actions / actions/actions-runner-controller
RunnerDeployment CRD does not support allowPrivilegeEscalation and capabilities parameters in PodSecurityContext
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 6.5k
- Forks
- 1.5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 27
Description
Describe the bug
RunnerDeployment CRD does not support allowPrivilegeEscalation and capabilities parameters in PodSecurityContext
Checks
- runner image:
summerwind/actions-runner:v2.283.1-ubuntu-20.04-24602ff - My actions-runner-controller version (v0.x.y) does support the feature
To Reproduce
Steps to reproduce the behavior:
- Deploy actions-runner-controller helm chart version
0.13.0and create a RunnerDeployment with the following securityContext:
securityContext:
allowPrivilegeEscalation: true
seLinuxOptions:
level: s0
role: system_r
type: super_t
user: system_u
capabilities:
add:
- DAC_READ_SEARCH
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
- helmfile apply will fail with error saying that
allowPrivilegeEscalationandcapabilitiesfields are not accepted
Expected behavior
RunnerDeployment should accept allowPrivilegeEscalation and capabilities parameters as a part of PodSecurityContext
Environment:
- Controller image [
summerwind/actions-runner-controller:v0.20.0] - Deployment Method - helm
- Helm Chart Version [
0.13.0]
Tried work-around
As a work-around we updated the CRDs for runners with the above parameters here and able to create a RunnerDeployment with the above securityContext BUT the actions-runner-controller is removing those parameters automatically.
- Thank you
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the CRD definitions under charts/actions-runner-controller/crds and trace how RunnerDeployment PodSecurityContext fields are handled by the controller. Compare the accepted schema and resulting runner configuration for allowPrivilegeEscalation and capabilities; done means both fields are accepted and preserved instead of being removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100