Make EphemeralRunnerController MaxConcurrentReconciles configurable

.github/actions/execute-assert-arc-e2e/action.yaml

@@ -0,0 +1,202 @@
+name: 'Execute and Assert ARC E2E Test Action'
+description: 'Queue E2E test workflow and assert workflow run result to be succeed'
+
+inputs:
+  auth-token:
+    description: 'GitHub access token to queue workflow run'
+    required: true
+  repo-owner:
+    description: "The repository owner name that has the test workflow file, ex: actions"
+    required: true
+  repo-name:
+    description: "The repository name that has the test workflow file, ex: test"
+    required: true
+  workflow-file:
+    description: 'The file name of the workflow yaml, ex: test.yml'
+    required: true
+  arc-name:
+    description: 'The name of the configured gha-runner-scale-set'
+    required: true
+  arc-namespace:
+    description: 'The namespace of the configured gha-runner-scale-set'
+    required: true
+  arc-controller-namespace:
+    description: 'The namespace of the configured gha-runner-scale-set-controller'
+    required: true
+  wait-to-finish:
+    description: 'Wait for the workflow run to finish'
+    required: true
+    default: "true"
+  wait-to-running:
+    description: 'Wait for the workflow run to start running'
+    required: true
+    default: "false"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Queue test workflow
+      shell: bash
+      id: queue_workflow
+      run: |
+        queue_time=`date +%FT%TZ`
+        echo "queue_time=$queue_time" >> $GITHUB_OUTPUT
+        curl -X POST https://api.github.com/repos/${{inputs.repo-owner}}/${{inputs.repo-name}}/actions/workflows/${{inputs.workflow-file}}/dispatches \
+        -H "Accept: application/vnd.github.v3+json" \
+        -H "Authorization: token ${{inputs.auth-token}}" \
+        -d '{"ref": "main", "inputs": { "arc_name": "${{inputs.arc-name}}" } }'
+
+    - name: Fetch workflow run & job ids
+      uses: actions/github-script@v7
+      id: query_workflow
+      with:
+        script: |
+          // Try to find the workflow run triggered by the previous step using the workflow_dispatch event.
+          // - Find recently create workflow runs in the test repository
+          // - For each workflow run, list its workflow job and see if the job's labels contain `inputs.arc-name`
+          // - Since the inputs.arc-name should be unique per e2e workflow run, once we find the job with the label, we find the workflow that we just triggered.
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_id = '${{inputs.workflow-file}}'
+          let workflow_run_id = 0
+          let workflow_job_id = 0
+          let workflow_run_html_url = ""
+          let count = 0
+          while (count++<12) {
+            await sleep(10 * 1000);
+            let listRunResponse = await github.rest.actions.listWorkflowRuns({
+              owner: owner,
+              repo: repo,
+              workflow_id: workflow_id,
+              created: '>${{steps.queue_workflow.outputs.queue_time}}'
+            })
+            if (listRunResponse.data.total_count > 0) {
+              console.log(`Found some new workflow runs for ${workflow_id}`)
+              for (let i = 0; i<listRunResponse.data.total_count; i++) {
+                let workflowRun = listRunResponse.data.workflow_runs[i]
+                console.log(`Check if workflow run ${workflowRun.id} is triggered by us.`)
+                let listJobResponse = await github.rest.actions.listJobsForWorkflowRun({
+                  owner: owner,
+                  repo: repo,
+                  run_id: workflowRun.id
+                })
+                console.log(`Workflow run ${workflowRun.id} has ${listJobResponse.data.total_count} jobs.`)
+                if (listJobResponse.data.total_count > 0) {
+                  for (let j = 0; j<listJobResponse.data.total_count; j++) {
+                    let workflowJob = listJobResponse.data.jobs[j]
+                    console.log(`Check if workflow job ${workflowJob.id} is triggered by us.`)
+                    console.log(JSON.stringify(workflowJob.labels));
+                    if (workflowJob.labels.includes('${{inputs.arc-name}}')) {
+                      console.log(`Workflow job ${workflowJob.id} (Run id: ${workflowJob.run_id}) is triggered by us.`)
+                      workflow_run_id = workflowJob.run_id
+                      workflow_job_id = workflowJob.id
+                      workflow_run_html_url = workflowRun.html_url
+                      break
+                    }
+                  }
+                }
+
+                if (workflow_job_id > 0) {
+                  break;
+                }
+              }
+            }
+
+            if (workflow_job_id > 0) {
+              break;
+            }
+          }
+          if (workflow_job_id == 0) {
+            core.setFailed(`Can't find workflow run and workflow job triggered to 'runs-on ${{inputs.arc-name}}'`)
+          } else {
+            core.setOutput('workflow_run', workflow_run_id);
+            core.setOutput('workflow_job', workflow_job_id);
+            core.setOutput('workflow_run_url', workflow_run_html_url);
+          }
+
+    - name: Generate summary about the triggered workflow run
+      shell: bash
+      run: |
+        cat <<-EOF > $GITHUB_STEP_SUMMARY
+        | **Triggered workflow run** |
+        |:--------------------------:|
+        | ${{steps.query_workflow.outputs.workflow_run_url}} |
+        EOF
+
+    - name: Wait for workflow to start running
+      if: inputs.wait-to-running == 'true' && inputs.wait-to-finish == 'false'
+      uses: actions/github-script@v7
+      with:
+        script: |
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_run_id = ${{steps.query_workflow.outputs.workflow_run}}
+          const workflow_job_id = ${{steps.query_workflow.outputs.workflow_job}}
+          let count = 0
+          while (count++<10) {
+            await sleep(30 * 1000);
+            let getRunResponse = await github.rest.actions.getWorkflowRun({
+              owner: owner,
+              repo: repo,
+              run_id: workflow_run_id
+            })
+            console.log(`${getRunResponse.data.html_url}: ${getRunResponse.data.status} (${getRunResponse.data.conclusion})`);
+            if (getRunResponse.data.status == 'in_progress') {
+              console.log(`Workflow run is in progress.`)
+              return
+            }
+          }
+          core.setFailed(`The triggered workflow run didn't start properly using ${{inputs.arc-name}}`)
+
+    - name: Wait for workflow to finish successfully
+      if: inputs.wait-to-finish == 'true'
+      uses: actions/github-script@v7
+      with:
+        script: |
+          // Wait 5 minutes and make sure the workflow run we triggered completed with result 'success'
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_run_id = ${{steps.query_workflow.outputs.workflow_run}}
+          const workflow_job_id = ${{steps.query_workflow.outputs.workflow_job}}
+          let count = 0
+          while (count++<10) {
+            await sleep(30 * 1000);
+            let getRunResponse = await github.rest.actions.getWorkflowRun({
+              owner: owner,
+              repo: repo,
+              run_id: workflow_run_id
+            })
+            console.log(`${getRunResponse.data.html_url}: ${getRunResponse.data.status} (${getRunResponse.data.conclusion})`);
+            if (getRunResponse.data.status == 'completed') {
+              if ( getRunResponse.data.conclusion == 'success') {
+                console.log(`Workflow run finished properly.`)
+                return
+              } else {
+                core.setFailed(`The triggered workflow run finish with result ${getRunResponse.data.conclusion}`)
+                return
+              }
+            }
+          }
+          core.setFailed(`The triggered workflow run didn't finish properly using ${{inputs.arc-name}}`)
+
+    - name: cleanup
+      if: inputs.wait-to-finish == 'true'
+      shell: bash
+      run: |
+        helm uninstall ${{ inputs.arc-name }} --namespace ${{inputs.arc-namespace}} --debug
+        kubectl wait --timeout=30s --for=delete AutoScalingRunnerSet -n ${{inputs.arc-namespace}} -l app.kubernetes.io/instance=${{ inputs.arc-name }}
+
+    - name: Gather logs and cleanup
+      shell: bash
+      if: always()
+      run: |
+        kubectl logs deployment/arc-gha-rs-controller -n ${{inputs.arc-controller-namespace}}

.github/actions/setup-arc-e2e/action.yaml

@@ -0,0 +1,63 @@
+name: 'Setup ARC E2E Test Action'
+description: 'Build controller image, create kind cluster, load the image, and exchange ARC configure token.'
+
+inputs:
+  app-id:
+    description: 'GitHub App Id for exchange access token'
+    required: true
+  app-pk:
+    description: "GitHub App private key for exchange access token"
+    required: true
+  image-name:
+    description: "Local docker image name for building"
+    required: true
+  image-tag:
+    description: "Tag of ARC Docker image for building"
+    required: true
+  target-org:
+    description: "The test organization for ARC e2e test"
+    required: true
+
+outputs:
+  token:
+    description: 'Token to use for configure ARC'
+    value: ${{steps.config-token.outputs.token}}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+          # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
+          # BuildKit v0.11 which has a bug causing intermittent 
+          # failures pushing images to GHCR
+          version: v0.9.1
+          driver-opts: image=moby/buildkit:v0.10.6
+
+    - name: Build controller image
+      uses: docker/build-push-action@v5
+      with:
+        file: Dockerfile
+        platforms: linux/amd64
+        load: true
+        build-args: |
+          DOCKER_IMAGE_NAME=${{inputs.image-name}}
+          VERSION=${{inputs.image-tag}} 
+        tags: |
+          ${{inputs.image-name}}:${{inputs.image-tag}}
+        no-cache: true
+
+    - name: Create minikube cluster and load image
+      shell: bash
+      run: |
+        minikube start
+        minikube image load ${{inputs.image-name}}:${{inputs.image-tag}}
+
+    - name: Get configure token
+      id: config-token
+      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
+      with:
+        application_id: ${{ inputs.app-id }}
+        application_private_key: ${{ inputs.app-pk }}
+        organization: ${{ inputs.target-org}}

.github/actions/setup-docker-environment/action.yaml

@@ -0,0 +1,47 @@
+name: "Setup Docker"
+
+inputs:
+  username:
+    description: "Username"
+    required: true
+  password:
+    description: "Password"
+    required: true
+  ghcr_username:
+    description: "GHCR username. Usually set from the github.actor variable"
+    required: true
+  ghcr_password:
+    description: "GHCR password. Usually set from the secrets.GITHUB_TOKEN variable"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Get Short SHA
+      id: vars
+      run: |
+        echo "sha_short=${GITHUB_SHA::7}" >> $GITHUB_ENV
+      shell: bash
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        version: latest
+
+    - name: Login to DockerHub
+      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.password != ''  }}
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}
+
+    - name: Login to GitHub Container Registry
+      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ghcr_password != ''  }}
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ inputs.ghcr_username }}
+        password: ${{ inputs.ghcr_password }}

.github/dependabot.yml

@@ -9,15 +9,3 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
-    groups:
-      gomod:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns:
-          - "*"

.github/workflows/arc-publish-chart.yaml

@@ -7,16 +7,16 @@ on:
     branches:
     - master
     paths:
-      - "charts/**"
-      - ".github/workflows/arc-publish-chart.yaml"
-      - "!charts/actions-runner-controller/docs/**"
-      - "!charts/gha-runner-scale-set-controller/**"
-      - "!charts/gha-runner-scale-set/**"
-      - "!**.md"
+    - 'charts/**'
+    - '.github/workflows/arc-publish-chart.yaml'
+    - '!charts/actions-runner-controller/docs/**'
+    - '!charts/gha-runner-scale-set-controller/**'
+    - '!charts/gha-runner-scale-set/**'
+    - '!**.md'
   workflow_dispatch:
     inputs:
       force:
-        description: "Force publish even if the chart version is not bumped"
+        description: 'Force publish even if the chart version is not bumped'
         type: boolean
         required: true
         default: false
@@ -40,12 +40,12 @@ jobs:
       publish-chart: ${{ steps.publish-chart-step.outputs.publish }}
     steps:
     - name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
     - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
       with:
         version: ${{ env.HELM_VERSION }}
 
@@ -58,12 +58,12 @@ jobs:
       run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score - --ignore-test pod-networkpolicy --ignore-test deployment-has-poddisruptionbudget --ignore-test deployment-has-host-podantiaffinity --ignore-test container-security-context --ignore-test pod-probes --ignore-test container-image-tag --enable-optional-test container-security-context-privileged --enable-optional-test container-security-context-readonlyrootfilesystem
 
     # python is a requirement for the chart-testing action below (supports yamllint among other tests)
-      - uses: actions/setup-python@v6
+    - uses: actions/setup-python@v5
       with:
-          python-version: "3.11"
+        python-version: '3.11'
 
     - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+      uses: helm/chart-testing-action@v2.6.0
 
     - name: Run chart-testing (list-changed)
       id: list-changed
@@ -79,7 +79,7 @@ jobs:
 
     - name: Create kind cluster
       if: steps.list-changed.outputs.changed == 'true'
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+      uses: helm/kind-action@v1.4.0
 
     # We need cert-manager already installed in the cluster because we assume the CRDs exist
     - name: Install cert-manager
@@ -134,7 +134,7 @@ jobs:
 
     steps:
     - name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
@@ -145,14 +145,14 @@ jobs:
 
     - name: Get Token
       id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
       with:
         application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
         application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}
         organization: ${{ env.CHART_TARGET_ORG }}
 
     - name: Install chart-releaser
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f
+      uses: helm/chart-releaser-action@v1.4.1
       with:
         install_only: true
         install_dir: ${{ github.workspace }}/bin
@@ -184,7 +184,7 @@ jobs:
     # this workaround is intended to move the index.yaml to the target repo
     # where the github pages are hosted
     - name: Checkout target repository
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
       with:
         repository: ${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}
         path: ${{ env.CHART_TARGET_REPO }}

.github/workflows/arc-publish.yaml

@@ -9,10 +9,10 @@ on:
   workflow_dispatch:
     inputs:
       release_tag_name:
-        description: "Tag name of the release to publish"
+        description: 'Tag name of the release to publish'
         required: true
       push_to_registries:
-        description: "Push images to registries"
+        description: 'Push images to registries'
         required: true
         type: boolean
         default: false
@@ -39,15 +39,17 @@ jobs:
     if: ${{ !startsWith(github.event.inputs.release_tag_name, 'gha-runner-scale-set-') }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
 
       - name: Install tools
         run: |
-
+          curl -L -O https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.2.0/kubebuilder_2.2.0_linux_amd64.tar.gz
+          tar zxvf kubebuilder_2.2.0_linux_amd64.tar.gz
+          sudo mv kubebuilder_2.2.0_linux_amd64 /usr/local/kubebuilder
           curl -s https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh | bash
           sudo mv kustomize /usr/local/bin
           curl -L -O https://github.com/tcnksm/ghr/releases/download/v0.13.0/ghr_v0.13.0_linux_amd64.tar.gz
@@ -71,7 +73,7 @@ jobs:
 
       - name: Get Token
         id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
         with:
           application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
           application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}

.github/workflows/arc-release-runners.yaml

@@ -1,6 +1,4 @@
 name: Release ARC Runner Images
-permissions:
-  contents: read
 
 # Revert to https://github.com/actions-runner-controller/releases#releases
 # for details on why we use this approach
@@ -9,17 +7,17 @@ on:
   # are available to the workflow run
   push:
     branches:
-      - "master"
+      - 'master'
     paths:
-      - "runner/VERSION"
-      - ".github/workflows/arc-release-runners.yaml"
+      - 'runner/VERSION'
+      - '.github/workflows/arc-release-runners.yaml'
 
 env:
   # Safeguard to prevent pushing images to registeries after build
   PUSH_TO_REGISTRIES: true
   TARGET_ORG: actions-runner-controller
   TARGET_WORKFLOW: release-runners.yaml
-  DOCKER_VERSION: 28.0.4
+  DOCKER_VERSION: 24.0.7
 
 concurrency:
   group: ${{ github.workflow }}
@@ -30,7 +28,7 @@ jobs:
     name: Trigger Build and Push of Runner Images
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Get runner version
         id: versions
         run: |
@@ -41,7 +39,7 @@ jobs:
 
       - name: Get Token
         id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
         with:
           application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
           application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}

.github/workflows/arc-update-runners-scheduled.yaml

@@ -1,9 +1,6 @@
 # This workflows polls releases from actions/runner and in case of a new one it
 # updates files containing runner version and opens a pull request.
 name: Runner Updates Check (Scheduled Job)
-permissions:
-  pull-requests: write
-  contents: write
 
 on:
   schedule:
@@ -24,7 +21,7 @@ jobs:
       container_hooks_current_version: ${{ steps.container_hooks_versions.outputs.container_hooks_current_version }}
       container_hooks_latest_version: ${{ steps.container_hooks_versions.outputs.container_hooks_latest_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Get runner current and latest versions
         id: runner_versions
@@ -53,8 +50,6 @@ jobs:
   # it sets a PR name as output.
   check_pr:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     needs: check_versions
     if: needs.check_versions.outputs.runner_current_version != needs.check_versions.outputs.runner_latest_version || needs.check_versions.outputs.container_hooks_current_version != needs.check_versions.outputs.container_hooks_latest_version
     outputs:
@@ -69,7 +64,7 @@ jobs:
           echo "CONTAINER_HOOKS_CURRENT_VERSION=${{ needs.check_versions.outputs.container_hooks_current_version }}"
           echo "CONTAINER_HOOKS_LATEST_VERSION=${{ needs.check_versions.outputs.container_hooks_latest_version }}"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: PR Name
         id: pr_name
@@ -124,7 +119,7 @@ jobs:
       PR_NAME: ${{ needs.check_pr.outputs.pr_name }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: New branch
         run: git checkout -b update-runner-"$(date +%Y-%m-%d)"

