
-		"app ID": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.NoError(t, err)
-		})
-	}
-}
-
-func TestAppConfigFromSecret_invalid(t *testing.T) {
-	tt := map[string]map[string]string{
-		"empty": {},
-		"token and app provided": {
-			"github_token":              "token",
-			"github_app_id":             "2",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-		"invalid app id": {
-			"github_app_id":             "abc",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-		"invalid app installation_id": {
-			"github_app_id":             "1",
-			"githu_app_installation_id": "abc",
-			"github_app_private_key":    "private key",
-		},
-		"empty private key": {
-			"github_app_id":             "1",
-			"githu_app_installation_id": "2",
-			"github_app_private_key":    "",
-		},
-	}
-
-	for name, data := range tt {
-		t.Run(name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				StringData: data,
-			}
-
-			appConfig, err := FromSecret(secret)
-			assert.Error(t, err)
-			assert.Nil(t, appConfig)
-		})
-	}
-}
-
-func TestAppConfigFromSecret_valid(t *testing.T) {
-	tt := map[string]map[string]string{
-		"with token": {
-			"github_token": "token",
-		},
-		"app config": {
-			"github_app_id":             "2",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-	}
-
-	for name, data := range tt {
-		t.Run(name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				StringData: data,
-			}
-
-			appConfig, err := FromSecret(secret)
-			assert.Error(t, err)
-			assert.Nil(t, appConfig)
-		})
-	}
-}
-
-func TestAppConfigFromString_valid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"token": {
-			Token: "token",
-		},
-		"app ID": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			bytes, err := json.Marshal(cfg)
-			require.NoError(t, err)
-
-			got, err := FromJSONString(string(bytes))
-			require.NoError(t, err)
-
-			want := cfg.tidy()
-			assert.Equal(t, want, got)
-		})
-	}
-}

apis/actions.github.com/v1alpha1/autoscalinglistener_types.go

@@ -59,38 +59,20 @@ type AutoscalingListenerSpec struct {
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
 
 	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
-
-	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
-
-	// +optional
-	Metrics *MetricsConfig `json:"metrics,omitempty"`
 
 	// +optional
 	Template *corev1.PodTemplateSpec `json:"template,omitempty"`
-
-	// +optional
-	ConfigSecretMetadata *ResourceMeta `json:"configSecretMetadata,omitempty"`
-
-	// +optional
-	ServiceAccountMetadata *ResourceMeta `json:"serviceAccountMetadata,omitempty"`
-
-	// +optional
-	RoleMetadata *ResourceMeta `json:"roleMetadata,omitempty"`
-
-	// +optional
-	RoleBindingMetadata *ResourceMeta `json:"roleBindingMetadata,omitempty"`
 }
 
 // AutoscalingListenerStatus defines the observed state of AutoscalingListener
 type AutoscalingListenerStatus struct{}
 
-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true
-// +kubebuilder:subresource:status
+//+kubebuilder:subresource:status
-// +kubebuilder:printcolumn:JSONPath=".spec.githubConfigUrl",name=GitHub Configure URL,type=string
+//+kubebuilder:printcolumn:JSONPath=".spec.githubConfigUrl",name=GitHub Configure URL,type=string
-// +kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetNamespace",name=AutoscalingRunnerSet Namespace,type=string
+//+kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetNamespace",name=AutoscalingRunnerSet Namespace,type=string
-// +kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetName",name=AutoscalingRunnerSet Name,type=string
+//+kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetName",name=AutoscalingRunnerSet Name,type=string
 
 // AutoscalingListener is the Schema for the autoscalinglisteners API
 type AutoscalingListener struct {
@@ -101,7 +83,8 @@ type AutoscalingListener struct {
 	Status AutoscalingListenerStatus `json:"status,omitempty"`
 }
 
-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true
+
 // AutoscalingListenerList contains a list of AutoscalingListener
 type AutoscalingListenerList struct {
 	metav1.TypeMeta `json:",inline"`

apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go

@@ -24,7 +24,6 @@ import (
 	"strings"
 
 	"github.com/actions/actions-runner-controller/hash"
-	"github.com/actions/actions-runner-controller/vault"
 	"golang.org/x/net/http/httpproxy"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -32,16 +31,16 @@ import (
 
 // NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
 
-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true
-// +kubebuilder:subresource:status
+//+kubebuilder:subresource:status
-// +kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.state",name=State,type=string
+//+kubebuilder:printcolumn:JSONPath=".status.state",name=State,type=string
-// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer
 
 // AutoscalingRunnerSet is the Schema for the autoscalingrunnersets API
 type AutoscalingRunnerSet struct {
@@ -66,51 +65,18 @@ type AutoscalingRunnerSetSpec struct {
 	// +optional
 	RunnerScaleSetName string `json:"runnerScaleSetName,omitempty"`
 
-	// +optional
-	RunnerScaleSetLabels []string `json:"runnerScaleSetLabels,omitempty"`
-
 	// +optional
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
 
 	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
-
-	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
 
 	// Required
 	Template corev1.PodTemplateSpec `json:"template,omitempty"`
 
-	// +optional
-	AutoscalingListenerMetadata *ResourceMeta `json:"autoscalingListener,omitempty"`
-
-	// +optional
-	ListenerMetrics *MetricsConfig `json:"listenerMetrics,omitempty"`
-
 	// +optional
 	ListenerTemplate *corev1.PodTemplateSpec `json:"listenerTemplate,omitempty"`
 
-	// +optional
-	ListenerServiceAccountMetadata *ResourceMeta `json:"listenerServiceAccountMetadata,omitempty"`
-
-	// +optional
-	ListenerRoleMetadata *ResourceMeta `json:"listenerRoleMetadata,omitempty"`
-
-	// +optional
-	ListenerRoleBindingMetadata *ResourceMeta `json:"listenerRoleBindingMetadata,omitempty"`
-
-	// +optional
-	ListenerConfigSecretMetadata *ResourceMeta `json:"listenerConfigSecretMetadata,omitempty"`
-
-	// +optional
-	EphemeralRunnerSetMetadata *ResourceMeta `json:"ephemeralRunnerSetMetadata,omitempty"`
-
-	// +optional
-	EphemeralRunnerMetadata *ResourceMeta `json:"ephemeralRunnerMetadata,omitempty"`
-
-	// +optional
-	EphemeralRunnerConfigSecretMetadata *ResourceMeta `json:"ephemeralRunnerConfigSecretMetadata,omitempty"`
-
 	// +optional
 	// +kubebuilder:validation:Minimum:=0
 	MaxRunners *int `json:"maxRunners,omitempty"`
@@ -120,12 +86,12 @@ type AutoscalingRunnerSetSpec struct {
 	MinRunners *int `json:"minRunners,omitempty"`
 }
 
-type TLSConfig struct {
+type GitHubServerTLSConfig struct {
 	// Required
 	CertificateFrom *TLSCertificateSource `json:"certificateFrom,omitempty"`
 }
 
-func (c *TLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error)) (*x509.CertPool, error) {
+func (c *GitHubServerTLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error)) (*x509.CertPool, error) {
 	if c.CertificateFrom == nil {
 		return nil, fmt.Errorf("certificateFrom not specified")
 	}
@@ -173,7 +139,7 @@ type ProxyConfig struct {
 	NoProxy []string `json:"noProxy,omitempty"`
 }
 
-func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secret, error)) (*httpproxy.Config, error) {
+func (c *ProxyConfig) toHTTPProxyConfig(secretFetcher func(string) (*corev1.Secret, error)) (*httpproxy.Config, error) {
 	config := &httpproxy.Config{
 		NoProxy: strings.Join(c.NoProxy, ","),
 	}
@@ -232,7 +198,7 @@ func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secr
 }
 
 func (c *ProxyConfig) ToSecretData(secretFetcher func(string) (*corev1.Secret, error)) (map[string][]byte, error) {
-	config, err := c.ToHTTPProxyConfig(secretFetcher)
+	config, err := c.toHTTPProxyConfig(secretFetcher)
 	if err != nil {
 		return nil, err
 	}
@@ -246,7 +212,7 @@ func (c *ProxyConfig) ToSecretData(secretFetcher func(string) (*corev1.Secret, e
 }
 
 func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, error)) (func(*http.Request) (*url.URL, error), error) {
-	config, err := c.ToHTTPProxyConfig(secretFetcher)
+	config, err := c.toHTTPProxyConfig(secretFetcher)
 	if err != nil {
 		return nil, err
 	}
@@ -266,63 +232,17 @@ type ProxyServerConfig struct {
 	CredentialSecretRef string `json:"credentialSecretRef,omitempty"`
 }
 
-type VaultConfig struct {
-	// +optional
-	Type vault.VaultType `json:"type,omitempty"`
-	// +optional
-	AzureKeyVault *AzureKeyVaultConfig `json:"azureKeyVault,omitempty"`
-	// +optional
-	Proxy *ProxyConfig `json:"proxy,omitempty"`
-}
-
-type AzureKeyVaultConfig struct {
-	// +required
-	URL string `json:"url,omitempty"`
-	// +required
-	TenantID string `json:"tenantId,omitempty"`
-	// +required
-	ClientID string `json:"clientId,omitempty"`
-	// +required
-	CertificatePath string `json:"certificatePath,omitempty"`
-}
-
-// MetricsConfig holds configuration parameters for each metric type
-type MetricsConfig struct {
-	// +optional
-	Counters map[string]*CounterMetric `json:"counters,omitempty"`
-	// +optional
-	Gauges map[string]*GaugeMetric `json:"gauges,omitempty"`
-	// +optional
-	Histograms map[string]*HistogramMetric `json:"histograms,omitempty"`
-}
-
-// CounterMetric holds configuration of a single metric of type Counter
-type CounterMetric struct {
-	Labels []string `json:"labels"`
-}
-
-// GaugeMetric holds configuration of a single metric of type Gauge
-type GaugeMetric struct {
-	Labels []string `json:"labels"`
-}
-
-// HistogramMetric holds configuration of a single metric of type Histogram
-type HistogramMetric struct {
-	Labels  []string  `json:"labels"`
-	Buckets []float64 `json:"buckets,omitempty"`
-}
-
 // AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet
 type AutoscalingRunnerSetStatus struct {
 	// +optional
 	CurrentRunners int `json:"currentRunners"`
 
 	// +optional
-	Phase AutoscalingRunnerSetPhase `json:"phase"`
+	State string `json:"state"`
 
 	// EphemeralRunner counts separated by the stage ephemeral runners are in, taken from the EphemeralRunnerSet
 
-	// +optional
+	//+optional
 	PendingEphemeralRunners int `json:"pendingEphemeralRunners"`
 	// +optional
 	RunningEphemeralRunners int `json:"runningEphemeralRunners"`
@@ -330,63 +250,12 @@ type AutoscalingRunnerSetStatus struct {
 	FailedEphemeralRunners int `json:"failedEphemeralRunners"`
 }
 
-type AutoscalingRunnerSetPhase string
-
-const (
-	// AutoscalingRunnerSetPhasePending phase means that the listener is not
-	// yet started
-	AutoscalingRunnerSetPhasePending  AutoscalingRunnerSetPhase = "Pending"
-	AutoscalingRunnerSetPhaseRunning  AutoscalingRunnerSetPhase = "Running"
-	AutoscalingRunnerSetPhaseOutdated AutoscalingRunnerSetPhase = "Outdated"
-)
-
-func (ars *AutoscalingRunnerSet) Hash() string {
-	type data struct {
-		Spec   *AutoscalingRunnerSetSpec
-		Labels map[string]string
-	}
-
-	d := &data{
-		Spec:   ars.Spec.DeepCopy(),
-		Labels: ars.Labels,
-	}
-
-	return hash.ComputeTemplateHash(d)
-}
-
 func (ars *AutoscalingRunnerSet) ListenerSpecHash() string {
 	arsSpec := ars.Spec.DeepCopy()
 	spec := arsSpec
 	return hash.ComputeTemplateHash(&spec)
 }
 
