actions / actions/actions-runner-controller

Install without Kube admin permission

Open
#2,207 1 comment 8 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement needs triage
Dominant language
Go
Stars
6.5k
Forks
1.5k
Avg merge
2d 2h
Merged PRs (30d)
27

Description

What would you like added?

Allow to install without Kubernetes cluster admin for company that do not have admin permissions

Why is this needed?

Some companies delegate the administration of Kubernetes to external vendor and the user of Kube do not have cluster admin. For example if RH is managing your Kube on azure (their shared offer between RH and MS: https://www.redhat.com/en/technologies/cloud-computing/openshift/azure) you should be able to install the runner without being admin (admin will never be given per contractual agreement)

Additional context

I work in big company where we do not have admin permissions on Kubernetes. The clusters (20+) are shared (200+ nodes) between various independant team and manage by RH for us. We would like to install the runner but do not have permissions so it fails (see below) and by contract we can not be admin on Kube. We only have quota access so we would like a way to install at Namespace level....something like OLM (https://docs.okd.io/4.10/operators/admin/olm-creating-policy.html) and it seems you already have it in mind https://github.com/evryfs/github-actions-runner-operator#operatorhub so any idea on a possible delivery in hub or a workaround to deploy ASAP without admin ?

for info the error we get as user when following deployment (excepted since we are not admin)

helm upgrade --install --namespace actions-runner-system --create-namespace --wait actions-runner-controller actions-runner-controller/actions-runner-controller
Error: query: failed to query with labels: secrets is forbidden: User "XXXXX" cannot list resource "secrets" in API group "" in the namespace "actions-runner-system"

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no source file or test; start with the Helm command and its permissions error for listing secrets in actions-runner-system. Determine the namespace-scoped installation requirements and define completion as deploying the runner without cluster-admin permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
ci-cd, devops, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.