.github/workflows/arc-validate-chart.yaml

@@ -5,20 +5,20 @@ on:
     branches:
       - master
     paths:
-      - "charts/**"
-      - ".github/workflows/arc-validate-chart.yaml"
-      - "!charts/actions-runner-controller/docs/**"
-      - "!**.md"
-      - "!charts/gha-runner-scale-set-controller/**"
-      - "!charts/gha-runner-scale-set/**"
+      - 'charts/**'
+      - '.github/workflows/arc-validate-chart.yaml'
+      - '!charts/actions-runner-controller/docs/**'
+      - '!**.md'
+      - '!charts/gha-runner-scale-set-controller/**'
+      - '!charts/gha-runner-scale-set/**'
   push:
     paths:
-      - "charts/**"
-      - ".github/workflows/arc-validate-chart.yaml"
-      - "!charts/actions-runner-controller/docs/**"
-      - "!**.md"
-      - "!charts/gha-runner-scale-set-controller/**"
-      - "!charts/gha-runner-scale-set/**"
+      - 'charts/**'
+      - '.github/workflows/arc-validate-chart.yaml'
+      - '!charts/actions-runner-controller/docs/**'
+      - '!**.md'
+      - '!charts/gha-runner-scale-set-controller/**'
+      - '!charts/gha-runner-scale-set/**'
   workflow_dispatch:
 env:
   KUBE_SCORE_VERSION: 1.10.0
@@ -40,22 +40,39 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
+      - name: Set up kube-score
+        run: |
+          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+          chmod 755 kube-score
+
+      - name: Kube-score generated manifests
+        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score -
+              --ignore-test pod-networkpolicy
+              --ignore-test deployment-has-poddisruptionbudget
+              --ignore-test deployment-has-host-podantiaffinity
+              --ignore-test container-security-context
+              --ignore-test pod-probes
+              --ignore-test container-image-tag
+              --enable-optional-test container-security-context-privileged
+              --enable-optional-test container-security-context-readonlyrootfilesystem
+
       # python is a requirement for the chart-testing action below (supports yamllint among other tests)
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: '3.11'
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@v2.6.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -70,7 +87,7 @@ jobs:
           ct lint --config charts/.ci/ct-config.yaml
 
       - name: Create kind cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+        uses: helm/kind-action@v1.4.0
         if: steps.list-changed.outputs.changed == 'true'
 
       # We need cert-manager already installed in the cluster because we assume the CRDs exist

.github/workflows/arc-validate-runners.yaml

@@ -3,11 +3,11 @@ name: Validate ARC Runners
 on:
   pull_request:
     branches:
-      - "**"
+      - '**'
     paths:
-      - "runner/**"
-      - "test/startup/**"
-      - "!**.md"
+      - 'runner/**'
+      - 'test/startup/**'
+      - '!**.md'
 
 permissions:
   contents: read
@@ -24,16 +24,28 @@ jobs:
     name: runner / shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - name: "Run shellcheck"
-        run: make shellcheck
-
+      - uses: actions/checkout@v4
+      - name: shellcheck
+        uses: reviewdog/action-shellcheck@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          path: "./runner"
+          pattern: |
+            *.sh
+            *.bash
+            update-status
+          # Make this consistent with `make shellsheck`
+          shellcheck_flags: "--shell bash --source-path runner"
+          exclude: "./.git/*"
+          check_all_files_with_shebangs: "false"
+          # Set this to "true" once we addressed all the shellcheck findings
+          fail_on_error: "false"
   test-runner-entrypoint:
     name: Test entrypoint
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-        uses: actions/checkout@v6
+      uses: actions/checkout@v4
 
     - name: Run tests
       run: |

.github/workflows/gha-publish-chart.yaml

@@ -4,37 +4,27 @@ on:
   workflow_dispatch:
     inputs:
       ref:
-        description: "The branch, tag or SHA to cut a release from"
+        description: 'The branch, tag or SHA to cut a release from'
         required: false
         type: string
-        default: ""
+        default: ''
       release_tag_name:
-        description: "The name to tag the controller image with"
+        description: 'The name to tag the controller image with'
         required: true
         type: string
-        default: "canary"
+        default: 'canary'
       push_to_registries:
-        description: "Push images to registries"
+        description: 'Push images to registries'
         required: true
         type: boolean
         default: false
       publish_gha_runner_scale_set_controller_chart:
-        description: "Publish new helm chart for gha-runner-scale-set-controller"
-        required: true
-        type: boolean
-        default: false
-      publish_gha_runner_scale_set_controller_experimental_chart:
-        description: "Publish new helm chart for gha-runner-scale-set-controller-experimental"
+        description: 'Publish new helm chart for gha-runner-scale-set-controller'
         required: true
         type: boolean
         default: false
       publish_gha_runner_scale_set_chart:
-        description: "Publish new helm chart for gha-runner-scale-set"
-        required: true
-        type: boolean
-        default: false
-      publish_gha_runner_scale_set_experimental_chart:
-        description: "Publish new helm chart for gha-runner-scale-set-experimental"
+        description: 'Publish new helm chart for gha-runner-scale-set'
         required: true
         type: boolean
         default: false
@@ -55,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -82,10 +72,10 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@v3
         with:
           # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
           # BuildKit v0.11 which has a bug causing intermittent
@@ -94,14 +84,14 @@ jobs:
           driver-opts: image=moby/buildkit:v0.10.6
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build & push controller image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@v5
         with:
           file: Dockerfile
           platforms: linux/amd64,linux/arm64
@@ -110,6 +100,8 @@ jobs:
           tags: |
             ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/gha-runner-scale-set-controller:${{ inputs.release_tag_name }}
             ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/gha-runner-scale-set-controller:${{ inputs.release_tag_name }}-${{ steps.resolve_parameters.outputs.short_sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Job summary
         run: |
@@ -129,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -148,7 +140,8 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
@@ -169,54 +162,6 @@ jobs:
           echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
           echo "- gha-runner-scale-set-controller Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY
 
-  publish-helm-chart-gha-runner-scale-set-controller-experimental:
-    if: ${{ inputs.publish_gha_runner_scale_set_controller_experimental_chart == true }}
-    needs: build-push-image
-    name: Publish Helm chart for gha-runner-scale-set-controller-experimental
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # If inputs.ref is empty, it'll resolve to the default branch
-          ref: ${{ inputs.ref }}
-
-      - name: Resolve parameters
-        id: resolve_parameters
-        run: |
-          resolvedRef="${{ inputs.ref }}"
-          if [ -z "$resolvedRef" ]
-          then
-            resolvedRef="${{ github.ref }}"
-          fi
-          echo "resolved_ref=$resolvedRef" >> $GITHUB_OUTPUT
-          echo "INFO: Resolving short SHA for $resolvedRef"
-          echo "short_sha=$(git rev-parse --short $resolvedRef)" >> $GITHUB_OUTPUT
-          echo "INFO: Normalizing repository name (lowercase)"
-          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
-
-      - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
-        with:
-          version: ${{ env.HELM_VERSION }}
-
-      - name: Publish new helm chart for gha-runner-scale-set-controller-experimental
-        run: |
-          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
-          GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG=$(cat charts/gha-runner-scale-set-controller-experimental/Chart.yaml | grep version: | cut -d " " -d '"' -f 2)
-          echo "GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG=${GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG}" >> $GITHUB_ENV
-          helm package charts/gha-runner-scale-set-controller-experimental/ --version="${GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG}"
-          helm push gha-runner-scale-set-controller-experimental-"${GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG}".tgz oci://ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/actions-runner-controller-charts
-
-      - name: Job summary
-        run: |
-          echo "New helm chart for gha-runner-scale-set-controller-experimental published successfully!" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Parameters:**" >> $GITHUB_STEP_SUMMARY
-          echo "- Ref: ${{ steps.resolve_parameters.outputs.resolved_ref }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
-          echo "- gha-runner-scale-set-controller-experimental Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CONTROLLER_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY
-
   publish-helm-chart-gha-runner-scale-set:
     if: ${{ inputs.publish_gha_runner_scale_set_chart == true }}
     needs: build-push-image
@@ -224,7 +169,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -243,7 +188,8 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
@@ -264,52 +210,3 @@ jobs:
           echo "- Ref: ${{ steps.resolve_parameters.outputs.resolvedRef }}" >> $GITHUB_STEP_SUMMARY
           echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
           echo "- gha-runner-scale-set Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY
-
-  publish-helm-chart-gha-runner-scale-set-experimental:
-    if: ${{ inputs.publish_gha_runner_scale_set_experimental_chart == true }}
-    needs: build-push-image
-    name: Publish Helm chart for gha-runner-scale-set-experimental
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # If inputs.ref is empty, it'll resolve to the default branch
-          ref: ${{ inputs.ref }}
-
-      - name: Resolve parameters
-        id: resolve_parameters
-        run: |
-          resolvedRef="${{ inputs.ref }}"
-          if [ -z "$resolvedRef" ]
-          then
-            resolvedRef="${{ github.ref }}"
-          fi
-          echo "resolved_ref=$resolvedRef" >> $GITHUB_OUTPUT
-          echo "INFO: Resolving short SHA for $resolvedRef"
-          echo "short_sha=$(git rev-parse --short $resolvedRef)" >> $GITHUB_OUTPUT
-          echo "INFO: Normalizing repository name (lowercase)"
-          echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
-
-      - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
-        with:
-          version: ${{ env.HELM_VERSION }}
-
-      - name: Publish new helm chart for gha-runner-scale-set-experimental
-        run: |
-          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
-
-          GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG=$(cat charts/gha-runner-scale-set-experimental/Chart.yaml | grep version: | cut -d " " -d '"' -f 2)
-          echo "GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG=${GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG}" >> $GITHUB_ENV
-          helm package charts/gha-runner-scale-set-experimental/ --version="${GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG}"
-          helm push gha-runner-scale-set-experimental-"${GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG}".tgz oci://ghcr.io/${{ steps.resolve_parameters.outputs.repository_owner }}/actions-runner-controller-charts
-
-      - name: Job summary
-        run: |
-          echo "New helm chart for gha-runner-scale-set-experimental published successfully!" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Parameters:**" >> $GITHUB_STEP_SUMMARY
-          echo "- Ref: ${{ steps.resolve_parameters.outputs.resolved_ref }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Short SHA: ${{ steps.resolve_parameters.outputs.short_sha }}" >> $GITHUB_STEP_SUMMARY
-          echo "- gha-runner-scale-set-experimental Chart version: ${{ env.GHA_RUNNER_SCALE_SET_CHART_VERSION_TAG }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/gha-validate-chart.yaml

@@ -5,20 +5,20 @@ on:
     branches:
       - master
     paths:
-      - "charts/**"
-      - ".github/workflows/gha-validate-chart.yaml"
-      - "!charts/actions-runner-controller/**"
-      - "!**.md"
+      - 'charts/**'
+      - '.github/workflows/gha-validate-chart.yaml'
+      - '!charts/actions-runner-controller/**'
+      - '!**.md'
   push:
     paths:
-      - "charts/**"
-      - ".github/workflows/gha-validate-chart.yaml"
-      - "!charts/actions-runner-controller/**"
-      - "!**.md"
+      - 'charts/**'
+      - '.github/workflows/gha-validate-chart.yaml'
+      - '!charts/actions-runner-controller/**'
+      - '!**.md'
   workflow_dispatch:
 env:
   KUBE_SCORE_VERSION: 1.16.1
-  HELM_VERSION: v3.19.4
+  HELM_VERSION: v3.8.0
 
 permissions:
   contents: read
@@ -36,22 +36,39 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        # Using https://github.com/Azure/setup-helm/releases/tag/v4.2
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
         with:
           version: ${{ env.HELM_VERSION }}
 
+      - name: Set up kube-score
+        run: |
+          wget https://github.com/zegl/kube-score/releases/download/v${{ env.KUBE_SCORE_VERSION }}/kube-score_${{ env.KUBE_SCORE_VERSION }}_linux_amd64 -O kube-score
+          chmod 755 kube-score
+
+      - name: Kube-score generated manifests
+        run: helm template  --values charts/.ci/values-kube-score.yaml charts/* | ./kube-score score -
+              --ignore-test pod-networkpolicy
+              --ignore-test deployment-has-poddisruptionbudget
+              --ignore-test deployment-has-host-podantiaffinity
+              --ignore-test container-security-context
+              --ignore-test pod-probes
+              --ignore-test container-image-tag
+              --enable-optional-test container-security-context-privileged
+              --enable-optional-test container-security-context-readonlyrootfilesystem
+
       # python is a requirement for the chart-testing action below (supports yamllint among other tests)
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: '3.11'
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@v2.6.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -61,39 +78,19 @@ jobs:
           if [[ -n "$changed" ]]; then
             echo "changed=true" >> $GITHUB_OUTPUT
           fi
-          echo "changed_charts<<EOF" >> $GITHUB_OUTPUT
-          echo "$changed" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Install helm-unittest
-        if: |
-          contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-controller-experimental') ||
-          contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-experimental')
-        run: |
-          helm plugin install https://github.com/helm-unittest/helm-unittest.git
-
-      - name: Run helm-unittest (gha-runner-scale-set-controller-experimental)
-        if: contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-controller-experimental')
-        run: |
-          helm unittest ./charts/gha-runner-scale-set-controller-experimental/
-
-      - name: Run helm-unittest (gha-runner-scale-set-experimental)
-        if: contains(steps.list-changed.outputs.changed_charts, 'charts/gha-runner-scale-set-experimental')
-        run: |
-          helm unittest ./charts/gha-runner-scale-set-experimental/
 
       - name: Run chart-testing (lint)
         run: |
           ct lint --config charts/.ci/ct-config-gha.yaml
 
       - name: Set up docker buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@v3
         if: steps.list-changed.outputs.changed == 'true'
         with:
           version: latest
 
       - name: Build controller image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@v5
         if: steps.list-changed.outputs.changed == 'true'
         with:
           file: Dockerfile
@@ -108,7 +105,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Create kind cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+        uses: helm/kind-action@v1.4.0
         if: steps.list-changed.outputs.changed == 'true'
         with:
           cluster_name: chart-testing
@@ -126,21 +123,3 @@ jobs:
         if: steps.list-changed.outputs.changed == 'true'
         run: |
           ct install --config charts/.ci/ct-config-gha.yaml
-  test-chart:
-    name: Test Chart
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: Test gha-runner-scale-set
-        run: go test ./charts/gha-runner-scale-set/...
-      - name: Test gha-runner-scale-set-controller
-        run: go test ./charts/gha-runner-scale-set-controller/...
-      - name: Test gha-runner-scale-set-experimental
-        run: go test ./charts/gha-runner-scale-set-experimental/...
-      - name: Test gha-runner-scale-set-controller-experimental
-        run: go test ./charts/gha-runner-scale-set-controller-experimental/...

.github/workflows/global-publish-canary.yaml

@@ -7,30 +7,30 @@ on:
     branches:
       - master
     paths-ignore:
-      - "**.md"
-      - ".github/actions/**"
-      - ".github/ISSUE_TEMPLATE/**"
-      - ".github/workflows/e2e-test-dispatch-workflow.yaml"
-      - ".github/workflows/gha-e2e-tests.yaml"
-      - ".github/workflows/arc-publish.yaml"
-      - ".github/workflows/arc-publish-chart.yaml"
-      - ".github/workflows/gha-publish-chart.yaml"
-      - ".github/workflows/arc-release-runners.yaml"
-      - ".github/workflows/global-run-codeql.yaml"
-      - ".github/workflows/global-run-first-interaction.yaml"
-      - ".github/workflows/global-run-stale.yaml"
-      - ".github/workflows/arc-update-runners-scheduled.yaml"
-      - ".github/workflows/validate-arc.yaml"
-      - ".github/workflows/arc-validate-chart.yaml"
-      - ".github/workflows/gha-validate-chart.yaml"
-      - ".github/workflows/arc-validate-runners.yaml"
-      - ".github/dependabot.yml"
-      - ".github/RELEASE_NOTE_TEMPLATE.md"
-      - "runner/**"
-      - ".gitignore"
-      - "PROJECT"
-      - "LICENSE"
-      - "Makefile"
+      - '**.md'
+      - '.github/actions/**'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/workflows/e2e-test-dispatch-workflow.yaml'
+      - '.github/workflows/gha-e2e-tests.yaml'
+      - '.github/workflows/arc-publish.yaml'
+      - '.github/workflows/arc-publish-chart.yaml'
+      - '.github/workflows/gha-publish-chart.yaml'
+      - '.github/workflows/arc-release-runners.yaml'
+      - '.github/workflows/global-run-codeql.yaml'
+      - '.github/workflows/global-run-first-interaction.yaml'
+      - '.github/workflows/global-run-stale.yaml'
+      - '.github/workflows/arc-update-runners-scheduled.yaml'
+      - '.github/workflows/validate-arc.yaml'
+      - '.github/workflows/arc-validate-chart.yaml'
+      - '.github/workflows/gha-validate-chart.yaml'
+      - '.github/workflows/arc-validate-runners.yaml'
+      - '.github/dependabot.yml'
+      - '.github/RELEASE_NOTE_TEMPLATE.md'
+      - 'runner/**'
+      - '.gitignore'
+      - 'PROJECT'
+      - 'LICENSE'
+      - 'Makefile'
 
 # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps
 permissions:
@@ -55,11 +55,11 @@ jobs:
       TARGET_REPO: actions-runner-controller
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Get Token
         id: get_workflow_token
-        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343
+        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
         with:
           application_id: ${{ secrets.ACTIONS_ACCESS_APP_ID }}
           application_private_key: ${{ secrets.ACTIONS_ACCESS_PK }}
@@ -90,10 +90,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -110,16 +110,16 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@v3
         with:
           version: latest
 
       # Unstable builds - run at your own risk
       - name: Build and Push
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: ./Dockerfile

.github/workflows/global-run-codeql.yaml

@@ -25,20 +25,20 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v2
         with:
-          languages: go, actions
+          languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v2

.github/workflows/global-run-first-interaction.yaml

@@ -1,10 +1,5 @@
 name: First Interaction
 
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
 on:
   issues:
     types: [opened]
@@ -16,11 +11,11 @@ jobs:
   check_for_first_interaction:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/first-interaction@v3
+      - uses: actions/checkout@v4
+      - uses: actions/first-interaction@main
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          issue_message: |
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          issue-message: |
             Hello! Thank you for filing an issue.
 
             The maintainers will triage your issue shortly.
@@ -28,7 +23,7 @@ jobs:
             In the meantime, please take a look at the [troubleshooting guide](https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md) for bug reports.
             
             If this is a feature request, please review our [contribution guidelines](https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md).
-          pr_message: |
+          pr-message: |
             Hello! Thank you for your contribution.
 
             Please review our [contribution guidelines](https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md) to understand the project's testing and code conventions.