-func (ars *AutoscalingRunnerSet) GitHubConfigSecret() string {
-	return ars.Spec.GitHubConfigSecret
-}
-
-func (ars *AutoscalingRunnerSet) GitHubConfigUrl() string {
-	return ars.Spec.GitHubConfigUrl
-}
-
-func (ars *AutoscalingRunnerSet) GitHubProxy() *ProxyConfig {
-	return ars.Spec.Proxy
-}
-
-func (ars *AutoscalingRunnerSet) GitHubServerTLS() *TLSConfig {
-	return ars.Spec.GitHubServerTLS
-}
-
-func (ars *AutoscalingRunnerSet) VaultConfig() *VaultConfig {
-	return ars.Spec.VaultConfig
-}
-
-func (ars *AutoscalingRunnerSet) VaultProxy() *ProxyConfig {
-	if ars.Spec.VaultConfig != nil {
-		return ars.Spec.VaultConfig.Proxy
-	}
-	return nil
-}
-
 func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 	type runnerSetSpec struct {
 		GitHubConfigUrl    string
@@ -394,7 +263,7 @@ func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 		RunnerGroup        string
 		RunnerScaleSetName string
 		Proxy              *ProxyConfig
-		GitHubServerTLS    *TLSConfig
+		GitHubServerTLS    *GitHubServerTLSConfig
 		Template           corev1.PodTemplateSpec
 	}
 	spec := &runnerSetSpec{
@@ -409,7 +278,7 @@ func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 	return hash.ComputeTemplateHash(&spec)
 }
 
-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true
 
 // AutoscalingRunnerSetList contains a list of AutoscalingRunnerSet
 type AutoscalingRunnerSetList struct {

apis/actions.github.com/v1alpha1/common.go

@@ -1,9 +0,0 @@
-package v1alpha1
-
-// ResourceMeta carries metadata common to all internal resources
-type ResourceMeta struct {
-	// +optional
-	Labels map[string]string `json:"labels,omitempty"`
-	// +optional
-	Annotations map[string]string `json:"annotations,omitempty"`
-}

apis/actions.github.com/v1alpha1/ephemeralrunner_types.go

@@ -21,12 +21,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// EphemeralRunnerContainerName is the name of the runner container.
+//+kubebuilder:object:root=true
-// It represents the name of the container running the self-hosted runner image.
+//+kubebuilder:subresource:status
-const EphemeralRunnerContainerName = "runner"
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:JSONPath=".spec.githubConfigUrl",name="GitHub Config URL",type=string
 // +kubebuilder:printcolumn:JSONPath=".status.runnerId",name=RunnerId,type=number
 // +kubebuilder:printcolumn:JSONPath=".status.phase",name=Status,type=string
@@ -34,7 +30,6 @@ const EphemeralRunnerContainerName = "runner"
 // +kubebuilder:printcolumn:JSONPath=".status.jobWorkflowRef",name=JobWorkflowRef,type=string
 // +kubebuilder:printcolumn:JSONPath=".status.workflowRunId",name=WorkflowRunId,type=number
 // +kubebuilder:printcolumn:JSONPath=".status.jobDisplayName",name=JobDisplayName,type=string
-// +kubebuilder:printcolumn:JSONPath=".status.jobId",name=JobId,type=string
 // +kubebuilder:printcolumn:JSONPath=".status.message",name=Message,type=string
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 
@@ -48,70 +43,22 @@ type EphemeralRunner struct {
 }
 
 func (er *EphemeralRunner) IsDone() bool {
-	return er.Status.Phase == EphemeralRunnerPhaseSucceeded || er.Status.Phase == EphemeralRunnerPhaseFailed || er.Status.Phase == EphemeralRunnerPhaseOutdated
+	return er.Status.Phase == corev1.PodSucceeded || er.Status.Phase == corev1.PodFailed
-}
-
-func (er *EphemeralRunner) HasJob() bool {
-	return len(er.Status.JobID) > 0
-}
-
-func (er *EphemeralRunner) HasContainerHookConfigured() bool {
-	for i := range er.Spec.Spec.Containers {
-		if er.Spec.Spec.Containers[i].Name != EphemeralRunnerContainerName {
-			continue
-		}
-
-		for _, env := range er.Spec.Spec.Containers[i].Env {
-			if env.Name == "ACTIONS_RUNNER_CONTAINER_HOOKS" {
-				return true
-			}
-		}
-
-		return false
-	}
-	return false
-}
-
-func (er *EphemeralRunner) GitHubConfigSecret() string {
-	return er.Spec.GitHubConfigSecret
-}
-
-func (er *EphemeralRunner) GitHubConfigUrl() string {
-	return er.Spec.GitHubConfigUrl
-}
-
-func (er *EphemeralRunner) GitHubProxy() *ProxyConfig {
-	return er.Spec.Proxy
-}
-
-func (er *EphemeralRunner) GitHubServerTLS() *TLSConfig {
-	return er.Spec.GitHubServerTLS
-}
-
-func (er *EphemeralRunner) VaultConfig() *VaultConfig {
-	return er.Spec.VaultConfig
-}
-
-func (er *EphemeralRunner) VaultProxy() *ProxyConfig {
-	if er.Spec.VaultConfig != nil {
-		return er.Spec.VaultConfig.Proxy
-	}
-	return nil
 }
 
 // EphemeralRunnerSpec defines the desired state of EphemeralRunner
 type EphemeralRunnerSpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
 	// +required
 	GitHubConfigUrl string `json:"githubConfigUrl,omitempty"`
 
 	// +required
 	GitHubConfigSecret string `json:"githubConfigSecret,omitempty"`
 
-	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
 	// +required
-	RunnerScaleSetID int `json:"runnerScaleSetId,omitempty"`
+	RunnerScaleSetId int `json:"runnerScaleSetId,omitempty"`
 
 	// +optional
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
@@ -120,16 +67,17 @@ type EphemeralRunnerSpec struct {
 	ProxySecretRef string `json:"proxySecretRef,omitempty"`
 
 	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
-
-	// +optional
-	EphemeralRunnerConfigSecretMetadata *ResourceMeta `json:"ephemeralRunnerConfigSecretMetadata,omitempty"`
 
+	// +required
 	corev1.PodTemplateSpec `json:",inline"`
 }
 
 // EphemeralRunnerStatus defines the observed state of EphemeralRunner
 type EphemeralRunnerStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
 	// Turns true only if the runner is online.
 	// +optional
 	Ready bool `json:"ready"`
@@ -143,25 +91,24 @@ type EphemeralRunnerStatus struct {
 	// The PodSucceded phase should be set only when confirmed that EphemeralRunner
 	// actually executed the job and has been removed from the service.
 	// +optional
-	Phase EphemeralRunnerPhase `json:"phase,omitempty"`
+	Phase corev1.PodPhase `json:"phase,omitempty"`
 	// +optional
 	Reason string `json:"reason,omitempty"`
 	// +optional
 	Message string `json:"message,omitempty"`
 
 	// +optional
-	RunnerID int `json:"runnerId,omitempty"`
+	RunnerId int `json:"runnerId,omitempty"`
 	// +optional
 	RunnerName string `json:"runnerName,omitempty"`
+	// +optional
+	RunnerJITConfig string `json:"runnerJITConfig,omitempty"`
 
 	// +optional
-	Failures map[string]metav1.Time `json:"failures,omitempty"`
+	Failures map[string]bool `json:"failures,omitempty"`
 
 	// +optional
-	JobRequestID int64 `json:"jobRequestId,omitempty"`
+	JobRequestId int64 `json:"jobRequestId,omitempty"`
-
-	// +optional
-	JobID string `json:"jobId,omitempty"`
 
 	// +optional
 	JobRepositoryName string `json:"jobRepositoryName,omitempty"`
@@ -170,48 +117,13 @@ type EphemeralRunnerStatus struct {
 	JobWorkflowRef string `json:"jobWorkflowRef,omitempty"`
 
 	// +optional
-	WorkflowRunID int64 `json:"workflowRunId,omitempty"`
+	WorkflowRunId int64 `json:"workflowRunId,omitempty"`
 
 	// +optional
 	JobDisplayName string `json:"jobDisplayName,omitempty"`
 }
 
-// EphemeralRunnerPhase is the phase of the ephemeral runner.
+//+kubebuilder:object:root=true
-// It must be a superset of the pod phase.
-type EphemeralRunnerPhase string
-
-const (
-	// EphemeralRunnerPhasePending is a phase set when the ephemeral runner is
-	// being provisioned and is not yet online.
-	EphemeralRunnerPhasePending EphemeralRunnerPhase = "Pending"
-	// EphemeralRunnerPhaseRunning is a phase set when the ephemeral runner is online and
-	// waiting for a job to execute.
-	EphemeralRunnerPhaseRunning EphemeralRunnerPhase = "Running"
-	// EphemeralRunnerPhaseSucceeded is a phase set when the ephemeral runner
-	// successfully executed the job and has been removed from the service.
-	EphemeralRunnerPhaseSucceeded EphemeralRunnerPhase = "Succeeded"
-	// EphemeralRunnerPhaseFailed is a phase set when the ephemeral runner
-	// fails with unrecoverable failure.
-	EphemeralRunnerPhaseFailed EphemeralRunnerPhase = "Failed"
-	// EphemeralRunnerPhaseOutdated is a special phase that indicates the runner is outdated and should be upgraded.
-	EphemeralRunnerPhaseOutdated EphemeralRunnerPhase = "Outdated"
-)
-
-func (s *EphemeralRunnerStatus) LastFailure() metav1.Time {
-	var maxTime metav1.Time
-	if len(s.Failures) == 0 {
-		return maxTime
-	}
-
-	for _, ts := range s.Failures {
-		if ts.After(maxTime.Time) {
-			maxTime = ts
-		}
-	}
-	return maxTime
-}
-
-// +kubebuilder:object:root=true
 
 // EphemeralRunnerList contains a list of EphemeralRunner
 type EphemeralRunnerList struct {

apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go

@@ -26,44 +26,33 @@ type EphemeralRunnerSetSpec struct {
 	Replicas int `json:"replicas,omitempty"`
 	// PatchID is the unique identifier for the patch issued by the listener app
 	PatchID int `json:"patchID"`
-	// EphemeralRunnerSpec is the spec of the ephemeral runner
+
 	EphemeralRunnerSpec EphemeralRunnerSpec `json:"ephemeralRunnerSpec,omitempty"`
-	// +optional
-	EphemeralRunnerMetadata *ResourceMeta `json:"ephemeralRunnerMetadata,omitempty"`
 }
 
 // EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet
 type EphemeralRunnerSetStatus struct {
 	// CurrentReplicas is the number of currently running EphemeralRunner resources being managed by this EphemeralRunnerSet.
 	CurrentReplicas int `json:"currentReplicas"`
+
+	// EphemeralRunner counts separated by the stage ephemeral runners are in
+
 	// +optional
 	PendingEphemeralRunners int `json:"pendingEphemeralRunners"`
 	// +optional
 	RunningEphemeralRunners int `json:"runningEphemeralRunners"`
 	// +optional
 	FailedEphemeralRunners int `json:"failedEphemeralRunners"`
-	// +optional
-	Phase EphemeralRunnerSetPhase `json:"phase"`
 }
 
-// EphemeralRunnerSetPhase is the phase of the ephemeral runner set resource
-type EphemeralRunnerSetPhase string
-
-const (
-	EphemeralRunnerSetPhaseRunning EphemeralRunnerSetPhase = "Running"
-	// EphemeralRunnerSetPhaseOutdated is set when at least one ephemeral runner
-	// contains the outdated phase
-	EphemeralRunnerSetPhaseOutdated EphemeralRunnerSetPhase = "Outdated"
-)
-
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:JSONPath=".spec.replicas",name="DesiredReplicas",type="integer"
 // +kubebuilder:printcolumn:JSONPath=".status.currentReplicas", name="CurrentReplicas",type="integer"
-// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer
 
 // EphemeralRunnerSet is the Schema for the ephemeralrunnersets API
 type EphemeralRunnerSet struct {
@@ -74,35 +63,9 @@ type EphemeralRunnerSet struct {
 	Status EphemeralRunnerSetStatus `json:"status,omitempty"`
 }
 
