Make EphemeralRunnerController MaxConcurrentReconciles configurable

Make EphemeralRunnerReconciler create runner pods faster and earlier
2025-12-10 11:41:27 +00:00 · 2024-11-01 01:56:11 +00:00 · 2024-09-30 05:25:43 +00:00
198 changed files with 10322 additions and 23507 deletions
--- a/.github/actions/execute-assert-arc-e2e/action.yaml
+++ b/.github/actions/execute-assert-arc-e2e/action.yaml
@@ -188,19 +188,6 @@ runs:
          }
          core.setFailed(`The triggered workflow run didn't finish properly using ${{inputs.arc-name}}`)

-    - name: Gather listener logs
-      shell: bash
-      if: always()
-      run: |
-        LISTENER_POD="$(kubectl get autoscalinglisteners.actions.github.com -n arc-systems -o jsonpath='{.items[*].metadata.name}')"
-        kubectl logs $LISTENER_POD -n ${{inputs.arc-controller-namespace}}
-    
-    - name: Gather coredns logs
-      shell: bash
-      if: always()
-      run: |
-        kubectl logs deployments/coredns -n kube-system 
-
    - name: cleanup
      if: inputs.wait-to-finish == 'true'
      shell: bash
@@ -208,8 +195,8 @@ runs:
        helm uninstall ${{ inputs.arc-name }} --namespace ${{inputs.arc-namespace}} --debug
        kubectl wait --timeout=30s --for=delete AutoScalingRunnerSet -n ${{inputs.arc-namespace}} -l app.kubernetes.io/instance=${{ inputs.arc-name }}

-    - name: Gather controller logs
+    - name: Gather logs and cleanup
      shell: bash
      if: always()
      run: |
-        kubectl logs deployment/arc-gha-rs-controller -n ${{inputs.arc-controller-namespace}}
+        kubectl logs deployment/arc-gha-rs-controller -n ${{inputs.arc-controller-namespace}}
--- a/.github/actions/setup-arc-e2e/action.yaml
+++ b/.github/actions/setup-arc-e2e/action.yaml
@@ -1,9 +1,9 @@
-name: "Setup ARC E2E Test Action"
-description: "Build controller image, create kind cluster, load the image, and exchange ARC configure token."
+name: 'Setup ARC E2E Test Action'
+description: 'Build controller image, create kind cluster, load the image, and exchange ARC configure token.'

 inputs:
  app-id:
-    description: "GitHub App Id for exchange access token"
+    description: 'GitHub App Id for exchange access token'
    required: true
  app-pk:
    description: "GitHub App private key for exchange access token"
@@ -20,31 +20,30 @@ inputs:

 outputs:
  token:
-    description: "Token to use for configure ARC"
+    description: 'Token to use for configure ARC'
    value: ${{steps.config-token.outputs.token}}

 runs:
  using: "composite"
  steps:
    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+      uses: docker/setup-buildx-action@v3
      with:
-        # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
-        # BuildKit v0.11 which has a bug causing intermittent
-        # failures pushing images to GHCR
-        version: v0.9.1
-        driver-opts: image=moby/buildkit:v0.10.6
+          # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
+          # BuildKit v0.11 which has a bug causing intermittent 
+          # failures pushing images to GHCR
+          version: v0.9.1
+          driver-opts: image=moby/buildkit:v0.10.6

    - name: Build controller image
-      # https://github.com/docker/build-push-action/releases/tag/v6.15.0
-      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
+      uses: docker/build-push-action@v5
      with:
        file: Dockerfile
        platforms: linux/amd64
        load: true
        build-args: |
          DOCKER_IMAGE_NAME=${{inputs.image-name}}
-          VERSION=${{inputs.image-tag}}
+          VERSION=${{inputs.image-tag}} 
        tags: |
          ${{inputs.image-name}}:${{inputs.image-tag}}
        no-cache: true
@@ -57,9 +56,8 @@ runs:

    - name: Get configure token
      id: config-token
-      # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
      with:
        application_id: ${{ inputs.app-id }}
        application_private_key: ${{ inputs.app-pk }}
-        organization: ${{ inputs.target-org}}
+        organization: ${{ inputs.target-org}}
--- a/.github/actions/setup-docker-environment/action.yaml
+++ b/.github/actions/setup-docker-environment/action.yaml
@@ -24,27 +24,23 @@ runs:
      shell: bash

    - name: Set up QEMU
-      # https://github.com/docker/setup-qemu-action/releases/tag/v3.6.0
-      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
+      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
-      # https://github.com/docker/setup-buildx-action/releases/tag/v3.10.0
-      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+      uses: docker/setup-buildx-action@v3
      with:
        version: latest

    - name: Login to DockerHub
      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.password != ''  }}
-      # https://github.com/docker/login-action/releases/tag/v3.4.0
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+      uses: docker/login-action@v3
      with:
        username: ${{ inputs.username }}
        password: ${{ inputs.password }}

    - name: Login to GitHub Container Registry
      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ghcr_password != ''  }}
-      # https://github.com/docker/login-action/releases/tag/v3.4.0
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ inputs.ghcr_username }}
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,15 +9,3 @@ updates:
    directory: "/" # Location of package manifests
    schedule:
      interval: "weekly"
-    groups:
-      gomod:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns:
-          - "*"
--- a/.github/workflows/arc-publish-chart.yaml
+++ b/.github/workflows/arc-publish-chart.yaml
@@ -5,18 +5,18 @@ name: Publish ARC Helm Charts
 on:
  push:
    branches:
-      - master
+    - master
    paths:
-      - "charts/**"
-      - ".github/workflows/arc-publish-chart.yaml"
-      - "!charts/actions-runner-controller/docs/**"
-      - "!charts/gha-runner-scale-set-controller/**"
-      - "!charts/gha-runner-scale-set/**"
-      - "!**.md"
+    - 'charts/**'
+    - '.github/workflows/arc-publish-chart.yaml'
+    - '!charts/actions-runner-controller/docs/**'
+    - '!charts/gha-runner-scale-set-controller/**'
+    - '!charts/gha-runner-scale-set/**'
+    - '!**.md'
  workflow_dispatch:
    inputs:
      force:
-        description: "Force publish even if the chart version is not bumped"
+        description: 'Force publish even if the chart version is not bumped'
        type: boolean
        required: true
        default: false
@@ -39,89 +39,86 @@ jobs:
    outputs:
      publish-chart: ${{ steps.publish-chart-step.outputs.publish }}
    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0

-      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
-        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
-        with:
-          version: ${{ env.HELM_VERSION }}
+    - name: Set up Helm
+      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
+      with:
+        version: ${{ env.HELM_VERSION }}

-      - name: Set up kube-score
-        run: |
-          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
-          chmod 755 kube-score
+    - name: Set up kube-score
+      run: |
+        wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+        chmod 755 kube-score

-      - name: Kube-score generated manifests
-        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score - --ignore-test pod-networkpolicy --ignore-test deployment-has-poddisruptionbudget --ignore-test deployment-has-host-podantiaffinity --ignore-test container-security-context --ignore-test pod-probes --ignore-test container-image-tag --enable-optional-test container-security-context-privileged --enable-optional-test container-security-context-readonlyrootfilesystem
+    - name: Kube-score generated manifests
+      run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score - --ignore-test pod-networkpolicy --ignore-test deployment-has-poddisruptionbudget --ignore-test deployment-has-host-podantiaffinity --ignore-test container-security-context --ignore-test pod-probes --ignore-test container-image-tag --enable-optional-test container-security-context-privileged --enable-optional-test container-security-context-readonlyrootfilesystem

-      # python is a requirement for the chart-testing action below (supports yamllint among other tests)
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
+    # python is a requirement for the chart-testing action below (supports yamllint among other tests)
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'

-      - name: Set up chart-testing
-        # https://github.com/helm/chart-testing-action/releases/tag/v2.7.0
-        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
+    - name: Set up chart-testing
+      uses: helm/chart-testing-action@v2.6.0

-      - name: Run chart-testing (list-changed)
-        id: list-changed
-        run: |
-          changed=$(ct list-changed --config charts/.ci/ct-config.yaml)
-          if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-          fi
+    - name: Run chart-testing (list-changed)
+      id: list-changed
+      run: |
+        changed=$(ct list-changed --config charts/.ci/ct-config.yaml)
+        if [[ -n "$changed" ]]; then
+          echo "changed=true" >> $GITHUB_OUTPUT
+        fi

-      - name: Run chart-testing (lint)
-        run: |
-          ct lint --config charts/.ci/ct-config.yaml
+    - name: Run chart-testing (lint)
+      run: |
+        ct lint --config charts/.ci/ct-config.yaml

-      - name: Create kind cluster
-        if: steps.list-changed.outputs.changed == 'true'
-        # https://github.com/helm/kind-action/releases/tag/v1.12.0
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
+    - name: Create kind cluster
+      if: steps.list-changed.outputs.changed == 'true'
+      uses: helm/kind-action@v1.4.0

-      # We need cert-manager already installed in the cluster because we assume the CRDs exist
-      - name: Install cert-manager
-        if: steps.list-changed.outputs.changed == 'true'
-        run: |
-          helm repo add jetstack https://charts.jetstack.io --force-update
-          helm install cert-manager jetstack/cert-manager --set installCRDs=true --wait
+    # We need cert-manager already installed in the cluster because we assume the CRDs exist
+    - name: Install cert-manager
+      if: steps.list-changed.outputs.changed == 'true'
+      run: |
+        helm repo add jetstack https://charts.jetstack.io --force-update
+        helm install cert-manager jetstack/cert-manager --set installCRDs=true --wait

-      - name: Run chart-testing (install)
-        if: steps.list-changed.outputs.changed == 'true'
-        run: ct install --config charts/.ci/ct-config.yaml
+    - name: Run chart-testing (install)
+      if: steps.list-changed.outputs.changed == 'true'
+      run: ct install --config charts/.ci/ct-config.yaml

-      # WARNING: This relies on the latest release being at the top of the JSON from GitHub and a clean chart.yaml
-      - name: Check if Chart Publish is Needed
-        id: publish-chart-step
-        run: |
-          CHART_TEXT=$(curl -fs https://raw.githubusercontent.com/${{ github.repository }}/master/charts/actions-runner-controller/Chart.yaml)
-          NEW_CHART_VERSION=$(echo "$CHART_TEXT" | grep version: | cut -d ' ' -f 2)
-          RELEASE_LIST=$(curl -fs https://api.github.com/repos/${{ github.repository }}/releases  | jq .[].tag_name | grep actions-runner-controller | cut -d '"' -f 2 | cut -d '-' -f 4)
-          LATEST_RELEASED_CHART_VERSION=$(echo $RELEASE_LIST | cut -d ' ' -f 1)
+    # WARNING: This relies on the latest release being at the top of the JSON from GitHub and a clean chart.yaml
+    - name: Check if Chart Publish is Needed
+      id: publish-chart-step
+      run: |
+        CHART_TEXT=$(curl -fs https://raw.githubusercontent.com/${{ github.repository }}/master/charts/actions-runner-controller/Chart.yaml)
+        NEW_CHART_VERSION=$(echo "$CHART_TEXT" | grep version: | cut -d ' ' -f 2)
+        RELEASE_LIST=$(curl -fs https://api.github.com/repos/${{ github.repository }}/releases  | jq .[].tag_name | grep actions-runner-controller | cut -d '"' -f 2 | cut -d '-' -f 4)
+        LATEST_RELEASED_CHART_VERSION=$(echo $RELEASE_LIST | cut -d ' ' -f 1)

-          echo "CHART_VERSION_IN_MASTER=$NEW_CHART_VERSION" >> $GITHUB_ENV
-          echo "LATEST_CHART_VERSION=$LATEST_RELEASED_CHART_VERSION" >> $GITHUB_ENV
+        echo "CHART_VERSION_IN_MASTER=$NEW_CHART_VERSION" >> $GITHUB_ENV
+        echo "LATEST_CHART_VERSION=$LATEST_RELEASED_CHART_VERSION" >> $GITHUB_ENV

-          # Always publish if force is true
-          if [[ $NEW_CHART_VERSION != $LATEST_RELEASED_CHART_VERSION || "${{ inputs.force }}" == "true" ]]; then
-            echo "publish=true" >> $GITHUB_OUTPUT
-          else
-            echo "publish=false" >> $GITHUB_OUTPUT
-          fi
+        # Always publish if force is true
+        if [[ $NEW_CHART_VERSION != $LATEST_RELEASED_CHART_VERSION || "${{ inputs.force }}" == "true" ]]; then
+          echo "publish=true" >> $GITHUB_OUTPUT
+        else
+          echo "publish=false" >> $GITHUB_OUTPUT
+        fi

-      - name: Job summary
-        run: |
-          echo "Chart linting has been completed." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Status:**" >> $GITHUB_STEP_SUMMARY
-          echo "- chart version in master: ${{ env.CHART_VERSION_IN_MASTER }}" >> $GITHUB_STEP_SUMMARY
-          echo "- latest chart version: ${{ env.LATEST_CHART_VERSION }}" >> $GITHUB_STEP_SUMMARY
-          echo "- publish new chart: ${{ steps.publish-chart-step.outputs.publish }}" >> $GITHUB_STEP_SUMMARY
+    - name: Job summary
+      run: |
+        echo "Chart linting has been completed." >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "**Status:**" >> $GITHUB_STEP_SUMMARY
+        echo "- chart version in master: ${{ env.CHART_VERSION_IN_MASTER }}" >> $GITHUB_STEP_SUMMARY
+        echo "- latest chart version: ${{ env.LATEST_CHART_VERSION }}" >> $GITHUB_STEP_SUMMARY
+        echo "- publish new chart: ${{ steps.publish-chart-step.outputs.publish }}" >> $GITHUB_STEP_SUMMARY

  publish-chart:
    if: needs.lint-chart.outputs.publish-chart == 'true'
@@ -136,81 +133,80 @@ jobs:
      CHART_TARGET_BRANCH: master

    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0

-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+    - name: Configure Git
+      run: |
+        git config user.name "$GITHUB_ACTOR"
+        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

-      - name: Get Token
-        id: get_workflow_token
-        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
-        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
-        with:
-          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
-          application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}
-          organization: ${{ env.CHART_TARGET_ORG }}
+    - name: Get Token
+      id: get_workflow_token
+      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
+      with:
+        application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
+        application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}
+        organization: ${{ env.CHART_TARGET_ORG }}

-      - name: Install chart-releaser
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f
-        with:
-          install_only: true
-          install_dir: ${{ github.workspace }}/bin
+    - name: Install chart-releaser
+      uses: helm/chart-releaser-action@v1.4.1
+      with:
+        install_only: true
+        install_dir: ${{ github.workspace }}/bin

-      - name: Package and upload release assets
-        run: |
-          cr package \
-            ${{ github.workspace }}/charts/actions-runner-controller/ \
-            --package-path .cr-release-packages
+    - name: Package and upload release assets
+      run: |
+        cr package \
+          ${{ github.workspace }}/charts/actions-runner-controller/ \
+          --package-path .cr-release-packages

-          cr upload \
-            --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
-            --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
-            --package-path .cr-release-packages \
-            --token ${{ secrets.GITHUB_TOKEN }}
+        cr upload \
+          --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
+          --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
+          --package-path .cr-release-packages \
+          --token ${{ secrets.GITHUB_TOKEN }}

-      - name: Generate updated index.yaml
-        run: |
-          cr index \
-            --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
-            --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
-            --index-path ${{ github.workspace }}/index.yaml \
-            --token ${{ secrets.GITHUB_TOKEN }} \
-            --push \
-            --pages-branch 'gh-pages' \
-            --pages-index-path 'index.yaml'
+    - name: Generate updated index.yaml
+      run: |
+        cr index \
+          --owner "$(echo ${{ github.repository }} | cut -d '/' -f 1)" \
+          --git-repo "$(echo ${{ github.repository }} | cut -d '/' -f 2)" \
+          --index-path ${{ github.workspace }}/index.yaml \
+          --token ${{ secrets.GITHUB_TOKEN }} \
+          --push \
+          --pages-branch 'gh-pages' \
+          --pages-index-path 'index.yaml'

-      # Chart Release was never intended to publish to a different repo
-      # this workaround is intended to move the index.yaml to the target repo
-      # where the github pages are hosted
-      - name: Checkout target repository
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}
-          path: ${{ env.CHART_TARGET_REPO }}
-          ref: ${{ env.CHART_TARGET_BRANCH }}
-          token: ${{ steps.get_workflow_token.outputs.token }}
+    # Chart Release was never intended to publish to a different repo
+    # this workaround is intended to move the index.yaml to the target repo
+    # where the github pages are hosted
+    - name: Checkout target repository
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}
+        path: ${{ env.CHART_TARGET_REPO }}
+        ref: ${{ env.CHART_TARGET_BRANCH }}
+        token: ${{ steps.get_workflow_token.outputs.token }}