.github/workflows/global-run-stale.yaml

@@ -14,7 +14,7 @@ jobs:
       issues: write         # for actions/stale to close stale issues
       pull-requests: write  # for actions/stale to close stale PRs
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v6
         with:
           stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
           # turn off stale for both issues and PRs

.github/workflows/go.yaml

@@ -4,16 +4,16 @@ on:
     branches:
       - master
     paths:
-      - ".github/workflows/go.yaml"
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
+      - '.github/workflows/go.yaml'
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
   pull_request:
     paths:
-      - ".github/workflows/go.yaml"
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
+      - '.github/workflows/go.yaml'
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
 
 permissions:
   contents: read
@@ -29,10 +29,10 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
           cache: false
       - name: fmt
         run: go fmt ./...
@@ -42,58 +42,47 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
           cache: false
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
+        uses: golangci/golangci-lint-action@v6
         with:
           only-new-issues: true
-          version: v2.11.2
+          version: v1.55.2
 
   generate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
           cache: false
       - name: Generate
         run: make generate
       - name: Check diff
         run: git diff --exit-code
 
-  mocks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: "Run mockery"
-        run: go tool github.com/vektra/mockery/v3
-      - name: Check diff
-        run: git diff --exit-code
-
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
       - run: make manifests
       - name: Check diff
         run: git diff --exit-code
-      - name: Setup envtest
+      - name: Install kubebuilder
         run: |
-          go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(go list -m -f '{{ .Version }}' sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $2, $3}')
-          ENVTEST_K8S_VERSION=$(go list -m -f '{{ .Version }}' k8s.io/api | awk -F'[v.]' '{printf "1.%d", $3}')
-          echo "KUBEBUILDER_ASSETS=$(setup-envtest use ${ENVTEST_K8S_VERSION} -p path)" >> $GITHUB_ENV
+          curl -D headers.txt -fsL "https://storage.googleapis.com/kubebuilder-tools/kubebuilder-tools-1.26.1-linux-amd64.tar.gz" -o kubebuilder-tools
+          echo "$(grep -i etag headers.txt -m 1 | cut -d'"' -f2) kubebuilder-tools" > sum
+          md5sum -c sum
+          tar -zvxf kubebuilder-tools
+          sudo mv kubebuilder /usr/local/
       - name: Run go tests
         run: |
           go test -short `go list ./... | grep -v ./test_e2e_arc`

.gitignore

@@ -34,5 +34,5 @@ bin
 # OS
 .DS_STORE
 
-
+/test-assets
 /.tools

.golangci.yaml

@@ -1,18 +1,19 @@
-version: "2"
 run:
-  timeout: 5m
-linters:
-  settings:
+  timeout: 3m
+output:
+  formats:
+    - format: github-actions
+      path: stdout
+linters-settings:
   errcheck:
     exclude-functions:
       - (net/http.ResponseWriter).Write
       - (*net/http.Server).Shutdown
       - (*github.com/actions/actions-runner-controller/simulator.VisibleRunnerGroups).Add
       - (*github.com/actions/actions-runner-controller/testing.Kind).Stop
-  exclusions:
-    presets:
-      - std-error-handling
-    rules:
-      - linters:
+issues:
+  exclude-rules:
+    - path: controllers/suite_test.go
+      linters:
         - staticcheck
-        text: "QF1008:"
+      text: "SA1019"

.mockery.yaml

@@ -1,17 +0,0 @@
-all: false
-dir: "{{.InterfaceDir}}"
-filename: mocks_test.go
-force-file-write: true
-formatter: goimports
-log-level: info
-structname: "{{.Mock}}{{.InterfaceName}}"
-pkgname: "{{.SrcPackageName}}"
-recursive: false
-template: testify
-packages:
-  github.com/actions/actions-runner-controller/cmd/ghalistener/metrics:
-    config:
-      all: true
-  github.com/actions/actions-runner-controller/controllers/actions.github.com:
-    config:
-      all: true

CODEOWNERS

@@ -1,2 +1,2 @@
 # actions-runner-controller maintainers
-* @mumoshu @toast-gear @actions/actions-launch @actions/actions-compute @nikola-jokic @rentziass @steve-glass
+* @mumoshu @toast-gear @actions/actions-launch @nikola-jokic @rentziass

CONTRIBUTING.md

@@ -102,19 +102,22 @@ A set of example pipelines (./acceptance/pipelines) are provided in this reposit
 When raising a PR please run the relevant suites to prove your change hasn't broken anything.
 
 #### Running Ginkgo Tests
+
 You can run the integration test suite that is written in Ginkgo with:
 
 ```shell
 make test-with-deps
 ```
 
-This will install `setup-envtest`, download the required envtest binaries (etcd, kube-apiserver, kubectl), and then run `go test`.
+This will firstly install a few binaries required to setup the integration test environment and then runs `go test` to start the Ginkgo test.
 
-If you don't want to use `make`, install the envtest binaries using `setup-envtest`:
+If you don't want to use `make`, like when you're running tests from your IDE, install required binaries to `/usr/local/kubebuilder/bin`.
+That's the directory in which controller-runtime's `envtest` framework locates the binaries.
 
 ```shell
-go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
-export KUBEBUILDER_ASSETS=$(setup-envtest use -p path)
+sudo mkdir -p /usr/local/kubebuilder/bin
+make kube-apiserver etcd
+sudo mv test-assets/{etcd,kube-apiserver} /usr/local/kubebuilder/bin/
 go test -v -run TestAPIs github.com/actions/actions-runner-controller/controllers/actions.summerwind.net
 ```
 

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.26.1 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.22.4 as builder
 
 WORKDIR /workspace
 
@@ -30,13 +30,14 @@ ARG TARGETPLATFORM TARGETOS TARGETARCH TARGETVARIANT VERSION=dev COMMIT_SHA=dev
 # to avoid https://github.com/moby/buildkit/issues/2334
 # We can use docker layer cache so the build is fast enogh anyway
 # We also use per-platform GOCACHE for the same reason.
-ENV GOCACHE="/build/${TARGETPLATFORM}/root/.cache/go-build"
+ENV GOCACHE /build/${TARGETPLATFORM}/root/.cache/go-build
 
 # Build
 RUN --mount=target=. \
   --mount=type=cache,mode=0777,target=${GOCACHE} \
   export GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT#v} && \
   go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/manager main.go && \
+  go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/github-runnerscaleset-listener ./cmd/githubrunnerscalesetlistener && \
   go build -trimpath -ldflags="-s -w -X 'github.com/actions/actions-runner-controller/build.Version=${VERSION}' -X 'github.com/actions/actions-runner-controller/build.CommitSHA=${COMMIT_SHA}'" -o /out/ghalistener ./cmd/ghalistener && \
   go build -trimpath -ldflags="-s -w" -o /out/github-webhook-server ./cmd/githubwebhookserver && \
   go build -trimpath -ldflags="-s -w" -o /out/actions-metrics-server ./cmd/actionsmetricsserver && \
@@ -51,6 +52,7 @@ WORKDIR /
 COPY --from=builder /out/manager .
 COPY --from=builder /out/github-webhook-server .
 COPY --from=builder /out/actions-metrics-server .
+COPY --from=builder /out/github-runnerscaleset-listener .
 COPY --from=builder /out/ghalistener .
 COPY --from=builder /out/sleep .
 

Makefile

@@ -6,7 +6,7 @@ endif
 DOCKER_USER ?= $(shell echo ${DOCKER_IMAGE_NAME} | cut -d / -f1)
 VERSION ?= dev
 COMMIT_SHA = $(shell git rev-parse HEAD)
-RUNNER_VERSION ?= 2.334.0
+RUNNER_VERSION ?= 2.319.1
 TARGETPLATFORM ?= $(shell arch)
 RUNNER_NAME ?= ${DOCKER_USER}/actions-runner
 RUNNER_TAG  ?= ${VERSION}
@@ -20,10 +20,10 @@ KUBECONTEXT ?= kind-acceptance
 CLUSTER ?= acceptance
 CERT_MANAGER_VERSION ?= v1.1.1
 KUBE_RBAC_PROXY_VERSION ?= v0.11.0
-SHELLCHECK_VERSION ?= 0.10.0
+SHELLCHECK_VERSION ?= 0.8.0
 
 # Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
-CRD_OPTIONS ?= "crd:generateEmbeddedObjectMeta=true,allowDangerousTypes=true"
+CRD_OPTIONS ?= "crd:generateEmbeddedObjectMeta=true"
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -32,15 +32,21 @@ else
 GOBIN=$(shell go env GOBIN)
 endif
 
+TEST_ASSETS=$(PWD)/test-assets
 TOOLS_PATH=$(PWD)/.tools
 
 OS_NAME := $(shell uname -s | tr A-Z a-z)
 
-# ENVTEST_VERSION is the version of controller-runtime release branch to fetch the envtest setup script
-ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
-# ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries
-ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
-ENVTEST ?= $(GOBIN)/setup-envtest
+# The etcd packages that coreos maintain use different extensions for each *nix OS on their github release page.
+# ETCD_EXTENSION: the storage format file extension listed on the release page.
+# EXTRACT_COMMAND: the  appropriate CLI command for extracting this file format.
+ifeq ($(OS_NAME), darwin)
+ETCD_EXTENSION:=zip
+EXTRACT_COMMAND:=unzip
+else
+ETCD_EXTENSION:=tar.gz
+EXTRACT_COMMAND:=tar -xzf
+endif
 
 # default list of platforms for which multiarch image is built
 ifeq (${PLATFORMS}, )
@@ -62,27 +68,26 @@ endif
 all: manager
 
 lint:
-	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v2.11.2 golangci-lint run
+	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v1.57.2 golangci-lint run
 
 GO_TEST_ARGS ?= -short
 
-
 # Run tests
-test: generate fmt vet manifests shellcheck setup-envtest
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
+test: generate fmt vet manifests shellcheck
 	go test $(GO_TEST_ARGS) `go list ./... | grep -v ./test_e2e_arc` -coverprofile cover.out
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
 	go test -fuzz=Fuzz -fuzztime=10s -run=Fuzz* ./controllers/actions.summerwind.net
 
-test-with-deps: setup-envtest
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
+test-with-deps: kube-apiserver etcd kubectl
+	# See https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/envtest#pkg-constants
+	TEST_ASSET_KUBE_APISERVER=$(KUBE_APISERVER_BIN) \
+	TEST_ASSET_ETCD=$(ETCD_BIN) \
+	TEST_ASSET_KUBECTL=$(KUBECTL_BIN) \
 	  make test
 
-
 # Build manager binary
 manager: generate fmt vet
 	go build -o bin/manager main.go
-	go build -o bin/github-runnerscaleset-listener ./cmd/ghalistener
+	go build -o bin/github-runnerscaleset-listener ./cmd/githubrunnerscalesetlistener
 
 # Run against the configured Kubernetes cluster in ~/.kube/config
 run: generate fmt vet manifests
@@ -112,6 +117,9 @@ manifests: manifests-gen-crds chart-crds
 
 manifests-gen-crds: controller-gen yq
 	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	for YAMLFILE in config/crd/bases/actions*.yaml; do \
+		$(YQ) '.spec.preserveUnknownFields = false' --inplace "$$YAMLFILE" ; \
+	done
 	make manifests-gen-crds-fix DELETE_KEY=x-kubernetes-list-type
 	make manifests-gen-crds-fix DELETE_KEY=x-kubernetes-list-map-keys
 
@@ -177,10 +185,6 @@ chart-crds:
 	cp config/crd/bases/actions.github.com_autoscalinglisteners.yaml charts/gha-runner-scale-set-controller/crds/
 	cp config/crd/bases/actions.github.com_ephemeralrunnersets.yaml charts/gha-runner-scale-set-controller/crds/
 	cp config/crd/bases/actions.github.com_ephemeralrunners.yaml charts/gha-runner-scale-set-controller/crds/
-	cp config/crd/bases/actions.github.com_autoscalingrunnersets.yaml charts/gha-runner-scale-set-controller-experimental/crds/
-	cp config/crd/bases/actions.github.com_autoscalinglisteners.yaml charts/gha-runner-scale-set-controller-experimental/crds/
-	cp config/crd/bases/actions.github.com_ephemeralrunnersets.yaml charts/gha-runner-scale-set-controller-experimental/crds/
-	cp config/crd/bases/actions.github.com_ephemeralrunners.yaml charts/gha-runner-scale-set-controller-experimental/crds/
 	rm charts/actions-runner-controller/crds/actions.github.com_autoscalingrunnersets.yaml
 	rm charts/actions-runner-controller/crds/actions.github.com_autoscalinglisteners.yaml
 	rm charts/actions-runner-controller/crds/actions.github.com_ephemeralrunnersets.yaml
@@ -200,7 +204,7 @@ generate: controller-gen
 
 # Run shellcheck on runner scripts
 shellcheck: shellcheck-install
-	$(TOOLS_PATH)/shellcheck --shell bash --source-path runner runner/*.sh runner/update-status hack/*.sh
+	$(TOOLS_PATH)/shellcheck --shell bash --source-path runner runner/*.sh hack/*.sh
 
 docker-buildx:
 	export DOCKER_CLI_EXPERIMENTAL=enabled ;\
@@ -209,6 +213,8 @@ docker-buildx:
 		docker buildx create --platform ${PLATFORMS} --name container-builder --use;\
 	fi
 	docker buildx build --platform ${PLATFORMS} \
+		--build-arg RUNNER_VERSION=${RUNNER_VERSION} \
+		--build-arg DOCKER_VERSION=${DOCKER_VERSION} \
 		--build-arg VERSION=${VERSION} \
 		--build-arg COMMIT_SHA=${COMMIT_SHA} \
 		-t "${DOCKER_IMAGE_NAME}:${VERSION}" \
@@ -294,10 +300,6 @@ acceptance/runner/startup:
 e2e:
 	go test -count=1 -v -timeout 600s -run '^TestE2E$$' ./test/e2e
 
-.PHONY: gha-e2e
-gha-e2e:
-	bash hack/e2e-test.sh
-
 # Upload release file to GitHub.
 github-release: release
 	ghr ${VERSION} release/
@@ -308,7 +310,7 @@ github-release: release
 # Otherwise we get errors like the below:
 #   Error: failed to install CRD crds/actions.summerwind.dev_runnersets.yaml: CustomResourceDefinition.apiextensions.k8s.io "runnersets.actions.summerwind.dev" is invalid: [spec.validation.openAPIV3Schema.properties[spec].properties[template].properties[spec].properties[containers].items.properties[ports].items.properties[protocol].default: Required value: this property is in x-kubernetes-list-map-keys, so it must have a default or be a required property, spec.validation.openAPIV3Schema.properties[spec].properties[template].properties[spec].properties[initContainers].items.properties[ports].items.properties[protocol].default: Required value: this property is in x-kubernetes-list-map-keys, so it must have a default or be a required property]
 #
-# Note that controller-gen newer than 0.8.1 is needed due to https://github.com/kubernetes-sigs/controller-tools/issues/448
+# Note that controller-gen newer than 0.6.1 is needed due to https://github.com/kubernetes-sigs/controller-tools/issues/448
 # Otherwise ObjectMeta embedded in Spec results in empty on the storage.
 controller-gen:
 ifeq (, $(shell which controller-gen))
@@ -318,7 +320,7 @@ ifeq (, $(wildcard $(GOBIN)/controller-gen))
 	CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\
 	cd $$CONTROLLER_GEN_TMP_DIR ;\
 	go mod init tmp ;\
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.20.1 ;\
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0 ;\
 	rm -rf $$CONTROLLER_GEN_TMP_DIR ;\
 	}
 endif
@@ -363,29 +365,68 @@ ifeq (, $(wildcard $(TOOLS_PATH)/shellcheck))
 endif
 SHELLCHECK=$(TOOLS_PATH)/shellcheck
 
-# find or download envtest
-envtest:
-ifeq (, $(shell which setup-envtest))
-ifeq (, $(wildcard $(GOBIN)/setup-envtest))
+# find or download etcd
+etcd:
+ifeq (, $(shell which etcd))
+ifeq (, $(wildcard $(TEST_ASSETS)/etcd))
 	@{ \
-	set -e ;\
-	ENVTEST_TMP_DIR=$$(mktemp -d) ;\
-	cd $$ENVTEST_TMP_DIR ;\
-	go mod init tmp ;\
-	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(ENVTEST_VERSION) ;\
-	rm -rf $$ENVTEST_TMP_DIR ;\
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/coreos/etcd/releases/download/v3.4.22/etcd-v3.4.22-$(OS_NAME)-amd64.$(ETCD_EXTENSION);\
+	mkdir -p $(TEST_ASSETS) ;\
+	$(EXTRACT_COMMAND) etcd-v3.4.22-$(OS_NAME)-amd64.$(ETCD_EXTENSION) ;\
+	mv etcd-v3.4.22-$(OS_NAME)-amd64/etcd $(TEST_ASSETS)/etcd ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
 	}
-endif
-ENVTEST=$(GOBIN)/setup-envtest
+ETCD_BIN=$(TEST_ASSETS)/etcd
 else
-ENVTEST=$(shell which setup-envtest)
+ETCD_BIN=$(TEST_ASSETS)/etcd
+endif
+else
+ETCD_BIN=$(shell which etcd)
 endif
 
-.PHONY: setup-envtest
-setup-envtest: envtest
-	@echo "Setting up envtest binaries for Kubernetes version $(ENVTEST_K8S_VERSION)..."
-	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path || { \
-		echo "Error: Failed to set up envtest binaries for version $(ENVTEST_K8S_VERSION)."; \
-		exit 1; \
+# find or download kube-apiserver
+kube-apiserver:
+ifeq (, $(shell which kube-apiserver))
+ifeq (, $(wildcard $(TEST_ASSETS)/kube-apiserver))
+	@{ \
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.2/kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mkdir -p $(TEST_ASSETS) ;\
+	tar zxvf kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mv kubebuilder_2.3.2_$(OS_NAME)_amd64/bin/kube-apiserver $(TEST_ASSETS)/kube-apiserver ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
 	}
+KUBE_APISERVER_BIN=$(TEST_ASSETS)/kube-apiserver
+else
+KUBE_APISERVER_BIN=$(TEST_ASSETS)/kube-apiserver
+endif
+else
+KUBE_APISERVER_BIN=$(shell which kube-apiserver)
+endif
 
+# find or download kubectl
+kubectl:
+ifeq (, $(shell which kubectl))
+ifeq (, $(wildcard $(TEST_ASSETS)/kubectl))
+	@{ \
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.2/kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mkdir -p $(TEST_ASSETS) ;\
+	tar zxvf kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mv kubebuilder_2.3.2_$(OS_NAME)_amd64/bin/kubectl $(TEST_ASSETS)/kubectl ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
+	}
+KUBECTL_BIN=$(TEST_ASSETS)/kubectl
+else
+KUBECTL_BIN=$(TEST_ASSETS)/kubectl
+endif
+else
+KUBECTL_BIN=$(shell which kubectl)
+endif

README.md

@@ -11,22 +11,21 @@ Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates and s
 With ARC, you can create runner scale sets that automatically scale based on the number of workflows running in your repository, organization, or enterprise. Because controlled runners can be ephemeral and based on containers, new runner instances can scale up or down rapidly and cleanly. For more information about autoscaling, see ["Autoscaling with self-hosted runners."](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners)
 
 You can set up ARC on Kubernetes using Helm, then create and run a workflow that uses runner scale sets. For more information about runner scale sets, see ["Deploying runner scale sets with Actions Runner Controller."](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/deploying-runner-scale-sets-with-actions-runner-controller#runner-scale-set)
-
 ## People
 
 Actions Runner Controller (ARC) is an open-source project currently developed and maintained in collaboration with the GitHub Actions team, external maintainers @mumoshu and @toast-gear, various [contributors](https://github.com/actions/actions-runner-controller/graphs/contributors), and the [awesome community](https://github.com/actions/actions-runner-controller/discussions).
 