-func (ers *EphemeralRunnerSet) GitHubConfigSecret() string {
+//+kubebuilder:object:root=true
-	return ers.Spec.EphemeralRunnerSpec.GitHubConfigSecret
-}
-
-func (ers *EphemeralRunnerSet) GitHubConfigUrl() string {
-	return ers.Spec.EphemeralRunnerSpec.GitHubConfigUrl
-}
-
-func (ers *EphemeralRunnerSet) GitHubProxy() *ProxyConfig {
-	return ers.Spec.EphemeralRunnerSpec.Proxy
-}
-
-func (ers *EphemeralRunnerSet) GitHubServerTLS() *TLSConfig {
-	return ers.Spec.EphemeralRunnerSpec.GitHubServerTLS
-}
-
-func (ers *EphemeralRunnerSet) VaultConfig() *VaultConfig {
-	return ers.Spec.EphemeralRunnerSpec.VaultConfig
-}
-
-func (ers *EphemeralRunnerSet) VaultProxy() *ProxyConfig {
-	if ers.Spec.EphemeralRunnerSpec.VaultConfig != nil {
-		return ers.Spec.EphemeralRunnerSpec.VaultConfig.Proxy
-	}
-	return nil
-}
 
 // EphemeralRunnerSetList contains a list of EphemeralRunnerSet
-// +kubebuilder:object:root=true
 type EphemeralRunnerSetList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`

apis/actions.github.com/v1alpha1/tls_config_test.go

@@ -0,0 +1,105 @@
+package v1alpha1_test
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
+	"github.com/actions/actions-runner-controller/github/actions/testserver"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	v1 "k8s.io/api/core/v1"
+)
+
+func TestGitHubServerTLSConfig_ToCertPool(t *testing.T) {
+	t.Run("returns an error if CertificateFrom not specified", func(t *testing.T) {
+		c := &v1alpha1.GitHubServerTLSConfig{
+			CertificateFrom: nil,
+		}
+
+		pool, err := c.ToCertPool(nil)
+		assert.Nil(t, pool)
+
+		require.Error(t, err)
+		assert.Equal(t, err.Error(), "certificateFrom not specified")
+	})
+
+	t.Run("returns an error if CertificateFrom.ConfigMapKeyRef not specified", func(t *testing.T) {
+		c := &v1alpha1.GitHubServerTLSConfig{
+			CertificateFrom: &v1alpha1.TLSCertificateSource{},
+		}
+
+		pool, err := c.ToCertPool(nil)
+		assert.Nil(t, pool)
+
+		require.Error(t, err)
+		assert.Equal(t, err.Error(), "configMapKeyRef not specified")
+	})
+
+	t.Run("returns a valid cert pool with correct configuration", func(t *testing.T) {
+		c := &v1alpha1.GitHubServerTLSConfig{
+			CertificateFrom: &v1alpha1.TLSCertificateSource{
+				ConfigMapKeyRef: &v1.ConfigMapKeySelector{
+					LocalObjectReference: v1.LocalObjectReference{
+						Name: "name",
+					},
+					Key: "key",
+				},
+			},
+		}
+
+		certsFolder := filepath.Join(
+			"../../../",
+			"github",
+			"actions",
+			"testdata",
+		)
+
+		fetcher := func(name, key string) ([]byte, error) {
+			cert, err := os.ReadFile(filepath.Join(certsFolder, "rootCA.crt"))
+			require.NoError(t, err)
+
+			pool := x509.NewCertPool()
+			ok := pool.AppendCertsFromPEM(cert)
+			assert.True(t, ok)
+
+			return cert, nil
+		}
+
+		pool, err := c.ToCertPool(fetcher)
+		require.NoError(t, err)
+		require.NotNil(t, pool)
+
+		// can be used to communicate with a server
+		serverSuccessfullyCalled := false
+		server := testserver.NewUnstarted(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			serverSuccessfullyCalled = true
+			w.WriteHeader(http.StatusOK)
+		}))
+
+		cert, err := tls.LoadX509KeyPair(
+			filepath.Join(certsFolder, "server.crt"),
+			filepath.Join(certsFolder, "server.key"),
+		)
+		require.NoError(t, err)
+
+		server.TLS = &tls.Config{Certificates: []tls.Certificate{cert}}
+		server.StartTLS()
+
+		client := &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{
+					RootCAs: pool,
+				},
+			},
+		}
+
+		_, err = client.Get(server.URL)
+		assert.NoError(t, err)
+		assert.True(t, serverSuccessfullyCalled)
+	})
+}

apis/actions.github.com/v1alpha1/version.go

@@ -1,72 +0,0 @@
-package v1alpha1
-
-import "strings"
-
-func IsVersionAllowed(resourceVersion, buildVersion string) bool {
-	if buildVersion == "dev" || resourceVersion == buildVersion || strings.HasPrefix(buildVersion, "canary-") {
-		return true
-	}
-
-	rv, ok := parseSemver(resourceVersion)
-	if !ok {
-		return false
-	}
-	bv, ok := parseSemver(buildVersion)
-	if !ok {
-		return false
-	}
-	return rv.major == bv.major && rv.minor == bv.minor
-}
-
-type semver struct {
-	major string
-	minor string
-}
-
-func parseSemver(v string) (p semver, ok bool) {
-	if v == "" {
-		return
-	}
-	p.major, v, ok = parseInt(v)
-	if !ok {
-		return p, false
-	}
-	if v == "" {
-		p.minor = "0"
-		return p, true
-	}
-	if v[0] != '.' {
-		return p, false
-	}
-	p.minor, v, ok = parseInt(v[1:])
-	if !ok {
-		return p, false
-	}
-	if v == "" {
-		return p, true
-	}
-	if v[0] != '.' {
-		return p, false
-	}
-	if _, _, ok = parseInt(v[1:]); !ok {
-		return p, false
-	}
-	return p, true
-}
-
-func parseInt(v string) (t, rest string, ok bool) {
-	if v == "" {
-		return
-	}
-	if v[0] < '0' || '9' < v[0] {
-		return
-	}
-	i := 1
-	for i < len(v) && '0' <= v[i] && v[i] <= '9' {
-		i++
-	}
-	if v[0] == '0' && i != 1 {
-		return
-	}
-	return v[:i], v[i:], true
-}

apis/actions.github.com/v1alpha1/version_test.go

@@ -1,60 +0,0 @@
-package v1alpha1_test
-
-import (
-	"testing"
-
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIsVersionAllowed(t *testing.T) {
-	t.Parallel()
-	tt := map[string]struct {
-		resourceVersion string
-		buildVersion    string
-		want            bool
-	}{
-		"dev should always be allowed": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "dev",
-			want:            true,
-		},
-		"resourceVersion is not semver": {
-			resourceVersion: "dev",
-			buildVersion:    "0.11.0",
-			want:            false,
-		},
-		"buildVersion is not semver": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "NA",
-			want:            false,
-		},
-		"major version mismatch": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "1.11.0",
-			want:            false,
-		},
-		"minor version mismatch": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "0.10.0",
-			want:            false,
-		},
-		"patch version mismatch": {
-			resourceVersion: "0.11.1",
-			buildVersion:    "0.11.0",
-			want:            true,
-		},
-		"arbitrary version match": {
-			resourceVersion: "abc",
-			buildVersion:    "abc",
-			want:            true,
-		},
-	}
-
-	for name, tc := range tt {
-		t.Run(name, func(t *testing.T) {
-			got := v1alpha1.IsVersionAllowed(tc.resourceVersion, tc.buildVersion)
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}

apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go

@@ -22,7 +22,6 @@ package v1alpha1
 
 import (
 	"k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
@@ -100,17 +99,7 @@ func (in *AutoscalingListenerSpec) DeepCopyInto(out *AutoscalingListenerSpec) {
 	}
 	if in.GitHubServerTLS != nil {
 		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
+		*out = new(GitHubServerTLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Metrics != nil {
-		in, out := &in.Metrics, &out.Metrics
-		*out = new(MetricsConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.Template != nil {
@@ -118,26 +107,6 @@ func (in *AutoscalingListenerSpec) DeepCopyInto(out *AutoscalingListenerSpec) {
 		*out = new(v1.PodTemplateSpec)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.ConfigSecretMetadata != nil {
-		in, out := &in.ConfigSecretMetadata, &out.ConfigSecretMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ServiceAccountMetadata != nil {
-		in, out := &in.ServiceAccountMetadata, &out.ServiceAccountMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.RoleMetadata != nil {
-		in, out := &in.RoleMetadata, &out.RoleMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.RoleBindingMetadata != nil {
-		in, out := &in.RoleBindingMetadata, &out.RoleBindingMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AutoscalingListenerSpec.
@@ -227,11 +196,6 @@ func (in *AutoscalingRunnerSetList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AutoscalingRunnerSetSpec) DeepCopyInto(out *AutoscalingRunnerSetSpec) {
 	*out = *in
-	if in.RunnerScaleSetLabels != nil {
-		in, out := &in.RunnerScaleSetLabels, &out.RunnerScaleSetLabels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
 	if in.Proxy != nil {
 		in, out := &in.Proxy, &out.Proxy
 		*out = new(ProxyConfig)
@@ -239,65 +203,15 @@ func (in *AutoscalingRunnerSetSpec) DeepCopyInto(out *AutoscalingRunnerSetSpec)
 	}
 	if in.GitHubServerTLS != nil {
 		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
+		*out = new(GitHubServerTLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	in.Template.DeepCopyInto(&out.Template)
-	if in.AutoscalingListenerMetadata != nil {
-		in, out := &in.AutoscalingListenerMetadata, &out.AutoscalingListenerMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerMetrics != nil {
-		in, out := &in.ListenerMetrics, &out.ListenerMetrics
-		*out = new(MetricsConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.ListenerTemplate != nil {
 		in, out := &in.ListenerTemplate, &out.ListenerTemplate
 		*out = new(v1.PodTemplateSpec)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.ListenerServiceAccountMetadata != nil {
-		in, out := &in.ListenerServiceAccountMetadata, &out.ListenerServiceAccountMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerRoleMetadata != nil {
-		in, out := &in.ListenerRoleMetadata, &out.ListenerRoleMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerRoleBindingMetadata != nil {
-		in, out := &in.ListenerRoleBindingMetadata, &out.ListenerRoleBindingMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerConfigSecretMetadata != nil {
-		in, out := &in.ListenerConfigSecretMetadata, &out.ListenerConfigSecretMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerSetMetadata != nil {
-		in, out := &in.EphemeralRunnerSetMetadata, &out.EphemeralRunnerSetMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerMetadata != nil {
-		in, out := &in.EphemeralRunnerMetadata, &out.EphemeralRunnerMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerConfigSecretMetadata != nil {
-		in, out := &in.EphemeralRunnerConfigSecretMetadata, &out.EphemeralRunnerConfigSecretMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.MaxRunners != nil {
 		in, out := &in.MaxRunners, &out.MaxRunners
 		*out = new(int)
@@ -335,41 +249,6 @@ func (in *AutoscalingRunnerSetStatus) DeepCopy() *AutoscalingRunnerSetStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *AzureKeyVaultConfig) DeepCopyInto(out *AzureKeyVaultConfig) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureKeyVaultConfig.
-func (in *AzureKeyVaultConfig) DeepCopy() *AzureKeyVaultConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(AzureKeyVaultConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CounterMetric) DeepCopyInto(out *CounterMetric) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CounterMetric.
-func (in *CounterMetric) DeepCopy() *CounterMetric {
-	if in == nil {
-		return nil
-	}
-	out := new(CounterMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *EphemeralRunner) DeepCopyInto(out *EphemeralRunner) {
 	*out = *in
@@ -492,11 +371,6 @@ func (in *EphemeralRunnerSetList) DeepCopyObject() runtime.Object {
 func (in *EphemeralRunnerSetSpec) DeepCopyInto(out *EphemeralRunnerSetSpec) {
 	*out = *in
 	in.EphemeralRunnerSpec.DeepCopyInto(&out.EphemeralRunnerSpec)
-	if in.EphemeralRunnerMetadata != nil {
-		in, out := &in.EphemeralRunnerMetadata, &out.EphemeralRunnerMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EphemeralRunnerSetSpec.
@@ -527,24 +401,14 @@ func (in *EphemeralRunnerSetStatus) DeepCopy() *EphemeralRunnerSetStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *EphemeralRunnerSpec) DeepCopyInto(out *EphemeralRunnerSpec) {
 	*out = *in
-	if in.GitHubServerTLS != nil {
-		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.Proxy != nil {
 		in, out := &in.Proxy, &out.Proxy
 		*out = new(ProxyConfig)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.VaultConfig != nil {
+	if in.GitHubServerTLS != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
+		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(VaultConfig)
+		*out = new(GitHubServerTLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerConfigSecretMetadata != nil {
-		in, out := &in.EphemeralRunnerConfigSecretMetadata, &out.EphemeralRunnerConfigSecretMetadata
-		*out = new(ResourceMeta)
 		(*in).DeepCopyInto(*out)
 	}
 	in.PodTemplateSpec.DeepCopyInto(&out.PodTemplateSpec)
@@ -565,9 +429,9 @@ func (in *EphemeralRunnerStatus) DeepCopyInto(out *EphemeralRunnerStatus) {
 	*out = *in
 	if in.Failures != nil {
 		in, out := &in.Failures, &out.Failures
-		*out = make(map[string]metav1.Time, len(*in))
+		*out = make(map[string]bool, len(*in))
 		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
+			(*out)[key] = val
 		}
 	}
 }
@@ -583,109 +447,21 @@ func (in *EphemeralRunnerStatus) DeepCopy() *EphemeralRunnerStatus {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GaugeMetric) DeepCopyInto(out *GaugeMetric) {
+func (in *GitHubServerTLSConfig) DeepCopyInto(out *GitHubServerTLSConfig) {
 	*out = *in
-	if in.Labels != nil {
+	if in.CertificateFrom != nil {
-		in, out := &in.Labels, &out.Labels
+		in, out := &in.CertificateFrom, &out.CertificateFrom
-		*out = make([]string, len(*in))
+		*out = new(TLSCertificateSource)
-		copy(*out, *in)
+		(*in).DeepCopyInto(*out)
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GaugeMetric.
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubServerTLSConfig.
-func (in *GaugeMetric) DeepCopy() *GaugeMetric {
+func (in *GitHubServerTLSConfig) DeepCopy() *GitHubServerTLSConfig {
 	if in == nil {
 		return nil
 	}
-	out := new(GaugeMetric)
+	out := new(GitHubServerTLSConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HistogramMetric) DeepCopyInto(out *HistogramMetric) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Buckets != nil {
-		in, out := &in.Buckets, &out.Buckets
-		*out = make([]float64, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HistogramMetric.
-func (in *HistogramMetric) DeepCopy() *HistogramMetric {
-	if in == nil {
-		return nil
-	}
-	out := new(HistogramMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *MetricsConfig) DeepCopyInto(out *MetricsConfig) {
-	*out = *in
-	if in.Counters != nil {
-		in, out := &in.Counters, &out.Counters
-		*out = make(map[string]*CounterMetric, len(*in))
-		for key, val := range *in {
-			var outVal *CounterMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(CounterMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-	if in.Gauges != nil {
-		in, out := &in.Gauges, &out.Gauges
-		*out = make(map[string]*GaugeMetric, len(*in))
-		for key, val := range *in {
-			var outVal *GaugeMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(GaugeMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-	if in.Histograms != nil {
-		in, out := &in.Histograms, &out.Histograms
-		*out = make(map[string]*HistogramMetric, len(*in))
-		for key, val := range *in {
-			var outVal *HistogramMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(HistogramMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricsConfig.
-func (in *MetricsConfig) DeepCopy() *MetricsConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(MetricsConfig)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -735,35 +511,6 @@ func (in *ProxyServerConfig) DeepCopy() *ProxyServerConfig {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ResourceMeta) DeepCopyInto(out *ResourceMeta) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Annotations != nil {
-		in, out := &in.Annotations, &out.Annotations
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceMeta.
-func (in *ResourceMeta) DeepCopy() *ResourceMeta {
-	if in == nil {
-		return nil
-	}
-	out := new(ResourceMeta)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLSCertificateSource) DeepCopyInto(out *TLSCertificateSource) {
 	*out = *in
@@ -783,48 +530,3 @@ func (in *TLSCertificateSource) DeepCopy() *TLSCertificateSource {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
-	*out = *in
-	if in.CertificateFrom != nil {
-		in, out := &in.CertificateFrom, &out.CertificateFrom
-		*out = new(TLSCertificateSource)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
-func (in *TLSConfig) DeepCopy() *TLSConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(TLSConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VaultConfig) DeepCopyInto(out *VaultConfig) {
-	*out = *in
-	if in.AzureKeyVault != nil {
-		in, out := &in.AzureKeyVault, &out.AzureKeyVault
-		*out = new(AzureKeyVaultConfig)
-		**out = **in
-	}
-	if in.Proxy != nil {
-		in, out := &in.Proxy, &out.Proxy
-		*out = new(ProxyConfig)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VaultConfig.
-func (in *VaultConfig) DeepCopy() *VaultConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(VaultConfig)
-	in.DeepCopyInto(out)
-	return out
-}

apis/actions.summerwind.net/v1alpha1/runner_types.go

@@ -215,10 +215,10 @@ func (rs *RunnerSpec) validateRepository() error {
 		foundCount += 1
 	}
 	if foundCount == 0 {
-		return errors.New("spec needs enterprise, organization or repository")
+		return errors.New("Spec needs enterprise, organization or repository")
 	}
 	if foundCount > 1 {
-		return errors.New("spec cannot have many fields defined enterprise, organization and repository")
+		return errors.New("Spec cannot have many fields defined enterprise, organization and repository")
 	}
 
 	return nil
@@ -317,19 +317,19 @@ type RunnerStatusRegistration struct {
 type WorkVolumeClaimTemplate struct {
 	StorageClassName string                              `json:"storageClassName"`
 	AccessModes      []corev1.PersistentVolumeAccessMode `json:"accessModes"`
-	Resources        corev1.VolumeResourceRequirements   `json:"resources"`
+	Resources        corev1.ResourceRequirements         `json:"resources"`
 }
 
 func (w *WorkVolumeClaimTemplate) validate() error {
-	if len(w.AccessModes) == 0 {
+	if w.AccessModes == nil || len(w.AccessModes) == 0 {
-		return errors.New("access mode should have at least one mode specified")
+		return errors.New("Access mode should have at least one mode specified")
 	}
 
 	for _, accessMode := range w.AccessModes {
 		switch accessMode {
 		case corev1.ReadWriteOnce, corev1.ReadWriteMany:
 		default:
-			return fmt.Errorf("access mode %v is not supported", accessMode)
+			return fmt.Errorf("Access mode %v is not supported", accessMode)
 		}
 	}
 	return nil

apis/actions.summerwind.net/v1alpha1/runner_webhook.go

@@ -17,12 +17,12 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"context"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
@@ -30,43 +30,38 @@ import (
 var runnerLog = logf.Log.WithName("runner-resource")
 
 func (r *Runner) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr, r).
+	return ctrl.NewWebhookManagedBy(mgr).
-		WithDefaulter(&RunnerDefaulter{}).
+		For(r).
-		WithValidator(&RunnerValidator{}).
 		Complete()
 }
 
 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runner,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runners,versions=v1alpha1,name=mutate.runner.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Defaulter[*Runner] = &RunnerDefaulter{}
+var _ webhook.Defaulter = &Runner{}
 
-type RunnerDefaulter struct{}
+// Default implements webhook.Defaulter so a webhook will be registered for the type
-
+func (r *Runner) Default() {
-// Default implements [admission.Defaulter].
+	// Nothing to do.
-func (in *RunnerDefaulter) Default(ctx context.Context, obj *Runner) error {
-	return nil
 }
 
 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runner,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runners,versions=v1alpha1,name=validate.runner.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Validator[*Runner] = &RunnerValidator{}
+var _ webhook.Validator = &Runner{}
-
-type RunnerValidator struct{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateCreate(ctx context.Context, r *Runner) (admission.Warnings, error) {
+func (r *Runner) ValidateCreate() (admission.Warnings, error) {
 	runnerLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateUpdate(ctx context.Context, old, r *Runner) (admission.Warnings, error) {
+func (r *Runner) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateDelete(ctx context.Context, obj *Runner) (admission.Warnings, error) {
+func (r *Runner) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }
 

apis/actions.summerwind.net/v1alpha1/runnerdeployment_webhook.go

@@ -17,12 +17,12 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"context"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
@@ -30,44 +30,38 @@ import (
 var runnerDeploymentLog = logf.Log.WithName("runnerdeployment-resource")
 
 func (r *RunnerDeployment) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr, r).
+	return ctrl.NewWebhookManagedBy(mgr).
-		WithDefaulter(&RunnerDeploymentDefaulter{}).
+		For(r).
-		WithValidator(&RunnerDeploymentValidator{}).
 		Complete()
 }
 
 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runnerdeployment,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerdeployments,versions=v1alpha1,name=mutate.runnerdeployment.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Defaulter[*RunnerDeployment] = &RunnerDeploymentDefaulter{}
+var _ webhook.Defaulter = &RunnerDeployment{}
-
-type RunnerDeploymentDefaulter struct{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type
-func (*RunnerDeploymentDefaulter) Default(context.Context, *RunnerDeployment) error {
+func (r *RunnerDeployment) Default() {
 	// Nothing to do.
-	return nil
 }
 
 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runnerdeployment,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerdeployments,versions=v1alpha1,name=validate.runnerdeployment.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Validator[*RunnerDeployment] = &RunnerDeploymentValidator{}
+var _ webhook.Validator = &RunnerDeployment{}
-
-type RunnerDeploymentValidator struct{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateCreate(ctx context.Context, r *RunnerDeployment) (admission.Warnings, error) {
+func (r *RunnerDeployment) ValidateCreate() (admission.Warnings, error) {
 	runnerDeploymentLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateUpdate(ctx context.Context, old, r *RunnerDeployment) (admission.Warnings, error) {
+func (r *RunnerDeployment) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerDeploymentLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateDelete(context.Context, *RunnerDeployment) (admission.Warnings, error) {
+func (r *RunnerDeployment) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }
 

apis/actions.summerwind.net/v1alpha1/runnerreplicaset_webhook.go

@@ -17,12 +17,12 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"context"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
@@ -30,44 +30,38 @@ import (
 var runnerReplicaSetLog = logf.Log.WithName("runnerreplicaset-resource")
 
 func (r *RunnerReplicaSet) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr, r).
+	return ctrl.NewWebhookManagedBy(mgr).
-		WithDefaulter(&RunnerReplicaSetDefaulter{}).
+		For(r).
-		WithValidator(&RunnerReplicaSetValidator{}).
 		Complete()
 }
 
 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runnerreplicaset,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerreplicasets,versions=v1alpha1,name=mutate.runnerreplicaset.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Defaulter[*RunnerReplicaSet] = &RunnerReplicaSetDefaulter{}
+var _ webhook.Defaulter = &RunnerReplicaSet{}
-
-type RunnerReplicaSetDefaulter struct{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type
-func (*RunnerReplicaSetDefaulter) Default(context.Context, *RunnerReplicaSet) error {
+func (r *RunnerReplicaSet) Default() {
 	// Nothing to do.
-	return nil
 }
 