-      - name: Copy index.yaml
-        run: |
-          cp ${{ github.workspace }}/index.yaml ${{ env.CHART_TARGET_REPO }}/actions-runner-controller/index.yaml
+    - name: Copy index.yaml
+      run: |
+        cp ${{ github.workspace }}/index.yaml ${{ env.CHART_TARGET_REPO }}/actions-runner-controller/index.yaml

-      - name: Commit and push to target repository
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-          git add .
-          git commit -m "Update index.yaml"
-          git push
-        working-directory: ${{ github.workspace }}/${{ env.CHART_TARGET_REPO }}
+    - name: Commit and push to target repository
+      run: |
+        git config user.name "$GITHUB_ACTOR"
+        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+        git add .
+        git commit -m "Update index.yaml"
+        git push
+      working-directory: ${{ github.workspace }}/${{ env.CHART_TARGET_REPO }}

-      - name: Job summary
-        run: |
-          echo "New helm chart has been published" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Status:**" >> $GITHUB_STEP_SUMMARY
-          echo "- New [index.yaml](https://github.com/${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}/tree/master/actions-runner-controller) pushed" >> $GITHUB_STEP_SUMMARY
+    - name: Job summary
+      run: |
+        echo "New helm chart has been published" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "**Status:**" >> $GITHUB_STEP_SUMMARY
+        echo "- New [index.yaml](https://github.com/${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}/tree/master/actions-runner-controller) pushed" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/arc-publish.yaml
+++ b/.github/workflows/arc-publish.yaml
@@ -9,17 +9,17 @@ on:
  workflow_dispatch:
    inputs:
      release_tag_name:
-        description: "Tag name of the release to publish"
+        description: 'Tag name of the release to publish'
        required: true
      push_to_registries:
-        description: "Push images to registries"
+        description: 'Push images to registries'
        required: true
        type: boolean
        default: false

 permissions:
-  contents: write
-  packages: write
+ contents: write
+ packages: write

 env:
  TARGET_ORG: actions-runner-controller
@@ -43,7 +43,7 @@ jobs:

      - uses: actions/setup-go@v5
        with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'

      - name: Install tools
        run: |
@@ -73,7 +73,6 @@ jobs:

      - name: Get Token
        id: get_workflow_token
-        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
        with:
          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
--- a/.github/workflows/arc-release-runners.yaml
+++ b/.github/workflows/arc-release-runners.yaml
@@ -7,10 +7,10 @@ on:
  # are available to the workflow run
  push:
    branches:
-      - "master"
+      - 'master'
    paths:
-      - "runner/VERSION"
-      - ".github/workflows/arc-release-runners.yaml"
+      - 'runner/VERSION'
+      - '.github/workflows/arc-release-runners.yaml'

 env:
  # Safeguard to prevent pushing images to registeries after build
@@ -39,7 +39,6 @@ jobs:

      - name: Get Token
        id: get_workflow_token
-        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
        with:
          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
--- a/.github/workflows/arc-validate-chart.yaml
+++ b/.github/workflows/arc-validate-chart.yaml
@@ -5,20 +5,20 @@ on:
    branches:
      - master
    paths:
-      - "charts/**"
-      - ".github/workflows/arc-validate-chart.yaml"
-      - "!charts/actions-runner-controller/docs/**"
-      - "!**.md"
-      - "!charts/gha-runner-scale-set-controller/**"
-      - "!charts/gha-runner-scale-set/**"
+      - 'charts/**'
+      - '.github/workflows/arc-validate-chart.yaml'
+      - '!charts/actions-runner-controller/docs/**'
+      - '!**.md'
+      - '!charts/gha-runner-scale-set-controller/**'
+      - '!charts/gha-runner-scale-set/**'
  push:
    paths:
-      - "charts/**"
-      - ".github/workflows/arc-validate-chart.yaml"
-      - "!charts/actions-runner-controller/docs/**"
-      - "!**.md"
-      - "!charts/gha-runner-scale-set-controller/**"
-      - "!charts/gha-runner-scale-set/**"
+      - 'charts/**'
+      - '.github/workflows/arc-validate-chart.yaml'
+      - '!charts/actions-runner-controller/docs/**'
+      - '!**.md'
+      - '!charts/gha-runner-scale-set-controller/**'
+      - '!charts/gha-runner-scale-set/**'
  workflow_dispatch:
 env:
  KUBE_SCORE_VERSION: 1.10.0
@@ -45,19 +45,34 @@ jobs:
          fetch-depth: 0

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}

+      - name: Set up kube-score
+        run: |
+          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+          chmod 755 kube-score
+
+      - name: Kube-score generated manifests
+        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score -
+              --ignore-test pod-networkpolicy
+              --ignore-test deployment-has-poddisruptionbudget
+              --ignore-test deployment-has-host-podantiaffinity
+              --ignore-test container-security-context
+              --ignore-test pod-probes
+              --ignore-test container-image-tag
+              --enable-optional-test container-security-context-privileged
+              --enable-optional-test container-security-context-readonlyrootfilesystem
+
      # python is a requirement for the chart-testing action below (supports yamllint among other tests)
      - uses: actions/setup-python@v5
        with:
-          python-version: "3.11"
+          python-version: '3.11'

      - name: Set up chart-testing
-        # https://github.com/helm/chart-testing-action/releases/tag/v2.7.0
-        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
+        uses: helm/chart-testing-action@v2.6.0

      - name: Run chart-testing (list-changed)
        id: list-changed
@@ -72,8 +87,7 @@ jobs:
          ct lint --config charts/.ci/ct-config.yaml

      - name: Create kind cluster
-        # https://github.com/helm/kind-action/releases/tag/v1.12.0
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
+        uses: helm/kind-action@v1.4.0
        if: steps.list-changed.outputs.changed == 'true'

      # We need cert-manager already installed in the cluster because we assume the CRDs exist
--- a/.github/workflows/arc-validate-runners.yaml
+++ b/.github/workflows/arc-validate-runners.yaml
@@ -3,17 +3,17 @@ name: Validate ARC Runners
 on:
  pull_request:
    branches:
-      - "**"
+      - '**'
    paths:
-      - "runner/**"
-      - "test/startup/**"
-      - "!**.md"
+      - 'runner/**'
+      - 'test/startup/**'
+      - '!**.md'

 permissions:
  contents: read

 concurrency:
-  # This will make sure we only apply the concurrency limits on pull requests
+  # This will make sure we only apply the concurrency limits on pull requests 
  # but not pushes to master branch by making the concurrency group name unique
  # for pushes
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -25,16 +25,28 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - name: "Run shellcheck"
-        run: make shellcheck
-
+      - name: shellcheck
+        uses: reviewdog/action-shellcheck@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          path: "./runner"
+          pattern: |
+            *.sh
+            *.bash
+            update-status
+          # Make this consistent with `make shellsheck`
+          shellcheck_flags: "--shell bash --source-path runner"
+          exclude: "./.git/*"
+          check_all_files_with_shebangs: "false"
+          # Set this to "true" once we addressed all the shellcheck findings
+          fail_on_error: "false"
  test-runner-entrypoint:
    name: Test entrypoint
    runs-on: ubuntu-latest
    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+    - name: Checkout
+      uses: actions/checkout@v4

-      - name: Run tests
-        run: |
-          make acceptance/runner/startup
+    - name: Run tests
+      run: |
+        make acceptance/runner/startup
--- a/.github/workflows/gha-e2e-tests.yaml
+++ b/.github/workflows/gha-e2e-tests.yaml
@@ -16,7 +16,7 @@ env:
  TARGET_ORG: actions-runner-controller
  TARGET_REPO: arc_e2e_test_dummy
  IMAGE_NAME: "arc-test-image"
-  IMAGE_VERSION: "0.11.0"
+  IMAGE_VERSION: "0.9.3"

 concurrency:
  # This will make sure we only apply the concurrency limits on pull requests
@@ -103,8 +103,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Test ARC E2E
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
@@ -196,8 +194,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Test ARC E2E
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
@@ -288,8 +284,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Test ARC E2E
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
@@ -389,8 +383,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Test ARC E2E
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
@@ -492,8 +484,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Test ARC E2E
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
@@ -589,8 +579,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Test ARC E2E
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
@@ -711,8 +699,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Test ARC E2E
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
@@ -803,8 +789,6 @@ jobs:
          kubectl wait --timeout=30s --for=condition=ready pod -n arc-systems -l actions.github.com/scale-set-name=$ARC_NAME
          kubectl get pod -n arc-systems

-          sleep 60
-
      - name: Trigger long running jobs and wait for runners to pick them up
        uses: ./.github/actions/execute-assert-arc-e2e
        timeout-minutes: 10
--- a/.github/workflows/gha-publish-chart.yaml
+++ b/.github/workflows/gha-publish-chart.yaml
@@ -4,27 +4,27 @@ on:
  workflow_dispatch:
    inputs:
      ref:
-        description: "The branch, tag or SHA to cut a release from"
+        description: 'The branch, tag or SHA to cut a release from'
        required: false
        type: string
-        default: ""
+        default: ''
      release_tag_name:
-        description: "The name to tag the controller image with"
+        description: 'The name to tag the controller image with'
        required: true
        type: string
-        default: "canary"
+        default: 'canary'
      push_to_registries:
-        description: "Push images to registries"
+        description: 'Push images to registries'
        required: true
        type: boolean
        default: false
      publish_gha_runner_scale_set_controller_chart:
-        description: "Publish new helm chart for gha-runner-scale-set-controller"
+        description: 'Publish new helm chart for gha-runner-scale-set-controller'
        required: true
        type: boolean
        default: false
      publish_gha_runner_scale_set_chart:
-        description: "Publish new helm chart for gha-runner-scale-set"
+        description: 'Publish new helm chart for gha-runner-scale-set'
        required: true
        type: boolean
        default: false
@@ -72,11 +72,10 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up QEMU
-        # https://github.com/docker/setup-qemu-action/releases/tag/v3.6.0
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+        uses: docker/setup-buildx-action@v3
        with:
          # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
          # BuildKit v0.11 which has a bug causing intermittent
@@ -85,16 +84,14 @@ jobs:
          driver-opts: image=moby/buildkit:v0.10.6

      - name: Login to GitHub Container Registry
-        # https://github.com/docker/login-action/releases/tag/v3.4.0
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & push controller image
-        # https://github.com/docker/build-push-action/releases/tag/v6.15.0
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
+        uses: docker/build-push-action@v5
        with:
          file: Dockerfile
          platforms: linux/amd64,linux/arm64
@@ -143,7 +140,7 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}
@@ -191,7 +188,7 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}
--- a/.github/workflows/gha-validate-chart.yaml
+++ b/.github/workflows/gha-validate-chart.yaml
@@ -5,20 +5,20 @@ on:
    branches:
      - master
    paths:
-      - "charts/**"
-      - ".github/workflows/gha-validate-chart.yaml"
-      - "!charts/actions-runner-controller/**"
-      - "!**.md"
+      - 'charts/**'
+      - '.github/workflows/gha-validate-chart.yaml'
+      - '!charts/actions-runner-controller/**'
+      - '!**.md'
  push:
    paths:
-      - "charts/**"
-      - ".github/workflows/gha-validate-chart.yaml"
-      - "!charts/actions-runner-controller/**"
-      - "!**.md"
+      - 'charts/**'
+      - '.github/workflows/gha-validate-chart.yaml'
+      - '!charts/actions-runner-controller/**'
+      - '!**.md'
  workflow_dispatch:
 env:
  KUBE_SCORE_VERSION: 1.16.1
-  HELM_VERSION: v3.17.0
+  HELM_VERSION: v3.8.0

 permissions:
  contents: read
@@ -41,19 +41,34 @@ jobs:
          fetch-depth: 0

      - name: Set up Helm
-        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2.0
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: ${{ env.HELM_VERSION }}

+      - name: Set up kube-score
+        run: |
+          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+          chmod 755 kube-score
+
+      - name: Kube-score generated manifests
+        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score -
+              --ignore-test pod-networkpolicy
+              --ignore-test deployment-has-poddisruptionbudget
+              --ignore-test deployment-has-host-podantiaffinity
+              --ignore-test container-security-context
+              --ignore-test pod-probes
+              --ignore-test container-image-tag
+              --enable-optional-test container-security-context-privileged
+              --enable-optional-test container-security-context-readonlyrootfilesystem
+
      # python is a requirement for the chart-testing action below (supports yamllint among other tests)
      - uses: actions/setup-python@v5
        with:
-          python-version: "3.11"
+          python-version: '3.11'

      - name: Set up chart-testing
-        # https://github.com/helm/chart-testing-action/releases/tag/v2.7.0
-        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
+        uses: helm/chart-testing-action@v2.6.0

      - name: Run chart-testing (list-changed)
        id: list-changed
@@ -69,14 +84,13 @@ jobs:
          ct lint --config charts/.ci/ct-config-gha.yaml

      - name: Set up docker buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+        uses: docker/setup-buildx-action@v3
        if: steps.list-changed.outputs.changed == 'true'
        with:
          version: latest

      - name: Build controller image
-        # https://github.com/docker/build-push-action/releases/tag/v6.15.0
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
+        uses: docker/build-push-action@v5
        if: steps.list-changed.outputs.changed == 'true'
        with:
          file: Dockerfile
@@ -91,8 +105,7 @@ jobs:
          cache-to: type=gha,mode=max

      - name: Create kind cluster
-        # https://github.com/helm/kind-action/releases/tag/v1.12.0
-        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
+        uses: helm/kind-action@v1.4.0
        if: steps.list-changed.outputs.changed == 'true'
        with:
          cluster_name: chart-testing
@@ -100,27 +113,13 @@ jobs:
      - name: Load image into cluster
        if: steps.list-changed.outputs.changed == 'true'
        run: |
-          export DOCKER_IMAGE_NAME=test-arc
-          export VERSION=dev
-          export IMG_RESULT=load
-          make docker-buildx
-          kind load docker-image test-arc:dev --name chart-testing
+            export DOCKER_IMAGE_NAME=test-arc
+            export VERSION=dev
+            export IMG_RESULT=load
+            make docker-buildx
+            kind load docker-image test-arc:dev --name chart-testing

      - name: Run chart-testing (install)
        if: steps.list-changed.outputs.changed == 'true'
        run: |
          ct install --config charts/.ci/ct-config-gha.yaml
-  test-chart:
-    name: Test Chart
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: Test gha-runner-scale-set
-        run: go test ./charts/gha-runner-scale-set/...
-      - name: Test gha-runner-scale-set-controller
-        run: go test ./charts/gha-runner-scale-set-controller/...
--- a/.github/workflows/global-publish-canary.yaml
+++ b/.github/workflows/global-publish-canary.yaml
@@ -7,30 +7,30 @@ on:
    branches:
      - master
    paths-ignore:
-      - "**.md"
-      - ".github/actions/**"
-      - ".github/ISSUE_TEMPLATE/**"
-      - ".github/workflows/e2e-test-dispatch-workflow.yaml"
-      - ".github/workflows/gha-e2e-tests.yaml"
-      - ".github/workflows/arc-publish.yaml"
-      - ".github/workflows/arc-publish-chart.yaml"
-      - ".github/workflows/gha-publish-chart.yaml"
-      - ".github/workflows/arc-release-runners.yaml"
-      - ".github/workflows/global-run-codeql.yaml"
-      - ".github/workflows/global-run-first-interaction.yaml"
-      - ".github/workflows/global-run-stale.yaml"
-      - ".github/workflows/arc-update-runners-scheduled.yaml"
-      - ".github/workflows/validate-arc.yaml"
-      - ".github/workflows/arc-validate-chart.yaml"
-      - ".github/workflows/gha-validate-chart.yaml"
-      - ".github/workflows/arc-validate-runners.yaml"
-      - ".github/dependabot.yml"
-      - ".github/RELEASE_NOTE_TEMPLATE.md"
-      - "runner/**"
-      - ".gitignore"
-      - "PROJECT"
-      - "LICENSE"
-      - "Makefile"
+      - '**.md'
+      - '.github/actions/**'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/workflows/e2e-test-dispatch-workflow.yaml'
+      - '.github/workflows/gha-e2e-tests.yaml'
+      - '.github/workflows/arc-publish.yaml'
+      - '.github/workflows/arc-publish-chart.yaml'
+      - '.github/workflows/gha-publish-chart.yaml'
+      - '.github/workflows/arc-release-runners.yaml'
+      - '.github/workflows/global-run-codeql.yaml'
+      - '.github/workflows/global-run-first-interaction.yaml'
+      - '.github/workflows/global-run-stale.yaml'
+      - '.github/workflows/arc-update-runners-scheduled.yaml'
+      - '.github/workflows/validate-arc.yaml'
+      - '.github/workflows/arc-validate-chart.yaml'
+      - '.github/workflows/gha-validate-chart.yaml'
+      - '.github/workflows/arc-validate-runners.yaml'
+      - '.github/dependabot.yml'
+      - '.github/RELEASE_NOTE_TEMPLATE.md'
+      - 'runner/**'
+      - '.gitignore'
+      - 'PROJECT'
+      - 'LICENSE'
+      - 'Makefile'

 # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps
 permissions:
@@ -59,7 +59,6 @@ jobs:

      - name: Get Token
        id: get_workflow_token
-        # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
        with:
          application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
@@ -94,8 +93,7 @@ jobs:
        uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
-        # https://github.com/docker/login-action/releases/tag/v3.4.0
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -112,19 +110,16 @@ jobs:
          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Set up QEMU
-        # https://github.com/docker/setup-qemu-action/releases/tag/v3.6.0
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        # https://github.com/docker/setup-buildx-action/releases/tag/v3.10.0
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+        uses: docker/setup-buildx-action@v3
        with:
          version: latest

      # Unstable builds - run at your own risk
      - name: Build and Push
-        # https://github.com/docker/build-push-action/releases/tag/v6.15.0
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@@ -4,16 +4,16 @@ on:
    branches:
      - master
    paths:
-      - ".github/workflows/go.yaml"
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
+      - '.github/workflows/go.yaml'
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
  pull_request:
    paths:
-      - ".github/workflows/go.yaml"
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
+      - '.github/workflows/go.yaml'
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'

 permissions:
  contents: read
@@ -32,7 +32,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
          cache: false
      - name: fmt
        run: go fmt ./...
@@ -45,14 +45,13 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
          cache: false
      - name: golangci-lint
-        # https://github.com/golangci/golangci-lint-action/releases/tag/v7.0.0
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd
+        uses: golangci/golangci-lint-action@v6
        with:
          only-new-issues: true
-          version: v2.1.2
+          version: v1.55.2

  generate:
    runs-on: ubuntu-latest
@@ -60,7 +59,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
          cache: false
      - name: Generate
        run: make generate
@@ -73,7 +72,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
      - run: make manifests
      - name: Check diff
        run: git diff --exit-code
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,14 +1,19 @@
-version: "2"
 run:
-  timeout: 5m
-linters:
-  settings:
-    errcheck:
-      exclude-functions:
-        - (net/http.ResponseWriter).Write
-        - (*net/http.Server).Shutdown
-        - (*github.com/actions/actions-runner-controller/simulator.VisibleRunnerGroups).Add
-        - (*github.com/actions/actions-runner-controller/testing.Kind).Stop
-  exclusions:
-    presets:
-      - std-error-handling
+  timeout: 3m
+output:
+  formats:
+    - format: github-actions
+      path: stdout
+linters-settings:
+  errcheck:
+    exclude-functions:
+      - (net/http.ResponseWriter).Write
+      - (*net/http.Server).Shutdown
+      - (*github.com/actions/actions-runner-controller/simulator.VisibleRunnerGroups).Add
+      - (*github.com/actions/actions-runner-controller/testing.Kind).Stop
+issues:
+  exclude-rules:
+    - path: controllers/suite_test.go
+      linters:
+        - staticcheck
+      text: "SA1019"
--- a/4
+++ b/4
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.24.0 as builder
+FROM --platform=$BUILDPLATFORM golang:1.22.4 as builder

 WORKDIR /workspace

@@ -37,6 +37,7 @@ RUN --mount=target=. \
  --mount=type=cache,mode=0777,target=${GOCACHE} \
  export GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT#v} && \
  go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/manager main.go && \
+  go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/github-runnerscaleset-listener ./cmd/githubrunnerscalesetlistener && \
  go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/ghalistener ./cmd/ghalistener && \
  go build -trimpath -ldflags="-s -w" -o /out/github-webhook-server ./cmd/githubwebhookserver && \
  go build -trimpath -ldflags="-s -w" -o /out/actions-metrics-server ./cmd/actionsmetricsserver && \
@@ -51,6 +52,7 @@ WORKDIR /
 COPY --from=builder /out/manager .
 COPY --from=builder /out/github-webhook-server .
 COPY --from=builder /out/actions-metrics-server .
+COPY --from=builder /out/github-runnerscaleset-listener .
 COPY --from=builder /out/ghalistener .
 COPY --from=builder /out/sleep .

--- a/16
+++ b/16
@@ -6,7 +6,7 @@ endif
 DOCKER_USER ?= $(shell echo ${DOCKER_IMAGE_NAME} | cut -d / -f1)
 VERSION ?= dev
 COMMIT_SHA = $(shell git rev-parse HEAD)
-RUNNER_VERSION ?= 2.323.0
+RUNNER_VERSION ?= 2.319.1
 TARGETPLATFORM ?= $(shell arch)
 RUNNER_NAME ?= ${DOCKER_USER}/actions-runner
 RUNNER_TAG  ?= ${VERSION}
@@ -20,10 +20,10 @@ KUBECONTEXT ?= kind-acceptance
 CLUSTER ?= acceptance
 CERT_MANAGER_VERSION ?= v1.1.1
 KUBE_RBAC_PROXY_VERSION ?= v0.11.0
-SHELLCHECK_VERSION ?= 0.10.0
+SHELLCHECK_VERSION ?= 0.8.0

 # Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
-CRD_OPTIONS ?= "crd:generateEmbeddedObjectMeta=true,allowDangerousTypes=true"
+CRD_OPTIONS ?= "crd:generateEmbeddedObjectMeta=true"

 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -68,7 +68,7 @@ endif
 all: manager

 lint:
-	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v2.1.2 golangci-lint run
+	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v1.57.2 golangci-lint run

 GO_TEST_ARGS ?= -short

@@ -87,7 +87,7 @@ test-with-deps: kube-apiserver etcd kubectl
 # Build manager binary
 manager: generate fmt vet
 	go build -o bin/manager main.go
-	go build -o bin/github-runnerscaleset-listener ./cmd/ghalistener
+	go build -o bin/github-runnerscaleset-listener ./cmd/githubrunnerscalesetlistener

 # Run against the configured Kubernetes cluster in ~/.kube/config
 run: generate fmt vet manifests
@@ -204,7 +204,7 @@ generate: controller-gen

 # Run shellcheck on runner scripts
 shellcheck: shellcheck-install
-	$(TOOLS_PATH)/shellcheck --shell bash --source-path runner runner/*.sh runner/update-status hack/*.sh
+	$(TOOLS_PATH)/shellcheck --shell bash --source-path runner runner/*.sh hack/*.sh

 docker-buildx:
 	export DOCKER_CLI_EXPERIMENTAL=enabled ;\
@@ -310,7 +310,7 @@ github-release: release
 # Otherwise we get errors like the below:
 #   Error: failed to install CRD crds/actions.summerwind.dev_runnersets.yaml: CustomResourceDefinition.apiextensions.k8s.io "runnersets.actions.summerwind.dev" is invalid: [spec.validation.openAPIV3Schema.properties[spec].properties[template].properties[spec].properties[containers].items.properties[ports].items.properties[protocol].default: Required value: this property is in x-kubernetes-list-map-keys, so it must have a default or be a required property, spec.validation.openAPIV3Schema.properties[spec].properties[template].properties[spec].properties[initContainers].items.properties[ports].items.properties[protocol].default: Required value: this property is in x-kubernetes-list-map-keys, so it must have a default or be a required property]
 #
-# Note that controller-gen newer than 0.7.0 is needed due to https://github.com/kubernetes-sigs/controller-tools/issues/448
+# Note that controller-gen newer than 0.6.1 is needed due to https://github.com/kubernetes-sigs/controller-tools/issues/448
 # Otherwise ObjectMeta embedded in Spec results in empty on the storage.
 controller-gen:
 ifeq (, $(shell which controller-gen))
@@ -320,7 +320,7 @@ ifeq (, $(wildcard $(GOBIN)/controller-gen))
 	CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\
 	cd $$CONTROLLER_GEN_TMP_DIR ;\
 	go mod init tmp ;\
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.17.2 ;\
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0 ;\
 	rm -rf $$CONTROLLER_GEN_TMP_DIR ;\
 	}
 endif
--- a/README.md
+++ b/README.md
@@ -11,22 +11,21 @@ Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates and s
 With ARC, you can create runner scale sets that automatically scale based on the number of workflows running in your repository, organization, or enterprise. Because controlled runners can be ephemeral and based on containers, new runner instances can scale up or down rapidly and cleanly. For more information about autoscaling, see ["Autoscaling with self-hosted runners."](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners)

 You can set up ARC on Kubernetes using Helm, then create and run a workflow that uses runner scale sets. For more information about runner scale sets, see ["Deploying runner scale sets with Actions Runner Controller."](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/deploying-runner-scale-sets-with-actions-runner-controller#runner-scale-set)
-
 ## People

 Actions Runner Controller (ARC) is an open-source project currently developed and maintained in collaboration with the GitHub Actions team, external maintainers @mumoshu and @toast-gear, various [contributors](https://github.com/actions/actions-runner-controller/graphs/contributors), and the [awesome community](https://github.com/actions/actions-runner-controller/discussions).

 If you think the project is awesome and is adding value to your business, please consider directly sponsoring [community maintainers](https://github.com/sponsors/actions-runner-controller) and individual contributors via GitHub Sponsors.

-If you are already the employer of one of the contributors, sponsoring via GitHub Sponsors might not be an option. Just support them by other means!
+In case you are already the employer of one of contributors, sponsoring via GitHub Sponsors might not be an option. Just support them in other means!

 See [the sponsorship dashboard](https://github.com/sponsors/actions-runner-controller) for the former and the current sponsors.

 ## Getting Started

-To give ARC a try with just a handful of commands, please refer to the [Quickstart guide](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/quickstart-for-actions-runner-controller).
+To give ARC a try with just a handful of commands, Please refer to the [Quickstart guide](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/quickstart-for-actions-runner-controller).

-For an overview of ARC, please refer to [About ARC](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller).
+For an overview of ARC, please refer to [About ARC](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller)

 With the introduction of [autoscaling runner scale sets](https://github.com/actions/actions-runner-controller/discussions/2775), the existing [autoscaling modes](./docs/automatically-scaling-runners.md) are now legacy. The legacy modes have certain use cases and will continue to be maintained by the community only.

@@ -38,7 +37,7 @@ ARC documentation is available on [docs.github.com](https://docs.github.com/en/a

 ### Legacy documentation

-The following documentation is for the legacy autoscaling modes that continue to be maintained by the community:
+The following documentation is for the legacy autoscaling modes that continue to be maintained by the community

 - [Quickstart guide](/docs/quickstart.md)
 - [About ARC](/docs/about-arc.md)
--- a/acceptance/pipelines/eks-integration-tests.yaml
+++ b/acceptance/pipelines/eks-integration-tests.yaml
@@ -5,23 +5,22 @@ on:

 env:
  IRSA_ROLE_ARN:
-  ASSUME_ROLE_ARN:
-  AWS_REGION:
+  ASSUME_ROLE_ARN: 
+  AWS_REGION: 

 jobs:
  assume-role-in-runner-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
    steps:
      - name: Test aws-actions/configure-aws-credentials Action
-        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
+        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ env.ASSUME_ROLE_ARN }}
          role-duration-seconds: 900
  assume-role-in-container-test:
-    runs-on: ["self-hosted", "Linux"]
-    container:
+    runs-on: ['self-hosted', 'Linux']
+    container: 
      image: amazon/aws-cli
      env:
        AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
@@ -30,8 +29,7 @@ jobs:
        - /var/run/secrets/eks.amazonaws.com/serviceaccount/token:/var/run/secrets/eks.amazonaws.com/serviceaccount/token
    steps:
      - name: Test aws-actions/configure-aws-credentials Action in container
-        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
+        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ env.ASSUME_ROLE_ARN }}
--- a/acceptance/pipelines/runner-integration-tests.yaml
+++ b/acceptance/pipelines/runner-integration-tests.yaml
@@ -8,8 +8,8 @@ env:

 jobs:
  run-step-in-container-test:
-    runs-on: ["self-hosted", "Linux"]
-    container:
+    runs-on: ['self-hosted', 'Linux']
+    container: 
      image: alpine
    steps:
      - name: Test we are working in the container
@@ -21,7 +21,7 @@ jobs:
              exit 1
          fi
  setup-python-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
    steps:
      - name: Print native Python environment
        run: |
@@ -41,12 +41,12 @@ jobs:
            echo "Python version detected : $(python --version 2>&1)"
          fi
  setup-node-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
    steps:
      - uses: actions/setup-node@v2
        with:
-          node-version: "12"
-      - name: Test actions/setup-node works
+          node-version: '12'
+      - name: Test actions/setup-node works 
        run: |
          VERSION=$(node --version | cut -c 2- | cut -d '.' -f1)
          if [[ $VERSION != '12' ]]; then
@@ -57,14 +57,13 @@ jobs:
            echo "Node version detected : $(node --version 2>&1)"
          fi
  setup-ruby-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
    steps:
-      # https://github.com/ruby/setup-ruby/releases/tag/v1.227.0
-      - uses: ruby/setup-ruby@1a615958ad9d422dd932dc1d5823942ee002799f
+      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.0
          bundler-cache: true
-      - name: Test ruby/setup-ruby works
+      - name: Test ruby/setup-ruby works 
        run: |
          VERSION=$(ruby --version | cut -d ' ' -f2 | cut -d '.' -f1-2)
          if [[ $VERSION != '3.0' ]]; then
@@ -75,8 +74,8 @@ jobs:
              echo "Ruby version detected : $(ruby --version 2>&1)"
          fi
  python-shell-test:
-    runs-on: ["self-hosted", "Linux"]
-    steps:
+    runs-on: ['self-hosted', 'Linux']
+    steps:      
      - name: Test Python shell works
        run: |
          import os
--- a/apis/actions.github.com/v1alpha1/autoscalinglistener_types.go
+++ b/apis/actions.github.com/v1alpha1/autoscalinglistener_types.go
@@ -61,9 +61,6 @@ type AutoscalingListenerSpec struct {
 	// +optional
 	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`

-	// +optional
-	Metrics *MetricsConfig `json:"metrics,omitempty"`
-
 	// +optional
 	Template *corev1.PodTemplateSpec `json:"template,omitempty"`
 }
@@ -71,11 +68,11 @@ type AutoscalingListenerSpec struct {
 // AutoscalingListenerStatus defines the observed state of AutoscalingListener
 type AutoscalingListenerStatus struct{}

-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:JSONPath=".spec.githubConfigUrl",name=GitHub Configure URL,type=string
-// +kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetNamespace",name=AutoscalingRunnerSet Namespace,type=string
-// +kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetName",name=AutoscalingRunnerSet Name,type=string
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:printcolumn:JSONPath=".spec.githubConfigUrl",name=GitHub Configure URL,type=string
+//+kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetNamespace",name=AutoscalingRunnerSet Namespace,type=string
+//+kubebuilder:printcolumn:JSONPath=".spec.autoscalingRunnerSetName",name=AutoscalingRunnerSet Name,type=string

 // AutoscalingListener is the Schema for the autoscalinglisteners API
 type AutoscalingListener struct {
@@ -86,7 +83,7 @@ type AutoscalingListener struct {
 	Status AutoscalingListenerStatus `json:"status,omitempty"`
 }

-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true

 // AutoscalingListenerList contains a list of AutoscalingListener
 type AutoscalingListenerList struct {
--- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go
+++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go
@@ -31,16 +31,16 @@ import (

 // NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.