 If you think the project is awesome and is adding value to your business, please consider directly sponsoring [community maintainers](https://github.com/sponsors/actions-runner-controller) and individual contributors via GitHub Sponsors.
 
-If you are already the employer of one of the contributors, sponsoring via GitHub Sponsors might not be an option. Just support them by other means!
+In case you are already the employer of one of contributors, sponsoring via GitHub Sponsors might not be an option. Just support them in other means!
 
 See [the sponsorship dashboard](https://github.com/sponsors/actions-runner-controller) for the former and the current sponsors.
 
 ## Getting Started
 
-To give ARC a try with just a handful of commands, please refer to the [Quickstart guide](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/quickstart-for-actions-runner-controller).
+To give ARC a try with just a handful of commands, Please refer to the [Quickstart guide](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/quickstart-for-actions-runner-controller).
 
-For an overview of ARC, please refer to [About ARC](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller).
+For an overview of ARC, please refer to [About ARC](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller)
 
 With the introduction of [autoscaling runner scale sets](https://github.com/actions/actions-runner-controller/discussions/2775), the existing [autoscaling modes](./docs/automatically-scaling-runners.md) are now legacy. The legacy modes have certain use cases and will continue to be maintained by the community only.
 
@@ -38,7 +37,7 @@ ARC documentation is available on [docs.github.com](https://docs.github.com/en/a
 
 ### Legacy documentation
 
-The following documentation is for the legacy autoscaling modes that continue to be maintained by the community:
+The following documentation is for the legacy autoscaling modes that continue to be maintained by the community
 
 - [Quickstart guide](/docs/quickstart.md)
 - [About ARC](/docs/about-arc.md)

acceptance/pipelines/eks-integration-tests.yaml

@@ -10,17 +10,16 @@ env:
 
 jobs:
   assume-role-in-runner-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
       - name: Test aws-actions/configure-aws-credentials Action
-        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
+        uses: aws-actions/configure-aws-credentials@v1
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ env.ASSUME_ROLE_ARN }}
           role-duration-seconds: 900
   assume-role-in-container-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     container: 
       image: amazon/aws-cli
       env:
@@ -30,8 +29,7 @@ jobs:
         - /var/run/secrets/eks.amazonaws.com/serviceaccount/token:/var/run/secrets/eks.amazonaws.com/serviceaccount/token
     steps:
       - name: Test aws-actions/configure-aws-credentials Action in container
-        # https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.1.0
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
+        uses: aws-actions/configure-aws-credentials@v1
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ env.ASSUME_ROLE_ARN }}

acceptance/pipelines/runner-integration-tests.yaml

@@ -8,7 +8,7 @@ env:
 
 jobs:
   run-step-in-container-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     container: 
       image: alpine
     steps:
@@ -21,7 +21,7 @@ jobs:
               exit 1
           fi
   setup-python-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
       - name: Print native Python environment
         run: |
@@ -41,11 +41,11 @@ jobs:
             echo "Python version detected : $(python --version 2>&1)"
           fi
   setup-node-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
       - uses: actions/setup-node@v2
         with:
-          node-version: "12"
+          node-version: '12'
       - name: Test actions/setup-node works 
         run: |
           VERSION=$(node --version | cut -c 2- | cut -d '.' -f1)
@@ -57,10 +57,9 @@ jobs:
             echo "Node version detected : $(node --version 2>&1)"
           fi
   setup-ruby-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:
-      # https://github.com/ruby/setup-ruby/releases/tag/v1.227.0
-      - uses: ruby/setup-ruby@1a615958ad9d422dd932dc1d5823942ee002799f
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: 3.0
           bundler-cache: true
@@ -75,7 +74,7 @@ jobs:
               echo "Ruby version detected : $(ruby --version 2>&1)"
           fi
   python-shell-test:
-    runs-on: ["self-hosted", "Linux"]
+    runs-on: ['self-hosted', 'Linux']
     steps:      
       - name: Test Python shell works
         run: |

apis/actions.github.com/v1alpha1/appconfig/appconfig.go

@@ -1,89 +0,0 @@
-package appconfig
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"strconv"
-
-	corev1 "k8s.io/api/core/v1"
-)
-
-type AppConfig struct {
-	AppID             string `json:"github_app_id"`
-	AppInstallationID int64  `json:"github_app_installation_id"`
-	AppPrivateKey     string `json:"github_app_private_key"`
-
-	Token string `json:"github_token"`
-}
-
-func (c *AppConfig) tidy() *AppConfig {
-	if len(c.Token) > 0 {
-		return &AppConfig{
-			Token: c.Token,
-		}
-	}
-
-	return &AppConfig{
-		AppID:             c.AppID,
-		AppInstallationID: c.AppInstallationID,
-		AppPrivateKey:     c.AppPrivateKey,
-	}
-}
-
-func (c *AppConfig) Validate() error {
-	if c == nil {
-		return fmt.Errorf("missing app config")
-	}
-	hasToken := len(c.Token) > 0
-	hasGitHubAppAuth := c.hasGitHubAppAuth()
-	if hasToken && hasGitHubAppAuth {
-		return fmt.Errorf("both PAT and GitHub App credentials provided. should only provide one")
-	}
-	if !hasToken && !hasGitHubAppAuth {
-		return fmt.Errorf("no credentials provided: either a PAT or GitHub App credentials should be provided")
-	}
-
-	return nil
-}
-
-func (c *AppConfig) hasGitHubAppAuth() bool {
-	return len(c.AppID) > 0 && c.AppInstallationID > 0 && len(c.AppPrivateKey) > 0
-}
-
-func FromSecret(secret *corev1.Secret) (*AppConfig, error) {
-	var appInstallationID int64
-	if v := string(secret.Data["github_app_installation_id"]); v != "" {
-		val, err := strconv.ParseInt(v, 10, 64)
-		if err != nil {
-			return nil, err
-		}
-		appInstallationID = val
-	}
-
-	cfg := &AppConfig{
-		Token:             string(secret.Data["github_token"]),
-		AppID:             string(secret.Data["github_app_id"]),
-		AppInstallationID: appInstallationID,
-		AppPrivateKey:     string(secret.Data["github_app_private_key"]),
-	}
-
-	if err := cfg.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate config: %v", err)
-	}
-
-	return cfg.tidy(), nil
-}
-
-func FromJSONString(v string) (*AppConfig, error) {
-	var appConfig AppConfig
-	if err := json.NewDecoder(bytes.NewBufferString(v)).Decode(&appConfig); err != nil {
-		return nil, err
-	}
-
-	if err := appConfig.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate app config decoded from string: %w", err)
-	}
-
-	return appConfig.tidy(), nil
-}

apis/actions.github.com/v1alpha1/appconfig/appconfig_test.go

@@ -1,152 +0,0 @@
-package appconfig
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	corev1 "k8s.io/api/core/v1"
-)
-
-func TestAppConfigValidate_invalid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"empty": {},
-		"token and app config": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-			Token:             "token",
-		},
-		"app id not set": {
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-		"app installation id not set": {
-			AppID:         "2",
-			AppPrivateKey: "private key",
-		},
-		"private key empty": {
-			AppID:             "2",
-			AppInstallationID: 1,
-			AppPrivateKey:     "",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.Error(t, err)
-		})
-	}
-}
-
-func TestAppConfigValidate_valid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"token": {
-			Token: "token",
-		},
-		"app ID": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			err := cfg.Validate()
-			require.NoError(t, err)
-		})
-	}
-}
-
-func TestAppConfigFromSecret_invalid(t *testing.T) {
-	tt := map[string]map[string]string{
-		"empty": {},
-		"token and app provided": {
-			"github_token":              "token",
-			"github_app_id":             "2",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-		"invalid app id": {
-			"github_app_id":             "abc",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-		"invalid app installation_id": {
-			"github_app_id":             "1",
-			"githu_app_installation_id": "abc",
-			"github_app_private_key":    "private key",
-		},
-		"empty private key": {
-			"github_app_id":             "1",
-			"githu_app_installation_id": "2",
-			"github_app_private_key":    "",
-		},
-	}
-
-	for name, data := range tt {
-		t.Run(name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				StringData: data,
-			}
-
-			appConfig, err := FromSecret(secret)
-			assert.Error(t, err)
-			assert.Nil(t, appConfig)
-		})
-	}
-}
-
-func TestAppConfigFromSecret_valid(t *testing.T) {
-	tt := map[string]map[string]string{
-		"with token": {
-			"github_token": "token",
-		},
-		"app config": {
-			"github_app_id":             "2",
-			"githu_app_installation_id": "3",
-			"github_app_private_key":    "private key",
-		},
-	}
-
-	for name, data := range tt {
-		t.Run(name, func(t *testing.T) {
-			secret := &corev1.Secret{
-				StringData: data,
-			}
-
-			appConfig, err := FromSecret(secret)
-			assert.Error(t, err)
-			assert.Nil(t, appConfig)
-		})
-	}
-}
-
-func TestAppConfigFromString_valid(t *testing.T) {
-	tt := map[string]*AppConfig{
-		"token": {
-			Token: "token",
-		},
-		"app ID": {
-			AppID:             "1",
-			AppInstallationID: 2,
-			AppPrivateKey:     "private key",
-		},
-	}
-
-	for name, cfg := range tt {
-		t.Run(name, func(t *testing.T) {
-			bytes, err := json.Marshal(cfg)
-			require.NoError(t, err)
-
-			got, err := FromJSONString(string(bytes))
-			require.NoError(t, err)
-
-			want := cfg.tidy()
-			assert.Equal(t, want, got)
-		})
-	}
-}

apis/actions.github.com/v1alpha1/autoscalinglistener_types.go

@@ -59,28 +59,10 @@ type AutoscalingListenerSpec struct {
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
 
 	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
-	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
-
-	// +optional
-	Metrics *MetricsConfig `json:"metrics,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
 
 	// +optional
 	Template *corev1.PodTemplateSpec `json:"template,omitempty"`
-
-	// +optional
-	ConfigSecretMetadata *ResourceMeta `json:"configSecretMetadata,omitempty"`
-
-	// +optional
-	ServiceAccountMetadata *ResourceMeta `json:"serviceAccountMetadata,omitempty"`
-
-	// +optional
-	RoleMetadata *ResourceMeta `json:"roleMetadata,omitempty"`
-
-	// +optional
-	RoleBindingMetadata *ResourceMeta `json:"roleBindingMetadata,omitempty"`
 }
 
 // AutoscalingListenerStatus defines the observed state of AutoscalingListener
@@ -102,6 +84,7 @@ type AutoscalingListener struct {
 }
 
 //+kubebuilder:object:root=true
+
 // AutoscalingListenerList contains a list of AutoscalingListener
 type AutoscalingListenerList struct {
 	metav1.TypeMeta `json:",inline"`

apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go

@@ -24,7 +24,6 @@ import (
 	"strings"
 
 	"github.com/actions/actions-runner-controller/hash"
-	"github.com/actions/actions-runner-controller/vault"
 	"golang.org/x/net/http/httpproxy"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -66,51 +65,18 @@ type AutoscalingRunnerSetSpec struct {
 	// +optional
 	RunnerScaleSetName string `json:"runnerScaleSetName,omitempty"`
 
-	// +optional
-	RunnerScaleSetLabels []string `json:"runnerScaleSetLabels,omitempty"`
-
 	// +optional
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
 
 	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
-	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
 
 	// Required
 	Template corev1.PodTemplateSpec `json:"template,omitempty"`
 
-	// +optional
-	AutoscalingListenerMetadata *ResourceMeta `json:"autoscalingListener,omitempty"`
-
-	// +optional
-	ListenerMetrics *MetricsConfig `json:"listenerMetrics,omitempty"`
-
 	// +optional
 	ListenerTemplate *corev1.PodTemplateSpec `json:"listenerTemplate,omitempty"`
 
-	// +optional
-	ListenerServiceAccountMetadata *ResourceMeta `json:"listenerServiceAccountMetadata,omitempty"`
-
-	// +optional
-	ListenerRoleMetadata *ResourceMeta `json:"listenerRoleMetadata,omitempty"`
-
-	// +optional
-	ListenerRoleBindingMetadata *ResourceMeta `json:"listenerRoleBindingMetadata,omitempty"`
-
-	// +optional
-	ListenerConfigSecretMetadata *ResourceMeta `json:"listenerConfigSecretMetadata,omitempty"`
-
-	// +optional
-	EphemeralRunnerSetMetadata *ResourceMeta `json:"ephemeralRunnerSetMetadata,omitempty"`
-
-	// +optional
-	EphemeralRunnerMetadata *ResourceMeta `json:"ephemeralRunnerMetadata,omitempty"`
-
-	// +optional
-	EphemeralRunnerConfigSecretMetadata *ResourceMeta `json:"ephemeralRunnerConfigSecretMetadata,omitempty"`
-
 	// +optional
 	// +kubebuilder:validation:Minimum:=0
 	MaxRunners *int `json:"maxRunners,omitempty"`
@@ -120,12 +86,12 @@ type AutoscalingRunnerSetSpec struct {
 	MinRunners *int `json:"minRunners,omitempty"`
 }
 
-type TLSConfig struct {
+type GitHubServerTLSConfig struct {
 	// Required
 	CertificateFrom *TLSCertificateSource `json:"certificateFrom,omitempty"`
 }
 
-func (c *TLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error)) (*x509.CertPool, error) {
+func (c *GitHubServerTLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error)) (*x509.CertPool, error) {
 	if c.CertificateFrom == nil {
 		return nil, fmt.Errorf("certificateFrom not specified")
 	}
@@ -173,7 +139,7 @@ type ProxyConfig struct {
 	NoProxy []string `json:"noProxy,omitempty"`
 }
 
-func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secret, error)) (*httpproxy.Config, error) {
+func (c *ProxyConfig) toHTTPProxyConfig(secretFetcher func(string) (*corev1.Secret, error)) (*httpproxy.Config, error) {
 	config := &httpproxy.Config{
 		NoProxy: strings.Join(c.NoProxy, ","),
 	}
@@ -232,7 +198,7 @@ func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secr
 }
 
 func (c *ProxyConfig) ToSecretData(secretFetcher func(string) (*corev1.Secret, error)) (map[string][]byte, error) {
-	config, err := c.ToHTTPProxyConfig(secretFetcher)
+	config, err := c.toHTTPProxyConfig(secretFetcher)
 	if err != nil {
 		return nil, err
 	}
@@ -246,7 +212,7 @@ func (c *ProxyConfig) ToSecretData(secretFetcher func(string) (*corev1.Secret, e
 }
 
 func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, error)) (func(*http.Request) (*url.URL, error), error) {
-	config, err := c.ToHTTPProxyConfig(secretFetcher)
+	config, err := c.toHTTPProxyConfig(secretFetcher)
 	if err != nil {
 		return nil, err
 	}
@@ -266,59 +232,13 @@ type ProxyServerConfig struct {
 	CredentialSecretRef string `json:"credentialSecretRef,omitempty"`
 }
 
-type VaultConfig struct {
-	// +optional
-	Type vault.VaultType `json:"type,omitempty"`
-	// +optional
-	AzureKeyVault *AzureKeyVaultConfig `json:"azureKeyVault,omitempty"`
-	// +optional
-	Proxy *ProxyConfig `json:"proxy,omitempty"`
-}
-
-type AzureKeyVaultConfig struct {
-	// +required
-	URL string `json:"url,omitempty"`
-	// +required
-	TenantID string `json:"tenantId,omitempty"`
-	// +required
-	ClientID string `json:"clientId,omitempty"`
-	// +required
-	CertificatePath string `json:"certificatePath,omitempty"`
-}
-
-// MetricsConfig holds configuration parameters for each metric type
-type MetricsConfig struct {
-	// +optional
-	Counters map[string]*CounterMetric `json:"counters,omitempty"`
-	// +optional
-	Gauges map[string]*GaugeMetric `json:"gauges,omitempty"`
-	// +optional
-	Histograms map[string]*HistogramMetric `json:"histograms,omitempty"`
-}
-
-// CounterMetric holds configuration of a single metric of type Counter
-type CounterMetric struct {
-	Labels []string `json:"labels"`
-}
-
-// GaugeMetric holds configuration of a single metric of type Gauge
-type GaugeMetric struct {
-	Labels []string `json:"labels"`
-}
-
-// HistogramMetric holds configuration of a single metric of type Histogram
-type HistogramMetric struct {
-	Labels  []string  `json:"labels"`
-	Buckets []float64 `json:"buckets,omitempty"`
-}
-
 // AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet
 type AutoscalingRunnerSetStatus struct {
 	// +optional
 	CurrentRunners int `json:"currentRunners"`
 
 	// +optional
-	Phase AutoscalingRunnerSetPhase `json:"phase"`
+	State string `json:"state"`
 