 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runnerreplicaset,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerreplicasets,versions=v1alpha1,name=validate.runnerreplicaset.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Validator[*RunnerReplicaSet] = &RunnerReplicaSetValidator{}
+var _ webhook.Validator = &RunnerReplicaSet{}
-
-type RunnerReplicaSetValidator struct{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateCreate(ctx context.Context, r *RunnerReplicaSet) (admission.Warnings, error) {
+func (r *RunnerReplicaSet) ValidateCreate() (admission.Warnings, error) {
 	runnerReplicaSetLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateUpdate(ctx context.Context, old, r *RunnerReplicaSet) (admission.Warnings, error) {
+func (r *RunnerReplicaSet) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerReplicaSetLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateDelete(context.Context, *RunnerReplicaSet) (admission.Warnings, error) {
+func (r *RunnerReplicaSet) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }
 

apis/actions.summerwind.net/v1alpha1/zz_generated.deepcopy.go

@@ -23,7 +23,7 @@ package v1alpha1
 import (
 	"k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -467,21 +467,6 @@ func (in *RunnerConfig) DeepCopy() *RunnerConfig {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDefaulter) DeepCopyInto(out *RunnerDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDefaulter.
-func (in *RunnerDefaulter) DeepCopy() *RunnerDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerDeployment) DeepCopyInto(out *RunnerDeployment) {
 	*out = *in
@@ -509,21 +494,6 @@ func (in *RunnerDeployment) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDeploymentDefaulter) DeepCopyInto(out *RunnerDeploymentDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDeploymentDefaulter.
-func (in *RunnerDeploymentDefaulter) DeepCopy() *RunnerDeploymentDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDeploymentDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerDeploymentList) DeepCopyInto(out *RunnerDeploymentList) {
 	*out = *in
@@ -626,21 +596,6 @@ func (in *RunnerDeploymentStatus) DeepCopy() *RunnerDeploymentStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDeploymentValidator) DeepCopyInto(out *RunnerDeploymentValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDeploymentValidator.
-func (in *RunnerDeploymentValidator) DeepCopy() *RunnerDeploymentValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDeploymentValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerList) DeepCopyInto(out *RunnerList) {
 	*out = *in
@@ -860,21 +815,6 @@ func (in *RunnerReplicaSet) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerReplicaSetDefaulter) DeepCopyInto(out *RunnerReplicaSetDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerReplicaSetDefaulter.
-func (in *RunnerReplicaSetDefaulter) DeepCopy() *RunnerReplicaSetDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerReplicaSetDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerReplicaSetList) DeepCopyInto(out *RunnerReplicaSetList) {
 	*out = *in
@@ -967,21 +907,6 @@ func (in *RunnerReplicaSetStatus) DeepCopy() *RunnerReplicaSetStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerReplicaSetValidator) DeepCopyInto(out *RunnerReplicaSetValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerReplicaSetValidator.
-func (in *RunnerReplicaSetValidator) DeepCopy() *RunnerReplicaSetValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerReplicaSetValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerSet) DeepCopyInto(out *RunnerSet) {
 	*out = *in
@@ -1187,21 +1112,6 @@ func (in *RunnerTemplate) DeepCopy() *RunnerTemplate {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerValidator) DeepCopyInto(out *RunnerValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerValidator.
-func (in *RunnerValidator) DeepCopy() *RunnerValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ScaleTargetRef) DeepCopyInto(out *ScaleTargetRef) {
 	*out = *in

charts/.ci/ct-config-gha.yaml

@@ -1,11 +1,9 @@
 # This file defines the config for "ct" (chart tester) used by the helm linting GitHub workflow
-remote: origin
-target-branch: master
 lint-conf: charts/.ci/lint-config.yaml
 chart-repos:
   - jetstack=https://charts.jetstack.io
 check-version-increment: false # Disable checking that the chart version has been bumped
 charts:
-  - charts/gha-runner-scale-set-controller
+- charts/gha-runner-scale-set-controller
-  - charts/gha-runner-scale-set
+- charts/gha-runner-scale-set
 skip-clean-up: true

charts/.ci/ct-config.yaml

@@ -1,9 +1,7 @@
 # This file defines the config for "ct" (chart tester) used by the helm linting GitHub workflow
-remote: origin
-target-branch: master
 lint-conf: charts/.ci/lint-config.yaml
 chart-repos:
   - jetstack=https://charts.jetstack.io
 check-version-increment: false # Disable checking that the chart version has been bumped
 charts:
-  - charts/actions-runner-controller
+- charts/actions-runner-controller

charts/.ci/scripts/local-kube-score.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+
 for chart in `ls charts`;
 do
 helm template --values charts/$chart/ci/ci-values.yaml charts/$chart | kube-score score - \
@@ -11,4 +12,4 @@ helm template --values charts/$chart/ci/ci-values.yaml charts/$chart | kube-scor
     --enable-optional-test container-security-context-privileged \
     --enable-optional-test container-security-context-readonlyrootfilesystem \
     --ignore-test container-security-context
-done
+done

charts/actions-runner-controller/README.md

@@ -44,7 +44,7 @@ All additional docs are kept in the `docs/` folder, this README is solely for do
 | `image.pullPolicy`                                        | The pull policy of the controller image                                                                                                   | IfNotPresent                                                                                    |
 | `metrics.serviceMonitor.enable`                           | Deploy serviceMonitor kind for for use with prometheus-operator CRDs                                                                      | false                                                                                           |
 | `metrics.serviceMonitor.interval`                         | Configure the interval that Prometheus should scrap the controller's metrics                                                              | 1m                                                                                              |
-| `metrics.serviceMonitor.namespace`                        | Namespace which Prometheus is running in                                                                                                  | `Release.Namespace` (the default namespace of the helm chart).                                  |
+| `metrics.serviceMonitor.namespace                         | Namespace which Prometheus is running in                                                                                                  | `Release.Namespace` (the default namespace of the helm chart).                                  |
 | `metrics.serviceMonitor.timeout`                          | Configure the timeout the timeout of Prometheus scrapping.                                                                                | 30s                                                                                             |
 | `metrics.serviceAnnotations`                              | Set annotations for the provisioned metrics service resource                                                                              |                                                                                                 |
 | `metrics.port`                                            | Set port of metrics service                                                                                                               | 8443                                                                                            |

