actions / actions/actions-runner-controller

RunnerDeployment CRD does not support allowPrivilegeEscalation and capabilities parameters in PodSecurityContext

Open
#856 1 comment 13 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Go
Stars
6.5k
Forks
1.5k
Avg merge
2d 2h
Merged PRs (30d)
27

Description

Describe the bug
RunnerDeployment CRD does not support allowPrivilegeEscalation and capabilities parameters in PodSecurityContext

Checks

  • runner image: summerwind/actions-runner:v2.283.1-ubuntu-20.04-24602ff
  • My actions-runner-controller version (v0.x.y) does support the feature

To Reproduce
Steps to reproduce the behavior:

  1. Deploy actions-runner-controller helm chart version 0.13.0 and create a RunnerDeployment with the following securityContext:
securityContext:
  allowPrivilegeEscalation: true
  seLinuxOptions:
    level: s0
    role: system_r
    type: super_t
    user: system_u
  capabilities:
    add:
    - DAC_READ_SEARCH
    - NET_ADMIN
    - SYS_ADMIN
    - SYS_RESOURCE
  1. helmfile apply will fail with error saying that allowPrivilegeEscalation and capabilities fields are not accepted

Expected behavior
RunnerDeployment should accept allowPrivilegeEscalation and capabilities parameters as a part of PodSecurityContext

Environment:

  • Controller image [summerwind/actions-runner-controller:v0.20.0]
  • Deployment Method - helm
  • Helm Chart Version [0.13.0]

Tried work-around
As a work-around we updated the CRDs for runners with the above parameters here and able to create a RunnerDeployment with the above securityContext BUT the actions-runner-controller is removing those parameters automatically.

  • Thank you

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the CRD definitions under charts/actions-runner-controller/crds and trace how RunnerDeployment PodSecurityContext fields are handled by the controller. Compare the accepted schema and resulting runner configuration for allowPrivilegeEscalation and capabilities; done means both fields are accepted and preserved instead of being removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.