 	// EphemeralRunner counts separated by the stage ephemeral runners are in, taken from the EphemeralRunnerSet
 
@@ -330,63 +250,12 @@ type AutoscalingRunnerSetStatus struct {
 	FailedEphemeralRunners int `json:"failedEphemeralRunners"`
 }
 
-type AutoscalingRunnerSetPhase string
-
-const (
-	// AutoscalingRunnerSetPhasePending phase means that the listener is not
-	// yet started
-	AutoscalingRunnerSetPhasePending  AutoscalingRunnerSetPhase = "Pending"
-	AutoscalingRunnerSetPhaseRunning  AutoscalingRunnerSetPhase = "Running"
-	AutoscalingRunnerSetPhaseOutdated AutoscalingRunnerSetPhase = "Outdated"
-)
-
-func (ars *AutoscalingRunnerSet) Hash() string {
-	type data struct {
-		Spec   *AutoscalingRunnerSetSpec
-		Labels map[string]string
-	}
-
-	d := &data{
-		Spec:   ars.Spec.DeepCopy(),
-		Labels: ars.Labels,
-	}
-
-	return hash.ComputeTemplateHash(d)
-}
-
 func (ars *AutoscalingRunnerSet) ListenerSpecHash() string {
 	arsSpec := ars.Spec.DeepCopy()
 	spec := arsSpec
 	return hash.ComputeTemplateHash(&spec)
 }
 
-func (ars *AutoscalingRunnerSet) GitHubConfigSecret() string {
-	return ars.Spec.GitHubConfigSecret
-}
-
-func (ars *AutoscalingRunnerSet) GitHubConfigUrl() string {
-	return ars.Spec.GitHubConfigUrl
-}
-
-func (ars *AutoscalingRunnerSet) GitHubProxy() *ProxyConfig {
-	return ars.Spec.Proxy
-}
-
-func (ars *AutoscalingRunnerSet) GitHubServerTLS() *TLSConfig {
-	return ars.Spec.GitHubServerTLS
-}
-
-func (ars *AutoscalingRunnerSet) VaultConfig() *VaultConfig {
-	return ars.Spec.VaultConfig
-}
-
-func (ars *AutoscalingRunnerSet) VaultProxy() *ProxyConfig {
-	if ars.Spec.VaultConfig != nil {
-		return ars.Spec.VaultConfig.Proxy
-	}
-	return nil
-}
-
 func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 	type runnerSetSpec struct {
 		GitHubConfigUrl    string
@@ -394,7 +263,7 @@ func (ars *AutoscalingRunnerSet) RunnerSetSpecHash() string {
 		RunnerGroup        string
 		RunnerScaleSetName string
 		Proxy              *ProxyConfig
-		GitHubServerTLS    *TLSConfig
+		GitHubServerTLS    *GitHubServerTLSConfig
 		Template           corev1.PodTemplateSpec
 	}
 	spec := &runnerSetSpec{

apis/actions.github.com/v1alpha1/common.go

@@ -1,9 +0,0 @@
-package v1alpha1
-
-// ResourceMeta carries metadata common to all internal resources
-type ResourceMeta struct {
-	// +optional
-	Labels map[string]string `json:"labels,omitempty"`
-	// +optional
-	Annotations map[string]string `json:"annotations,omitempty"`
-}

apis/actions.github.com/v1alpha1/ephemeralrunner_types.go

@@ -21,10 +21,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// EphemeralRunnerContainerName is the name of the runner container.
-// It represents the name of the container running the self-hosted runner image.
-const EphemeralRunnerContainerName = "runner"
-
 //+kubebuilder:object:root=true
 //+kubebuilder:subresource:status
 // +kubebuilder:printcolumn:JSONPath=".spec.githubConfigUrl",name="GitHub Config URL",type=string
@@ -34,7 +30,6 @@ const EphemeralRunnerContainerName = "runner"
 // +kubebuilder:printcolumn:JSONPath=".status.jobWorkflowRef",name=JobWorkflowRef,type=string
 // +kubebuilder:printcolumn:JSONPath=".status.workflowRunId",name=WorkflowRunId,type=number
 // +kubebuilder:printcolumn:JSONPath=".status.jobDisplayName",name=JobDisplayName,type=string
-// +kubebuilder:printcolumn:JSONPath=".status.jobId",name=JobId,type=string
 // +kubebuilder:printcolumn:JSONPath=".status.message",name=Message,type=string
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 
@@ -48,70 +43,22 @@ type EphemeralRunner struct {
 }
 
 func (er *EphemeralRunner) IsDone() bool {
-	return er.Status.Phase == EphemeralRunnerPhaseSucceeded || er.Status.Phase == EphemeralRunnerPhaseFailed || er.Status.Phase == EphemeralRunnerPhaseOutdated
-}
-
-func (er *EphemeralRunner) HasJob() bool {
-	return len(er.Status.JobID) > 0
-}
-
-func (er *EphemeralRunner) HasContainerHookConfigured() bool {
-	for i := range er.Spec.Spec.Containers {
-		if er.Spec.Spec.Containers[i].Name != EphemeralRunnerContainerName {
-			continue
-		}
-
-		for _, env := range er.Spec.Spec.Containers[i].Env {
-			if env.Name == "ACTIONS_RUNNER_CONTAINER_HOOKS" {
-				return true
-			}
-		}
-
-		return false
-	}
-	return false
-}
-
-func (er *EphemeralRunner) GitHubConfigSecret() string {
-	return er.Spec.GitHubConfigSecret
-}
-
-func (er *EphemeralRunner) GitHubConfigUrl() string {
-	return er.Spec.GitHubConfigUrl
-}
-
-func (er *EphemeralRunner) GitHubProxy() *ProxyConfig {
-	return er.Spec.Proxy
-}
-
-func (er *EphemeralRunner) GitHubServerTLS() *TLSConfig {
-	return er.Spec.GitHubServerTLS
-}
-
-func (er *EphemeralRunner) VaultConfig() *VaultConfig {
-	return er.Spec.VaultConfig
-}
-
-func (er *EphemeralRunner) VaultProxy() *ProxyConfig {
-	if er.Spec.VaultConfig != nil {
-		return er.Spec.VaultConfig.Proxy
-	}
-	return nil
+	return er.Status.Phase == corev1.PodSucceeded || er.Status.Phase == corev1.PodFailed
 }
 
 // EphemeralRunnerSpec defines the desired state of EphemeralRunner
 type EphemeralRunnerSpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
 	// +required
 	GitHubConfigUrl string `json:"githubConfigUrl,omitempty"`
 
 	// +required
 	GitHubConfigSecret string `json:"githubConfigSecret,omitempty"`
 
-	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
 	// +required
-	RunnerScaleSetID int `json:"runnerScaleSetId,omitempty"`
+	RunnerScaleSetId int `json:"runnerScaleSetId,omitempty"`
 
 	// +optional
 	Proxy *ProxyConfig `json:"proxy,omitempty"`
@@ -120,16 +67,17 @@ type EphemeralRunnerSpec struct {
 	ProxySecretRef string `json:"proxySecretRef,omitempty"`
 
 	// +optional
-	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
-
-	// +optional
-	EphemeralRunnerConfigSecretMetadata *ResourceMeta `json:"ephemeralRunnerConfigSecretMetadata,omitempty"`
+	GitHubServerTLS *GitHubServerTLSConfig `json:"githubServerTLS,omitempty"`
 
+	// +required
 	corev1.PodTemplateSpec `json:",inline"`
 }
 
 // EphemeralRunnerStatus defines the observed state of EphemeralRunner
 type EphemeralRunnerStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
 	// Turns true only if the runner is online.
 	// +optional
 	Ready bool `json:"ready"`
@@ -143,25 +91,24 @@ type EphemeralRunnerStatus struct {
 	// The PodSucceded phase should be set only when confirmed that EphemeralRunner
 	// actually executed the job and has been removed from the service.
 	// +optional
-	Phase EphemeralRunnerPhase `json:"phase,omitempty"`
+	Phase corev1.PodPhase `json:"phase,omitempty"`
 	// +optional
 	Reason string `json:"reason,omitempty"`
 	// +optional
 	Message string `json:"message,omitempty"`
 
 	// +optional
-	RunnerID int `json:"runnerId,omitempty"`
+	RunnerId int `json:"runnerId,omitempty"`
 	// +optional
 	RunnerName string `json:"runnerName,omitempty"`
+	// +optional
+	RunnerJITConfig string `json:"runnerJITConfig,omitempty"`
 
 	// +optional
-	Failures map[string]metav1.Time `json:"failures,omitempty"`
+	Failures map[string]bool `json:"failures,omitempty"`
 
 	// +optional
-	JobRequestID int64 `json:"jobRequestId,omitempty"`
-
-	// +optional
-	JobID string `json:"jobId,omitempty"`
+	JobRequestId int64 `json:"jobRequestId,omitempty"`
 
 	// +optional
 	JobRepositoryName string `json:"jobRepositoryName,omitempty"`
@@ -170,47 +117,12 @@ type EphemeralRunnerStatus struct {
 	JobWorkflowRef string `json:"jobWorkflowRef,omitempty"`
 
 	// +optional
-	WorkflowRunID int64 `json:"workflowRunId,omitempty"`
+	WorkflowRunId int64 `json:"workflowRunId,omitempty"`
 
 	// +optional
 	JobDisplayName string `json:"jobDisplayName,omitempty"`
 }
 
-// EphemeralRunnerPhase is the phase of the ephemeral runner.
-// It must be a superset of the pod phase.
-type EphemeralRunnerPhase string
-
-const (
-	// EphemeralRunnerPhasePending is a phase set when the ephemeral runner is
-	// being provisioned and is not yet online.
-	EphemeralRunnerPhasePending EphemeralRunnerPhase = "Pending"
-	// EphemeralRunnerPhaseRunning is a phase set when the ephemeral runner is online and
-	// waiting for a job to execute.
-	EphemeralRunnerPhaseRunning EphemeralRunnerPhase = "Running"
-	// EphemeralRunnerPhaseSucceeded is a phase set when the ephemeral runner
-	// successfully executed the job and has been removed from the service.
-	EphemeralRunnerPhaseSucceeded EphemeralRunnerPhase = "Succeeded"
-	// EphemeralRunnerPhaseFailed is a phase set when the ephemeral runner
-	// fails with unrecoverable failure.
-	EphemeralRunnerPhaseFailed EphemeralRunnerPhase = "Failed"
-	// EphemeralRunnerPhaseOutdated is a special phase that indicates the runner is outdated and should be upgraded.
-	EphemeralRunnerPhaseOutdated EphemeralRunnerPhase = "Outdated"
-)
-
-func (s *EphemeralRunnerStatus) LastFailure() metav1.Time {
-	var maxTime metav1.Time
-	if len(s.Failures) == 0 {
-		return maxTime
-	}
-
-	for _, ts := range s.Failures {
-		if ts.After(maxTime.Time) {
-			maxTime = ts
-		}
-	}
-	return maxTime
-}
-
 //+kubebuilder:object:root=true
 
 // EphemeralRunnerList contains a list of EphemeralRunner

apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go

@@ -26,36 +26,25 @@ type EphemeralRunnerSetSpec struct {
 	Replicas int `json:"replicas,omitempty"`
 	// PatchID is the unique identifier for the patch issued by the listener app
 	PatchID int `json:"patchID"`
-	// EphemeralRunnerSpec is the spec of the ephemeral runner
+
 	EphemeralRunnerSpec EphemeralRunnerSpec `json:"ephemeralRunnerSpec,omitempty"`
-	// +optional
-	EphemeralRunnerMetadata *ResourceMeta `json:"ephemeralRunnerMetadata,omitempty"`
 }
 
 // EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet
 type EphemeralRunnerSetStatus struct {
 	// CurrentReplicas is the number of currently running EphemeralRunner resources being managed by this EphemeralRunnerSet.
 	CurrentReplicas int `json:"currentReplicas"`
+
+	// EphemeralRunner counts separated by the stage ephemeral runners are in
+
 	// +optional
 	PendingEphemeralRunners int `json:"pendingEphemeralRunners"`
 	// +optional
 	RunningEphemeralRunners int `json:"runningEphemeralRunners"`
 	// +optional
 	FailedEphemeralRunners int `json:"failedEphemeralRunners"`
-	// +optional
-	Phase EphemeralRunnerSetPhase `json:"phase"`
 }
 
-// EphemeralRunnerSetPhase is the phase of the ephemeral runner set resource
-type EphemeralRunnerSetPhase string
-
-const (
-	EphemeralRunnerSetPhaseRunning EphemeralRunnerSetPhase = "Running"
-	// EphemeralRunnerSetPhaseOutdated is set when at least one ephemeral runner
-	// contains the outdated phase
-	EphemeralRunnerSetPhaseOutdated EphemeralRunnerSetPhase = "Outdated"
-)
-
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:JSONPath=".spec.replicas",name="DesiredReplicas",type="integer"
@@ -74,35 +63,9 @@ type EphemeralRunnerSet struct {
 	Status EphemeralRunnerSetStatus `json:"status,omitempty"`
 }
 
-func (ers *EphemeralRunnerSet) GitHubConfigSecret() string {
-	return ers.Spec.EphemeralRunnerSpec.GitHubConfigSecret
-}
-
-func (ers *EphemeralRunnerSet) GitHubConfigUrl() string {
-	return ers.Spec.EphemeralRunnerSpec.GitHubConfigUrl
-}
-
-func (ers *EphemeralRunnerSet) GitHubProxy() *ProxyConfig {
-	return ers.Spec.EphemeralRunnerSpec.Proxy
-}
-
-func (ers *EphemeralRunnerSet) GitHubServerTLS() *TLSConfig {
-	return ers.Spec.EphemeralRunnerSpec.GitHubServerTLS
-}
-
-func (ers *EphemeralRunnerSet) VaultConfig() *VaultConfig {
-	return ers.Spec.EphemeralRunnerSpec.VaultConfig
-}
-
-func (ers *EphemeralRunnerSet) VaultProxy() *ProxyConfig {
-	if ers.Spec.EphemeralRunnerSpec.VaultConfig != nil {
-		return ers.Spec.EphemeralRunnerSpec.VaultConfig.Proxy
-	}
-	return nil
-}
+//+kubebuilder:object:root=true
 
 // EphemeralRunnerSetList contains a list of EphemeralRunnerSet
-// +kubebuilder:object:root=true
 type EphemeralRunnerSetList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`

apis/actions.github.com/v1alpha1/tls_config_test.go

@@ -0,0 +1,105 @@
+package v1alpha1_test
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
+	"github.com/actions/actions-runner-controller/github/actions/testserver"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	v1 "k8s.io/api/core/v1"
+)
+
+func TestGitHubServerTLSConfig_ToCertPool(t *testing.T) {
+	t.Run("returns an error if CertificateFrom not specified", func(t *testing.T) {
+		c := &v1alpha1.GitHubServerTLSConfig{
+			CertificateFrom: nil,
+		}
+
+		pool, err := c.ToCertPool(nil)
+		assert.Nil(t, pool)
+
+		require.Error(t, err)
+		assert.Equal(t, err.Error(), "certificateFrom not specified")
+	})
+
+	t.Run("returns an error if CertificateFrom.ConfigMapKeyRef not specified", func(t *testing.T) {
+		c := &v1alpha1.GitHubServerTLSConfig{
+			CertificateFrom: &v1alpha1.TLSCertificateSource{},
+		}
+
+		pool, err := c.ToCertPool(nil)
+		assert.Nil(t, pool)
+
+		require.Error(t, err)
+		assert.Equal(t, err.Error(), "configMapKeyRef not specified")
+	})
+
+	t.Run("returns a valid cert pool with correct configuration", func(t *testing.T) {
+		c := &v1alpha1.GitHubServerTLSConfig{
+			CertificateFrom: &v1alpha1.TLSCertificateSource{
+				ConfigMapKeyRef: &v1.ConfigMapKeySelector{
+					LocalObjectReference: v1.LocalObjectReference{
+						Name: "name",
+					},
+					Key: "key",
+				},
+			},
+		}
+
+		certsFolder := filepath.Join(
+			"../../../",
+			"github",
+			"actions",
+			"testdata",
+		)
+
+		fetcher := func(name, key string) ([]byte, error) {
+			cert, err := os.ReadFile(filepath.Join(certsFolder, "rootCA.crt"))
+			require.NoError(t, err)
+
+			pool := x509.NewCertPool()
+			ok := pool.AppendCertsFromPEM(cert)
+			assert.True(t, ok)
+
+			return cert, nil
+		}
+
+		pool, err := c.ToCertPool(fetcher)
+		require.NoError(t, err)
+		require.NotNil(t, pool)
+
+		// can be used to communicate with a server
+		serverSuccessfullyCalled := false
+		server := testserver.NewUnstarted(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			serverSuccessfullyCalled = true
+			w.WriteHeader(http.StatusOK)
+		}))
+
+		cert, err := tls.LoadX509KeyPair(
+			filepath.Join(certsFolder, "server.crt"),
+			filepath.Join(certsFolder, "server.key"),
+		)
+		require.NoError(t, err)
+
+		server.TLS = &tls.Config{Certificates: []tls.Certificate{cert}}
+		server.StartTLS()
+
+		client := &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{
+					RootCAs: pool,
+				},
+			},
+		}
+
+		_, err = client.Get(server.URL)
+		assert.NoError(t, err)
+		assert.True(t, serverSuccessfullyCalled)
+	})
+}