-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.state",name=State,type=string
-// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.state",name=State,type=string
+//+kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer

 // AutoscalingRunnerSet is the Schema for the autoscalingrunnersets API
 type AutoscalingRunnerSet struct {
@@ -74,9 +74,6 @@ type AutoscalingRunnerSetSpec struct {
 	// Required
 	Template corev1.PodTemplateSpec `json:"template,omitempty"`

-	// +optional
-	ListenerMetrics *MetricsConfig `json:"listenerMetrics,omitempty"`
-
 	// +optional
 	ListenerTemplate *corev1.PodTemplateSpec `json:"listenerTemplate,omitempty"`

@@ -235,32 +232,6 @@ type ProxyServerConfig struct {
 	CredentialSecretRef string `json:"credentialSecretRef,omitempty"`
 }

-// MetricsConfig holds configuration parameters for each metric type
-type MetricsConfig struct {
-	// +optional
-	Counters map[string]*CounterMetric `json:"counters,omitempty"`
-	// +optional
-	Gauges map[string]*GaugeMetric `json:"gauges,omitempty"`
-	// +optional
-	Histograms map[string]*HistogramMetric `json:"histograms,omitempty"`
-}
-
-// CounterMetric holds configuration of a single metric of type Counter
-type CounterMetric struct {
-	Labels []string `json:"labels"`
-}
-
-// GaugeMetric holds configuration of a single metric of type Gauge
-type GaugeMetric struct {
-	Labels []string `json:"labels"`
-}
-
-// HistogramMetric holds configuration of a single metric of type Histogram
-type HistogramMetric struct {
-	Labels  []string  `json:"labels"`
-	Buckets []float64 `json:"buckets,omitempty"`
-}
-
 // AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet
 type AutoscalingRunnerSetStatus struct {
 	// +optional
@@ -271,7 +242,7 @@ type AutoscalingRunnerSetStatus struct {

 	// EphemeralRunner counts separated by the stage ephemeral runners are in, taken from the EphemeralRunnerSet

-	// +optional
+	//+optional
 	PendingEphemeralRunners int `json:"pendingEphemeralRunners"`
 	// +optional
 	RunningEphemeralRunners int `json:"runningEphemeralRunners"`
@@ -307,7 +278,7 @@ func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 	return hash.ComputeTemplateHash(&spec)
 }

-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true

 // AutoscalingRunnerSetList contains a list of AutoscalingRunnerSet
 type AutoscalingRunnerSetList struct {
--- a/apis/actions.github.com/v1alpha1/ephemeralrunner_types.go
+++ b/apis/actions.github.com/v1alpha1/ephemeralrunner_types.go
@@ -21,12 +21,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )

-// EphemeralRunnerContainerName is the name of the runner container.
-// It represents the name of the container running the self-hosted runner image.
-const EphemeralRunnerContainerName = "runner"
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
 // +kubebuilder:printcolumn:JSONPath=".spec.githubConfigUrl",name="GitHub Config URL",type=string
 // +kubebuilder:printcolumn:JSONPath=".status.runnerId",name=RunnerId,type=number
 // +kubebuilder:printcolumn:JSONPath=".status.phase",name=Status,type=string
@@ -50,25 +46,11 @@ func (er *EphemeralRunner) IsDone() bool {
 	return er.Status.Phase == corev1.PodSucceeded || er.Status.Phase == corev1.PodFailed
 }

-func (er *EphemeralRunner) HasContainerHookConfigured() bool {
-	for i := range er.Spec.Spec.Containers {
-		if er.Spec.Spec.Containers[i].Name != EphemeralRunnerContainerName {
-			continue
-		}
-
-		for _, env := range er.Spec.Spec.Containers[i].Env {
-			if env.Name == "ACTIONS_RUNNER_CONTAINER_HOOKS" {
-				return true
-			}
-		}
-
-		return false
-	}
-	return false
-}
-
 // EphemeralRunnerSpec defines the desired state of EphemeralRunner
 type EphemeralRunnerSpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
 	// +required
 	GitHubConfigUrl string `json:"githubConfigUrl,omitempty"`

@@ -87,11 +69,15 @@ type EphemeralRunnerSpec struct {
 	// +optional
 	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`

+	// +required
 	corev1.PodTemplateSpec `json:",inline"`
 }

 // EphemeralRunnerStatus defines the observed state of EphemeralRunner
 type EphemeralRunnerStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
 	// Turns true only if the runner is online.
 	// +optional
 	Ready bool `json:"ready"`
@@ -137,7 +123,7 @@ type EphemeralRunnerStatus struct {
 	JobDisplayName string `json:"jobDisplayName,omitempty"`
 }

-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true

 // EphemeralRunnerList contains a list of EphemeralRunner
 type EphemeralRunnerList struct {
--- a/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go
+++ b/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go
@@ -26,7 +26,7 @@ type EphemeralRunnerSetSpec struct {
 	Replicas int `json:"replicas,omitempty"`
 	// PatchID is the unique identifier for the patch issued by the listener app
 	PatchID int `json:"patchID"`
-	// EphemeralRunnerSpec is the spec of the ephemeral runner
+
 	EphemeralRunnerSpec EphemeralRunnerSpec `json:"ephemeralRunnerSpec,omitempty"`
 }

@@ -34,6 +34,9 @@ type EphemeralRunnerSetSpec struct {
 type EphemeralRunnerSetStatus struct {
 	// CurrentReplicas is the number of currently running EphemeralRunner resources being managed by this EphemeralRunnerSet.
 	CurrentReplicas int `json:"currentReplicas"`
+
+	// EphemeralRunner counts separated by the stage ephemeral runners are in
+
 	// +optional
 	PendingEphemeralRunners int `json:"pendingEphemeralRunners"`
 	// +optional
@@ -46,10 +49,10 @@ type EphemeralRunnerSetStatus struct {
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:JSONPath=".spec.replicas",name="DesiredReplicas",type="integer"
 // +kubebuilder:printcolumn:JSONPath=".status.currentReplicas", name="CurrentReplicas",type="integer"
-// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
-// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer
+//+kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer

 // EphemeralRunnerSet is the Schema for the ephemeralrunnersets API
 type EphemeralRunnerSet struct {
@@ -60,7 +63,7 @@ type EphemeralRunnerSet struct {
 	Status EphemeralRunnerSetStatus `json:"status,omitempty"`
 }

-// +kubebuilder:object:root=true
+//+kubebuilder:object:root=true

 // EphemeralRunnerSetList contains a list of EphemeralRunnerSet
 type EphemeralRunnerSetList struct {
--- a/apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go
@@ -102,11 +102,6 @@ func (in *AutoscalingListenerSpec) DeepCopyInto(out *AutoscalingListenerSpec) {
 		*out = new(GitHubServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Metrics != nil {
-		in, out := &in.Metrics, &out.Metrics
-		*out = new(MetricsConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.Template != nil {
 		in, out := &in.Template, &out.Template
 		*out = new(v1.PodTemplateSpec)
@@ -212,11 +207,6 @@ func (in *AutoscalingRunnerSetSpec) DeepCopyInto(out *AutoscalingRunnerSetSpec)
 		(*in).DeepCopyInto(*out)
 	}
 	in.Template.DeepCopyInto(&out.Template)
-	if in.ListenerMetrics != nil {
-		in, out := &in.ListenerMetrics, &out.ListenerMetrics
-		*out = new(MetricsConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.ListenerTemplate != nil {
 		in, out := &in.ListenerTemplate, &out.ListenerTemplate
 		*out = new(v1.PodTemplateSpec)
@@ -259,26 +249,6 @@ func (in *AutoscalingRunnerSetStatus) DeepCopy() *AutoscalingRunnerSetStatus {
 	return out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CounterMetric) DeepCopyInto(out *CounterMetric) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CounterMetric.
-func (in *CounterMetric) DeepCopy() *CounterMetric {
-	if in == nil {
-		return nil
-	}
-	out := new(CounterMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *EphemeralRunner) DeepCopyInto(out *EphemeralRunner) {
 	*out = *in
@@ -476,26 +446,6 @@ func (in *EphemeralRunnerStatus) DeepCopy() *EphemeralRunnerStatus {
 	return out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GaugeMetric) DeepCopyInto(out *GaugeMetric) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GaugeMetric.
-func (in *GaugeMetric) DeepCopy() *GaugeMetric {
-	if in == nil {
-		return nil
-	}
-	out := new(GaugeMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GitHubServerTLSConfig) DeepCopyInto(out *GitHubServerTLSConfig) {
 	*out = *in
@@ -516,94 +466,6 @@ func (in *GitHubServerTLSConfig) DeepCopy() *GitHubServerTLSConfig {
 	return out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HistogramMetric) DeepCopyInto(out *HistogramMetric) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Buckets != nil {
-		in, out := &in.Buckets, &out.Buckets
-		*out = make([]float64, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HistogramMetric.
-func (in *HistogramMetric) DeepCopy() *HistogramMetric {
-	if in == nil {
-		return nil
-	}
-	out := new(HistogramMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *MetricsConfig) DeepCopyInto(out *MetricsConfig) {
-	*out = *in
-	if in.Counters != nil {
-		in, out := &in.Counters, &out.Counters
-		*out = make(map[string]*CounterMetric, len(*in))
-		for key, val := range *in {
-			var outVal *CounterMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(CounterMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-	if in.Gauges != nil {
-		in, out := &in.Gauges, &out.Gauges
-		*out = make(map[string]*GaugeMetric, len(*in))
-		for key, val := range *in {
-			var outVal *GaugeMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(GaugeMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-	if in.Histograms != nil {
-		in, out := &in.Histograms, &out.Histograms
-		*out = make(map[string]*HistogramMetric, len(*in))
-		for key, val := range *in {
-			var outVal *HistogramMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(HistogramMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricsConfig.
-func (in *MetricsConfig) DeepCopy() *MetricsConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(MetricsConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ProxyConfig) DeepCopyInto(out *ProxyConfig) {
 	*out = *in
--- a/apis/actions.summerwind.net/v1alpha1/runner_types.go
+++ b/apis/actions.summerwind.net/v1alpha1/runner_types.go
@@ -215,10 +215,10 @@ func (rs *RunnerSpec) validateRepository() error {
 		foundCount += 1
 	}
 	if foundCount == 0 {
-		return errors.New("spec needs enterprise, organization or repository")
+		return errors.New("Spec needs enterprise, organization or repository")
 	}
 	if foundCount > 1 {
-		return errors.New("spec cannot have many fields defined enterprise, organization and repository")
+		return errors.New("Spec cannot have many fields defined enterprise, organization and repository")
 	}

 	return nil
@@ -317,19 +317,19 @@ type RunnerStatusRegistration struct {
 type WorkVolumeClaimTemplate struct {
 	StorageClassName string                              `json:"storageClassName"`
 	AccessModes      []corev1.PersistentVolumeAccessMode `json:"accessModes"`
-	Resources        corev1.VolumeResourceRequirements   `json:"resources"`
+	Resources        corev1.ResourceRequirements         `json:"resources"`
 }

 func (w *WorkVolumeClaimTemplate) validate() error {
-	if len(w.AccessModes) == 0 {
-		return errors.New("access mode should have at least one mode specified")
+	if w.AccessModes == nil || len(w.AccessModes) == 0 {
+		return errors.New("Access mode should have at least one mode specified")
 	}

 	for _, accessMode := range w.AccessModes {
 		switch accessMode {
 		case corev1.ReadWriteOnce, corev1.ReadWriteMany:
 		default:
-			return fmt.Errorf("access mode %v is not supported", accessMode)
+			return fmt.Errorf("Access mode %v is not supported", accessMode)
 		}
 	}
 	return nil
--- a/apis/actions.summerwind.net/v1alpha1/runner_webhook.go
+++ b/apis/actions.summerwind.net/v1alpha1/runner_webhook.go
@@ -17,9 +17,6 @@ limitations under the License.
 package v1alpha1

 import (
-	"context"
-	"fmt"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
@@ -35,51 +32,36 @@ var runnerLog = logf.Log.WithName("runner-resource")
 func (r *Runner) SetupWebhookWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewWebhookManagedBy(mgr).
 		For(r).
-		WithDefaulter(&RunnerDefaulter{}).
-		WithValidator(&RunnerValidator{}).
 		Complete()
 }

 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runner,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runners,versions=v1alpha1,name=mutate.runner.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1

-var _ webhook.CustomDefaulter = &RunnerDefaulter{}
-
-type RunnerDefaulter struct{}
+var _ webhook.Defaulter = &Runner{}

 // Default implements webhook.Defaulter so a webhook will be registered for the type
-func (*RunnerDefaulter) Default(ctx context.Context, obj runtime.Object) error {
+func (r *Runner) Default() {
 	// Nothing to do.
-	return nil
 }

 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runner,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runners,versions=v1alpha1,name=validate.runner.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1

-var _ webhook.CustomValidator = &RunnerValidator{}
-
-type RunnerValidator struct{}
+var _ webhook.Validator = &Runner{}

 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
-	r, ok := obj.(*Runner)
-	if !ok {
-		return nil, fmt.Errorf("expected Runner object, got %T", obj)
-	}
+func (r *Runner) ValidateCreate() (admission.Warnings, error) {
 	runnerLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }

 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateUpdate(ctx context.Context, old, obj runtime.Object) (admission.Warnings, error) {
-	r, ok := obj.(*Runner)
-	if !ok {
-		return nil, fmt.Errorf("expected Runner object, got %T", obj)
-	}
+func (r *Runner) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }

 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
+func (r *Runner) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }

--- a/apis/actions.summerwind.net/v1alpha1/runnerdeployment_webhook.go
+++ b/apis/actions.summerwind.net/v1alpha1/runnerdeployment_webhook.go
@@ -17,9 +17,6 @@ limitations under the License.
 package v1alpha1

 import (
-	"context"
-	"fmt"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
@@ -35,51 +32,36 @@ var runnerDeploymentLog = logf.Log.WithName("runnerdeployment-resource")
 func (r *RunnerDeployment) SetupWebhookWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewWebhookManagedBy(mgr).
 		For(r).
-		WithDefaulter(&RunnerDeploymentDefaulter{}).
-		WithValidator(&RunnerDeploymentValidator{}).
 		Complete()
 }

 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runnerdeployment,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerdeployments,versions=v1alpha1,name=mutate.runnerdeployment.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1

-var _ webhook.CustomDefaulter = &RunnerDeploymentDefaulter{}
-
-type RunnerDeploymentDefaulter struct{}
+var _ webhook.Defaulter = &RunnerDeployment{}

 // Default implements webhook.Defaulter so a webhook will be registered for the type
-func (*RunnerDeploymentDefaulter) Default(context.Context, runtime.Object) error {
+func (r *RunnerDeployment) Default() {
 	// Nothing to do.
-	return nil
 }

 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runnerdeployment,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerdeployments,versions=v1alpha1,name=validate.runnerdeployment.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1

-var _ webhook.CustomValidator = &RunnerDeploymentValidator{}
-
-type RunnerDeploymentValidator struct{}
+var _ webhook.Validator = &RunnerDeployment{}

 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
-	r, ok := obj.(*RunnerDeployment)
-	if !ok {
-		return nil, fmt.Errorf("expected RunnerDeployment object, got %T", obj)
-	}
+func (r *RunnerDeployment) ValidateCreate() (admission.Warnings, error) {
 	runnerDeploymentLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }

 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateUpdate(ctx context.Context, old, obj runtime.Object) (admission.Warnings, error) {
-	r, ok := obj.(*RunnerDeployment)
-	if !ok {
-		return nil, fmt.Errorf("expected RunnerDeployment object, got %T", obj)
-	}
+func (r *RunnerDeployment) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerDeploymentLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }

 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateDelete(context.Context, runtime.Object) (admission.Warnings, error) {
+func (r *RunnerDeployment) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }

--- a/apis/actions.summerwind.net/v1alpha1/runnerreplicaset_webhook.go
+++ b/apis/actions.summerwind.net/v1alpha1/runnerreplicaset_webhook.go
@@ -17,9 +17,6 @@ limitations under the License.
 package v1alpha1

 import (
-	"context"
-	"fmt"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
@@ -35,51 +32,36 @@ var runnerReplicaSetLog = logf.Log.WithName("runnerreplicaset-resource")
 func (r *RunnerReplicaSet) SetupWebhookWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewWebhookManagedBy(mgr).
 		For(r).
-		WithDefaulter(&RunnerReplicaSetDefaulter{}).
-		WithValidator(&RunnerReplicaSetValidator{}).
 		Complete()
 }

 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runnerreplicaset,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerreplicasets,versions=v1alpha1,name=mutate.runnerreplicaset.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1

-var _ webhook.CustomDefaulter = &RunnerReplicaSetDefaulter{}
-
-type RunnerReplicaSetDefaulter struct{}
+var _ webhook.Defaulter = &RunnerReplicaSet{}

 // Default implements webhook.Defaulter so a webhook will be registered for the type
-func (*RunnerReplicaSetDefaulter) Default(context.Context, runtime.Object) error {
+func (r *RunnerReplicaSet) Default() {
 	// Nothing to do.
-	return nil
 }

