fixed merge conflict, repaired paths in examples

packages/k8s/src/hooks/cleanup-job.ts

@@ -1,5 +1,6 @@
-import { podPrune } from '../k8s'
+import { pruneSecrets, prunePods } from '../k8s'
 
 export async function cleanupJob(): Promise<void> {
-  await podPrune()
+  await prunePods()
+  await pruneSecrets()
 }

packages/k8s/src/hooks/constants.ts

@@ -20,7 +20,7 @@ export function getJobPodName(): string {
 export function getStepPodName(): string {
   return `${getRunnerPodName().substring(
     0,
-    MAX_POD_NAME_LENGTH - ('-step'.length + STEP_POD_NAME_SUFFIX_LENGTH)
+    MAX_POD_NAME_LENGTH - ('-step-'.length + STEP_POD_NAME_SUFFIX_LENGTH)
   )}-step-${uuidv4().substring(0, STEP_POD_NAME_SUFFIX_LENGTH)}`
 }
 
@@ -34,6 +34,13 @@ export function getVolumeClaimName(): string {
   return name
 }
 
+export function getSecretName(): string {
+  return `${getRunnerPodName().substring(
+    0,
+    MAX_POD_NAME_LENGTH - ('-secret-'.length + STEP_POD_NAME_SUFFIX_LENGTH)
+  )}-secret-${uuidv4().substring(0, STEP_POD_NAME_SUFFIX_LENGTH)}`
+}
+
 const MAX_POD_NAME_LENGTH = 63
 const STEP_POD_NAME_SUFFIX_LENGTH = 8
 export const JOB_CONTAINER_NAME = 'job'

packages/k8s/src/hooks/prepare-job.ts

@@ -14,7 +14,7 @@ import {
   isAuthPermissionsOK,
   isPodContainerAlpine,
   namespace,
-  podPrune,
+  prunePods,
   requiredPermissions,
   waitForPodPhases
 } from '../k8s'
@@ -29,7 +29,7 @@ export async function prepareJob(
   args: prepareJobArgs,
   responseFile
 ): Promise<void> {
-  await podPrune()
+  await prunePods()
   if (!(await isAuthPermissionsOK())) {
     throw new Error(
       `The Service account needs the following permissions ${JSON.stringify(
@@ -58,8 +58,8 @@ export async function prepareJob(
   try {
     createdPod = await createPod(container, services, args.registry)
   } catch (err) {
-    await podPrune()
-    throw new Error(`failed to create job pod: ${err}`)
+    await prunePods()
+    throw new Error(`failed to create job pod: ${JSON.stringify(err)}`)
   }
 
   if (!createdPod?.metadata?.name) {
@@ -73,7 +73,7 @@ export async function prepareJob(
       new Set([PodPhase.PENDING])
     )
   } catch (err) {
-    await podPrune()
+    await prunePods()
     throw new Error(`Pod failed to come online with error: ${err}`)
   }
 

packages/k8s/src/hooks/run-container-step.ts

@@ -3,6 +3,7 @@ import * as core from '@actions/core'
 import { PodPhase } from 'hooklib'
 import {
   createJob,
+  createSecretForEnvs,
   getContainerJobPodName,
   getPodLogs,
   getPodStatus,
@@ -16,7 +17,13 @@ export async function runContainerStep(stepContainer): Promise<number> {
   if (stepContainer.dockerfile) {
     throw new Error('Building container actions is not currently supported')
   }
-  const container = createPodSpec(stepContainer)
+  let secretName: string | undefined = undefined
+  if (stepContainer['environmentVariables']) {
+    secretName = await createSecretForEnvs(
+      stepContainer['environmentVariables']
+    )
+  }
+  const container = createPodSpec(stepContainer, secretName)
   const job = await createJob(container)
   if (!job.metadata?.name) {
     throw new Error(
@@ -25,12 +32,11 @@ export async function runContainerStep(stepContainer): Promise<number> {
       )} to have correctly set the metadata.name`
     )
   }
-
   const podName = await getContainerJobPodName(job.metadata.name)
   await waitForPodPhases(
     podName,
-    new Set([PodPhase.COMPLETED, PodPhase.RUNNING]),
-    new Set([PodPhase.PENDING])
+    new Set([PodPhase.COMPLETED, PodPhase.RUNNING, PodPhase.SUCCEEDED]),
+    new Set([PodPhase.PENDING, PodPhase.UNKNOWN])
   )
   await getPodLogs(podName, JOB_CONTAINER_NAME)
   await waitForJobToComplete(job.metadata.name)
@@ -40,28 +46,28 @@ export async function runContainerStep(stepContainer): Promise<number> {
     core.warning(`Can't determine container status`)
     return 0
   }
-
   const exitCode =
     status.containerStatuses[status.containerStatuses.length - 1].state
       ?.terminated?.exitCode
   return Number(exitCode) || 0
 }
 