apis/actions.github.com/v1alpha1/version.go

@@ -1,72 +0,0 @@
-package v1alpha1
-
-import "strings"
-
-func IsVersionAllowed(resourceVersion, buildVersion string) bool {
-	if buildVersion == "dev" || resourceVersion == buildVersion || strings.HasPrefix(buildVersion, "canary-") {
-		return true
-	}
-
-	rv, ok := parseSemver(resourceVersion)
-	if !ok {
-		return false
-	}
-	bv, ok := parseSemver(buildVersion)
-	if !ok {
-		return false
-	}
-	return rv.major == bv.major && rv.minor == bv.minor
-}
-
-type semver struct {
-	major string
-	minor string
-}
-
-func parseSemver(v string) (p semver, ok bool) {
-	if v == "" {
-		return
-	}
-	p.major, v, ok = parseInt(v)
-	if !ok {
-		return p, false
-	}
-	if v == "" {
-		p.minor = "0"
-		return p, true
-	}
-	if v[0] != '.' {
-		return p, false
-	}
-	p.minor, v, ok = parseInt(v[1:])
-	if !ok {
-		return p, false
-	}
-	if v == "" {
-		return p, true
-	}
-	if v[0] != '.' {
-		return p, false
-	}
-	if _, _, ok = parseInt(v[1:]); !ok {
-		return p, false
-	}
-	return p, true
-}
-
-func parseInt(v string) (t, rest string, ok bool) {
-	if v == "" {
-		return
-	}
-	if v[0] < '0' || '9' < v[0] {
-		return
-	}
-	i := 1
-	for i < len(v) && '0' <= v[i] && v[i] <= '9' {
-		i++
-	}
-	if v[0] == '0' && i != 1 {
-		return
-	}
-	return v[:i], v[i:], true
-}

apis/actions.github.com/v1alpha1/version_test.go

@@ -1,60 +0,0 @@
-package v1alpha1_test
-
-import (
-	"testing"
-
-	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIsVersionAllowed(t *testing.T) {
-	t.Parallel()
-	tt := map[string]struct {
-		resourceVersion string
-		buildVersion    string
-		want            bool
-	}{
-		"dev should always be allowed": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "dev",
-			want:            true,
-		},
-		"resourceVersion is not semver": {
-			resourceVersion: "dev",
-			buildVersion:    "0.11.0",
-			want:            false,
-		},
-		"buildVersion is not semver": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "NA",
-			want:            false,
-		},
-		"major version mismatch": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "1.11.0",
-			want:            false,
-		},
-		"minor version mismatch": {
-			resourceVersion: "0.11.0",
-			buildVersion:    "0.10.0",
-			want:            false,
-		},
-		"patch version mismatch": {
-			resourceVersion: "0.11.1",
-			buildVersion:    "0.11.0",
-			want:            true,
-		},
-		"arbitrary version match": {
-			resourceVersion: "abc",
-			buildVersion:    "abc",
-			want:            true,
-		},
-	}
-
-	for name, tc := range tt {
-		t.Run(name, func(t *testing.T) {
-			got := v1alpha1.IsVersionAllowed(tc.resourceVersion, tc.buildVersion)
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}

apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go

@@ -22,7 +22,6 @@ package v1alpha1
 
 import (
 	"k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
@@ -100,17 +99,7 @@ func (in *AutoscalingListenerSpec) DeepCopyInto(out *AutoscalingListenerSpec) {
 	}
 	if in.GitHubServerTLS != nil {
 		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Metrics != nil {
-		in, out := &in.Metrics, &out.Metrics
-		*out = new(MetricsConfig)
+		*out = new(GitHubServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.Template != nil {
@@ -118,26 +107,6 @@ func (in *AutoscalingListenerSpec) DeepCopyInto(out *AutoscalingListenerSpec) {
 		*out = new(v1.PodTemplateSpec)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.ConfigSecretMetadata != nil {
-		in, out := &in.ConfigSecretMetadata, &out.ConfigSecretMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ServiceAccountMetadata != nil {
-		in, out := &in.ServiceAccountMetadata, &out.ServiceAccountMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.RoleMetadata != nil {
-		in, out := &in.RoleMetadata, &out.RoleMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.RoleBindingMetadata != nil {
-		in, out := &in.RoleBindingMetadata, &out.RoleBindingMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AutoscalingListenerSpec.
@@ -227,11 +196,6 @@ func (in *AutoscalingRunnerSetList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AutoscalingRunnerSetSpec) DeepCopyInto(out *AutoscalingRunnerSetSpec) {
 	*out = *in
-	if in.RunnerScaleSetLabels != nil {
-		in, out := &in.RunnerScaleSetLabels, &out.RunnerScaleSetLabels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
 	if in.Proxy != nil {
 		in, out := &in.Proxy, &out.Proxy
 		*out = new(ProxyConfig)
@@ -239,65 +203,15 @@ func (in *AutoscalingRunnerSetSpec) DeepCopyInto(out *AutoscalingRunnerSetSpec)
 	}
 	if in.GitHubServerTLS != nil {
 		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
+		*out = new(GitHubServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	in.Template.DeepCopyInto(&out.Template)
-	if in.AutoscalingListenerMetadata != nil {
-		in, out := &in.AutoscalingListenerMetadata, &out.AutoscalingListenerMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerMetrics != nil {
-		in, out := &in.ListenerMetrics, &out.ListenerMetrics
-		*out = new(MetricsConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.ListenerTemplate != nil {
 		in, out := &in.ListenerTemplate, &out.ListenerTemplate
 		*out = new(v1.PodTemplateSpec)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.ListenerServiceAccountMetadata != nil {
-		in, out := &in.ListenerServiceAccountMetadata, &out.ListenerServiceAccountMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerRoleMetadata != nil {
-		in, out := &in.ListenerRoleMetadata, &out.ListenerRoleMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerRoleBindingMetadata != nil {
-		in, out := &in.ListenerRoleBindingMetadata, &out.ListenerRoleBindingMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ListenerConfigSecretMetadata != nil {
-		in, out := &in.ListenerConfigSecretMetadata, &out.ListenerConfigSecretMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerSetMetadata != nil {
-		in, out := &in.EphemeralRunnerSetMetadata, &out.EphemeralRunnerSetMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerMetadata != nil {
-		in, out := &in.EphemeralRunnerMetadata, &out.EphemeralRunnerMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerConfigSecretMetadata != nil {
-		in, out := &in.EphemeralRunnerConfigSecretMetadata, &out.EphemeralRunnerConfigSecretMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.MaxRunners != nil {
 		in, out := &in.MaxRunners, &out.MaxRunners
 		*out = new(int)
@@ -335,41 +249,6 @@ func (in *AutoscalingRunnerSetStatus) DeepCopy() *AutoscalingRunnerSetStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *AzureKeyVaultConfig) DeepCopyInto(out *AzureKeyVaultConfig) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureKeyVaultConfig.
-func (in *AzureKeyVaultConfig) DeepCopy() *AzureKeyVaultConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(AzureKeyVaultConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CounterMetric) DeepCopyInto(out *CounterMetric) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CounterMetric.
-func (in *CounterMetric) DeepCopy() *CounterMetric {
-	if in == nil {
-		return nil
-	}
-	out := new(CounterMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *EphemeralRunner) DeepCopyInto(out *EphemeralRunner) {
 	*out = *in
@@ -492,11 +371,6 @@ func (in *EphemeralRunnerSetList) DeepCopyObject() runtime.Object {
 func (in *EphemeralRunnerSetSpec) DeepCopyInto(out *EphemeralRunnerSetSpec) {
 	*out = *in
 	in.EphemeralRunnerSpec.DeepCopyInto(&out.EphemeralRunnerSpec)
-	if in.EphemeralRunnerMetadata != nil {
-		in, out := &in.EphemeralRunnerMetadata, &out.EphemeralRunnerMetadata
-		*out = new(ResourceMeta)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EphemeralRunnerSetSpec.
@@ -527,24 +401,14 @@ func (in *EphemeralRunnerSetStatus) DeepCopy() *EphemeralRunnerSetStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *EphemeralRunnerSpec) DeepCopyInto(out *EphemeralRunnerSpec) {
 	*out = *in
-	if in.GitHubServerTLS != nil {
-		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.Proxy != nil {
 		in, out := &in.Proxy, &out.Proxy
 		*out = new(ProxyConfig)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.VaultConfig != nil {
-		in, out := &in.VaultConfig, &out.VaultConfig
-		*out = new(VaultConfig)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.EphemeralRunnerConfigSecretMetadata != nil {
-		in, out := &in.EphemeralRunnerConfigSecretMetadata, &out.EphemeralRunnerConfigSecretMetadata
-		*out = new(ResourceMeta)
+	if in.GitHubServerTLS != nil {
+		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
+		*out = new(GitHubServerTLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
 	in.PodTemplateSpec.DeepCopyInto(&out.PodTemplateSpec)
@@ -565,9 +429,9 @@ func (in *EphemeralRunnerStatus) DeepCopyInto(out *EphemeralRunnerStatus) {
 	*out = *in
 	if in.Failures != nil {
 		in, out := &in.Failures, &out.Failures
-		*out = make(map[string]metav1.Time, len(*in))
+		*out = make(map[string]bool, len(*in))
 		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
+			(*out)[key] = val
 		}
 	}
 }
@@ -583,109 +447,21 @@ func (in *EphemeralRunnerStatus) DeepCopy() *EphemeralRunnerStatus {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GaugeMetric) DeepCopyInto(out *GaugeMetric) {
+func (in *GitHubServerTLSConfig) DeepCopyInto(out *GitHubServerTLSConfig) {
 	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.CertificateFrom != nil {
+		in, out := &in.CertificateFrom, &out.CertificateFrom
+		*out = new(TLSCertificateSource)
+		(*in).DeepCopyInto(*out)
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GaugeMetric.
-func (in *GaugeMetric) DeepCopy() *GaugeMetric {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitHubServerTLSConfig.
+func (in *GitHubServerTLSConfig) DeepCopy() *GitHubServerTLSConfig {
 	if in == nil {
 		return nil
 	}
-	out := new(GaugeMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HistogramMetric) DeepCopyInto(out *HistogramMetric) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Buckets != nil {
-		in, out := &in.Buckets, &out.Buckets
-		*out = make([]float64, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HistogramMetric.
-func (in *HistogramMetric) DeepCopy() *HistogramMetric {
-	if in == nil {
-		return nil
-	}
-	out := new(HistogramMetric)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *MetricsConfig) DeepCopyInto(out *MetricsConfig) {
-	*out = *in
-	if in.Counters != nil {
-		in, out := &in.Counters, &out.Counters
-		*out = make(map[string]*CounterMetric, len(*in))
-		for key, val := range *in {
-			var outVal *CounterMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(CounterMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-	if in.Gauges != nil {
-		in, out := &in.Gauges, &out.Gauges
-		*out = make(map[string]*GaugeMetric, len(*in))
-		for key, val := range *in {
-			var outVal *GaugeMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(GaugeMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-	if in.Histograms != nil {
-		in, out := &in.Histograms, &out.Histograms
-		*out = make(map[string]*HistogramMetric, len(*in))
-		for key, val := range *in {
-			var outVal *HistogramMetric
-			if val == nil {
-				(*out)[key] = nil
-			} else {
-				inVal := (*in)[key]
-				in, out := &inVal, &outVal
-				*out = new(HistogramMetric)
-				(*in).DeepCopyInto(*out)
-			}
-			(*out)[key] = outVal
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricsConfig.
-func (in *MetricsConfig) DeepCopy() *MetricsConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(MetricsConfig)
+	out := new(GitHubServerTLSConfig)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -735,35 +511,6 @@ func (in *ProxyServerConfig) DeepCopy() *ProxyServerConfig {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ResourceMeta) DeepCopyInto(out *ResourceMeta) {
-	*out = *in
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Annotations != nil {
-		in, out := &in.Annotations, &out.Annotations
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceMeta.
-func (in *ResourceMeta) DeepCopy() *ResourceMeta {
-	if in == nil {
-		return nil
-	}
-	out := new(ResourceMeta)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLSCertificateSource) DeepCopyInto(out *TLSCertificateSource) {
 	*out = *in
@@ -783,48 +530,3 @@ func (in *TLSCertificateSource) DeepCopy() *TLSCertificateSource {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
-	*out = *in
-	if in.CertificateFrom != nil {
-		in, out := &in.CertificateFrom, &out.CertificateFrom
-		*out = new(TLSCertificateSource)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
-func (in *TLSConfig) DeepCopy() *TLSConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(TLSConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VaultConfig) DeepCopyInto(out *VaultConfig) {
-	*out = *in
-	if in.AzureKeyVault != nil {
-		in, out := &in.AzureKeyVault, &out.AzureKeyVault
-		*out = new(AzureKeyVaultConfig)
-		**out = **in
-	}
-	if in.Proxy != nil {
-		in, out := &in.Proxy, &out.Proxy
-		*out = new(ProxyConfig)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VaultConfig.
-func (in *VaultConfig) DeepCopy() *VaultConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(VaultConfig)
-	in.DeepCopyInto(out)
-	return out
-}

apis/actions.summerwind.net/v1alpha1/runner_types.go

@@ -215,10 +215,10 @@ func (rs *RunnerSpec) validateRepository() error {
 		foundCount += 1
 	}
 	if foundCount == 0 {
-		return errors.New("spec needs enterprise, organization or repository")
+		return errors.New("Spec needs enterprise, organization or repository")
 	}
 	if foundCount > 1 {
-		return errors.New("spec cannot have many fields defined enterprise, organization and repository")
+		return errors.New("Spec cannot have many fields defined enterprise, organization and repository")
 	}
 
 	return nil
@@ -317,19 +317,19 @@ type RunnerStatusRegistration struct {
 type WorkVolumeClaimTemplate struct {
 	StorageClassName string                              `json:"storageClassName"`
 	AccessModes      []corev1.PersistentVolumeAccessMode `json:"accessModes"`
-	Resources        corev1.VolumeResourceRequirements   `json:"resources"`
+	Resources        corev1.ResourceRequirements         `json:"resources"`
 }
 
 func (w *WorkVolumeClaimTemplate) validate() error {
-	if len(w.AccessModes) == 0 {
-		return errors.New("access mode should have at least one mode specified")
+	if w.AccessModes == nil || len(w.AccessModes) == 0 {
+		return errors.New("Access mode should have at least one mode specified")
 	}
 
 	for _, accessMode := range w.AccessModes {
 		switch accessMode {
 		case corev1.ReadWriteOnce, corev1.ReadWriteMany:
 		default:
-			return fmt.Errorf("access mode %v is not supported", accessMode)
+			return fmt.Errorf("Access mode %v is not supported", accessMode)
 		}
 	}
 	return nil

apis/actions.summerwind.net/v1alpha1/runner_webhook.go

@@ -17,12 +17,12 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"context"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
@@ -30,43 +30,38 @@ import (
 var runnerLog = logf.Log.WithName("runner-resource")
 
 func (r *Runner) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr, r).
-		WithDefaulter(&RunnerDefaulter{}).
-		WithValidator(&RunnerValidator{}).
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
 		Complete()
 }
 
 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runner,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runners,versions=v1alpha1,name=mutate.runner.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Defaulter[*Runner] = &RunnerDefaulter{}
+var _ webhook.Defaulter = &Runner{}
 
-type RunnerDefaulter struct{}
-
-// Default implements [admission.Defaulter].
-func (in *RunnerDefaulter) Default(ctx context.Context, obj *Runner) error {
-	return nil
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *Runner) Default() {
+	// Nothing to do.
 }
 
 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runner,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runners,versions=v1alpha1,name=validate.runner.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Validator[*Runner] = &RunnerValidator{}
-
-type RunnerValidator struct{}
+var _ webhook.Validator = &Runner{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateCreate(ctx context.Context, r *Runner) (admission.Warnings, error) {
+func (r *Runner) ValidateCreate() (admission.Warnings, error) {
 	runnerLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateUpdate(ctx context.Context, old, r *Runner) (admission.Warnings, error) {
+func (r *Runner) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerValidator) ValidateDelete(ctx context.Context, obj *Runner) (admission.Warnings, error) {
+func (r *Runner) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }
 

apis/actions.summerwind.net/v1alpha1/runnerdeployment_webhook.go

@@ -17,12 +17,12 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"context"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
@@ -30,44 +30,38 @@ import (
 var runnerDeploymentLog = logf.Log.WithName("runnerdeployment-resource")
 
 func (r *RunnerDeployment) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr, r).
-		WithDefaulter(&RunnerDeploymentDefaulter{}).
-		WithValidator(&RunnerDeploymentValidator{}).
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
 		Complete()
 }
 
 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runnerdeployment,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerdeployments,versions=v1alpha1,name=mutate.runnerdeployment.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Defaulter[*RunnerDeployment] = &RunnerDeploymentDefaulter{}
-
-type RunnerDeploymentDefaulter struct{}
+var _ webhook.Defaulter = &RunnerDeployment{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type
-func (*RunnerDeploymentDefaulter) Default(context.Context, *RunnerDeployment) error {
+func (r *RunnerDeployment) Default() {
 	// Nothing to do.
-	return nil
 }
 
 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runnerdeployment,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerdeployments,versions=v1alpha1,name=validate.runnerdeployment.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Validator[*RunnerDeployment] = &RunnerDeploymentValidator{}
-
-type RunnerDeploymentValidator struct{}
+var _ webhook.Validator = &RunnerDeployment{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateCreate(ctx context.Context, r *RunnerDeployment) (admission.Warnings, error) {
+func (r *RunnerDeployment) ValidateCreate() (admission.Warnings, error) {
 	runnerDeploymentLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateUpdate(ctx context.Context, old, r *RunnerDeployment) (admission.Warnings, error) {
+func (r *RunnerDeployment) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerDeploymentLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerDeploymentValidator) ValidateDelete(context.Context, *RunnerDeployment) (admission.Warnings, error) {
+func (r *RunnerDeployment) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }
 

apis/actions.summerwind.net/v1alpha1/runnerreplicaset_webhook.go

@@ -17,12 +17,12 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"context"
-
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
@@ -30,44 +30,38 @@ import (
 var runnerReplicaSetLog = logf.Log.WithName("runnerreplicaset-resource")
 
 func (r *RunnerReplicaSet) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr, r).
-		WithDefaulter(&RunnerReplicaSetDefaulter{}).
-		WithValidator(&RunnerReplicaSetValidator{}).
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
 		Complete()
 }
 
 // +kubebuilder:webhook:path=/mutate-actions-summerwind-dev-v1alpha1-runnerreplicaset,verbs=create;update,mutating=true,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerreplicasets,versions=v1alpha1,name=mutate.runnerreplicaset.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Defaulter[*RunnerReplicaSet] = &RunnerReplicaSetDefaulter{}
-
-type RunnerReplicaSetDefaulter struct{}
+var _ webhook.Defaulter = &RunnerReplicaSet{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type
-func (*RunnerReplicaSetDefaulter) Default(context.Context, *RunnerReplicaSet) error {
+func (r *RunnerReplicaSet) Default() {
 	// Nothing to do.
-	return nil
 }
 