 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runnerreplicaset,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerreplicasets,versions=v1alpha1,name=validate.runnerreplicaset.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1

-var _ webhook.CustomValidator = &RunnerReplicaSetValidator{}
-
-type RunnerReplicaSetValidator struct{}
+var _ webhook.Validator = &RunnerReplicaSet{}

 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
-	r, ok := obj.(*RunnerReplicaSet)
-	if !ok {
-		return nil, fmt.Errorf("expected RunnerReplicaSet object, got %T", obj)
-	}
+func (r *RunnerReplicaSet) ValidateCreate() (admission.Warnings, error) {
 	runnerReplicaSetLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }

 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateUpdate(ctx context.Context, old, obj runtime.Object) (admission.Warnings, error) {
-	r, ok := obj.(*RunnerReplicaSet)
-	if !ok {
-		return nil, fmt.Errorf("expected RunnerReplicaSet object, got %T", obj)
-	}
+func (r *RunnerReplicaSet) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerReplicaSetLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }

 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateDelete(context.Context, runtime.Object) (admission.Warnings, error) {
+func (r *RunnerReplicaSet) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }

--- a/apis/actions.summerwind.net/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/actions.summerwind.net/v1alpha1/zz_generated.deepcopy.go
@@ -467,21 +467,6 @@ func (in *RunnerConfig) DeepCopy() *RunnerConfig {
 	return out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDefaulter) DeepCopyInto(out *RunnerDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDefaulter.
-func (in *RunnerDefaulter) DeepCopy() *RunnerDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerDeployment) DeepCopyInto(out *RunnerDeployment) {
 	*out = *in
@@ -509,21 +494,6 @@ func (in *RunnerDeployment) DeepCopyObject() runtime.Object {
 	return nil
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDeploymentDefaulter) DeepCopyInto(out *RunnerDeploymentDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDeploymentDefaulter.
-func (in *RunnerDeploymentDefaulter) DeepCopy() *RunnerDeploymentDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDeploymentDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerDeploymentList) DeepCopyInto(out *RunnerDeploymentList) {
 	*out = *in
@@ -626,21 +596,6 @@ func (in *RunnerDeploymentStatus) DeepCopy() *RunnerDeploymentStatus {
 	return out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDeploymentValidator) DeepCopyInto(out *RunnerDeploymentValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDeploymentValidator.
-func (in *RunnerDeploymentValidator) DeepCopy() *RunnerDeploymentValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDeploymentValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerList) DeepCopyInto(out *RunnerList) {
 	*out = *in
@@ -860,21 +815,6 @@ func (in *RunnerReplicaSet) DeepCopyObject() runtime.Object {
 	return nil
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerReplicaSetDefaulter) DeepCopyInto(out *RunnerReplicaSetDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerReplicaSetDefaulter.
-func (in *RunnerReplicaSetDefaulter) DeepCopy() *RunnerReplicaSetDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerReplicaSetDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerReplicaSetList) DeepCopyInto(out *RunnerReplicaSetList) {
 	*out = *in
@@ -967,21 +907,6 @@ func (in *RunnerReplicaSetStatus) DeepCopy() *RunnerReplicaSetStatus {
 	return out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerReplicaSetValidator) DeepCopyInto(out *RunnerReplicaSetValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerReplicaSetValidator.
-func (in *RunnerReplicaSetValidator) DeepCopy() *RunnerReplicaSetValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerReplicaSetValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerSet) DeepCopyInto(out *RunnerSet) {
 	*out = *in
@@ -1187,21 +1112,6 @@ func (in *RunnerTemplate) DeepCopy() *RunnerTemplate {
 	return out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerValidator) DeepCopyInto(out *RunnerValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerValidator.
-func (in *RunnerValidator) DeepCopy() *RunnerValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ScaleTargetRef) DeepCopyInto(out *ScaleTargetRef) {
 	*out = *in
--- a/charts/.ci/ct-config-gha.yaml
+++ b/charts/.ci/ct-config-gha.yaml
@@ -1,11 +1,9 @@
 # This file defines the config for "ct" (chart tester) used by the helm linting GitHub workflow
-remote: origin
-target-branch: master
 lint-conf: charts/.ci/lint-config.yaml
 chart-repos:
  - jetstack=https://charts.jetstack.io
 check-version-increment: false # Disable checking that the chart version has been bumped
 charts:
-  - charts/gha-runner-scale-set-controller
-  - charts/gha-runner-scale-set
+- charts/gha-runner-scale-set-controller
+- charts/gha-runner-scale-set
 skip-clean-up: true
--- a/charts/.ci/ct-config.yaml
+++ b/charts/.ci/ct-config.yaml
@@ -1,9 +1,7 @@
 # This file defines the config for "ct" (chart tester) used by the helm linting GitHub workflow
-remote: origin
-target-branch: master
 lint-conf: charts/.ci/lint-config.yaml
 chart-repos:
  - jetstack=https://charts.jetstack.io
 check-version-increment: false # Disable checking that the chart version has been bumped
 charts:
-  - charts/actions-runner-controller
+- charts/actions-runner-controller
--- a/charts/.ci/scripts/local-kube-score.sh
+++ b/charts/.ci/scripts/local-kube-score.sh
@@ -1,5 +1,6 @@
 #!/bin/bash

+
 for chart in `ls charts`;
 do
 helm template --values charts/$chart/ci/ci-values.yaml charts/$chart | kube-score score - \
@@ -11,4 +12,4 @@ helm template --values charts/$chart/ci/ci-values.yaml charts/$chart | kube-scor
    --enable-optional-test container-security-context-privileged \
    --enable-optional-test container-security-context-readonlyrootfilesystem \
    --ignore-test container-security-context
-done
+done
--- a/charts/actions-runner-controller/crds/actions.summerwind.dev_horizontalrunnerautoscalers.yaml
+++ b/charts/actions-runner-controller/crds/actions.summerwind.dev_horizontalrunnerautoscalers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.17.2
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: horizontalrunnerautoscalers.actions.summerwind.dev
 spec:
  group: actions.summerwind.dev
@@ -159,8 +159,10 @@ spec:
                    ScaleUpTriggers is an experimental feature to increase the desired replicas by 1
                    on each webhook requested received by the webhookBasedAutoscaler.

+
                    This feature requires you to also enable and deploy the webhookBasedAutoscaler onto your cluster.

+
                    Note that the added runners remain until the next sync period at least,
                    and they may or may not be used by GitHub Actions depending on the timing.
                    They are intended to be used to gain "resource slack" immediately after you
--- a/charts/actions-runner-controller/crds/actions.summerwind.dev_runnerdeployments.yaml
+++ b/charts/actions-runner-controller/crds/actions.summerwind.dev_runnerdeployments.yaml
--- a/charts/actions-runner-controller/crds/actions.summerwind.dev_runnerreplicasets.yaml
+++ b/charts/actions-runner-controller/crds/actions.summerwind.dev_runnerreplicasets.yaml
--- a/charts/actions-runner-controller/crds/actions.summerwind.dev_runners.yaml
+++ b/charts/actions-runner-controller/crds/actions.summerwind.dev_runners.yaml
--- a/charts/actions-runner-controller/crds/actions.summerwind.dev_runnersets.yaml
+++ b/charts/actions-runner-controller/crds/actions.summerwind.dev_runnersets.yaml
--- a/charts/actions-runner-controller/templates/NOTES.txt
+++ b/charts/actions-runner-controller/templates/NOTES.txt
@@ -6,17 +6,17 @@
  {{- end }}
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "actions-runner-controller.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "actions-runner-controller.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
  echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ include "actions-runner-controller.namespace" . }} svc -w {{ include "actions-runner-controller.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ include "actions-runner-controller.namespace" . }} {{ include "actions-runner-controller.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "actions-runner-controller.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "actions-runner-controller.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
  echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ include "actions-runner-controller.namespace" . }} -l "app.kubernetes.io/name={{ include "actions-runner-controller.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ include "actions-runner-controller.namespace" . }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "actions-runner-controller.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ include "actions-runner-controller.namespace" . }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
 {{- end }}
--- a/charts/actions-runner-controller/templates/_helpers.tpl
+++ b/charts/actions-runner-controller/templates/_helpers.tpl
@@ -1,14 +1,3 @@
-{{/*
-Allow overriding the namespace for the resources.
-*/}}
-{{- define "actions-runner-controller.namespace" -}}
-{{- if .Values.namespaceOverride }}
-  {{- .Values.namespaceOverride }}
-{{- else }}
-  {{- .Release.Namespace }}
-{{- end }}
-{{- end }}
-
 {{/*
 Expand the name of the chart.
 */}}
--- a/charts/actions-runner-controller/templates/actionsmetrics.deployment.yaml
+++ b/charts/actions-runner-controller/templates/actionsmetrics.deployment.yaml
@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: {{ include "actions-runner-controller-actions-metrics-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:
--- a/charts/actions-runner-controller/templates/actionsmetrics.ingress.yaml.yml
+++ b/charts/actions-runner-controller/templates/actionsmetrics.ingress.yaml.yml
@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: {{ $fullName }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  {{- with .Values.actionsMetricsServer.ingress.annotations }}
--- a/charts/actions-runner-controller/templates/actionsmetrics.role_binding.yaml
+++ b/charts/actions-runner-controller/templates/actionsmetrics.role_binding.yaml
@@ -10,5 +10,5 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: {{ include "actions-runner-controller-actions-metrics-server.serviceAccountName" . }}
-    namespace: {{ include "actions-runner-controller.namespace" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/actions-runner-controller/templates/actionsmetrics.secrets.yaml
+++ b/charts/actions-runner-controller/templates/actionsmetrics.secrets.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "actions-runner-controller-actions-metrics-server.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: Opaque
--- a/charts/actions-runner-controller/templates/actionsmetrics.service.yaml
+++ b/charts/actions-runner-controller/templates/actionsmetrics.service.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "actions-runner-controller-actions-metrics-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller-actions-metrics-server.selectorLabels" . | nindent 4 }}
 {{- if .Values.actionsMetricsServer.service.annotations }}
--- a/charts/actions-runner-controller/templates/actionsmetrics.serviceaccount.yaml.yml
+++ b/charts/actions-runner-controller/templates/actionsmetrics.serviceaccount.yaml.yml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "actions-runner-controller-actions-metrics-server.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  {{- with .Values.actionsMetricsServer.serviceAccount.annotations }}
--- a/charts/actions-runner-controller/templates/actionsmetrics.servicemonitor.yaml.yml
+++ b/charts/actions-runner-controller/templates/actionsmetrics.servicemonitor.yaml.yml
@@ -1,5 +1,5 @@
 {{- if and .Values.actionsMetricsServer.enabled .Values.actionsMetrics.serviceMonitor.enable }}
-{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default (include "actions-runner-controller.namespace" .) }}
+{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default .Release.Namespace }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
--- a/charts/actions-runner-controller/templates/auth_proxy_role_binding.yaml
+++ b/charts/actions-runner-controller/templates/auth_proxy_role_binding.yaml
@@ -10,5 +10,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/actions-runner-controller/templates/certificate.yaml
+++ b/charts/actions-runner-controller/templates/certificate.yaml
@@ -6,7 +6,7 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
  name: {{ include "actions-runner-controller.selfsignedIssuerName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
  selfSigned: {}
 ---
@@ -14,11 +14,11 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: {{ include "actions-runner-controller.servingCertName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
  dnsNames:
-  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ include "actions-runner-controller.namespace" . }}.svc
-  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ include "actions-runner-controller.namespace" . }}.svc.cluster.local
+  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ .Release.Namespace }}.svc
+  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ .Release.Namespace }}.svc.cluster.local
  issuerRef:
    kind: Issuer
    name: {{ include "actions-runner-controller.selfsignedIssuerName" . }}
--- a/charts/actions-runner-controller/templates/controller.metrics.service.yaml
+++ b/charts/actions-runner-controller/templates/controller.metrics.service.yaml
@@ -4,7 +4,7 @@ metadata:
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  name: {{ include "actions-runner-controller.metricsServiceName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  {{- with .Values.metrics.serviceAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
--- a/charts/actions-runner-controller/templates/controller.metrics.serviceMonitor.yaml
+++ b/charts/actions-runner-controller/templates/controller.metrics.serviceMonitor.yaml
@@ -8,7 +8,7 @@ metadata:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  name: {{ include "actions-runner-controller.serviceMonitorName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
  endpoints:
    - path: /metrics
--- a/charts/actions-runner-controller/templates/controller.pdb.yaml
+++ b/charts/actions-runner-controller/templates/controller.pdb.yaml
@@ -5,7 +5,7 @@ metadata:
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  name: {{ include "actions-runner-controller.pdbName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
  {{- if .Values.podDisruptionBudget.minAvailable }}
  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
--- a/charts/actions-runner-controller/templates/deployment.yaml
+++ b/charts/actions-runner-controller/templates/deployment.yaml
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: {{ include "actions-runner-controller.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:
@@ -56,7 +56,7 @@ spec:
        - "--docker-registry-mirror={{ .Values.dockerRegistryMirror }}"
        {{- end }}
        {{- if .Values.scope.singleNamespace }}
-        - "--watch-namespace={{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}"
+        - "--watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }}"
        {{- end }}
        {{- if .Values.logLevel }}
        - "--log-level={{ .Values.logLevel }}"
--- a/charts/actions-runner-controller/templates/githubwebhook.deployment.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.deployment.yaml
@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: {{ include "actions-runner-controller-github-webhook-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:
@@ -43,7 +43,7 @@ spec:
        - "--log-level={{ .Values.githubWebhookServer.logLevel }}"
        {{- end }}
        {{- if .Values.scope.singleNamespace }}
-        - "--watch-namespace={{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}"
+        - "--watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }}"
        {{- end }}
        {{- if .Values.runnerGithubURL  }}
        - "--runner-github-url={{ .Values.runnerGithubURL }}"
--- a/charts/actions-runner-controller/templates/githubwebhook.ingress.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.ingress.yaml
@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: {{ $fullName }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  {{- with .Values.githubWebhookServer.ingress.annotations }}
--- a/charts/actions-runner-controller/templates/githubwebhook.pdb.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.pdb.yaml
@@ -5,7 +5,7 @@ metadata:
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  name: {{ include "actions-runner-controller-github-webhook-server.pdbName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
  {{- if .Values.githubWebhookServer.podDisruptionBudget.minAvailable }}
  minAvailable: {{ .Values.githubWebhookServer.podDisruptionBudget.minAvailable }}
--- a/charts/actions-runner-controller/templates/githubwebhook.role_binding.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.role_binding.yaml
@@ -10,5 +10,5 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: {{ include "actions-runner-controller-github-webhook-server.serviceAccountName" . }}
-    namespace: {{ include "actions-runner-controller.namespace" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/actions-runner-controller/templates/githubwebhook.secrets.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.secrets.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "actions-runner-controller-github-webhook-server.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: Opaque
--- a/charts/actions-runner-controller/templates/githubwebhook.service.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.service.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "actions-runner-controller-github-webhook-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller-github-webhook-server.selectorLabels" . | nindent 4 }}
 {{- if .Values.githubWebhookServer.service.annotations }}
--- a/charts/actions-runner-controller/templates/githubwebhook.serviceMonitor.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.serviceMonitor.yaml
@@ -1,5 +1,5 @@
 {{- if and .Values.githubWebhookServer.enabled .Values.metrics.serviceMonitor.enable }}
-{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default (include "actions-runner-controller.namespace" .) }}
+{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default .Release.Namespace }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
--- a/charts/actions-runner-controller/templates/githubwebhook.serviceaccount.yaml
+++ b/charts/actions-runner-controller/templates/githubwebhook.serviceaccount.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "actions-runner-controller-github-webhook-server.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  {{- with .Values.githubWebhookServer.serviceAccount.annotations }}
--- a/charts/actions-runner-controller/templates/leader_election_role.yaml
+++ b/charts/actions-runner-controller/templates/leader_election_role.yaml
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "actions-runner-controller.leaderElectionRoleName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups:
  - ""
--- a/charts/actions-runner-controller/templates/leader_election_role_binding.yaml
+++ b/charts/actions-runner-controller/templates/leader_election_role_binding.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "actions-runner-controller.leaderElectionRoleName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -10,4 +10,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
--- a/charts/actions-runner-controller/templates/manager_role_binding.yaml
+++ b/charts/actions-runner-controller/templates/manager_role_binding.yaml
@@ -9,4 +9,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
--- a/charts/actions-runner-controller/templates/manager_role_binding_secrets.yaml
+++ b/charts/actions-runner-controller/templates/manager_role_binding_secrets.yaml
@@ -6,7 +6,7 @@ kind: ClusterRoleBinding
 {{- end }}
 metadata:
  name: {{ include "actions-runner-controller.managerRoleName" . }}-secrets
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  {{- if .Values.scope.singleNamespace }}
@@ -18,4 +18,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
--- a/charts/actions-runner-controller/templates/manager_secrets.yaml
+++ b/charts/actions-runner-controller/templates/manager_secrets.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "actions-runner-controller.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  {{- if .Values.authSecret.annotations }}
  annotations:
    {{ toYaml .Values.authSecret.annotations | nindent 4 }}
--- a/charts/actions-runner-controller/templates/serviceaccount.yaml
+++ b/charts/actions-runner-controller/templates/serviceaccount.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
--- a/charts/actions-runner-controller/templates/webhook_configs.yaml
+++ b/charts/actions-runner-controller/templates/webhook_configs.yaml
@@ -2,7 +2,7 @@
 We will use a self managed CA if one is not provided by cert-manager
 */}}
 {{- $ca := genCA "actions-runner-ca" 3650 }}
-{{- $cert := genSignedCert (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) (include "actions-runner-controller.namespace" .)) nil (list (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) (include "actions-runner-controller.namespace" .))) 3650 $ca }}
+{{- $cert := genSignedCert (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) .Release.Namespace) nil (list (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) .Release.Namespace)) 3650 $ca }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
@@ -11,7 +11,7 @@ metadata:
  name: {{ include "actions-runner-controller.fullname" . }}-mutating-webhook-configuration
  {{- if .Values.certManagerEnabled }}
  annotations:
-    cert-manager.io/inject-ca-from: {{ include "actions-runner-controller.namespace" . }}/{{ include "actions-runner-controller.servingCertName" . }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "actions-runner-controller.servingCertName" . }}
  {{- end }}
 webhooks:
 - admissionReviewVersions:
@@ -19,7 +19,7 @@ webhooks:
  {{- if .Values.scope.singleNamespace }}
  namespaceSelector:
    matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
  {{- end }}
  clientConfig:
    {{- if .Values.admissionWebHooks.caBundle }}
@@ -29,7 +29,7 @@ webhooks:
    {{- end }}
    service:
      name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
      path: /mutate-actions-summerwind-dev-v1alpha1-runner
  failurePolicy: Fail
  name: mutate.runner.actions.summerwind.dev
@@ -50,7 +50,7 @@ webhooks:
  {{- if .Values.scope.singleNamespace }}
  namespaceSelector:
    matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
  {{- end }}
  clientConfig:
    {{- if .Values.admissionWebHooks.caBundle }}
@@ -60,7 +60,7 @@ webhooks:
    {{- end }}
    service:
      name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
      path: /mutate-actions-summerwind-dev-v1alpha1-runnerdeployment
  failurePolicy: Fail
  name: mutate.runnerdeployment.actions.summerwind.dev
@@ -81,7 +81,7 @@ webhooks:
  {{- if .Values.scope.singleNamespace }}
  namespaceSelector:
    matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
  {{- end }}
  clientConfig:
    {{- if .Values.admissionWebHooks.caBundle }}
@@ -91,7 +91,7 @@ webhooks:
    {{- end }}
    service:
      name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
      path: /mutate-actions-summerwind-dev-v1alpha1-runnerreplicaset
  failurePolicy: Fail
  name: mutate.runnerreplicaset.actions.summerwind.dev
@@ -112,7 +112,7 @@ webhooks:
  {{- if .Values.scope.singleNamespace }}
  namespaceSelector:
    matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
  {{- end }}
  clientConfig:
    {{- if .Values.admissionWebHooks.caBundle }}
@@ -122,7 +122,7 @@ webhooks:
    {{- end }}
    service:
      name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
      path: /mutate-runner-set-pod
  failurePolicy: Fail
  name: mutate-runner-pod.webhook.actions.summerwind.dev
@@ -148,7 +148,7 @@ metadata:
  name: {{ include "actions-runner-controller.fullname" . }}-validating-webhook-configuration
  {{- if .Values.certManagerEnabled }}
  annotations:
-    cert-manager.io/inject-ca-from: {{ include "actions-runner-controller.namespace" . }}/{{ include "actions-runner-controller.servingCertName" . }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "actions-runner-controller.servingCertName" . }}
  {{- end }}
 webhooks:
 - admissionReviewVersions:
@@ -156,7 +156,7 @@ webhooks:
  {{- if .Values.scope.singleNamespace }}
  namespaceSelector:
    matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
  {{- end }}
  clientConfig:
    {{- if .Values.admissionWebHooks.caBundle }}
@@ -166,7 +166,7 @@ webhooks:
    {{- end }}
    service:
      name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
      path: /validate-actions-summerwind-dev-v1alpha1-runner
  failurePolicy: Fail
  name: validate.runner.actions.summerwind.dev
@@ -187,7 +187,7 @@ webhooks:
  {{- if .Values.scope.singleNamespace }}
  namespaceSelector:
    matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
  {{- end }}
  clientConfig:
    {{- if .Values.admissionWebHooks.caBundle }}
@@ -197,7 +197,7 @@ webhooks:
    {{- end }}
    service:
      name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
      path: /validate-actions-summerwind-dev-v1alpha1-runnerdeployment
  failurePolicy: Fail
  name: validate.runnerdeployment.actions.summerwind.dev
@@ -218,7 +218,7 @@ webhooks:
  {{- if .Values.scope.singleNamespace }}
  namespaceSelector:
    matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
  {{- end }}
  clientConfig:
    {{- if .Values.admissionWebHooks.caBundle }}
@@ -228,7 +228,7 @@ webhooks:
    {{- end }}
    service:
      name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
      path: /validate-actions-summerwind-dev-v1alpha1-runnerreplicaset
  failurePolicy: Fail
  name: validate.runnerreplicaset.actions.summerwind.dev
@@ -250,7 +250,7 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "actions-runner-controller.servingCertName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: kubernetes.io/tls
--- a/charts/actions-runner-controller/templates/webhook_service.yaml
+++ b/charts/actions-runner-controller/templates/webhook_service.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "actions-runner-controller.webhookServiceName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "actions-runner-controller.labels" . | nindent 4 }}
  {{- with .Values.service.annotations }}
--- a/charts/actions-runner-controller/values.yaml
+++ b/charts/actions-runner-controller/values.yaml
@@ -420,6 +420,3 @@ actionsMetricsServer:
    #      - chart-example.local
  terminationGracePeriodSeconds: 10
  lifecycle: {}
-
-# Add the option to deploy in another namespace rather than .Release.Namespace.
-namespaceOverride: ""
--- a/charts/gha-runner-scale-set-controller/Chart.yaml
+++ b/charts/gha-runner-scale-set-controller/Chart.yaml
@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.11.0
+version: 0.9.3

