search

actions / runner

The Runner for GitHub Actions :rocket:
https://github.com/features/actions
MIT License
4.89k stars 959 forks source link

Self hosted runner reports access error during registration; needs view permissions #2507

Open weiw05 opened 1 year ago

weiw05 commented 1 year ago

Describe the bug I'm using the Linux self-hosted runner. Most of the time, it works great, but occasionally, I get an error during runner registration with the message: "An error occurred: Access denied. System:ServiceIdentity;DDDDDDDD-DDDD-DDDD-DDDD-DDDDDDDDDDDD needs View permissions to perform the action." I'd like to know what view permission this is referring to.

To Reproduce Steps to reproduce the behavior:

  1. generate a Github personal access token (PAT) with admin:org permission
  2. use the Github Rest API to get a org runner registration token (curl ... https://api.github.com/orgs/.../actions/runners/registration-token)
  3. configure the runner with token (./config.sh --url --token ...)
  4. start the runner: (./run.sh)

Expected behavior Connected to Github Current runner version: '2.303.0' Listening for Jobs Running job: ...

Runner Version and Platform

2.303.0

OS of the machine running the runner? Linux

What's not working?

Get the following error message occasionally: Current runner version: '2.303.0' Listening for Jobs An error occurred: Access denied. System:ServiceIdentity;DDDDDDDD-DDDD-DDDD-DDDD-DDDDDDDDDDDD needs View permissions to perform the action. Runner listener exit with retryable error, re-launch runner in 5 seconds. Restarting runner...

√ Connected to GitHub

Failed to create a session. The runner registration has been deleted from the server, please re-configure. Runner listener exit with terminated error, stop the service, no retry needed. Exiting runner...

Job Log Output

no job is processed

Runner and Worker's Diagnostic Logs

If applicable, add relevant diagnostic log information. Logs are located in the runner's _diag folder. The runner logs are prefixed with Runner_ and the worker logs are prefixed with Worker_. Each job run correlates to a worker log. All sensitive information should already be masked out, but please double-check before pasting here.

ruvceskistefan commented 1 year ago

Hey @weiw05 , Are your runner groups at the ORG level configured for All repositories or All workflows?

If you registered the runners at org-level to the "default" runners group. It was configured to allow all repositories(excluding public repositories by default)

weiw05 commented 1 year ago

The runner group is configured for one repository (the only one I'm running the workflows on), and All workflows. I get the error even though no workflows are triggered from other repositories. Is All repositories a requirement to avoid the permission error?

shantanu10 commented 1 year ago

Hi @weiw05,

Did you manage the solve the issue? I am also getting the same issue whenever i delete my github runner. It takes 5-10 mins for a github runner to come up. Till that time, multiple runners come up and gets terminated.

weiw05 commented 1 year ago

No, still seeing the same problem, and still occurring occasionally/seemingly randomly.

vitalykarasik commented 1 year ago

See https://github.com/actions/runner/issues/756#issuecomment-1087442901 : "If the runner does not get any tasks for 30 days, it is being cleaned up from the service side. That might be the reason why you needed to re-configure your runner again."

pdeva commented 1 year ago

we are getting this error too..

furlangiacomo commented 10 months ago

we are getting the same error with action-runner-controller and runner version 2.311.0, did anyone find a workaround or something?

nazbadat commented 10 months ago

Is there a way to find the token when trying to remove the runner? I understand it is displayed when you initially configure the runner, but you need that same token when you're trying to reconfigure. The only issue is, if you try and remove the runner after the 30 days and it's disappeared from the GH UI, you can't view the token to remove it... So you have to then go ahead and wipe you're entire directory, and start again? Sounds extremely counter intuitive to me, not sure if anyone else agrees either...

The only other option to prevent this is to make sure you make a note of the token when configuring initially, then if you ever run into the issue where your runners have been inactive for too long, you can then go ahead and remove the runner with the token you took a note of way back when lol.

celiogafesi commented 6 months ago

We are also facing the same problem, with it happening without a clear pattern. Has anyone managed to come up with a fix for this?

cb-krishnapatel commented 5 months ago

Team, can we bump this up? due to this, I'm facing random workflow failures. I'm facing this with GitHub app authentication with all the necessary permissions given.

Nuru commented 5 months ago

My runners are exiting with this error if they remain idle more than 2 minutes. Deployed via actions-runner-controller Helm Chart v0.23.7.

luismiguelsaez-steercrm commented 4 months ago

I'm deploying the runners to Kubernetes ( EKS ) through Helm, using gha-runner-scale-set-controller chart version 0.9.2. We have a workflow that uses a matrix to create around 60 runners to build different images.

I am experiencing the issue randomly for some of the runners, even though they register successfully to GHA

√ Connected to GitHub

it fails seconds later while executing the job with the following errors

[RUNNER 2024-06-26 14:58:17Z ERR  GitHubActionsService] POST request to https://pipelinesghubeus3.actions.githubusercontent.com/EMdYJ0e8OZvrY3kdHoarqQa5vRx5ItkhbERYlQ35U6MxWjS0e4/_apis/oauth2/token failed. HTTP Status: BadRequest
[RUNNER 2024-06-26 14:58:17Z ERR  Terminal] WRITE ERROR: Failed to create a session. The runner registration has been deleted from the server, please re-configure. Runner registrations are automatically deleted for runners that have not connected to the service recently.

GHA is somehow deleting the runner registration, making the job fail with Error: The operation was canceled.

I have already read a bunch of issues opened by people experiencing similar problems, but GH is not putting much effort in their resolution. I'm starting to think that they just want people use the GH managed runners, but that is not possible for security reasons, depending on the infrastructure, and we are already paying for the service.

rnpaiva commented 3 months ago

It's happening for me as well , but it's intermittent .. Someone fixed it or workaround it somehow ? After some time the runner tries to connect in the github several times but never register properly : Screenshot from 2024-08-08 12-18-30

quintmouthaan commented 2 months ago

How can this issue be open for 17 months without any reaction from Github whatsoever? That is just ridiculous.

We started encountering this issue as well and this is a serious issue for us. We cannot use the Github hosted runners due to security considerations. Makes me seriously consider if we should move to a different solution like AWS Code Pipelines.