 // +kubebuilder:webhook:path=/validate-actions-summerwind-dev-v1alpha1-runnerreplicaset,verbs=create;update,mutating=false,failurePolicy=fail,groups=actions.summerwind.dev,resources=runnerreplicasets,versions=v1alpha1,name=validate.runnerreplicaset.actions.summerwind.dev,sideEffects=None,admissionReviewVersions=v1beta1
 
-var _ admission.Validator[*RunnerReplicaSet] = &RunnerReplicaSetValidator{}
-
-type RunnerReplicaSetValidator struct{}
+var _ webhook.Validator = &RunnerReplicaSet{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateCreate(ctx context.Context, r *RunnerReplicaSet) (admission.Warnings, error) {
+func (r *RunnerReplicaSet) ValidateCreate() (admission.Warnings, error) {
 	runnerReplicaSetLog.Info("validate resource to be created", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateUpdate(ctx context.Context, old, r *RunnerReplicaSet) (admission.Warnings, error) {
+func (r *RunnerReplicaSet) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
 	runnerReplicaSetLog.Info("validate resource to be updated", "name", r.Name)
 	return nil, r.Validate()
 }
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type
-func (*RunnerReplicaSetValidator) ValidateDelete(context.Context, *RunnerReplicaSet) (admission.Warnings, error) {
+func (r *RunnerReplicaSet) ValidateDelete() (admission.Warnings, error) {
 	return nil, nil
 }
 

apis/actions.summerwind.net/v1alpha1/zz_generated.deepcopy.go

@@ -23,7 +23,7 @@ package v1alpha1
 import (
 	"k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -467,21 +467,6 @@ func (in *RunnerConfig) DeepCopy() *RunnerConfig {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDefaulter) DeepCopyInto(out *RunnerDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDefaulter.
-func (in *RunnerDefaulter) DeepCopy() *RunnerDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerDeployment) DeepCopyInto(out *RunnerDeployment) {
 	*out = *in
@@ -509,21 +494,6 @@ func (in *RunnerDeployment) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDeploymentDefaulter) DeepCopyInto(out *RunnerDeploymentDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDeploymentDefaulter.
-func (in *RunnerDeploymentDefaulter) DeepCopy() *RunnerDeploymentDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDeploymentDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerDeploymentList) DeepCopyInto(out *RunnerDeploymentList) {
 	*out = *in
@@ -626,21 +596,6 @@ func (in *RunnerDeploymentStatus) DeepCopy() *RunnerDeploymentStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerDeploymentValidator) DeepCopyInto(out *RunnerDeploymentValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerDeploymentValidator.
-func (in *RunnerDeploymentValidator) DeepCopy() *RunnerDeploymentValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerDeploymentValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerList) DeepCopyInto(out *RunnerList) {
 	*out = *in
@@ -860,21 +815,6 @@ func (in *RunnerReplicaSet) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerReplicaSetDefaulter) DeepCopyInto(out *RunnerReplicaSetDefaulter) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerReplicaSetDefaulter.
-func (in *RunnerReplicaSetDefaulter) DeepCopy() *RunnerReplicaSetDefaulter {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerReplicaSetDefaulter)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerReplicaSetList) DeepCopyInto(out *RunnerReplicaSetList) {
 	*out = *in
@@ -967,21 +907,6 @@ func (in *RunnerReplicaSetStatus) DeepCopy() *RunnerReplicaSetStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerReplicaSetValidator) DeepCopyInto(out *RunnerReplicaSetValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerReplicaSetValidator.
-func (in *RunnerReplicaSetValidator) DeepCopy() *RunnerReplicaSetValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerReplicaSetValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RunnerSet) DeepCopyInto(out *RunnerSet) {
 	*out = *in
@@ -1187,21 +1112,6 @@ func (in *RunnerTemplate) DeepCopy() *RunnerTemplate {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RunnerValidator) DeepCopyInto(out *RunnerValidator) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RunnerValidator.
-func (in *RunnerValidator) DeepCopy() *RunnerValidator {
-	if in == nil {
-		return nil
-	}
-	out := new(RunnerValidator)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ScaleTargetRef) DeepCopyInto(out *ScaleTargetRef) {
 	*out = *in

charts/.ci/ct-config-gha.yaml

@@ -1,6 +1,4 @@
 # This file defines the config for "ct" (chart tester) used by the helm linting GitHub workflow
-remote: origin
-target-branch: master
 lint-conf: charts/.ci/lint-config.yaml
 chart-repos:
   - jetstack=https://charts.jetstack.io

charts/.ci/ct-config.yaml

@@ -1,6 +1,4 @@
 # This file defines the config for "ct" (chart tester) used by the helm linting GitHub workflow
-remote: origin
-target-branch: master
 lint-conf: charts/.ci/lint-config.yaml
 chart-repos:
   - jetstack=https://charts.jetstack.io

charts/.ci/scripts/local-kube-score.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+
 for chart in `ls charts`;
 do
 helm template --values charts/$chart/ci/ci-values.yaml charts/$chart | kube-score score - \

charts/actions-runner-controller/README.md

@@ -44,7 +44,7 @@ All additional docs are kept in the `docs/` folder, this README is solely for do
 | `image.pullPolicy`                                        | The pull policy of the controller image                                                                                                   | IfNotPresent                                                                                    |
 | `metrics.serviceMonitor.enable`                           | Deploy serviceMonitor kind for for use with prometheus-operator CRDs                                                                      | false                                                                                           |
 | `metrics.serviceMonitor.interval`                         | Configure the interval that Prometheus should scrap the controller's metrics                                                              | 1m                                                                                              |
-| `metrics.serviceMonitor.namespace`                        | Namespace which Prometheus is running in                                                                                                  | `Release.Namespace` (the default namespace of the helm chart).                                  |
+| `metrics.serviceMonitor.namespace                         | Namespace which Prometheus is running in                                                                                                  | `Release.Namespace` (the default namespace of the helm chart).                                  |
 | `metrics.serviceMonitor.timeout`                          | Configure the timeout the timeout of Prometheus scrapping.                                                                                | 30s                                                                                             |
 | `metrics.serviceAnnotations`                              | Set annotations for the provisioned metrics service resource                                                                              |                                                                                                 |
 | `metrics.port`                                            | Set port of metrics service                                                                                                               | 8443                                                                                            |

charts/actions-runner-controller/crds/actions.summerwind.dev_horizontalrunnerautoscalers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.20.1
+    controller-gen.kubebuilder.io/version: v0.14.0
   name: horizontalrunnerautoscalers.actions.summerwind.dev
 spec:
   group: actions.summerwind.dev
@@ -32,8 +32,7 @@ spec:
       name: v1alpha1
       schema:
         openAPIV3Schema:
-        description: HorizontalRunnerAutoscaler is the Schema for the horizontalrunnerautoscaler
-          API
+          description: HorizontalRunnerAutoscaler is the Schema for the horizontalrunnerautoscaler API
           properties:
             apiVersion:
               description: |-
@@ -53,8 +52,7 @@ spec:
             metadata:
               type: object
             spec:
-            description: HorizontalRunnerAutoscalerSpec defines the desired state
-              of HorizontalRunnerAutoscaler
+              description: HorizontalRunnerAutoscalerSpec defines the desired state of HorizontalRunnerAutoscaler
               properties:
                 capacityReservations:
                   items:
@@ -85,12 +83,10 @@ spec:
                       type: object
                   type: object
                 maxReplicas:
-                description: MaxReplicas is the maximum number of replicas the deployment
-                  is allowed to scale
+                  description: MaxReplicas is the maximum number of replicas the deployment is allowed to scale
                   type: integer
                 metrics:
-                description: Metrics is the collection of various metric targets to
-                  calculate desired number of runners
+                  description: Metrics is the collection of various metric targets to calculate desired number of runners
                   items:
                     properties:
                       repositoryNames:
@@ -138,8 +134,7 @@ spec:
                     type: object
                   type: array
                 minReplicas:
-                description: MinReplicas is the minimum number of replicas the deployment
-                  is allowed to scale
+                  description: MinReplicas is the minimum number of replicas the deployment is allowed to scale
                   type: integer
                 scaleDownDelaySecondsAfterScaleOut:
                   description: |-
@@ -147,8 +142,7 @@ spec:
                     Used to prevent flapping (down->up->down->... loop)
                   type: integer
                 scaleTargetRef:
-                description: ScaleTargetRef is the reference to scaled resource like
-                  RunnerDeployment
+                  description: ScaleTargetRef is the reference to scaled resource like RunnerDeployment
                   properties:
                     kind:
                       description: Kind is the type of resource being referenced
@@ -165,8 +159,10 @@ spec:
                     ScaleUpTriggers is an experimental feature to increase the desired replicas by 1
                     on each webhook requested received by the webhookBasedAutoscaler.
 
+
                     This feature requires you to also enable and deploy the webhookBasedAutoscaler onto your cluster.
 
+
                     Note that the added runners remain until the next sync period at least,
                     and they may or may not be used by GitHub Actions depending on the timing.
                     They are intended to be used to gain "resource slack" immediately after you
@@ -240,8 +236,7 @@ spec:
                       A schedule can optionally be recurring, so that the corresponding override happens every day, week, month, or year.
                     properties:
                       endTime:
-                      description: EndTime is the time at which the first override
-                        ends.
+                        description: EndTime is the time at which the first override ends.
                         format: date-time
                         type: string
                       minReplicas:
@@ -272,8 +267,7 @@ spec:
                             type: string
                         type: object
                       startTime:
-                      description: StartTime is the time at which the first override
-                        starts.
+                        description: StartTime is the time at which the first override starts.
                         format: date-time
                         type: string
                     required:
@@ -322,3 +316,4 @@ spec:
       storage: true
       subresources:
         status: {}
+  preserveUnknownFields: false

charts/actions-runner-controller/templates/NOTES.txt

@@ -6,17 +6,17 @@
   {{- end }}
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "actions-runner-controller.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "actions-runner-controller.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ include "actions-runner-controller.namespace" . }} svc -w {{ include "actions-runner-controller.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ include "actions-runner-controller.namespace" . }} {{ include "actions-runner-controller.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "actions-runner-controller.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "actions-runner-controller.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ include "actions-runner-controller.namespace" . }} -l "app.kubernetes.io/name={{ include "actions-runner-controller.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ include "actions-runner-controller.namespace" . }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "actions-runner-controller.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
   echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ include "actions-runner-controller.namespace" . }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
 {{- end }}

charts/actions-runner-controller/templates/_helpers.tpl

@@ -1,14 +1,3 @@
-{{/*
-Allow overriding the namespace for the resources.
-*/}}
-{{- define "actions-runner-controller.namespace" -}}
-{{- if .Values.namespaceOverride }}
-  {{- .Values.namespaceOverride }}
-{{- else }}
-  {{- .Release.Namespace }}
-{{- end }}
-{{- end }}
-
 {{/*
 Expand the name of the chart.
 */}}

charts/actions-runner-controller/templates/actionsmetrics.deployment.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:

charts/actions-runner-controller/templates/actionsmetrics.ingress.yaml.yml

@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ $fullName }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.actionsMetricsServer.ingress.annotations }}

charts/actions-runner-controller/templates/actionsmetrics.role_binding.yaml

@@ -10,5 +10,5 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ include "actions-runner-controller-actions-metrics-server.serviceAccountName" . }}
-    namespace: {{ include "actions-runner-controller.namespace" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}

charts/actions-runner-controller/templates/actionsmetrics.secrets.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: Opaque

charts/actions-runner-controller/templates/actionsmetrics.service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller-actions-metrics-server.selectorLabels" . | nindent 4 }}
 {{- if .Values.actionsMetricsServer.service.annotations }}

charts/actions-runner-controller/templates/actionsmetrics.serviceaccount.yaml.yml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "actions-runner-controller-actions-metrics-server.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.actionsMetricsServer.serviceAccount.annotations }}

charts/actions-runner-controller/templates/actionsmetrics.servicemonitor.yaml.yml

@@ -1,5 +1,5 @@
 {{- if and .Values.actionsMetricsServer.enabled .Values.actionsMetrics.serviceMonitor.enable }}
-{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default (include "actions-runner-controller.namespace" .) }}
+{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default .Release.Namespace }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

charts/actions-runner-controller/templates/auth_proxy_role_binding.yaml

@@ -10,5 +10,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 {{- end }}

charts/actions-runner-controller/templates/certificate.yaml

@@ -6,7 +6,7 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   name: {{ include "actions-runner-controller.selfsignedIssuerName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   selfSigned: {}
 ---
@@ -14,11 +14,11 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: {{ include "actions-runner-controller.servingCertName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   dnsNames:
-  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ include "actions-runner-controller.namespace" . }}.svc
-  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ include "actions-runner-controller.namespace" . }}.svc.cluster.local
+  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ .Release.Namespace }}.svc
+  - {{ include "actions-runner-controller.webhookServiceName" . }}.{{ .Release.Namespace }}.svc.cluster.local
   issuerRef:
     kind: Issuer
     name: {{ include "actions-runner-controller.selfsignedIssuerName" . }}

charts/actions-runner-controller/templates/controller.metrics.service.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   name: {{ include "actions-runner-controller.metricsServiceName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   {{- with .Values.metrics.serviceAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/actions-runner-controller/templates/controller.metrics.serviceMonitor.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   name: {{ include "actions-runner-controller.serviceMonitorName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   endpoints:
     - path: /metrics

charts/actions-runner-controller/templates/controller.pdb.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   name: {{ include "actions-runner-controller.pdbName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   {{- if .Values.podDisruptionBudget.minAvailable }}
   minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}

charts/actions-runner-controller/templates/deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "actions-runner-controller.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:
@@ -56,7 +56,7 @@ spec:
         - "--docker-registry-mirror={{ .Values.dockerRegistryMirror }}"
         {{- end }}
         {{- if .Values.scope.singleNamespace }}
-        - "--watch-namespace={{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}"
+        - "--watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }}"
         {{- end }}
         {{- if .Values.logLevel }}
         - "--log-level={{ .Values.logLevel }}"

charts/actions-runner-controller/templates/githubwebhook.deployment.yaml

@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 spec:
@@ -43,7 +43,7 @@ spec:
         - "--log-level={{ .Values.githubWebhookServer.logLevel }}"
         {{- end }}
         {{- if .Values.scope.singleNamespace }}
-        - "--watch-namespace={{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}"
+        - "--watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }}"
         {{- end }}
         {{- if .Values.runnerGithubURL  }}
         - "--runner-github-url={{ .Values.runnerGithubURL }}"

charts/actions-runner-controller/templates/githubwebhook.ingress.yaml

@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ $fullName }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.githubWebhookServer.ingress.annotations }}

charts/actions-runner-controller/templates/githubwebhook.pdb.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   name: {{ include "actions-runner-controller-github-webhook-server.pdbName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   {{- if .Values.githubWebhookServer.podDisruptionBudget.minAvailable }}
   minAvailable: {{ .Values.githubWebhookServer.podDisruptionBudget.minAvailable }}

charts/actions-runner-controller/templates/githubwebhook.role_binding.yaml

@@ -10,5 +10,5 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ include "actions-runner-controller-github-webhook-server.serviceAccountName" . }}
-    namespace: {{ include "actions-runner-controller.namespace" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}

charts/actions-runner-controller/templates/githubwebhook.secrets.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: Opaque

charts/actions-runner-controller/templates/githubwebhook.service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.fullname" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller-github-webhook-server.selectorLabels" . | nindent 4 }}
 {{- if .Values.githubWebhookServer.service.annotations }}

charts/actions-runner-controller/templates/githubwebhook.serviceMonitor.yaml

@@ -1,5 +1,5 @@
 {{- if and .Values.githubWebhookServer.enabled .Values.metrics.serviceMonitor.enable }}
-{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default (include "actions-runner-controller.namespace" .) }}
+{{- $servicemonitornamespace := .Values.actionsMetrics.serviceMonitor.namespace | default .Release.Namespace }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

charts/actions-runner-controller/templates/githubwebhook.serviceaccount.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "actions-runner-controller-github-webhook-server.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.githubWebhookServer.serviceAccount.annotations }}

charts/actions-runner-controller/templates/leader_election_role.yaml

@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "actions-runner-controller.leaderElectionRoleName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups:
   - ""

charts/actions-runner-controller/templates/leader_election_role_binding.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "actions-runner-controller.leaderElectionRoleName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -10,4 +10,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}

charts/actions-runner-controller/templates/manager_role_binding.yaml

@@ -9,4 +9,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}

charts/actions-runner-controller/templates/manager_role_binding_secrets.yaml

@@ -6,7 +6,7 @@ kind: ClusterRoleBinding
 {{- end }}
 metadata:
   name: {{ include "actions-runner-controller.managerRoleName" . }}-secrets
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   {{- if .Values.scope.singleNamespace }}
@@ -18,4 +18,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}

charts/actions-runner-controller/templates/manager_secrets.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller.secretName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   {{- if .Values.authSecret.annotations }}
   annotations:
     {{ toYaml .Values.authSecret.annotations | nindent 4 }}

charts/actions-runner-controller/templates/serviceaccount.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "actions-runner-controller.serviceAccountName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