charts/actions-runner-controller/crds/actions.summerwind.dev_horizontalrunnerautoscalers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.1
+    controller-gen.kubebuilder.io/version: v0.14.0
   name: horizontalrunnerautoscalers.actions.summerwind.dev
 spec:
   group: actions.summerwind.dev
@@ -12,313 +12,308 @@ spec:
     listKind: HorizontalRunnerAutoscalerList
     plural: horizontalrunnerautoscalers
     shortNames:
-    - hra
+      - hra
     singular: horizontalrunnerautoscaler
   scope: Namespaced
   versions:
-  - additionalPrinterColumns:
+    - additionalPrinterColumns:
-    - jsonPath: .spec.minReplicas
+        - jsonPath: .spec.minReplicas
-      name: Min
+          name: Min
-      type: number
+          type: number
-    - jsonPath: .spec.maxReplicas
+        - jsonPath: .spec.maxReplicas
-      name: Max
+          name: Max
-      type: number
+          type: number
-    - jsonPath: .status.desiredReplicas
+        - jsonPath: .status.desiredReplicas
-      name: Desired
+          name: Desired
-      type: number
+          type: number
-    - jsonPath: .status.scheduledOverridesSummary
+        - jsonPath: .status.scheduledOverridesSummary
-      name: Schedule
+          name: Schedule
-      type: string
+          type: string
-    name: v1alpha1
+      name: v1alpha1
-    schema:
+      schema:
-      openAPIV3Schema:
+        openAPIV3Schema:
-        description: HorizontalRunnerAutoscaler is the Schema for the horizontalrunnerautoscaler
+          description: HorizontalRunnerAutoscaler is the Schema for the horizontalrunnerautoscaler API
-          API
+          properties:
-        properties:
+            apiVersion:
-          apiVersion:
+              description: |-
-            description: |-
+                APIVersion defines the versioned schema of this representation of an object.
-              APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
-              Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
-              may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
-            type: string
+            kind:
-          kind:
+              description: |-
-            description: |-
+                Kind is a string value representing the REST resource this object represents.
-              Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
-              Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
-              Cannot be updated.
+                In CamelCase.
-              In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
-            type: string
+            metadata:
-          metadata:
+              type: object
-            type: object
+            spec:
-          spec:
+              description: HorizontalRunnerAutoscalerSpec defines the desired state of HorizontalRunnerAutoscaler
-            description: HorizontalRunnerAutoscalerSpec defines the desired state
+              properties:
-              of HorizontalRunnerAutoscaler
+                capacityReservations:
-            properties:
+                  items:
-              capacityReservations:
+                    description: |-
-                items:
+                      CapacityReservation specifies the number of replicas temporarily added
-                  description: |-
+                      to the scale target until ExpirationTime.
-                    CapacityReservation specifies the number of replicas temporarily added
-                    to the scale target until ExpirationTime.
-                  properties:
-                    effectiveTime:
-                      format: date-time
-                      type: string
-                    expirationTime:
-                      format: date-time
-                      type: string
-                    name:
-                      type: string
-                    replicas:
-                      type: integer
-                  type: object
-                type: array
-              githubAPICredentialsFrom:
-                properties:
-                  secretRef:
                     properties:
+                      effectiveTime:
+                        format: date-time
+                        type: string
+                      expirationTime:
+                        format: date-time
+                        type: string
                       name:
                         type: string
-                    required:
+                      replicas:
-                    - name
+                        type: integer
                     type: object
-                type: object
+                  type: array
-              maxReplicas:
+                githubAPICredentialsFrom:
-                description: MaxReplicas is the maximum number of replicas the deployment
-                  is allowed to scale
-                type: integer
-              metrics:
-                description: Metrics is the collection of various metric targets to
-                  calculate desired number of runners
-                items:
                   properties:
-                    repositoryNames:
+                    secretRef:
-                      description: |-
+                      properties:
-                        RepositoryNames is the list of repository names to be used for calculating the metric.
+                        name:
-                        For example, a repository name is the REPO part of `github.com/USER/REPO`.
+                          type: string
-                      items:
+                      required:
+                        - name
+                      type: object
+                  type: object
+                maxReplicas:
+                  description: MaxReplicas is the maximum number of replicas the deployment is allowed to scale
+                  type: integer
+                metrics:
+                  description: Metrics is the collection of various metric targets to calculate desired number of runners
+                  items:
+                    properties:
+                      repositoryNames:
+                        description: |-
+                          RepositoryNames is the list of repository names to be used for calculating the metric.
+                          For example, a repository name is the REPO part of `github.com/USER/REPO`.
+                        items:
+                          type: string
+                        type: array
+                      scaleDownAdjustment:
+                        description: |-
+                          ScaleDownAdjustment is the number of runners removed on scale-down.
+                          You can only specify either ScaleDownFactor or ScaleDownAdjustment.
+                        type: integer
+                      scaleDownFactor:
+                        description: |-
+                          ScaleDownFactor is the multiplicative factor applied to the current number of runners used
+                          to determine how many pods should be removed.
                         type: string
-                      type: array
+                      scaleDownThreshold:
-                    scaleDownAdjustment:
+                        description: |-
-                      description: |-
+                          ScaleDownThreshold is the percentage of busy runners less than which will
-                        ScaleDownAdjustment is the number of runners removed on scale-down.
+                          trigger the hpa to scale the runners down.
-                        You can only specify either ScaleDownFactor or ScaleDownAdjustment.
+                        type: string
-                      type: integer
+                      scaleUpAdjustment:
-                    scaleDownFactor:
+                        description: |-
-                      description: |-
+                          ScaleUpAdjustment is the number of runners added on scale-up.
-                        ScaleDownFactor is the multiplicative factor applied to the current number of runners used
+                          You can only specify either ScaleUpFactor or ScaleUpAdjustment.
-                        to determine how many pods should be removed.
+                        type: integer
-                      type: string
+                      scaleUpFactor:
-                    scaleDownThreshold:
+                        description: |-
-                      description: |-
+                          ScaleUpFactor is the multiplicative factor applied to the current number of runners used
-                        ScaleDownThreshold is the percentage of busy runners less than which will
+                          to determine how many pods should be added.
-                        trigger the hpa to scale the runners down.
+                        type: string
-                      type: string
+                      scaleUpThreshold:
-                    scaleUpAdjustment:
+                        description: |-
-                      description: |-
+                          ScaleUpThreshold is the percentage of busy runners greater than which will
-                        ScaleUpAdjustment is the number of runners added on scale-up.
+                          trigger the hpa to scale runners up.
-                        You can only specify either ScaleUpFactor or ScaleUpAdjustment.
+                        type: string
-                      type: integer
+                      type:
-                    scaleUpFactor:
+                        description: |-
-                      description: |-
+                          Type is the type of metric to be used for autoscaling.
-                        ScaleUpFactor is the multiplicative factor applied to the current number of runners used
+                          It can be TotalNumberOfQueuedAndInProgressWorkflowRuns or PercentageRunnersBusy.
-                        to determine how many pods should be added.
+                        type: string
-                      type: string
+                    type: object
-                    scaleUpThreshold:
+                  type: array
-                      description: |-
+                minReplicas:
-                        ScaleUpThreshold is the percentage of busy runners greater than which will
+                  description: MinReplicas is the minimum number of replicas the deployment is allowed to scale
-                        trigger the hpa to scale runners up.
+                  type: integer
-                      type: string
+                scaleDownDelaySecondsAfterScaleOut:
-                    type:
-                      description: |-
-                        Type is the type of metric to be used for autoscaling.
-                        It can be TotalNumberOfQueuedAndInProgressWorkflowRuns or PercentageRunnersBusy.
-                      type: string
-                  type: object
-                type: array
-              minReplicas:
-                description: MinReplicas is the minimum number of replicas the deployment
-                  is allowed to scale
-                type: integer
-              scaleDownDelaySecondsAfterScaleOut:
-                description: |-
-                  ScaleDownDelaySecondsAfterScaleUp is the approximate delay for a scale down followed by a scale up
-                  Used to prevent flapping (down->up->down->... loop)
-                type: integer
-              scaleTargetRef:
-                description: ScaleTargetRef is the reference to scaled resource like
-                  RunnerDeployment
-                properties:
-                  kind:
-                    description: Kind is the type of resource being referenced
-                    enum:
-                    - RunnerDeployment
-                    - RunnerSet
-                    type: string
-                  name:
-                    description: Name is the name of resource being referenced
-                    type: string
-                type: object
-              scaleUpTriggers:
-                description: |-
-                  ScaleUpTriggers is an experimental feature to increase the desired replicas by 1
-                  on each webhook requested received by the webhookBasedAutoscaler.
-
-                  This feature requires you to also enable and deploy the webhookBasedAutoscaler onto your cluster.
-
-                  Note that the added runners remain until the next sync period at least,
-                  and they may or may not be used by GitHub Actions depending on the timing.
-                  They are intended to be used to gain "resource slack" immediately after you
-                  receive a webhook from GitHub, so that you can loosely expect MinReplicas runners to be always available.
-                items:
-                  properties:
-                    amount:
-                      type: integer
-                    duration:
-                      type: string
-                    githubEvent:
-                      properties:
-                        checkRun:
-                          description: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#check_run
-                          properties:
-                            names:
-                              description: |-
-                                Names is a list of GitHub Actions glob patterns.
-                                Any check_run event whose name matches one of patterns in the list can trigger autoscaling.
-                                Note that check_run name seem to equal to the job name you've defined in your actions workflow yaml file.
-                                So it is very likely that you can utilize this to trigger depending on the job.
-                              items:
-                                type: string
-                              type: array
-                            repositories:
-                              description: |-
-                                Repositories is a list of GitHub repositories.
-                                Any check_run event whose repository matches one of repositories in the list can trigger autoscaling.
-                              items:
-                                type: string
-                              type: array
-                            status:
-                              type: string
-                            types:
-                              description: 'One of: created, rerequested, or completed'
-                              items:
-                                type: string
-                              type: array
-                          type: object
-                        pullRequest:
-                          description: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request
-                          properties:
-                            branches:
-                              items:
-                                type: string
-                              type: array
-                            types:
-                              items:
-                                type: string
-                              type: array
-                          type: object
-                        push:
-                          description: |-
-                            PushSpec is the condition for triggering scale-up on push event
-                            Also see https://docs.github.com/en/actions/reference/events-that-trigger-workflows#push
-                          type: object
-                        workflowJob:
-                          description: https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_job
-                          type: object
-                      type: object
-                  type: object
-                type: array
-              scheduledOverrides:
-                description: |-
-                  ScheduledOverrides is the list of ScheduledOverride.
-                  It can be used to override a few fields of HorizontalRunnerAutoscalerSpec on schedule.
-                  The earlier a scheduled override is, the higher it is prioritized.
-                items:
                   description: |-
-                    ScheduledOverride can be used to override a few fields of HorizontalRunnerAutoscalerSpec on schedule.
+                    ScaleDownDelaySecondsAfterScaleUp is the approximate delay for a scale down followed by a scale up
-                    A schedule can optionally be recurring, so that the corresponding override happens every day, week, month, or year.
+                    Used to prevent flapping (down->up->down->... loop)
+                  type: integer
+                scaleTargetRef:
+                  description: ScaleTargetRef is the reference to scaled resource like RunnerDeployment
                   properties:
-                    endTime:
+                    kind:
-                      description: EndTime is the time at which the first override
+                      description: Kind is the type of resource being referenced
-                        ends.
+                      enum:
-                      format: date-time
+                        - RunnerDeployment
+                        - RunnerSet
                       type: string
-                    minReplicas:
+                    name:
-                      description: |-
+                      description: Name is the name of resource being referenced
-                        MinReplicas is the number of runners while overriding.
-                        If omitted, it doesn't override minReplicas.
-                      minimum: 0
-                      nullable: true
-                      type: integer
-                    recurrenceRule:
-                      properties:
-                        frequency:
-                          description: |-
-                            Frequency is the name of a predefined interval of each recurrence.
-                            The valid values are "Daily", "Weekly", "Monthly", and "Yearly".
-                            If empty, the corresponding override happens only once.
-                          enum:
-                          - Daily
-                          - Weekly
-                          - Monthly
-                          - Yearly
-                          type: string
-                        untilTime:
-                          description: |-
-                            UntilTime is the time of the final recurrence.
-                            If empty, the schedule recurs forever.
-                          format: date-time
-                          type: string
-                      type: object
-                    startTime:
-                      description: StartTime is the time at which the first override
-                        starts.
-                      format: date-time
                       type: string
-                  required:
-                  - endTime
-                  - startTime
                   type: object
-                type: array
+                scaleUpTriggers:
-            type: object
+                  description: |-
-          status:
+                    ScaleUpTriggers is an experimental feature to increase the desired replicas by 1
-            properties:
+                    on each webhook requested received by the webhookBasedAutoscaler.
-              cacheEntries:
+
-                items:
+
-                  properties:
+                    This feature requires you to also enable and deploy the webhookBasedAutoscaler onto your cluster.
-                    expirationTime:
+
-                      format: date-time
+
-                      type: string
+                    Note that the added runners remain until the next sync period at least,
-                    key:
+                    and they may or may not be used by GitHub Actions depending on the timing.
-                      type: string
+                    They are intended to be used to gain "resource slack" immediately after you
-                    value:
+                    receive a webhook from GitHub, so that you can loosely expect MinReplicas runners to be always available.
-                      type: integer
+                  items:
-                  type: object
+                    properties:
-                type: array
+                      amount:
-              desiredReplicas:
+                        type: integer
-                description: |-
+                      duration:
-                  DesiredReplicas is the total number of desired, non-terminated and latest pods to be set for the primary RunnerSet
+                        type: string
-                  This doesn't include outdated pods while upgrading the deployment and replacing the runnerset.
+                      githubEvent:
-                type: integer
+                        properties:
-              lastSuccessfulScaleOutTime:
+                          checkRun:
-                format: date-time
+                            description: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#check_run
-                nullable: true
+                            properties:
-                type: string
+                              names:
-              observedGeneration:
+                                description: |-
-                description: |-
+                                  Names is a list of GitHub Actions glob patterns.
-                  ObservedGeneration is the most recent generation observed for the target. It corresponds to e.g.
+                                  Any check_run event whose name matches one of patterns in the list can trigger autoscaling.
-                  RunnerDeployment's generation, which is updated on mutation by the API Server.
+                                  Note that check_run name seem to equal to the job name you've defined in your actions workflow yaml file.
-                format: int64
+                                  So it is very likely that you can utilize this to trigger depending on the job.
-                type: integer
+                                items:
-              scheduledOverridesSummary:
+                                  type: string
-                description: |-
+                                type: array
-                  ScheduledOverridesSummary is the summary of active and upcoming scheduled overrides to be shown in e.g. a column of a `kubectl get hra` output
+                              repositories:
-                  for observability.
+                                description: |-
-                type: string
+                                  Repositories is a list of GitHub repositories.
-            type: object
+                                  Any check_run event whose repository matches one of repositories in the list can trigger autoscaling.
-        type: object
+                                items:
-    served: true
+                                  type: string
-    storage: true
+                                type: array
-    subresources:
+                              status:
-      status: {}
+                                type: string
+                              types:
+                                description: 'One of: created, rerequested, or completed'
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                          pullRequest:
+                            description: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request
+                            properties:
+                              branches:
+                                items:
+                                  type: string
+                                type: array
+                              types:
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                          push:
+                            description: |-
+                              PushSpec is the condition for triggering scale-up on push event
+                              Also see https://docs.github.com/en/actions/reference/events-that-trigger-workflows#push
+                            type: object
+                          workflowJob:
+                            description: https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_job
+                            type: object
+                        type: object
+                    type: object
+                  type: array
+                scheduledOverrides:
+                  description: |-
+                    ScheduledOverrides is the list of ScheduledOverride.
+                    It can be used to override a few fields of HorizontalRunnerAutoscalerSpec on schedule.
+                    The earlier a scheduled override is, the higher it is prioritized.
+                  items:
+                    description: |-
+                      ScheduledOverride can be used to override a few fields of HorizontalRunnerAutoscalerSpec on schedule.
+                      A schedule can optionally be recurring, so that the corresponding override happens every day, week, month, or year.
+                    properties:
+                      endTime:
+                        description: EndTime is the time at which the first override ends.
+                        format: date-time
+                        type: string
+                      minReplicas:
+                        description: |-
+                          MinReplicas is the number of runners while overriding.
+                          If omitted, it doesn't override minReplicas.
+                        minimum: 0
+                        nullable: true
+                        type: integer
+                      recurrenceRule:
+                        properties:
+                          frequency:
+                            description: |-
+                              Frequency is the name of a predefined interval of each recurrence.
+                              The valid values are "Daily", "Weekly", "Monthly", and "Yearly".
+                              If empty, the corresponding override happens only once.
+                            enum:
+                              - Daily
+                              - Weekly
+                              - Monthly
+                              - Yearly
+                            type: string
+                          untilTime:
+                            description: |-
+                              UntilTime is the time of the final recurrence.
+                              If empty, the schedule recurs forever.
+                            format: date-time
+                            type: string
+                        type: object
+                      startTime:
+                        description: StartTime is the time at which the first override starts.
+                        format: date-time
+                        type: string
+                    required:
+                      - endTime
+                      - startTime
+                    type: object
+                  type: array
+              type: object
+            status:
+              properties:
+                cacheEntries:
+                  items:
+                    properties:
+                      expirationTime:
+                        format: date-time
+                        type: string
+                      key:
+                        type: string
+                      value:
+                        type: integer
+                    type: object
+                  type: array
+                desiredReplicas:
+                  description: |-
+                    DesiredReplicas is the total number of desired, non-terminated and latest pods to be set for the primary RunnerSet
+                    This doesn't include outdated pods while upgrading the deployment and replacing the runnerset.
+                  type: integer
+                lastSuccessfulScaleOutTime:
+                  format: date-time
+                  nullable: true
+                  type: string
+                observedGeneration:
+                  description: |-
+                    ObservedGeneration is the most recent generation observed for the target. It corresponds to e.g.
+                    RunnerDeployment's generation, which is updated on mutation by the API Server.
+                  format: int64
+                  type: integer
+                scheduledOverridesSummary:
+                  description: |-
+                    ScheduledOverridesSummary is the summary of active and upcoming scheduled overrides to be shown in e.g. a column of a `kubectl get hra` output
+                    for observability.
+                  type: string
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+  preserveUnknownFields: false

charts/actions-runner-controller/templates/NOTES.txt

@@ -6,17 +6,17 @@
   {{- end }}
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "actions-runner-controller.fullname" . }})
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "actions-runner-controller.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ include "actions-runner-controller.namespace" . }} svc -w {{ include "actions-runner-controller.fullname" . }}'
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "actions-runner-controller.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ include "actions-runner-controller.namespace" . }} {{ include "actions-runner-controller.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "actions-runner-controller.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ include "actions-runner-controller.namespace" . }} -l "app.kubernetes.io/name={{ include "actions-runner-controller.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "actions-runner-controller.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ include "actions-runner-controller.namespace" . }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
   echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ include "actions-runner-controller.namespace" . }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
 {{- end }}

charts/actions-runner-controller/templates/_helpers.tpl

@@ -1,14 +1,3 @@
-{{/*
-Allow overriding the namespace for the resources.
-*/}}
-{{- define "actions-runner-controller.namespace" -}}
-{{- if .Values.namespaceOverride }}
-  {{- .Values.namespaceOverride }}
-{{- else }}
-  {{- .Release.Namespace }}
-{{- end }}
-{{- end }}
-
 {{/*
 Expand the name of the chart.
 */}}

charts/actions-runner-controller/templates/actionsmetrics.deployment.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:

charts/actions-runner-controller/templates/actionsmetrics.ingress.yaml.yml

@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ $fullName }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.actionsMetricsServer.ingress.annotations }}

charts/actions-runner-controller/templates/actionsmetrics.role_binding.yaml

@@ -10,5 +10,5 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ include "actions-runner-controller-actions-metrics-server.serviceAccountName" . }}
-    namespace: {{ include "actions-runner-controller.namespace" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}

charts/actions-runner-controller/templates/actionsmetrics.secrets.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: Opaque

charts/actions-runner-controller/templates/actionsmetrics.service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller-actions-metrics-server.selectorLabels" . | nindent 4 }}
 {{- if .Values.actionsMetricsServer.service.annotations }}

charts/actions-runner-controller/templates/actionsmetrics.serviceaccount.yaml.yml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.actionsMetricsServer.serviceAccount.annotations }}

charts/actions-runner-controller/templates/actionsmetrics.servicemonitor.yaml.yml