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.11.0"
+appVersion: "0.9.3"

 home: https://github.com/actions/actions-runner-controller

--- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml
+++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml
--- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml
+++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml
--- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml
+++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml
--- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml
+++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml
--- a/charts/gha-runner-scale-set-controller/templates/NOTES.txt
+++ b/charts/gha-runner-scale-set-controller/templates/NOTES.txt
@@ -1,3 +1,5 @@
 Thank you for installing {{ .Chart.Name }}.

 Your release is named {{ .Release.Name }}.
+
+WARNING: Older version of the listener (githubrunnerscalesetlistener) is deprecated and will be removed in the future gha-runner-scale-set-0.10.0 release. If you are using environment variable override to force the old listener, please remove the environment variable and use the new listener (ghalistener) instead.
--- a/charts/gha-runner-scale-set-controller/templates/_helpers.tpl
+++ b/charts/gha-runner-scale-set-controller/templates/_helpers.tpl
@@ -7,17 +7,6 @@ Expand the name of the chart.
 gha-rs-controller
 {{- end }}

-{{/*
-Allow overriding the namespace for the resources.
-*/}}
-{{- define "gha-runner-scale-set-controller.namespace" -}}
-{{- if .Values.namespaceOverride }}
-  {{- .Values.namespaceOverride }}
-{{- else }}
-  {{- .Release.Namespace }}
-{{- end }}
-{{- end }}
-
 {{- define "gha-runner-scale-set-controller.name" -}}
 {{- default (include "gha-base-name" .) .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
@@ -68,7 +57,7 @@ Selector labels
 */}}
 {{- define "gha-runner-scale-set-controller.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "gha-runner-scale-set-controller.name" . }}
-app.kubernetes.io/namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+app.kubernetes.io/namespace: {{ .Release.Namespace }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}

--- a/charts/gha-runner-scale-set-controller/templates/deployment.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/deployment.yaml
@@ -2,10 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: {{ include "gha-runner-scale-set-controller.fullname" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gha-runner-scale-set-controller.labels" . | nindent 4 }}
-    actions.github.com/controller-service-account-namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+    actions.github.com/controller-service-account-namespace: {{ .Release.Namespace }}
    actions.github.com/controller-service-account-name: {{ include "gha-runner-scale-set-controller.serviceAccountName" . }}
    {{- if .Values.flags.watchSingleNamespace }}
    actions.github.com/controller-watch-single-namespace: {{ .Values.flags.watchSingleNamespace }}
@@ -25,7 +25,7 @@ spec:
      labels:
        app.kubernetes.io/part-of: gha-rs-controller
        app.kubernetes.io/component: controller-manager
-        app.kubernetes.io/version: {{ .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+        app.kubernetes.io/version: {{ .Chart.Version }}
        {{- include "gha-runner-scale-set-controller.selectorLabels" . | nindent 8 }}
        {{- with .Values.podLabels }}
          {{- toYaml . | nindent 8 }}
@@ -65,9 +65,6 @@ spec:
        {{- with .Values.flags.watchSingleNamespace }}
        - "--watch-single-namespace={{ . }}"
        {{- end }}
-        {{- with .Values.flags.runnerMaxConcurrentReconciles }}
-        - "--runner-max-concurrent-reconciles={{ . }}"
-        {{- end }}
        {{- with .Values.flags.updateStrategy }}
        - "--update-strategy={{ . }}"
        {{- end }}
@@ -85,12 +82,6 @@ spec:
        {{- range .Values.flags.excludeLabelPropagationPrefixes }}
        - "--exclude-label-propagation-prefix={{ . }}"
        {{- end }}
-        {{- with .Values.flags.k8sClientRateLimiterQPS }}
-        - "--k8s-client-rate-limiter-qps={{ . }}"
-        {{- end }}
-        {{- with .Values.flags.k8sClientRateLimiterBurst }}
-        - "--k8s-client-rate-limiter-burst={{ . }}"
-        {{- end }}
        command:
        - "/manager"
        {{- with .Values.metrics }}
--- a/charts/gha-runner-scale-set-controller/templates/leader_election_role.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/leader_election_role.yaml
@@ -4,12 +4,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "gha-runner-scale-set-controller.leaderElectionRoleName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 rules:
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "watch", "list", "delete", "update", "create"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-{{- end }}
+{{- end }}
--- a/charts/gha-runner-scale-set-controller/templates/leader_election_role_binding.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/leader_election_role_binding.yaml
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "gha-runner-scale-set-controller.leaderElectionRoleBinding" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -11,5 +11,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "gha-runner-scale-set-controller.serviceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/gha-runner-scale-set-controller/templates/manager_cluster_role_binding.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/manager_cluster_role_binding.yaml
@@ -10,5 +10,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "gha-runner-scale-set-controller.serviceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/gha-runner-scale-set-controller/templates/manager_listener_role.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/manager_listener_role.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "gha-runner-scale-set-controller.managerListenerRoleName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups:
  - ""
--- a/charts/gha-runner-scale-set-controller/templates/manager_listener_role_binding.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/manager_listener_role_binding.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "gha-runner-scale-set-controller.managerListenerRoleBinding" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -10,4 +10,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "gha-runner-scale-set-controller.serviceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
--- a/charts/gha-runner-scale-set-controller/templates/manager_single_namespace_controller_role.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/manager_single_namespace_controller_role.yaml
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "gha-runner-scale-set-controller.managerSingleNamespaceRoleName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups:
  - actions.github.com
--- a/charts/gha-runner-scale-set-controller/templates/manager_single_namespace_controller_role_binding.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/manager_single_namespace_controller_role_binding.yaml
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "gha-runner-scale-set-controller.managerSingleNamespaceRoleBinding" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -11,5 +11,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "gha-runner-scale-set-controller.serviceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/gha-runner-scale-set-controller/templates/manager_single_namespace_watch_role_binding.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/manager_single_namespace_watch_role_binding.yaml
@@ -11,5 +11,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "gha-runner-scale-set-controller.serviceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/gha-runner-scale-set-controller/templates/serviceaccount.yaml
+++ b/charts/gha-runner-scale-set-controller/templates/serviceaccount.yaml
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "gha-runner-scale-set-controller.serviceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gha-runner-scale-set-controller.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
--- a/charts/gha-runner-scale-set-controller/tests/template_test.go
+++ b/charts/gha-runner-scale-set-controller/tests/template_test.go
@@ -17,7 +17,6 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )

 type Chart struct {
@@ -367,7 +366,6 @@ func TestTemplate_ControllerDeployment_Defaults(t *testing.T) {
 		"--metrics-addr=0",
 		"--listener-metrics-addr=0",
 		"--listener-metrics-endpoint=",
-		"--runner-max-concurrent-reconciles=2",
 	}
 	assert.ElementsMatch(t, expectedArgs, deployment.Spec.Template.Spec.Containers[0].Args)

@@ -520,7 +518,6 @@ func TestTemplate_ControllerDeployment_Customize(t *testing.T) {
 		"--listener-metrics-addr=0",
 		"--listener-metrics-endpoint=",
 		"--metrics-addr=0",
-		"--runner-max-concurrent-reconciles=2",
 	}

 	assert.ElementsMatch(t, expectArgs, deployment.Spec.Template.Spec.Containers[0].Args)
@@ -649,7 +646,6 @@ func TestTemplate_EnableLeaderElection(t *testing.T) {
 		"--listener-metrics-addr=0",
 		"--listener-metrics-endpoint=",
 		"--metrics-addr=0",
-		"--runner-max-concurrent-reconciles=2",
 	}

 	assert.ElementsMatch(t, expectedArgs, deployment.Spec.Template.Spec.Containers[0].Args)
@@ -690,7 +686,6 @@ func TestTemplate_ControllerDeployment_ForwardImagePullSecrets(t *testing.T) {
 		"--listener-metrics-addr=0",
 		"--listener-metrics-endpoint=",
 		"--metrics-addr=0",
-		"--runner-max-concurrent-reconciles=2",
 	}

 	assert.ElementsMatch(t, expectedArgs, deployment.Spec.Template.Spec.Containers[0].Args)
@@ -781,7 +776,6 @@ func TestTemplate_ControllerDeployment_WatchSingleNamespace(t *testing.T) {
 		"--listener-metrics-addr=0",
 		"--listener-metrics-endpoint=",
 		"--metrics-addr=0",
-		"--runner-max-concurrent-reconciles=2",
 	}

 	assert.ElementsMatch(t, expectedArgs, deployment.Spec.Template.Spec.Containers[0].Args)
@@ -1079,146 +1073,3 @@ func TestDeployment_excludeLabelPropagationPrefixes(t *testing.T) {
 	assert.Contains(t, container.Args, "--exclude-label-propagation-prefix=prefix.com/")
 	assert.Contains(t, container.Args, "--exclude-label-propagation-prefix=complete.io/label")
 }
-func TestNamespaceOverride(t *testing.T) {
-	t.Parallel()
-
-	chartPath := "../../gha-runner-scale-set-controller"
-
-	releaseName := "test"
-	releaseNamespace := "test-" + strings.ToLower(random.UniqueId())
-	namespaceOverride := "test-" + strings.ToLower(random.UniqueId())
-
-	tt := map[string]struct {
-		file          string
-		options       *helm.Options
-		wantNamespace string
-	}{
-		"deployment": {
-			file: "deployment.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride": namespaceOverride,
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: namespaceOverride,
-		},
-		"leader_election_role_binding": {
-			file: "leader_election_role_binding.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride": namespaceOverride,
-					"replicaCount":      "2",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: namespaceOverride,
-		},
-		"leader_election_role": {
-			file: "leader_election_role.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride": namespaceOverride,
-					"replicaCount":      "2",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: namespaceOverride,
-		},
-		"manager_listener_role_binding": {
-			file: "manager_listener_role_binding.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride": namespaceOverride,
-					"replicaCount":      "2",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: namespaceOverride,
-		},
-		"manager_listener_role": {
-			file: "manager_listener_role.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride": namespaceOverride,
-					"replicaCount":      "2",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: namespaceOverride,
-		},
-		"manager_single_namespace_controller_role": {
-			file: "manager_single_namespace_controller_role.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":          namespaceOverride,
-					"flags.watchSingleNamespace": "true",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: namespaceOverride,
-		},
-		"manager_single_namespace_controller_role_binding": {
-			file: "manager_single_namespace_controller_role_binding.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":          namespaceOverride,
-					"flags.watchSingleNamespace": "true",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: namespaceOverride,
-		},
-		"manager_single_namespace_watch_role": {
-			file: "manager_single_namespace_watch_role.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":          namespaceOverride,
-					"flags.watchSingleNamespace": "target-ns",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: "target-ns",
-		},
-		"manager_single_namespace_watch_role_binding": {
-			file: "manager_single_namespace_watch_role_binding.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":          namespaceOverride,
-					"flags.watchSingleNamespace": "target-ns",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-			wantNamespace: "target-ns",
-		},
-	}
-
-	for name, tc := range tt {
-		c := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			templateFile := filepath.Join("./templates", c.file)
-
-			output, err := helm.RenderTemplateE(t, c.options, chartPath, releaseName, []string{templateFile})
-			if err != nil {
-				t.Errorf("Error rendering template %s from chart %s: %s", c.file, chartPath, err)
-			}
-
-			type object struct {
-				Metadata metav1.ObjectMeta
-			}
-			var renderedObject object
-			helm.UnmarshalK8SYaml(t, output, &renderedObject)
-			assert.Equal(t, tc.wantNamespace, renderedObject.Metadata.Namespace)
-		})
-	}
-}
--- a/charts/gha-runner-scale-set-controller/values.yaml
+++ b/charts/gha-runner-scale-set-controller/values.yaml
@@ -106,11 +106,6 @@ flags:
  ## Defaults to watch all namespaces when unset.
  # watchSingleNamespace: ""

