Kubernetes #

If you have a large number of machines with Kubernetes installed, and you want to change the number of runners by scaling a Deployment, this page is for you.

Topology #

The PAT stays on KMS. Runners ask KMS for a short-lived registration token, so the long-lived credential never lands on a runner pod.

KMS #

To register a runner without exposing the Personal Access Token to it, run KMS first.

Create a docker-compose.yml file with the following content.

services:
  kms:
    image: knatnetwork/github-runner-kms:latest
    restart: always
    environment:
      PAT_knatnetwork: 'ghp_Lxxxxxxxxxx2NUk5F'
      PAT_rust-lang: 'ghp_Lxxxxxxxxxx2NUk5F'
    ports:
      - 3000:3000

If your org’s name is org_name, the environment variable is PAT_org_name: 'ghp_Lxxxxxxxxxx2NUk5F'.

Then run docker-compose up -d. KMS listens on port 3000.

Runner #

With KMS running, deploy the runners as a Deployment. Copy the manifest below and adjust the values you need.

This example uses a dind sidecar so Docker builds stay off the host daemon.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: knat-network-runner-deployment
  labels:
    app: githubrunner
spec:
  replicas: 3
  selector:
    matchLabels:
      app: githubrunner
  template:
    metadata:
      labels:
        app: githubrunner
    spec:
      containers:
        - name: github-runner
          imagePullPolicy: Always
          image: 'knatnetwork/github-runner:latest'
          env:
            - name: RUNNER_REGISTER_TO
              value: "knatnetwork"
            - name: GOPROXY
              value: "http://goproxy.knat.network,https://proxy.golang.org,direct"
            - name: KMS_SERVER_ADDR
              value: "http://<KMS_HOST_IP>:3000"
            - name: RUNNER_LABELS
              value: "internal-cluster,docker"
            - name: DOCKER_HOST
              value: tcp://localhost:2375

        - name: dind
          imagePullPolicy: IfNotPresent
          image: docker:dind
          args: ["--registry-mirror=https://registry-mirror.knat.network"]
          securityContext:
            privileged: true
          env:
          - name: DOCKER_TLS_CERTDIR
            value: ""
          - name: DOCKER_HOST
            value: tcp://localhost:2375