@@ -1,5 +1,5 @@
 {{- if and .Values.actionsMetricsServer.enabled .Values.actionsMetrics.serviceMonitor.enable }}
-{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default (include "actions-runner-controller.namespace" .) }}
+{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default .Release.Namespace }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

charts/actions-runner-controller/templates/auth_proxy_role_binding.yaml

@@ -10,5 +10,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}

charts/actions-runner-controller/templates/certificate.yaml

@@ -6,7 +6,7 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   name: {{ include "actions-runner-controller.selfsignedIssuerName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   selfSigned: {}
 ---
@@ -14,11 +14,11 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: {{ include "actions-runner-controller.servingCertName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   dnsNames:
-  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ include "actions-runner-controller.namespace" . }}.svc
+  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ .Release.Namespace }}.svc
-  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ include "actions-runner-controller.namespace" . }}.svc.cluster.local
+  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ .Release.Namespace }}.svc.cluster.local
   issuerRef:
     kind: Issuer
     name: {{ include "actions-runner-controller.selfsignedIssuerName" . }}

charts/actions-runner-controller/templates/controller.metrics.service.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   name: {{ include "actions-runner-controller.metricsServiceName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   {{- with .Values.metrics.serviceAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/actions-runner-controller/templates/controller.metrics.serviceMonitor.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   name: {{ include "actions-runner-controller.serviceMonitorName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   endpoints:
     - path: /metrics

charts/actions-runner-controller/templates/controller.pdb.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   name: {{ include "actions-runner-controller.pdbName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   {{- if .Values.podDisruptionBudget.minAvailable }}
   minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}

charts/actions-runner-controller/templates/deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "actions-runner-controller.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:
@@ -56,7 +56,7 @@ spec:
         - "--docker-registry-mirror={{ .Values.dockerRegistryMirror }}"
         {{- end }}
         {{- if .Values.scope.singleNamespace }}
-        - "--watch-namespace={{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}"
+        - "--watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }}"
         {{- end }}
         {{- if .Values.logLevel }}
         - "--log-level={{ .Values.logLevel }}"

charts/actions-runner-controller/templates/githubwebhook.deployment.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:
@@ -43,7 +43,7 @@ spec:
         - "--log-level={{ .Values.githubWebhookServer.logLevel }}"
         {{- end }}
         {{- if .Values.scope.singleNamespace }}
-        - "--watch-namespace={{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}"
+        - "--watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }}"
         {{- end }}
         {{- if .Values.runnerGithubURL  }}
         - "--runner-github-url={{ .Values.runnerGithubURL }}"

charts/actions-runner-controller/templates/githubwebhook.ingress.yaml

@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ $fullName }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.githubWebhookServer.ingress.annotations }}

charts/actions-runner-controller/templates/githubwebhook.pdb.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   name: {{ include "actions-runner-controller-github-webhook-server.pdbName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   {{- if .Values.githubWebhookServer.podDisruptionBudget.minAvailable }}
   minAvailable: {{ .Values.githubWebhookServer.podDisruptionBudget.minAvailable }}

charts/actions-runner-controller/templates/githubwebhook.role_binding.yaml

@@ -10,5 +10,5 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ include "actions-runner-controller-github-webhook-server.serviceAccountName" . }}
-    namespace: {{ include "actions-runner-controller.namespace" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}

charts/actions-runner-controller/templates/githubwebhook.secrets.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: Opaque

charts/actions-runner-controller/templates/githubwebhook.service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller-github-webhook-server.selectorLabels" . | nindent 4 }}
 {{- if .Values.githubWebhookServer.service.annotations }}

charts/actions-runner-controller/templates/githubwebhook.serviceMonitor.yaml

@@ -1,5 +1,5 @@
 {{- if and .Values.githubWebhookServer.enabled .Values.metrics.serviceMonitor.enable }}
-{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default (include "actions-runner-controller.namespace" .) }}
+{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default .Release.Namespace }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

charts/actions-runner-controller/templates/githubwebhook.serviceaccount.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.githubWebhookServer.serviceAccount.annotations }}

charts/actions-runner-controller/templates/leader_election_role.yaml

@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "actions-runner-controller.leaderElectionRoleName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups:
   - ""

charts/actions-runner-controller/templates/leader_election_role_binding.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "actions-runner-controller.leaderElectionRoleName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -10,4 +10,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}

charts/actions-runner-controller/templates/manager_role_binding.yaml

@@ -9,4 +9,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}

charts/actions-runner-controller/templates/manager_role_binding_secrets.yaml

@@ -6,7 +6,7 @@ kind: ClusterRoleBinding
 {{- end }}
 metadata:
   name: {{ include "actions-runner-controller.managerRoleName" . }}-secrets
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   {{- if .Values.scope.singleNamespace }}
@@ -18,4 +18,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}

charts/actions-runner-controller/templates/manager_secrets.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   {{- if .Values.authSecret.annotations }}
   annotations:
     {{ toYaml .Values.authSecret.annotations | nindent 4 }}

charts/actions-runner-controller/templates/serviceaccount.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

charts/actions-runner-controller/templates/webhook_configs.yaml

@@ -2,7 +2,7 @@
 We will use a self managed CA if one is not provided by cert-manager
 */}}
 {{- $ca := genCA "actions-runner-ca" 3650 }}
-{{- $cert := genSignedCert (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) (include "actions-runner-controller.namespace" .)) nil (list (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) (include "actions-runner-controller.namespace" .))) 3650 $ca }}
+{{- $cert := genSignedCert (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) .Release.Namespace) nil (list (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) .Release.Namespace)) 3650 $ca }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
@@ -11,7 +11,7 @@ metadata:
   name: {{ include "actions-runner-controller.fullname" . }}-mutating-webhook-configuration
   {{- if .Values.certManagerEnabled }}
   annotations:
-    cert-manager.io/inject-ca-from: {{ include "actions-runner-controller.namespace" . }}/{{ include "actions-runner-controller.servingCertName" . }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "actions-runner-controller.servingCertName" . }}
   {{- end }}
 webhooks:
 - admissionReviewVersions:
@@ -19,7 +19,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -29,7 +29,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-actions-summerwind-dev-v1alpha1-runner
   failurePolicy: Fail
   name: mutate.runner.actions.summerwind.dev
@@ -50,7 +50,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -60,7 +60,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-actions-summerwind-dev-v1alpha1-runnerdeployment
   failurePolicy: Fail
   name: mutate.runnerdeployment.actions.summerwind.dev
@@ -81,7 +81,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -91,7 +91,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-actions-summerwind-dev-v1alpha1-runnerreplicaset
   failurePolicy: Fail
   name: mutate.runnerreplicaset.actions.summerwind.dev
@@ -112,7 +112,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -122,7 +122,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-runner-set-pod
   failurePolicy: Fail
   name: mutate-runner-pod.webhook.actions.summerwind.dev
@@ -148,7 +148,7 @@ metadata:
   name: {{ include "actions-runner-controller.fullname" . }}-validating-webhook-configuration
   {{- if .Values.certManagerEnabled }}
   annotations:
-    cert-manager.io/inject-ca-from: {{ include "actions-runner-controller.namespace" . }}/{{ include "actions-runner-controller.servingCertName" . }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "actions-runner-controller.servingCertName" . }}
   {{- end }}
 webhooks:
 - admissionReviewVersions:
@@ -156,7 +156,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -166,7 +166,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /validate-actions-summerwind-dev-v1alpha1-runner
   failurePolicy: Fail
   name: validate.runner.actions.summerwind.dev
@@ -187,7 +187,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -197,7 +197,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /validate-actions-summerwind-dev-v1alpha1-runnerdeployment
   failurePolicy: Fail
   name: validate.runnerdeployment.actions.summerwind.dev
@@ -218,7 +218,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -228,7 +228,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /validate-actions-summerwind-dev-v1alpha1-runnerreplicaset
   failurePolicy: Fail
   name: validate.runnerreplicaset.actions.summerwind.dev
@@ -250,7 +250,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller.servingCertName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: kubernetes.io/tls

charts/actions-runner-controller/templates/webhook_service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "actions-runner-controller.webhookServiceName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.service.annotations }}

charts/actions-runner-controller/values.yaml

@@ -420,6 +420,3 @@ actionsMetricsServer:
     #      - chart-example.local
   terminationGracePeriodSeconds: 10
   lifecycle: {}
-
-# Add the option to deploy in another namespace rather than .Release.Namespace.
-namespaceOverride: ""

charts/gha-runner-scale-set-controller-experimental/.helmignore

@@ -1,24 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
-tests/

charts/gha-runner-scale-set-controller-experimental/Chart.yaml

@@ -1,33 +0,0 @@
-apiVersion: v2
-name: gha-runner-scale-set-controller-experimental
-description: A Helm chart for install actions-runner-controller CRD
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: "0.14.0"
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "0.14.0"
-
-home: https://github.com/actions/actions-runner-controller
-
-sources:
-  - "https://github.com/actions/actions-runner-controller"
-
-maintainers:
-  - name: actions
-    url: https://github.com/actions

charts/gha-runner-scale-set-controller-experimental/templates/NOTES.txt

@@ -1,3 +0,0 @@
-Thank you for installing {{ .Chart.Name }}.
-
-Your release is named {{ .Release.Name }}.

charts/gha-runner-scale-set-controller-experimental/templates/_controller.tpl

@@ -1,67 +0,0 @@
-{{/*
-Allow overriding the namespace for the resources.
-*/}}
-{{- define "gha-controller.namespace" -}}
-{{- if .Values.namespaceOverride }}
-  {{- .Values.namespaceOverride }}
-{{- else }}
-  {{- .Release.Namespace }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "gha-controller.name" -}}
-{{- if .Values.nameOverride }}
-  {{- .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-  {{- $name := default (include "gha-base-name" .) .Values.nameOverride }}
-  {{- if contains $name .Release.Name }}
-    {{- .Release.Name | trunc 63 | trimSuffix "-" }}
-  {{- else }}
-    {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-  {{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Labels applied to the controller deployment
-*/}}
-{{- define "gha-controller.labels" -}}
-{{- $resourceLabels := dict "app.kubernetes.io/component" "controller-manager" -}}
-{{- $commonLabels := include "gha-common.labels" . | fromYaml -}}
-{{- $userLabels := include "apply-non-reserved-gha-labels-and-annotations" (.Values.controller.metadata.labels | default (dict)) | fromYaml -}}
-{{- $global := include "apply-non-reserved-gha-labels-and-annotations" (.Values.labels | default (dict)) | fromYaml -}}
-{{- $labels := mergeOverwrite $global $userLabels $resourceLabels $commonLabels -}}
-
-{{- /* Reserved actions.github.com/* labels owned by the chart itself */ -}}
-{{- $_ := set $labels "actions.github.com/controller-service-account-namespace" (include "gha-controller.namespace" .) -}}
-{{- $_ := set $labels "actions.github.com/controller-service-account-name" (include "gha-controller.service-account-name" .) -}}
-{{- with .Values.controller.manager.config.watchSingleNamespace }}
-  {{- $_ := set $labels "actions.github.com/controller-watch-single-namespace" . -}}
-{{- end }}
-
-{{- toYaml $labels -}}
-{{- end }}
-
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "gha-controller.service-account-name" -}}
-{{- if eq .Values.controller.serviceAccount.name "default"}}
-  {{- fail "serviceAccount.name cannot be set to 'default'" }}
-{{- end }}
-{{- if .Values.controller.serviceAccount.create }}
-  {{- default (include "gha-controller.name" .) .Values.controller.serviceAccount.name }}
-{{- else }}
-  {{- if not .Values.controller.serviceAccount.name }}
-    {{- fail "serviceAccount.name must be set if serviceAccount.create is false" }}
-  {{- else }}
-    {{- .Values.controller.serviceAccount.name }}
-  {{- end }}
-{{- end }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/_controller_template.tpl