-function createPodSpec(container): k8s.V1Container {
+function createPodSpec(container, secretName?: string): k8s.V1Container {
   const podContainer = new k8s.V1Container()
   podContainer.name = JOB_CONTAINER_NAME
   podContainer.image = container.image
   if (container.entryPoint) {
     podContainer.command = [container.entryPoint, ...container.entryPointArgs]
   }
-
-  podContainer.env = []
-  for (const [key, value] of Object.entries(
-    container['environmentVariables']
-  )) {
-    if (value && key !== 'HOME') {
-      podContainer.env.push({ name: key, value: value as string })
-    }
+  if (secretName) {
+    podContainer.envFrom = [
+      {
+        secretRef: {
+          name: secretName,
+          optional: false
+        }
+      }
+    ]
   }
   podContainer.volumeMounts = containerVolumes()
 

packages/k8s/src/hooks/run-script-step.ts

@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
 import { RunScriptStepArgs } from 'hooklib'
 import { execPodStep } from '../k8s'
-import { JOB_CONTAINER_NAME } from './constants'
+import { getJobPodName, JOB_CONTAINER_NAME } from './constants'
 
 export async function runScriptStep(
   args: RunScriptStepArgs,
@@ -13,7 +13,7 @@ export async function runScriptStep(
     args.entryPointArgs,
     args.environmentVariables
   )
-  await execPodStep(cb.command, state.jobPod, JOB_CONTAINER_NAME)
+  await execPodStep(cb.command, getJobPodName(), JOB_CONTAINER_NAME)
 }
 
 class CommandsBuilder {

packages/k8s/src/k8s/index.ts

@@ -1,10 +1,11 @@
 import * as k8s from '@kubernetes/client-node'
 import { ContainerInfo, PodPhase, Registry } from 'hooklib'
 import * as stream from 'stream'
-import { v4 as uuidv4 } from 'uuid'
 import {
   getJobPodName,
   getRunnerPodName,
+  getSecretName,
+  getStepPodName,
   getVolumeClaimName,
   RunnerInstanceLabel
 } from '../hooks/constants'
@@ -119,7 +120,7 @@ export async function createJob(
   job.apiVersion = 'batch/v1'
   job.kind = 'Job'
   job.metadata = new k8s.V1ObjectMeta()
-  job.metadata.name = getJobPodName()
+  job.metadata.name = getStepPodName()
   job.metadata.labels = { 'runner-pod': getRunnerPodName() }
 
   job.spec = new k8s.V1JobSpec()
@@ -173,7 +174,13 @@ export async function getContainerJobPodName(jobName: string): Promise<string> {
 }
 
 export async function deletePod(podName: string): Promise<void> {
-  await k8sApi.deleteNamespacedPod(podName, namespace())
+  await k8sApi.deleteNamespacedPod(
+    podName,
+    namespace(),
+    undefined,
+    undefined,
+    0
+  )
 }
 
 export async function execPodStep(
@@ -244,12 +251,13 @@ export async function createDockerSecret(
       }
     }
   }
-  const secretName = generateSecretName()
+  const secretName = getSecretName()
   const secret = new k8s.V1Secret()
   secret.immutable = true
   secret.apiVersion = 'v1'
   secret.metadata = new k8s.V1ObjectMeta()
   secret.metadata.name = secretName
+  secret.metadata.labels = { 'runner-pod': getRunnerPodName() }
   secret.kind = 'Secret'
   secret.data = {
     '.dockerconfigjson': Buffer.from(
@@ -262,6 +270,50 @@ export async function createDockerSecret(
   return body
 }
 
+export async function createSecretForEnvs(envs: {
+  [key: string]: string
+}): Promise<string> {
+  const secret = new k8s.V1Secret()
+  const secretName = getSecretName()
+  secret.immutable = true
+  secret.apiVersion = 'v1'
+  secret.metadata = new k8s.V1ObjectMeta()
+  secret.metadata.name = secretName
+  secret.metadata.labels = { 'runner-pod': getRunnerPodName() }
+  secret.kind = 'Secret'
+  secret.data = {}
+  for (const [key, value] of Object.entries(envs)) {
+    secret.data[key] = Buffer.from(value).toString('base64')
+  }
+
+  await k8sApi.createNamespacedSecret(namespace(), secret)
+  return secretName
+}
+
+export async function deleteSecret(secretName: string): Promise<void> {
+  await k8sApi.deleteNamespacedSecret(secretName, namespace())
+}
+
+export async function pruneSecrets(): Promise<void> {
+  const secretList = await k8sApi.listNamespacedSecret(
+    namespace(),
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    new RunnerInstanceLabel().toString()
+  )
+  if (!secretList.body.items.length) {
+    return
+  }
+
+  await Promise.all(
+    secretList.body.items.map(
+      secret => secret.metadata?.name && deleteSecret(secret.metadata.name)
+    )
+  )
+}
+
 export async function waitForPodPhases(
   podName: string,
   awaitingPhases: Set<PodPhase>,
@@ -273,7 +325,6 @@ export async function waitForPodPhases(
   try {
     while (true) {
       phase = await getPodPhase(podName)
-
       if (awaitingPhases.has(phase)) {
         return
       }
@@ -340,7 +391,7 @@ export async function getPodLogs(
   await new Promise(resolve => r.on('close', () => resolve(null)))
 }
 
-export async function podPrune(): Promise<void> {
+export async function prunePods(): Promise<void> {
   const podList = await k8sApi.listNamespacedPod(
     namespace(),
     undefined,
@@ -454,10 +505,6 @@ export function namespace(): string {
   return context.namespace
 }
 
-function generateSecretName(): string {
-  return `github-secret-${uuidv4()}`
-}
-
 function runnerName(): string {
   const name = process.env.ACTIONS_RUNNER_POD_NAME
   if (!name) {

packages/k8s/src/k8s/utils.ts

@@ -52,9 +52,9 @@ export function containerVolumes(
           'absolute path volume mounts outside of the work folder are not supported'
         )
       }
-      sourceVolumePath = userVolume.sourceVolumePath
+      sourceVolumePath = userVolume.sourceVolumePath.slice(workspacePath.length)
     } else {
-      sourceVolumePath = path.join(workspacePath, userVolume.sourceVolumePath)
+      sourceVolumePath = userVolume.sourceVolumePath
     }
 
     mounts.push({