actions / actions-runner-controller

Kubernetes controller for GitHub Actions self-hosted runners
Apache License 2.0
4.53k stars 1.07k forks source link

Runner Scale Set Auth Secret Does Not Support GH App Client ID #3667

Open molson504x opened 1 month ago

molson504x commented 1 month ago

Checks

Controller Version

0.9.3

Deployment Method

Helm

Checks

To Reproduce

1. Create an auth secret to authenticate a runner scale set, use the GH App's Client ID (not App ID) in the "github_app_id" secret parameter.
2. Attempt to use this secret when deploying the helm chart for a new runner scale set.  Observe the reconciler error stating `"strconv.ParseInt: parsing \"[GH APP CLIENT ID HERE]\": invalid syntax"`.

Describe the bug

While deploying a runner scale set, I attempted to use the GH App client ID rather than the GH App ID. This produces the following error in the reconciler:

ERROR Reconciler error {"controller": "autoscalingrunnerset", "controllerGroup": "actions.github.com", "controllerKind": "AutoscalingRunnerSet", "AutoscalingRunnerSet": {"name":"gh-arc-runners","namespace":"arc-runners"}, "namespace": "arc-runners", "name": "gh-arc-runners", "reconcileID": "bad05748-8745-447f-bac3-62d771451fe0", "error": "strconv.ParseInt: parsing \"I[REDACTED FOR SECURITY REASONS}\": invalid syntax"}

However, per the GH App Docs an App ID and Client ID should both be allowed in the iss parameter of a JWT token. Additionally, GitHub seems to be guiding people to use the Client ID for authenticating GH Apps instead of the App ID (messaging such as:

Using your App ID to get installation tokens? You can now use your Client ID instead.

appears on the app configuration page).

When I run this with an App ID instead of a Client ID the runner scale set deploys as expected.

Describe the expected behavior

I'd expect the Client ID to be able to be used when deploying a new Runner Scale Set.

Additional Context

None.

Controller Logs

See note above about the relevant logs output by the controller.

Runner Pod Logs

None, since the runner pod never was deployed because of this error.
github-actions[bot] commented 1 month ago

Hello! Thank you for filing an issue.

The maintainers will triage your issue shortly.

In the meantime, please take a look at the troubleshooting guide for bug reports.

If this is a feature request, please review our contribution guidelines.