-  ## The maximum number of concurrent reconciles which can be run by the EphemeralRunner controller.
-  # Increase this value to improve the throughput of the controller.
-  # It may also increase the load on the API server and the external service (e.g. GitHub API).
-  runnerMaxConcurrentReconciles: 2
-
  ## Defines how the controller should handle upgrades while having running jobs.
  ##
  ## The strategies available are:
@@ -135,10 +130,3 @@ flags:
  ## Labels that match prefix specified in the list are excluded from propagation.
  # excludeLabelPropagationPrefixes:
  #   - "argocd.argoproj.io/instance"
-
-# Overrides the default `.Release.Namespace` for all resources in this chart.
-namespaceOverride: ""
-
-## Defines the K8s client rate limiter parameters.
-  # k8sClientRateLimiterQPS: 20
-  # k8sClientRateLimiterBurst: 30
--- a/charts/gha-runner-scale-set/Chart.yaml
+++ b/charts/gha-runner-scale-set/Chart.yaml
@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.11.0
+version: 0.9.3

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.11.0"
+appVersion: "0.9.3"

 home: https://github.com/actions/actions-runner-controller

--- a/charts/gha-runner-scale-set/templates/_helpers.tpl
+++ b/charts/gha-runner-scale-set/templates/_helpers.tpl
@@ -43,7 +43,7 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 app.kubernetes.io/part-of: gha-rs
 actions.github.com/scale-set-name: {{ include "gha-runner-scale-set.scale-set-name" . }}
-actions.github.com/scale-set-namespace: {{ include "gha-runner-scale-set.namespace" . }}
+actions.github.com/scale-set-namespace: {{ .Release.Namespace }}
 {{- end }}

 {{/*
@@ -87,7 +87,7 @@ app.kubernetes.io/instance: {{ include "gha-runner-scale-set.scale-set-name" . }
  {{- if eq $val.name "runner" }}
 image: {{ $val.image }}
 command: ["cp"]
-args: ["-r", "/home/runner/externals/.", "/home/runner/tmpDir/"]
+args: ["-r", "-v", "/home/runner/externals/.", "/home/runner/tmpDir/"]
 volumeMounts:
  - name: dind-externals
    mountPath: /home/runner/tmpDir
@@ -136,7 +136,7 @@ volumeMounts:
  {{- range $i, $volume := .Values.template.spec.volumes }}
    {{- if eq $volume.name "work" }}
      {{- $createWorkVolume = 0 }}
- {{ $volume | toYaml | nindent 2 | trim }}
+- {{ $volume | toYaml | nindent 2 }}
    {{- end }}
  {{- end }}
  {{- if eq $createWorkVolume 1 }}
@@ -150,7 +150,7 @@ volumeMounts:
  {{- range $i, $volume := .Values.template.spec.volumes }}
    {{- if eq $volume.name "work" }}
      {{- $createWorkVolume = 0 }}
- {{ $volume | toYaml | nindent 2 | trim  }}
+- {{ $volume | toYaml | nindent 2 }}
    {{- end }}
  {{- end }}
  {{- if eq $createWorkVolume 1 }}
@@ -165,7 +165,7 @@ volumeMounts:
 {{- define "gha-runner-scale-set.non-work-volumes" -}}
  {{- range $i, $volume := .Values.template.spec.volumes }}
    {{- if ne $volume.name "work" }}
- {{ $volume | toYaml | nindent 2 | trim }}
+- {{ $volume | toYaml | nindent 2 }}
    {{- end }}
  {{- end }}
 {{- end }}
@@ -218,7 +218,7 @@ env:
        {{- if eq $env.name "RUNNER_UPDATE_CA_CERTS" }}
          {{- $setRunnerUpdateCaCerts = 0 }}
        {{- end }}
-  - {{ $env | toYaml | nindent 4 | trim }}
+  - {{ $env | toYaml | nindent 4 }}
      {{- end }}
    {{- end }}
    {{- if $setDockerHost }}
@@ -255,7 +255,7 @@ volumeMounts:
        {{- if eq $volMount.name "github-server-tls-cert" }}
          {{- $mountGitHubServerTLS = 0 }}
        {{- end }}
-  - {{ $volMount | toYaml | nindent 4 | trim }}
+  - {{ $volMount | toYaml | nindent 4 }}
      {{- end }}
    {{- end }}
    {{- if $mountWork }}
@@ -481,8 +481,8 @@ volumeMounts:
      {{- $managerServiceAccountName = (get $controllerDeployment.metadata.labels "actions.github.com/controller-service-account-name") }}
    {{- end }}
  {{- else if gt $singleNamespaceCounter 0 }}
-    {{- if hasKey $singleNamespaceControllerDeployments (include "gha-runner-scale-set.namespace" .) }}
-      {{- $controllerDeployment = get $singleNamespaceControllerDeployments (include "gha-runner-scale-set.namespace" .) }}
+    {{- if hasKey $singleNamespaceControllerDeployments .Release.Namespace }}
+      {{- $controllerDeployment = get $singleNamespaceControllerDeployments .Release.Namespace }}
      {{- with $controllerDeployment.metadata }}
        {{- $managerServiceAccountName = (get $controllerDeployment.metadata.labels "actions.github.com/controller-service-account-name") }}
      {{- end }}
@@ -538,8 +538,8 @@ volumeMounts:
      {{- $managerServiceAccountNamespace = (get $controllerDeployment.metadata.labels "actions.github.com/controller-service-account-namespace") }}
    {{- end }}
  {{- else if gt $singleNamespaceCounter 0 }}
-    {{- if hasKey $singleNamespaceControllerDeployments (include "gha-runner-scale-set.namespace" .) }}
-      {{- $controllerDeployment = get $singleNamespaceControllerDeployments (include "gha-runner-scale-set.namespace" .) }}
+    {{- if hasKey $singleNamespaceControllerDeployments .Release.Namespace }}
+      {{- $controllerDeployment = get $singleNamespaceControllerDeployments .Release.Namespace }}
      {{- with $controllerDeployment.metadata }}
        {{- $managerServiceAccountNamespace = (get $controllerDeployment.metadata.labels "actions.github.com/controller-service-account-namespace") }}
      {{- end }}
@@ -553,11 +553,3 @@ volumeMounts:
 {{- $managerServiceAccountNamespace }}
 {{- end }}
 {{- end }}
-
-{{- define "gha-runner-scale-set.namespace" -}}
-{{- if .Values.namespaceOverride }}
-  {{- .Values.namespaceOverride }}
-{{- else }}
-  {{- .Release.Namespace }}
-{{- end }}
-{{- end }}
--- a/charts/gha-runner-scale-set/templates/autoscalingrunnerset.yaml
+++ b/charts/gha-runner-scale-set/templates/autoscalingrunnerset.yaml
@@ -1,35 +1,18 @@
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.autoscalingRunnerSet) }}
 apiVersion: actions.github.com/v1alpha1
 kind: AutoscalingRunnerSet
 metadata:
  {{- if or (not (include "gha-runner-scale-set.scale-set-name" .)) (gt (len (include "gha-runner-scale-set.scale-set-name" .)) 45) }}
  {{ fail "Name must have up to 45 characters" }}
  {{- end }}
-  {{- if gt (len (include "gha-runner-scale-set.namespace" .)) 63 }}
+  {{- if gt (len .Release.Namespace) 63 }}
  {{ fail "Namespace must have up to 63 characters" }}
  {{- end }}
  name: {{ include "gha-runner-scale-set.scale-set-name" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.autoscalingRunnerSet.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
    app.kubernetes.io/component: "autoscaling-runner-set"
    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.autoscalingRunnerSet.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
    actions.github.com/values-hash: {{ toJson .Values | sha256sum | trunc 63 }}
    {{- $containerMode := .Values.containerMode }}
    {{- if not (kindIs "string" .Values.githubConfigSecret) }}
@@ -106,16 +89,11 @@ spec:
  minRunners: {{ .Values.minRunners | int }}
  {{- end }}

-  {{- with .Values.listenerTemplate }}
+  {{- with .Values.listenerTemplate}}
  listenerTemplate:
    {{- toYaml . | nindent 4}}
  {{- end }}

-  {{- with .Values.listenerMetrics }}
-  listenerMetrics:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-
  template:
    {{- with .Values.template.metadata }}
    metadata:
--- a/charts/gha-runner-scale-set/templates/githubsecret.yaml
+++ b/charts/gha-runner-scale-set/templates/githubsecret.yaml
@@ -1,29 +1,11 @@
 {{- if not (kindIs "string" .Values.githubConfigSecret) }}
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.githubConfigSecret) }}
 apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "gha-runner-scale-set.githubsecret" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.githubConfigSecret.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
-  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.githubConfigSecret.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
  finalizers:
    - actions.github.com/cleanup-protection
 data:
--- a/charts/gha-runner-scale-set/templates/kube_mode_role.yaml
+++ b/charts/gha-runner-scale-set/templates/kube_mode_role.yaml
@@ -1,31 +1,11 @@
 {{- $containerMode := .Values.containerMode }}
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.kubernetesModeRole) }}
 {{- if and (eq $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
 # default permission for runner pod service account in kubernetes mode (container hook)
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "gha-runner-scale-set.kubeModeRoleName" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
-  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.kubernetesModeRole.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
-    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
-  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.kubernetesModeRole.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
+  namespace: {{ .Release.Namespace }}
  finalizers:
    - actions.github.com/cleanup-protection
 rules:
--- a/charts/gha-runner-scale-set/templates/kube_mode_role_binding.yaml
+++ b/charts/gha-runner-scale-set/templates/kube_mode_role_binding.yaml
@@ -1,31 +1,10 @@
 {{- $containerMode := .Values.containerMode }}
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.kubernetesModeRoleBinding) }}
 {{- if and (eq $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "gha-runner-scale-set.kubeModeRoleBindingName" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
-  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.kubernetesModeRoleBinding.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
-    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
-
-  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.kubernetesModeRoleBinding.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
+  namespace: {{ .Release.Namespace }}
  finalizers:
    - actions.github.com/cleanup-protection
 roleRef:
@@ -35,5 +14,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "gha-runner-scale-set.kubeModeServiceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}
--- a/charts/gha-runner-scale-set/templates/kube_mode_serviceaccount.yaml
+++ b/charts/gha-runner-scale-set/templates/kube_mode_serviceaccount.yaml
@@ -1,33 +1,18 @@
 {{- $containerMode := .Values.containerMode }}
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.kubernetesModeServiceAccount) }}
 {{- if and (eq $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "gha-runner-scale-set.kubeModeServiceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
-  {{- if or .Values.annotations $hasCustomResourceMeta }}
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.containerMode.kubernetesModeServiceAccount }}
+  {{- with .Values.containerMode.kubernetesModeServiceAccount.annotations }}
  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.kubernetesModeServiceAccount.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
  {{- end }}
-  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.kubernetesModeServiceAccount.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
-    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
-
  finalizers:
    - actions.github.com/cleanup-protection
+  labels:
+    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
 {{- end }}
--- a/charts/gha-runner-scale-set/templates/manager_role.yaml
+++ b/charts/gha-runner-scale-set/templates/manager_role.yaml
@@ -1,29 +1,11 @@
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.managerRole) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "gha-runner-scale-set.managerRoleName" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.managerRole.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
    app.kubernetes.io/component: manager-role
-  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.managerRole.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
  finalizers:
    - actions.github.com/cleanup-protection
 rules:
--- a/charts/gha-runner-scale-set/templates/manager_role_binding.yaml
+++ b/charts/gha-runner-scale-set/templates/manager_role_binding.yaml
@@ -1,29 +1,11 @@
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.managerRoleBinding) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "gha-runner-scale-set.managerRoleBindingName" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.managerRoleBinding.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
    app.kubernetes.io/component: manager-role-binding
-  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.managerRoleBinding.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
  finalizers:
    - actions.github.com/cleanup-protection
 roleRef:
--- a/charts/gha-runner-scale-set/templates/no_permission_serviceaccount.yaml
+++ b/charts/gha-runner-scale-set/templates/no_permission_serviceaccount.yaml
@@ -1,30 +1,12 @@
-{{- $hasCustomResourceMeta := (and .Values.resourceMeta .Values.resourceMeta.noPermissionServiceAccount) }}
 {{- $containerMode := .Values.containerMode }}
 {{- if and (ne $containerMode.type "kubernetes") (not .Values.template.spec.serviceAccountName) }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "gha-runner-scale-set.noPermissionServiceAccountName" . }}
-  namespace: {{ include "gha-runner-scale-set.namespace" . }}
+  namespace: {{ .Release.Namespace }}
  labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.noPermissionServiceAccount.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
    {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
-  annotations:
-    {{- with .Values.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- if $hasCustomResourceMeta }}
-    {{- with .Values.resourceMeta.noPermissionServiceAccount.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    {{- end }}
  finalizers:
    - actions.github.com/cleanup-protection
 {{- end }}
--- a/charts/gha-runner-scale-set/tests/template_test.go
+++ b/charts/gha-runner-scale-set/tests/template_test.go
@@ -6,8 +6,6 @@ import (
 	"strings"
 	"testing"

-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
 	v1alpha1 "github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
 	actionsgithubcom "github.com/actions/actions-runner-controller/controllers/actions.github.com"
 	"github.com/gruntwork-io/terratest/modules/helm"
@@ -744,6 +742,37 @@ func TestTemplateRenderedAutoScalingRunnerSet_DinD_ExtraInitContainers(t *testin
 	assert.Equal(t, "ls", ars.Spec.Template.Spec.InitContainers[2].Command[0], "InitContainers[2] Command[0] should be ls")
 }

+func TestTemplateRenderedKubernetesModeServiceAccountAnnotations(t *testing.T) {
+	t.Parallel()
+
+	// Path to the helm chart we will test
+	helmChartPath, err := filepath.Abs("../../gha-runner-scale-set")
+	require.NoError(t, err)
+
+	testValuesPath, err := filepath.Abs("../tests/values_kubernetes_mode_service_account_annotations.yaml")
+	require.NoError(t, err)
+
+	releaseName := "test-runners"
+	namespaceName := "test-" + strings.ToLower(random.UniqueId())
+
+	options := &helm.Options{
+		Logger: logger.Discard,
+		SetValues: map[string]string{
+			"controllerServiceAccount.name":      "arc",
+			"controllerServiceAccount.namespace": "arc-system",
+		},
+		ValuesFiles:    []string{testValuesPath},
+		KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
+	}
+
+	output := helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/kube_mode_serviceaccount.yaml"})
+
+	var sa corev1.ServiceAccount
+	helm.UnmarshalK8SYaml(t, output, &sa)
+
+	assert.Equal(t, "arn:aws:iam::123456789012:role/sample-role", sa.Annotations["eks.amazonaws.com/role-arn"], "Annotations should be arn:aws:iam::123456789012:role/sample-role")
+}
+
 func TestTemplateRenderedAutoScalingRunnerSet_DinD_ExtraVolumes(t *testing.T) {
 	t.Parallel()

