Actions-runner-controller: Associate runners with multiple repos

[chenrui333]

I wonder if there is any way that we can associate action runners with multiple repos.

(this would also allow to reduce the committed resource usage)

[summerwind]

Yeah, I'm also waiting for GitHub to support "organization-level runners" !
Currently, GitHub does not support this feature but I believe that they will support in the near future.

[chenrui333]

@summerwind do you have any open issue or community thread that I can follow? Thanks!!

[mumoshu]

@chenrui333 Here's the thread https://github.community/t5/GitHub-Actions/Expose-self-hosted-runner-to-organization-only/m-p/44176 😃

[summerwind]

FYI: It seems that the runner's code is ready to support the API for org-level runner.
https://github.com/actions/runner/pull/339

[chenrui333]

Nice!

[chenrui333]

Looking at v2.168.0 release note, the org-level runner should be supported now?

https://github.com/actions/runner/releases/tag/v2.168.0

[summerwind]

Maybe yes but GitHub API doesn't seem to be opened yet.

[chenrui333]

Isn't this saying "Update Runner Register GitHub API URL to Support Org-level Runner ", let me do a quick check with their latest API.

[reiniertimmer]

Hello all, I'm also very interested in this project and have been doing some initial exploration with this k8s solution. Seems to work well (though we have a bit of a limited use case for now)

The organization runners are supported in the GitHub API since April 21st - though it does not seem like you can add a runner to your personal GH account (so you can have a single runner for all of your personal repositories). Docs don't mention it either: https://help.github.com/en/actions/hosting-your-own-runners/adding-self-hosted-runners

I plan to do some testing with this solution as soon as possible to see if I come across any issues. For now my main problem is that you have to be organization owner in order to add runners

[mumoshu]

Apparently we now have a different set of APIs for operations around organizational runners.

https://developer.github.com/v3/actions/self-hosted-runners/

Today, we specifically use https://github.com/summerwind/actions-runner-controller/blob/5714459c24e7cad727eeefe2d188aedcadb47c39/github/github.go#L66, https://github.com/summerwind/actions-runner-controller/blob/5714459c24e7cad727eeefe2d188aedcadb47c39/github/github.go#L90 and https://github.com/summerwind/actions-runner-controller/blob/5714459c24e7cad727eeefe2d188aedcadb47c39/github/github.go#L113 for creating, deleting tokens and listing runners, respectively.

You need to update code to use either the repository-specific APIs and the organizational APIs depending on the runner spec.

Perhaps making runner.spec.repository to be optional and adding an optional field organization and using the organizational APIs when spec.organization is set would suffice?

Anyone wants to contribute? 😃

[reiniertimmer]

So if I understand correctly, the latest runner can work with both org/repo, but the token handling registration is different for both cases.

I'll have a look if I can make some sense of this and if I could contribute

[mumoshu]

Yes, I think you're correct. I'm more than happy to help if you could give it a try!

[reiniertimmer]

One issue so far is that it seems that go-github does not support the new API yet.

[mumoshu]

@reiniertimmer Yes that's true. I read the got-github code and realized that it isn't even in the master branch yet.

However, I thought go-github had a low-level API that allows you to send arbitrary HTTP requests w/ the correct Authorization header added. Perhaps you can use that.

[reiniertimmer]

Hi, yes that's what it's using internally.

I started out with it and it seems perfectly doable, though maybe I'll contribute that code to go-github as well (it's pretty straightforward because the APIs are almost similar)

[reiniertimmer]

Implementation was quite simple, ~but I fear that there's some issue with this new API: I _can_ use oauth to create a runner token, but cannot seem to get it to retrieve all runners on the organization (although according to the docs, it requires only read permissions). So.. in progress but not quite there yet.~

Edit: of course it was an error on my part, the API seems to work well. Testing the implementation now. I'll create the PR once I have been able to verify that both the old and the new case work as before.