@@ -1,122 +0,0 @@
-
-{{/*
-Labels applied to the controller Pod template (spec.template.metadata.labels)
-*/}}
-{{- define "gha-controller-template.labels" -}}
-{{- $static := dict "app.kubernetes.io/part-of" "gha-rs-controller" "app.kubernetes.io/component" "controller-manager" -}}
-{{- $_ := set $static "app.kubernetes.io/version" (.Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-") -}}
-{{- $selector := include "gha-controller.selector-labels" . | fromYaml -}}
-{{- $podUser := include "apply-non-reserved-gha-labels-and-annotations" (.Values.controller.pod.metadata.labels | default (dict)) | fromYaml -}}
-{{- $labels := mergeOverwrite $podUser $selector $static -}}
-{{- toYaml $labels -}}
-{{- end }}
-
-{{/*
-Annotations applied to the controller Pod template (spec.template.metadata.annotations)
-*/}}
-{{- define "gha-controller-template.annotations" -}}
-{{- $static := dict "kubectl.kubernetes.io/default-container" "manager" -}}
-{{- $podUser := include "apply-non-reserved-gha-labels-and-annotations" (.Values.controller.pod.metadata.annotations | default (dict)) | fromYaml -}}
-{{- $annotations := mergeOverwrite $podUser $static -}}
-{{- toYaml $annotations -}}
-{{- end }}
-
-{{- define "gha-controller-template.manager-container" -}}
-name: manager
-image: "{{ .Values.controller.manager.container.image }}"
-imagePullPolicy: {{ default "IfNotPresent" .Values.controller.manager.container.pullPolicy }}
-command:
-  - "/manager"
-args:
-  - "--auto-scaling-runner-set-only"
-{{- if gt (int (default 1 .Values.controller.replicaCount)) 1 }}
-  - "--enable-leader-election"
-  - "--leader-election-id={{ include "gha-controller.name" . }}"
-{{- end }}
-{{- with .Values.imagePullSecrets }}
-{{- range . }}
-  - "--auto-scaler-image-pull-secrets={{- .name -}}"
-{{- end }}
-{{- end }}
-{{- with .Values.controller.manager.config.logLevel }}
-  - "--log-level={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.logFormat }}
-  - "--log-format={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.watchSingleNamespace }}
-  - "--watch-single-namespace={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.runnerMaxConcurrentReconciles }}
-  - "--runner-max-concurrent-reconciles={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.updateStrategy }}
-  - "--update-strategy={{ . }}"
-{{- end }}
-{{- if .Values.controller.metrics }}
-{{- with .Values.controller.metrics }}
-  - "--listener-metrics-addr={{ .listenerAddr }}"
-  - "--listener-metrics-endpoint={{ .listenerEndpoint }}"
-  - "--metrics-addr={{ .controllerManagerAddr }}"
-{{- end }}
-{{- else }}
-  - "--listener-metrics-addr=0"
-  - "--listener-metrics-endpoint="
-  - "--metrics-addr=0"
-{{- end }}
-{{- range .Values.controller.manager.config.excludeLabelPropagationPrefixes }}
-  - "--exclude-label-propagation-prefix={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.k8sClientRateLimiterQPS }}
-  - "--k8s-client-rate-limiter-qps={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.k8sClientRateLimiterBurst }}
-  - "--k8s-client-rate-limiter-burst={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.container.extraArgs }}
-{{- range . }}
-  - "{{ . }}"
-{{- end }}
-{{- end }}
-{{- $ports := list -}}
-{{- if .Values.controller.metrics }}
-{{- $metricsPort := dict "containerPort" ((regexReplaceAll ":([0-9]+)" .Values.controller.metrics.controllerManagerAddr "${1}") | int) "protocol" "TCP" "name" "metrics" -}}
-{{- $ports = append $ports $metricsPort -}}
-{{- end }}
-{{- with .Values.controller.manager.container.extraPorts }}
-{{- if kindIs "slice" . }}
-{{- $ports = concat $ports . -}}
-{{- end }}
-{{- end }}
-{{- if gt (len $ports) 0 }}
-ports:
-{{- toYaml $ports | nindent 2 }}
-{{- end }}
-env:
-  - name: CONTROLLER_MANAGER_CONTAINER_IMAGE
-    value: "{{ .Values.controller.manager.container.image }}"
-  - name: CONTROLLER_MANAGER_POD_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-  {{- with .Values.controller.manager.container.env }}
-  {{- if kindIs "slice" . }}
-{{- toYaml . | nindent 2 }}
-  {{- end }}
-  {{- end }}
-{{- with .Values.controller.manager.container.resources }}
-resources:
-{{- toYaml . | nindent 2 }}
-{{- end }}
-{{- with .Values.controller.manager.container.securityContext }}
-securityContext:
-{{- toYaml . | nindent 2 }}
-{{- end }}
-volumeMounts:
-  - mountPath: /tmp
-    name: tmp
-  {{- $podVolumeMounts := (.Values.controller.pod.volumeMounts | default list) -}}
-  {{- range $podVolumeMounts }}
-  - {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/_defaults.tpl

@@ -1,74 +0,0 @@
-{{- define "gha-base-name" -}}
-gha-rs-controller
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "gha-controller.chart" -}}
-{{- printf "%s-%s" (include "gha-base-name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "gha-common.labels" -}}
-helm.sh/chart: {{ include "gha-controller.chart" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "gha-rs-controller"
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-app.kubernetes.io/name: {{ include "gha-controller.name" . }}
-app.kubernetes.io/namespace: {{ include "gha-controller.namespace" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-
-{{- define "gha-controller.manager-cluster-role-name" -}}
-{{- include "gha-controller.name" . }}
-{{- end }}
-
-{{- define "gha-controller.manager-cluster-role-binding" -}}
-{{- include "gha-controller.name" . }}
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-role-name" -}}
-{{- include "gha-controller.name" . }}-single-namespace
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-role-binding" -}}
-{{- include "gha-controller.name" . }}-single-namespace
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-watch-role-name" -}}
-{{- include "gha-controller.name" . }}-single-namespace-watch
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-watch-role-binding" -}}
-{{- include "gha-controller.name" . }}-single-namespace-watch
-{{- end }}
-
-{{- define "gha-controller.manager-listener-role-name" -}}
-{{- include "gha-controller.name" . }}-listener
-{{- end }}
-
-{{- define "gha-controller.manager-listener-role-binding" -}}
-{{- include "gha-controller.name" . }}-listener
-{{- end }}
-
-{{- define "gha-controller.leaderElectionRoleName" -}}
-{{- include "gha-controller.name" . }}-leader-election
-{{- end }}
-
-{{- define "gha-controller.leader-election-role-name" -}}
-{{- include "gha-controller.leaderElectionRoleName" . -}}
-{{- end }}
-
-{{- define "gha-controller.leaderElectionRoleBinding" -}}
-{{- include "gha-controller.name" . }}-leader-election
-{{- end }}
-
-{{- define "gha-controller.leader-election-role-binding" -}}
-{{- include "gha-controller.leaderElectionRoleBinding" . -}}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/_helpers.tpl

@@ -1,21 +0,0 @@
-{{/*
-Takes a map of user labels and removes the ones with "actions.github.com/" prefix
-*/}}
-{{- define "apply-non-reserved-gha-labels-and-annotations" -}}
-{{- $userLabels := . -}}
-{{- $processed := dict -}}
-{{- range $key, $value := $userLabels -}}
-  {{- if not (hasPrefix "actions.github.com/" $key) -}}
-    {{- $_ := set $processed $key $value -}}
-  {{- end -}}
-{{- end -}}
-{{- if not (empty $processed) -}}
-  {{- $processed | toYaml }}
-{{- end }}
-{{- end }}
-
-{{- define "gha-controller.selector-labels" -}}
-app.kubernetes.io/name: {{ include "gha-controller.name" . }}
-app.kubernetes.io/namespace: {{ include "gha-controller.namespace" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/deployment.yaml

@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "gha-controller.name" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-  labels:
-    {{- include "gha-controller.labels" . | nindent 4 }}
-spec:
-  replicas: {{ default 1 .Values.controller.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "gha-controller.selector-labels" . | nindent 6 }}
-  template:
-    metadata:
-      annotations:
-        {{- include "gha-controller-template.annotations" . | nindent 8 }}
-      labels:
-        {{- include "gha-controller-template.labels" . | nindent 8 }}
-    spec:
-      {{- $pod := (.Values.controller.pod | default dict) -}}
-      {{- if and (hasKey .Values.controller "pod") (not (kindIs "map" $pod)) -}}
-        {{- fail "controller.pod must be an object" -}}
-      {{- end -}}
-      {{- $podSpec := (index $pod "spec" | default dict) -}}
-      {{- if and (hasKey $pod "spec") (not (kindIs "map" $podSpec)) -}}
-        {{- fail "controller.pod.spec must be an object" -}}
-      {{- end -}}
-
-
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gha-controller.service-account-name" . }}
-      containers:
-        -
-      {{- include "gha-controller-template.manager-container" . | nindent 10 }}
-        {{- $extraContainers := (index $podSpec "containers" | default list) -}}
-        {{- range $extraContainers }}
-        -
-      {{- toYaml . | nindent 10 }}
-        {{- end }}
-      terminationGracePeriodSeconds: {{ default 10 (index $podSpec "terminationGracePeriodSeconds") }}
-      volumes:
-        - name: tmp
-          emptyDir: {}
-      {{- $podVolumes := (index $podSpec "volumes" | default list) -}}
-      {{- range $podVolumes }}
-        - {{- toYaml . | nindent 10 }}
-      {{- end }}
-      {{- $runnerPodSpecExtraFields := (omit $podSpec "containers" "serviceAccountName" "terminationGracePeriodSeconds" "volumes") -}}
-      {{- if gt (len $runnerPodSpecExtraFields) 0 }}
-      {{- toYaml $runnerPodSpecExtraFields | nindent 6 }}
-      {{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/leader_election_role.yaml

@@ -1,15 +0,0 @@
-{{- if gt (int (default 1 .Values.controller.replicaCount)) 1 }}
-# permissions to do leader election.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gha-controller.leader-election-role-name" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-rules:
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "watch", "list", "delete", "update", "create"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/leader_election_role_binding.yaml

@@ -1,15 +0,0 @@
-{{- if gt (int (default 1 .Values.controller.replicaCount)) 1 }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gha-controller.leader-election-role-binding" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gha-controller.leader-election-role-name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gha-controller.service-account-name" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/manager_cluster_role.yaml

@@ -1,144 +0,0 @@
-{{- if empty .Values.controller.manager.config.watchSingleNamespace }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "gha-controller.manager-cluster-role-name" . }}
-rules:
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalingrunnersets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalingrunnersets/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalingrunnersets/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalinglisteners
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalinglisteners/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalinglisteners/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunnersets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunnersets/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunnersets/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunners
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunners/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunners/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts
-  verbs:
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - roles
-  verbs:
-  - list
-  - watch
-  - patch
-{{- end }}