@@ -864,7 +893,7 @@ func TestTemplateRenderedAutoScalingRunnerSet_EnableDinD(t *testing.T) {
 	assert.Equal(t, "init-dind-externals", ars.Spec.Template.Spec.InitContainers[0].Name)
 	assert.Equal(t, "ghcr.io/actions/actions-runner:latest", ars.Spec.Template.Spec.InitContainers[0].Image)
 	assert.Equal(t, "cp", ars.Spec.Template.Spec.InitContainers[0].Command[0])
-	assert.Equal(t, "-r /home/runner/externals/. /home/runner/tmpDir/", strings.Join(ars.Spec.Template.Spec.InitContainers[0].Args, " "))
+	assert.Equal(t, "-r -v /home/runner/externals/. /home/runner/tmpDir/", strings.Join(ars.Spec.Template.Spec.InitContainers[0].Args, " "))

 	assert.Len(t, ars.Spec.Template.Spec.Containers, 2, "Template.Spec should have 2 container")
 	assert.Equal(t, "runner", ars.Spec.Template.Spec.Containers[0].Name)
@@ -1178,7 +1207,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 				}
 			}
 			require.NotNil(t, volume)
-			assert.Equal(t, "certs-configmap", volume.ConfigMap.Name)
+			assert.Equal(t, "certs-configmap", volume.ConfigMap.LocalObjectReference.Name)
 			assert.Equal(t, "cert.pem", volume.ConfigMap.Items[0].Key)
 			assert.Equal(t, "cert.pem", volume.ConfigMap.Items[0].Path)

@@ -1238,7 +1267,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 				}
 			}
 			require.NotNil(t, volume)
-			assert.Equal(t, "certs-configmap", volume.ConfigMap.Name)
+			assert.Equal(t, "certs-configmap", volume.ConfigMap.LocalObjectReference.Name)
 			assert.Equal(t, "cert.pem", volume.ConfigMap.Items[0].Key)
 			assert.Equal(t, "cert.pem", volume.ConfigMap.Items[0].Path)

@@ -1298,7 +1327,7 @@ func TestTemplateRenderedWithTLS(t *testing.T) {
 				}
 			}
 			require.NotNil(t, volume)
-			assert.Equal(t, "certs-configmap", volume.ConfigMap.Name)
+			assert.Equal(t, "certs-configmap", volume.ConfigMap.LocalObjectReference.Name)
 			assert.Equal(t, "cert.pem", volume.ConfigMap.Items[0].Key)
 			assert.Equal(t, "cert.pem", volume.ConfigMap.Items[0].Path)

@@ -2114,357 +2143,3 @@ func TestAutoscalingRunnerSetAnnotationValuesHash(t *testing.T) {
 	assert.NotEqual(t, firstHash, secondHash)
 	assert.LessOrEqual(t, len(secondHash), 63)
 }
-
-func TestCustomLabels(t *testing.T) {
-	t.Parallel()
-
-	// Path to the helm chart we will test
-	helmChartPath, err := filepath.Abs("../../gha-runner-scale-set")
-	require.NoError(t, err)
-
-	releaseName := "test-runners"
-	namespaceName := "test-" + strings.ToLower(random.UniqueId())
-
-	options := &helm.Options{
-		Logger: logger.Discard,
-		SetValues: map[string]string{
-			"githubConfigUrl":                                              "https://github.com/actions",
-			"githubConfigSecret.github_token":                              "gh_token12345",
-			"controllerServiceAccount.name":                                "arc",
-			"containerMode.type":                                           "kubernetes",
-			"controllerServiceAccount.namespace":                           "arc-system",
-			`labels.argocd\.argoproj\.io/sync-wave`:                        `"1"`,
-			`labels.app\.kubernetes\.io/part-of`:                           "no-override", // this shouldn't be overwritten
-			"resourceMeta.autoscalingRunnerSet.labels.ars-custom":          "ars-custom-value",
-			"resourceMeta.githubConfigSecret.labels.gh-custom":             "gh-custom-value",
-			"resourceMeta.kubernetesModeRole.labels.kmr-custom":            "kmr-custom-value",
-			"resourceMeta.kubernetesModeRoleBinding.labels.kmrb-custom":    "kmrb-custom-value",
-			"resourceMeta.kubernetesModeServiceAccount.labels.kmsa-custom": "kmsa-custom-value",
-			"resourceMeta.managerRole.labels.mr-custom":                    "mr-custom-value",
-			"resourceMeta.managerRoleBinding.labels.mrb-custom":            "mrb-custom-value",
-		},
-		KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
-	}
-
-	output := helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/githubsecret.yaml"})
-
-	const targetLabel = "argocd.argoproj.io/sync-wave"
-	const wantCustomValue = `"1"`
-	const reservedLabel = "app.kubernetes.io/part-of"
-	const wantReservedValue = "gha-rs"
-
-	var githubSecret corev1.Secret
-	helm.UnmarshalK8SYaml(t, output, &githubSecret)
-	assert.Equal(t, wantCustomValue, githubSecret.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, githubSecret.Labels[reservedLabel])
-	assert.Equal(t, "gh-custom-value", githubSecret.Labels["gh-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/kube_mode_role.yaml"})
-	var role rbacv1.Role
-	helm.UnmarshalK8SYaml(t, output, &role)
-	assert.Equal(t, wantCustomValue, role.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, role.Labels[reservedLabel])
-	assert.Equal(t, "kmr-custom-value", role.Labels["kmr-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/kube_mode_role_binding.yaml"})
-	var roleBinding rbacv1.RoleBinding
-	helm.UnmarshalK8SYaml(t, output, &roleBinding)
-	assert.Equal(t, wantCustomValue, roleBinding.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, roleBinding.Labels[reservedLabel])
-	assert.Equal(t, "kmrb-custom-value", roleBinding.Labels["kmrb-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/autoscalingrunnerset.yaml"})
-	var ars v1alpha1.AutoscalingRunnerSet
-	helm.UnmarshalK8SYaml(t, output, &ars)
-	assert.Equal(t, wantCustomValue, ars.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, ars.Labels[reservedLabel])
-	assert.Equal(t, "ars-custom-value", ars.Labels["ars-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/kube_mode_serviceaccount.yaml"})
-	var serviceAccount corev1.ServiceAccount
-	helm.UnmarshalK8SYaml(t, output, &serviceAccount)
-	assert.Equal(t, wantCustomValue, serviceAccount.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, serviceAccount.Labels[reservedLabel])
-	assert.Equal(t, "kmsa-custom-value", serviceAccount.Labels["kmsa-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/manager_role.yaml"})
-	var managerRole rbacv1.Role
-	helm.UnmarshalK8SYaml(t, output, &managerRole)
-	assert.Equal(t, wantCustomValue, managerRole.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, managerRole.Labels[reservedLabel])
-	assert.Equal(t, "mr-custom-value", managerRole.Labels["mr-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/manager_role_binding.yaml"})
-	var managerRoleBinding rbacv1.RoleBinding
-	helm.UnmarshalK8SYaml(t, output, &managerRoleBinding)
-	assert.Equal(t, wantCustomValue, managerRoleBinding.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, managerRoleBinding.Labels[reservedLabel])
-	assert.Equal(t, "mrb-custom-value", managerRoleBinding.Labels["mrb-custom"])
-
-	options = &helm.Options{
-		Logger: logger.Discard,
-		SetValues: map[string]string{
-			"githubConfigUrl":                                            "https://github.com/actions",
-			"githubConfigSecret.github_token":                            "gh_token12345",
-			"controllerServiceAccount.name":                              "arc",
-			"controllerServiceAccount.namespace":                         "arc-system",
-			`labels.argocd\.argoproj\.io/sync-wave`:                      `"1"`,
-			"resourceMeta.noPermissionServiceAccount.labels.npsa-custom": "npsa-custom-value",
-		},
-		KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
-	}
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/no_permission_serviceaccount.yaml"})
-	var noPermissionServiceAccount corev1.ServiceAccount
-	helm.UnmarshalK8SYaml(t, output, &noPermissionServiceAccount)
-	assert.Equal(t, wantCustomValue, noPermissionServiceAccount.Labels[targetLabel])
-	assert.Equal(t, wantReservedValue, noPermissionServiceAccount.Labels[reservedLabel])
-	assert.Equal(t, "npsa-custom-value", noPermissionServiceAccount.Labels["npsa-custom"])
-}
-
-func TestCustomAnnotations(t *testing.T) {
-	t.Parallel()
-
-	// Path to the helm chart we will test
-	helmChartPath, err := filepath.Abs("../../gha-runner-scale-set")
-	require.NoError(t, err)
-
-	releaseName := "test-runners"
-	namespaceName := "test-" + strings.ToLower(random.UniqueId())
-
-	options := &helm.Options{
-		Logger: logger.Discard,
-		SetValues: map[string]string{
-			"githubConfigUrl":                                                   "https://github.com/actions",
-			"githubConfigSecret.github_token":                                   "gh_token12345",
-			"containerMode.type":                                                "kubernetes",
-			"controllerServiceAccount.name":                                     "arc",
-			"controllerServiceAccount.namespace":                                "arc-system",
-			`annotations.argocd\.argoproj\.io/sync-wave`:                        `"1"`,
-			"resourceMeta.autoscalingRunnerSet.annotations.ars-custom":          "ars-custom-value",
-			"resourceMeta.githubConfigSecret.annotations.gh-custom":             "gh-custom-value",
-			"resourceMeta.kubernetesModeRole.annotations.kmr-custom":            "kmr-custom-value",
-			"resourceMeta.kubernetesModeRoleBinding.annotations.kmrb-custom":    "kmrb-custom-value",
-			"resourceMeta.kubernetesModeServiceAccount.annotations.kmsa-custom": "kmsa-custom-value",
-			"resourceMeta.managerRole.annotations.mr-custom":                    "mr-custom-value",
-			"resourceMeta.managerRoleBinding.annotations.mrb-custom":            "mrb-custom-value",
-		},
-		KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
-	}
-
-	const targetAnnotations = "argocd.argoproj.io/sync-wave"
-	const wantCustomValue = `"1"`
-
-	output := helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/githubsecret.yaml"})
-
-	var githubSecret corev1.Secret
-	helm.UnmarshalK8SYaml(t, output, &githubSecret)
-	assert.Equal(t, wantCustomValue, githubSecret.Annotations[targetAnnotations])
-	assert.Equal(t, "gh-custom-value", githubSecret.Annotations["gh-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/kube_mode_role.yaml"})
-	var role rbacv1.Role
-	helm.UnmarshalK8SYaml(t, output, &role)
-	assert.Equal(t, wantCustomValue, role.Annotations[targetAnnotations])
-	assert.Equal(t, "kmr-custom-value", role.Annotations["kmr-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/kube_mode_role_binding.yaml"})
-	var roleBinding rbacv1.RoleBinding
-	helm.UnmarshalK8SYaml(t, output, &roleBinding)
-	assert.Equal(t, wantCustomValue, roleBinding.Annotations[targetAnnotations])
-	assert.Equal(t, "kmrb-custom-value", roleBinding.Annotations["kmrb-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/autoscalingrunnerset.yaml"})
-	var ars v1alpha1.AutoscalingRunnerSet
-	helm.UnmarshalK8SYaml(t, output, &ars)
-	assert.Equal(t, wantCustomValue, ars.Annotations[targetAnnotations])
-	assert.Equal(t, "ars-custom-value", ars.Annotations["ars-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/kube_mode_serviceaccount.yaml"})
-	var serviceAccount corev1.ServiceAccount
-	helm.UnmarshalK8SYaml(t, output, &serviceAccount)
-	assert.Equal(t, wantCustomValue, serviceAccount.Annotations[targetAnnotations])
-	assert.Equal(t, "kmsa-custom-value", serviceAccount.Annotations["kmsa-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/manager_role.yaml"})
-	var managerRole rbacv1.Role
-	helm.UnmarshalK8SYaml(t, output, &managerRole)
-	assert.Equal(t, wantCustomValue, managerRole.Annotations[targetAnnotations])
-	assert.Equal(t, "mr-custom-value", managerRole.Annotations["mr-custom"])
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/manager_role_binding.yaml"})
-	var managerRoleBinding rbacv1.RoleBinding
-	helm.UnmarshalK8SYaml(t, output, &managerRoleBinding)
-	assert.Equal(t, wantCustomValue, managerRoleBinding.Annotations[targetAnnotations])
-	assert.Equal(t, "mrb-custom-value", managerRoleBinding.Annotations["mrb-custom"])
-
-	options = &helm.Options{
-		Logger: logger.Discard,
-		SetValues: map[string]string{
-			"githubConfigUrl":                                                 "https://github.com/actions",
-			"githubConfigSecret.github_token":                                 "gh_token12345",
-			"controllerServiceAccount.name":                                   "arc",
-			"controllerServiceAccount.namespace":                              "arc-system",
-			`annotations.argocd\.argoproj\.io/sync-wave`:                      `"1"`,
-			"resourceMeta.noPermissionServiceAccount.annotations.npsa-custom": "npsa-custom-value",
-		},
-		KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
-	}
-
-	output = helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/no_permission_serviceaccount.yaml"})
-	var noPermissionServiceAccount corev1.ServiceAccount
-	helm.UnmarshalK8SYaml(t, output, &noPermissionServiceAccount)
-	assert.Equal(t, wantCustomValue, noPermissionServiceAccount.Annotations[targetAnnotations])
-	assert.Equal(t, "npsa-custom-value", noPermissionServiceAccount.Annotations["npsa-custom"])
-}
-
-func TestNamespaceOverride(t *testing.T) {
-	t.Parallel()
-
-	chartPath := "../../gha-runner-scale-set"
-
-	releaseName := "test"
-	releaseNamespace := "test-" + strings.ToLower(random.UniqueId())
-	namespaceOverride := "test-" + strings.ToLower(random.UniqueId())
-
-	tt := map[string]struct {
-		file    string
-		options *helm.Options
-	}{
-		"manager_role": {
-			file: "manager_role.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-		"manager_role_binding": {
-			file: "manager_role_binding.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-		"no_permission_serviceaccount": {
-			file: "no_permission_serviceaccount.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-		"autoscalingrunnerset": {
-			file: "autoscalingrunnerset.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-		"githubsecret": {
-			file: "githubsecret.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-		"kube_mode_role": {
-			file: "kube_mode_role.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"containerMode.type":                 "kubernetes",
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-		"kube_mode_role_binding": {
-			file: "kube_mode_role_binding.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"containerMode.type":                 "kubernetes",
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-		"kube_mode_serviceaccount": {
-			file: "kube_mode_serviceaccount.yaml",
-			options: &helm.Options{
-				Logger: logger.Discard,
-				SetValues: map[string]string{
-					"namespaceOverride":                  namespaceOverride,
-					"containerMode.type":                 "kubernetes",
-					"controllerServiceAccount.name":      "foo",
-					"controllerServiceAccount.namespace": "bar",
-					"githubConfigSecret.github_token":    "gh_token12345",
-					"githubConfigUrl":                    "https://github.com",
-				},
-				KubectlOptions: k8s.NewKubectlOptions("", "", releaseNamespace),
-			},
-		},
-	}
-
-	for name, tc := range tt {
-		c := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			templateFile := filepath.Join("./templates", c.file)
-
-			output, err := helm.RenderTemplateE(t, c.options, chartPath, releaseName, []string{templateFile})
-			if err != nil {
-				t.Errorf("Error rendering template %s from chart %s: %s", c.file, chartPath, err)
-			}
-
-			type object struct {
-				Metadata metav1.ObjectMeta
-			}
-			var renderedObject object
-			helm.UnmarshalK8SYaml(t, output, &renderedObject)
-			assert.Equal(t, namespaceOverride, renderedObject.Metadata.Namespace)
-		})
-	}
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Yusuke Kuoka	a4876c5d03	Make EphemeralRunnerController MaxConcurrentReconciles configurable	2024-11-01 01:56:11 +00:00
Yusuke Kuoka	f58dd76763	Make EphemeralRunnerReconciler create runner pods faster and earlier	2024-09-30 05:25:43 +00:00