charts/actions-runner-controller/templates/webhook_configs.yaml

@@ -2,7 +2,7 @@
 We will use a self managed CA if one is not provided by cert-manager
 */}}
 {{- $ca := genCA "actions-runner-ca" 3650 }}
-{{- $cert := genSignedCert (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) (include "actions-runner-controller.namespace" .)) nil (list (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) (include "actions-runner-controller.namespace" .))) 3650 $ca }}
+{{- $cert := genSignedCert (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) .Release.Namespace) nil (list (printf "%s.%s.svc" (include "actions-runner-controller.webhookServiceName" .) .Release.Namespace)) 3650 $ca }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
@@ -11,7 +11,7 @@ metadata:
   name: {{ include "actions-runner-controller.fullname" . }}-mutating-webhook-configuration
   {{- if .Values.certManagerEnabled }}
   annotations:
-    cert-manager.io/inject-ca-from: {{ include "actions-runner-controller.namespace" . }}/{{ include "actions-runner-controller.servingCertName" . }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "actions-runner-controller.servingCertName" . }}
   {{- end }}
 webhooks:
 - admissionReviewVersions:
@@ -19,7 +19,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -29,7 +29,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-actions-summerwind-dev-v1alpha1-runner
   failurePolicy: Fail
   name: mutate.runner.actions.summerwind.dev
@@ -50,7 +50,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -60,7 +60,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-actions-summerwind-dev-v1alpha1-runnerdeployment
   failurePolicy: Fail
   name: mutate.runnerdeployment.actions.summerwind.dev
@@ -81,7 +81,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -91,7 +91,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-actions-summerwind-dev-v1alpha1-runnerreplicaset
   failurePolicy: Fail
   name: mutate.runnerreplicaset.actions.summerwind.dev
@@ -112,7 +112,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -122,7 +122,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /mutate-runner-set-pod
   failurePolicy: Fail
   name: mutate-runner-pod.webhook.actions.summerwind.dev
@@ -148,7 +148,7 @@ metadata:
   name: {{ include "actions-runner-controller.fullname" . }}-validating-webhook-configuration
   {{- if .Values.certManagerEnabled }}
   annotations:
-    cert-manager.io/inject-ca-from: {{ include "actions-runner-controller.namespace" . }}/{{ include "actions-runner-controller.servingCertName" . }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "actions-runner-controller.servingCertName" . }}
   {{- end }}
 webhooks:
 - admissionReviewVersions:
@@ -156,7 +156,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -166,7 +166,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /validate-actions-summerwind-dev-v1alpha1-runner
   failurePolicy: Fail
   name: validate.runner.actions.summerwind.dev
@@ -187,7 +187,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -197,7 +197,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /validate-actions-summerwind-dev-v1alpha1-runnerdeployment
   failurePolicy: Fail
   name: validate.runnerdeployment.actions.summerwind.dev
@@ -218,7 +218,7 @@ webhooks:
   {{- if .Values.scope.singleNamespace }}
   namespaceSelector:
     matchLabels:
-      kubernetes.io/metadata.name: {{ default (include "actions-runner-controller.namespace" .) .Values.scope.watchNamespace }}
+      kubernetes.io/metadata.name: {{ default .Release.Namespace .Values.scope.watchNamespace }}
   {{- end }}
   clientConfig:
     {{- if .Values.admissionWebHooks.caBundle }}
@@ -228,7 +228,7 @@ webhooks:
     {{- end }}
     service:
       name: {{ include "actions-runner-controller.webhookServiceName" . }}
-      namespace: {{ include "actions-runner-controller.namespace" . }}
+      namespace: {{ .Release.Namespace }}
       path: /validate-actions-summerwind-dev-v1alpha1-runnerreplicaset
   failurePolicy: Fail
   name: validate.runnerreplicaset.actions.summerwind.dev
@@ -250,7 +250,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "actions-runner-controller.servingCertName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
 type: kubernetes.io/tls

charts/actions-runner-controller/templates/webhook_service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "actions-runner-controller.webhookServiceName" . }}
-  namespace: {{ include "actions-runner-controller.namespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "actions-runner-controller.labels" . | nindent 4 }}
   {{- with .Values.service.annotations }}

charts/actions-runner-controller/values.yaml

@@ -420,6 +420,3 @@ actionsMetricsServer:
     #      - chart-example.local
   terminationGracePeriodSeconds: 10
   lifecycle: {}
-
-# Add the option to deploy in another namespace rather than .Release.Namespace.
-namespaceOverride: ""

charts/gha-runner-scale-set-controller-experimental/.helmignore

@@ -1,24 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
-tests/

charts/gha-runner-scale-set-controller-experimental/Chart.yaml

@@ -1,33 +0,0 @@
-apiVersion: v2
-name: gha-runner-scale-set-controller-experimental
-description: A Helm chart for install actions-runner-controller CRD
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: "0.14.1"
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "0.14.1"
-
-home: https://github.com/actions/actions-runner-controller
-
-sources:
-  - "https://github.com/actions/actions-runner-controller"
-
-maintainers:
-  - name: actions
-    url: https://github.com/actions

charts/gha-runner-scale-set-controller-experimental/templates/NOTES.txt

@@ -1,3 +0,0 @@
-Thank you for installing {{ .Chart.Name }}.
-
-Your release is named {{ .Release.Name }}.

charts/gha-runner-scale-set-controller-experimental/templates/_controller.tpl

@@ -1,67 +0,0 @@
-{{/*
-Allow overriding the namespace for the resources.
-*/}}
-{{- define "gha-controller.namespace" -}}
-{{- if .Values.namespaceOverride }}
-  {{- .Values.namespaceOverride }}
-{{- else }}
-  {{- .Release.Namespace }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "gha-controller.name" -}}
-{{- if .Values.nameOverride }}
-  {{- .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-  {{- $name := default (include "gha-base-name" .) .Values.nameOverride }}
-  {{- if contains $name .Release.Name }}
-    {{- .Release.Name | trunc 63 | trimSuffix "-" }}
-  {{- else }}
-    {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-  {{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Labels applied to the controller deployment
-*/}}
-{{- define "gha-controller.labels" -}}
-{{- $resourceLabels := dict "app.kubernetes.io/component" "controller-manager" -}}
-{{- $commonLabels := include "gha-common.labels" . | fromYaml -}}
-{{- $userLabels := include "apply-non-reserved-gha-labels-and-annotations" (.Values.controller.metadata.labels | default (dict)) | fromYaml -}}
-{{- $global := include "apply-non-reserved-gha-labels-and-annotations" (.Values.labels | default (dict)) | fromYaml -}}
-{{- $labels := mergeOverwrite $global $userLabels $resourceLabels $commonLabels -}}
-
-{{- /* Reserved actions.github.com/* labels owned by the chart itself */ -}}
-{{- $_ := set $labels "actions.github.com/controller-service-account-namespace" (include "gha-controller.namespace" .) -}}
-{{- $_ := set $labels "actions.github.com/controller-service-account-name" (include "gha-controller.service-account-name" .) -}}
-{{- with .Values.controller.manager.config.watchSingleNamespace }}
-  {{- $_ := set $labels "actions.github.com/controller-watch-single-namespace" . -}}
-{{- end }}
-
-{{- toYaml $labels -}}
-{{- end }}
-
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "gha-controller.service-account-name" -}}
-{{- if eq .Values.controller.serviceAccount.name "default"}}
-  {{- fail "serviceAccount.name cannot be set to 'default'" }}
-{{- end }}
-{{- if .Values.controller.serviceAccount.create }}
-  {{- default (include "gha-controller.name" .) .Values.controller.serviceAccount.name }}
-{{- else }}
-  {{- if not .Values.controller.serviceAccount.name }}
-    {{- fail "serviceAccount.name must be set if serviceAccount.create is false" }}
-  {{- else }}
-    {{- .Values.controller.serviceAccount.name }}
-  {{- end }}
-{{- end }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/_controller_template.tpl

@@ -1,122 +0,0 @@
-
-{{/*
-Labels applied to the controller Pod template (spec.template.metadata.labels)
-*/}}
-{{- define "gha-controller-template.labels" -}}
-{{- $static := dict "app.kubernetes.io/part-of" "gha-rs-controller" "app.kubernetes.io/component" "controller-manager" -}}
-{{- $_ := set $static "app.kubernetes.io/version" (.Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-") -}}
-{{- $selector := include "gha-controller.selector-labels" . | fromYaml -}}
-{{- $podUser := include "apply-non-reserved-gha-labels-and-annotations" (.Values.controller.pod.metadata.labels | default (dict)) | fromYaml -}}
-{{- $labels := mergeOverwrite $podUser $selector $static -}}
-{{- toYaml $labels -}}
-{{- end }}
-
-{{/*
-Annotations applied to the controller Pod template (spec.template.metadata.annotations)
-*/}}
-{{- define "gha-controller-template.annotations" -}}
-{{- $static := dict "kubectl.kubernetes.io/default-container" "manager" -}}
-{{- $podUser := include "apply-non-reserved-gha-labels-and-annotations" (.Values.controller.pod.metadata.annotations | default (dict)) | fromYaml -}}
-{{- $annotations := mergeOverwrite $podUser $static -}}
-{{- toYaml $annotations -}}
-{{- end }}
-
-{{- define "gha-controller-template.manager-container" -}}
-name: manager
-image: "{{ .Values.controller.manager.container.image }}"
-imagePullPolicy: {{ default "IfNotPresent" .Values.controller.manager.container.pullPolicy }}
-command:
-  - "/manager"
-args:
-  - "--auto-scaling-runner-set-only"
-{{- if gt (int (default 1 .Values.controller.replicaCount)) 1 }}
-  - "--enable-leader-election"
-  - "--leader-election-id={{ include "gha-controller.name" . }}"
-{{- end }}
-{{- with .Values.imagePullSecrets }}
-{{- range . }}
-  - "--auto-scaler-image-pull-secrets={{- .name -}}"
-{{- end }}
-{{- end }}
-{{- with .Values.controller.manager.config.logLevel }}
-  - "--log-level={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.logFormat }}
-  - "--log-format={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.watchSingleNamespace }}
-  - "--watch-single-namespace={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.runnerMaxConcurrentReconciles }}
-  - "--runner-max-concurrent-reconciles={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.updateStrategy }}
-  - "--update-strategy={{ . }}"
-{{- end }}
-{{- if .Values.controller.metrics }}
-{{- with .Values.controller.metrics }}
-  - "--listener-metrics-addr={{ .listenerAddr }}"
-  - "--listener-metrics-endpoint={{ .listenerEndpoint }}"
-  - "--metrics-addr={{ .controllerManagerAddr }}"
-{{- end }}
-{{- else }}
-  - "--listener-metrics-addr=0"
-  - "--listener-metrics-endpoint="
-  - "--metrics-addr=0"
-{{- end }}
-{{- range .Values.controller.manager.config.excludeLabelPropagationPrefixes }}
-  - "--exclude-label-propagation-prefix={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.k8sClientRateLimiterQPS }}
-  - "--k8s-client-rate-limiter-qps={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.config.k8sClientRateLimiterBurst }}
-  - "--k8s-client-rate-limiter-burst={{ . }}"
-{{- end }}
-{{- with .Values.controller.manager.container.extraArgs }}
-{{- range . }}
-  - "{{ . }}"
-{{- end }}
-{{- end }}
-{{- $ports := list -}}
-{{- if .Values.controller.metrics }}
-{{- $metricsPort := dict "containerPort" ((regexReplaceAll ":([0-9]+)" .Values.controller.metrics.controllerManagerAddr "${1}") | int) "protocol" "TCP" "name" "metrics" -}}
-{{- $ports = append $ports $metricsPort -}}
-{{- end }}
-{{- with .Values.controller.manager.container.extraPorts }}
-{{- if kindIs "slice" . }}
-{{- $ports = concat $ports . -}}
-{{- end }}
-{{- end }}
-{{- if gt (len $ports) 0 }}
-ports:
-{{- toYaml $ports | nindent 2 }}
-{{- end }}
-env:
-  - name: CONTROLLER_MANAGER_CONTAINER_IMAGE
-    value: "{{ .Values.controller.manager.container.image }}"
-  - name: CONTROLLER_MANAGER_POD_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-  {{- with .Values.controller.manager.container.env }}
-  {{- if kindIs "slice" . }}
-{{- toYaml . | nindent 2 }}
-  {{- end }}
-  {{- end }}
-{{- with .Values.controller.manager.container.resources }}
-resources:
-{{- toYaml . | nindent 2 }}
-{{- end }}
-{{- with .Values.controller.manager.container.securityContext }}
-securityContext:
-{{- toYaml . | nindent 2 }}
-{{- end }}
-volumeMounts:
-  - mountPath: /tmp
-    name: tmp
-  {{- $podVolumeMounts := (.Values.controller.pod.volumeMounts | default list) -}}
-  {{- range $podVolumeMounts }}
-  - {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/_defaults.tpl

@@ -1,74 +0,0 @@
-{{- define "gha-base-name" -}}
-gha-rs-controller
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "gha-controller.chart" -}}
-{{- printf "%s-%s" (include "gha-base-name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "gha-common.labels" -}}
-helm.sh/chart: {{ include "gha-controller.chart" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "gha-rs-controller"
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-app.kubernetes.io/name: {{ include "gha-controller.name" . }}
-app.kubernetes.io/namespace: {{ include "gha-controller.namespace" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-
-{{- define "gha-controller.manager-cluster-role-name" -}}
-{{- include "gha-controller.name" . }}
-{{- end }}
-
-{{- define "gha-controller.manager-cluster-role-binding" -}}
-{{- include "gha-controller.name" . }}
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-role-name" -}}
-{{- include "gha-controller.name" . }}-single-namespace
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-role-binding" -}}
-{{- include "gha-controller.name" . }}-single-namespace
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-watch-role-name" -}}
-{{- include "gha-controller.name" . }}-single-namespace-watch
-{{- end }}
-
-{{- define "gha-controller.manager-single-namespace-watch-role-binding" -}}
-{{- include "gha-controller.name" . }}-single-namespace-watch
-{{- end }}
-
-{{- define "gha-controller.manager-listener-role-name" -}}
-{{- include "gha-controller.name" . }}-listener
-{{- end }}
-
-{{- define "gha-controller.manager-listener-role-binding" -}}
-{{- include "gha-controller.name" . }}-listener
-{{- end }}
-
-{{- define "gha-controller.leaderElectionRoleName" -}}
-{{- include "gha-controller.name" . }}-leader-election
-{{- end }}
-
-{{- define "gha-controller.leader-election-role-name" -}}
-{{- include "gha-controller.leaderElectionRoleName" . -}}
-{{- end }}
-
-{{- define "gha-controller.leaderElectionRoleBinding" -}}
-{{- include "gha-controller.name" . }}-leader-election
-{{- end }}
-
-{{- define "gha-controller.leader-election-role-binding" -}}
-{{- include "gha-controller.leaderElectionRoleBinding" . -}}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/_helpers.tpl

@@ -1,21 +0,0 @@
-{{/*
-Takes a map of user labels and removes the ones with "actions.github.com/" prefix
-*/}}
-{{- define "apply-non-reserved-gha-labels-and-annotations" -}}
-{{- $userLabels := . -}}
-{{- $processed := dict -}}
-{{- range $key, $value := $userLabels -}}
-  {{- if not (hasPrefix "actions.github.com/" $key) -}}
-    {{- $_ := set $processed $key $value -}}
-  {{- end -}}
-{{- end -}}
-{{- if not (empty $processed) -}}
-  {{- $processed | toYaml }}
-{{- end }}
-{{- end }}
-
-{{- define "gha-controller.selector-labels" -}}
-app.kubernetes.io/name: {{ include "gha-controller.name" . }}
-app.kubernetes.io/namespace: {{ include "gha-controller.namespace" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/deployment.yaml

@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "gha-controller.name" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-  labels:
-    {{- include "gha-controller.labels" . | nindent 4 }}
-spec:
-  replicas: {{ default 1 .Values.controller.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "gha-controller.selector-labels" . | nindent 6 }}
-  template:
-    metadata:
-      annotations:
-        {{- include "gha-controller-template.annotations" . | nindent 8 }}
-      labels:
-        {{- include "gha-controller-template.labels" . | nindent 8 }}
-    spec:
-      {{- $pod := (.Values.controller.pod | default dict) -}}
-      {{- if and (hasKey .Values.controller "pod") (not (kindIs "map" $pod)) -}}
-        {{- fail "controller.pod must be an object" -}}
-      {{- end -}}
-      {{- $podSpec := (index $pod "spec" | default dict) -}}
-      {{- if and (hasKey $pod "spec") (not (kindIs "map" $podSpec)) -}}
-        {{- fail "controller.pod.spec must be an object" -}}
-      {{- end -}}
-
-
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gha-controller.service-account-name" . }}
-      containers:
-        -
-      {{- include "gha-controller-template.manager-container" . | nindent 10 }}
-        {{- $extraContainers := (index $podSpec "containers" | default list) -}}
-        {{- range $extraContainers }}
-        -
-      {{- toYaml . | nindent 10 }}
-        {{- end }}
-      terminationGracePeriodSeconds: {{ default 10 (index $podSpec "terminationGracePeriodSeconds") }}
-      volumes:
-        - name: tmp
-          emptyDir: {}
-      {{- $podVolumes := (index $podSpec "volumes" | default list) -}}
-      {{- range $podVolumes }}
-        - {{- toYaml . | nindent 10 }}
-      {{- end }}
-      {{- $runnerPodSpecExtraFields := (omit $podSpec "containers" "serviceAccountName" "terminationGracePeriodSeconds" "volumes") -}}
-      {{- if gt (len $runnerPodSpecExtraFields) 0 }}
-      {{- toYaml $runnerPodSpecExtraFields | nindent 6 }}
-      {{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/leader_election_role.yaml

@@ -1,15 +0,0 @@
-{{- if gt (int (default 1 .Values.controller.replicaCount)) 1 }}
-# permissions to do leader election.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gha-controller.leader-election-role-name" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-rules:
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "watch", "list", "delete", "update", "create"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/leader_election_role_binding.yaml

@@ -1,15 +0,0 @@
-{{- if gt (int (default 1 .Values.controller.replicaCount)) 1 }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gha-controller.leader-election-role-binding" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gha-controller.leader-election-role-name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gha-controller.service-account-name" . }}
-  namespace: {{ include "gha-controller.namespace" . }}
-{{- end }}

charts/gha-runner-scale-set-controller-experimental/templates/manager_cluster_role.yaml

@@ -1,144 +0,0 @@
-{{- if empty .Values.controller.manager.config.watchSingleNamespace }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "gha-controller.manager-cluster-role-name" . }}
-rules:
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalingrunnersets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalingrunnersets/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalingrunnersets/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalinglisteners
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalinglisteners/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - autoscalinglisteners/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunnersets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunnersets/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunnersets/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunners
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunners/finalizers
-  verbs:
-  - patch
-  - update
-- apiGroups:
-  - actions.github.com
-  resources:
-  - ephemeralrunners/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts
-  verbs:
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - rolebindings
-  verbs:
-  - list
-  - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - roles
-  verbs:
-  - list
-  - watch
-  - patch
-{{- end }}