From 276bb1ca3aef1d25b3f369d3f03cc117efebe322 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Fri, 12 Jun 2026 17:10:10 +0200 Subject: [PATCH 01/22] Fix ephemeral runner set status update --- .../templates/_mode_kubernetes.tpl | 5 ++++- .../actions.github.com/ephemeralrunnerset_controller.go | 3 +-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl b/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl index 6589d01d1c..90800e80d3 100644 --- a/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl +++ b/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl @@ -82,7 +82,10 @@ volumeMounts: subPath: extension readOnly: true {{- end }} - {{ include "githubServerTLS.volumeMountItem" (dict "root" $ "existingVolumeMounts" (list)) | nindent 2 }} + {{- with .Values.runner.container.volumeMounts }} + {{- toYaml . | nindent 2 }} + {{- end }} + {{ include "githubServerTLS.volumeMountItem" (dict "root" $ "existingVolumeMounts" (.Values.runner.container.volumeMounts | default list)) | nindent 2 }} {{- end }} {{- define "runner-mode-kubernetes.pod-volumes" -}} diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller.go b/controllers/actions.github.com/ephemeralrunnerset_controller.go index 919a46419f..092b93f6e0 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller.go @@ -245,7 +245,6 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R } func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet, state *ephemeralRunnersByState, log logr.Logger) error { - original := ephemeralRunnerSet.DeepCopy() var phase v1alpha1.EphemeralRunnerSetPhase switch { case len(state.outdated) > 0: @@ -262,7 +261,7 @@ func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemer // Update the status if needed. if ephemeralRunnerSet.Status != desiredStatus { ephemeralRunnerSet.Status = desiredStatus - if err := r.Status().Patch(ctx, ephemeralRunnerSet, client.MergeFrom(original)); err != nil { + if err := r.Status().Update(ctx, ephemeralRunnerSet); err != nil { log.Error(err, "Failed to update EphemeralRunnerSet status") return err } From 390d6e289d15b9aa3560b9cc56bc1363b472f749 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Sat, 13 Jun 2026 01:13:55 +0200 Subject: [PATCH 02/22] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../templates/_mode_kubernetes.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl b/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl index 90800e80d3..672c8495d4 100644 --- a/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl +++ b/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl @@ -85,7 +85,7 @@ volumeMounts: {{- with .Values.runner.container.volumeMounts }} {{- toYaml . | nindent 2 }} {{- end }} - {{ include "githubServerTLS.volumeMountItem" (dict "root" $ "existingVolumeMounts" (.Values.runner.container.volumeMounts | default list)) | nindent 2 }} + {{ include "githubServerTLS.volumeMountItem" (dict "root" $ "existingVolumeMounts" (.Values.runner.container.volumeMounts | default (list))) | nindent 2 }} {{- end }} {{- define "runner-mode-kubernetes.pod-volumes" -}} From 5f974df2decfe3d8dc8a890cd5d3dee7f0fc743b Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 15 Jun 2026 10:41:30 +0200 Subject: [PATCH 03/22] Renam Url to URL --- .../v1alpha1/autoscalingrunnerset_types.go | 10 +++++----- apis/actions.github.com/v1alpha1/proxy_config_test.go | 8 ++++---- charts/gha-runner-scale-set/tests/template_test.go | 4 ++-- .../autoscalinglistener_controller_test.go | 4 ++-- .../autoscalingrunnerset_controller_test.go | 4 ++-- .../ephemeralrunner_controller_test.go | 6 +++--- .../ephemeralrunnerset_controller_test.go | 6 +++--- .../secretresolver/secret_resolver.go | 8 ++++---- 8 files changed, 25 insertions(+), 25 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index dd1bce7fa1..21aa5e9059 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -182,9 +182,9 @@ func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secr } if c.HTTP != nil { - u, err := url.Parse(c.HTTP.Url) + u, err := url.Parse(c.HTTP.URL) if err != nil { - return nil, fmt.Errorf("failed to parse proxy http url %q: %w", c.HTTP.Url, err) + return nil, fmt.Errorf("failed to parse proxy http url %q: %w", c.HTTP.URL, err) } if c.HTTP.CredentialSecretRef != "" { @@ -207,9 +207,9 @@ func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secr } if c.HTTPS != nil { - u, err := url.Parse(c.HTTPS.Url) + u, err := url.Parse(c.HTTPS.URL) if err != nil { - return nil, fmt.Errorf("failed to parse proxy https url %q: %w", c.HTTPS.Url, err) + return nil, fmt.Errorf("failed to parse proxy https url %q: %w", c.HTTPS.URL, err) } if c.HTTPS.CredentialSecretRef != "" { @@ -263,7 +263,7 @@ func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, erro type ProxyServerConfig struct { // Required - Url string `json:"url,omitempty"` + URL string `json:"url,omitempty"` // +optional CredentialSecretRef string `json:"credentialSecretRef,omitempty"` diff --git a/apis/actions.github.com/v1alpha1/proxy_config_test.go b/apis/actions.github.com/v1alpha1/proxy_config_test.go index 9291cde4e0..0357e5e268 100644 --- a/apis/actions.github.com/v1alpha1/proxy_config_test.go +++ b/apis/actions.github.com/v1alpha1/proxy_config_test.go @@ -14,11 +14,11 @@ import ( func TestProxyConfig_ToSecret(t *testing.T) { config := &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: "http://proxy.example.com:8080", + URL: "http://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, HTTPS: &v1alpha1.ProxyServerConfig{ - Url: "https://proxy.example.com:8080", + URL: "https://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, NoProxy: []string{ @@ -48,11 +48,11 @@ func TestProxyConfig_ToSecret(t *testing.T) { func TestProxyConfig_ProxyFunc(t *testing.T) { config := &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: "http://proxy.example.com:8080", + URL: "http://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, HTTPS: &v1alpha1.ProxyServerConfig{ - Url: "https://proxy.example.com:8080", + URL: "https://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, NoProxy: []string{ diff --git a/charts/gha-runner-scale-set/tests/template_test.go b/charts/gha-runner-scale-set/tests/template_test.go index e9aa4c9bcb..8c74b956ed 100644 --- a/charts/gha-runner-scale-set/tests/template_test.go +++ b/charts/gha-runner-scale-set/tests/template_test.go @@ -1365,11 +1365,11 @@ func TestTemplateRenderedWithProxy(t *testing.T) { require.NotNil(t, ars.Spec.Proxy) require.NotNil(t, ars.Spec.Proxy.HTTP) - assert.Equal(t, "http://proxy.example.com", ars.Spec.Proxy.HTTP.Url) + assert.Equal(t, "http://proxy.example.com", ars.Spec.Proxy.HTTP.URL) assert.Equal(t, "http-secret", ars.Spec.Proxy.HTTP.CredentialSecretRef) require.NotNil(t, ars.Spec.Proxy.HTTPS) - assert.Equal(t, "https://proxy.example.com", ars.Spec.Proxy.HTTPS.Url) + assert.Equal(t, "https://proxy.example.com", ars.Spec.Proxy.HTTPS.URL) assert.Equal(t, "https-secret", ars.Spec.Proxy.HTTPS.CredentialSecretRef) require.NotNil(t, ars.Spec.Proxy.NoProxy) diff --git a/controllers/actions.github.com/autoscalinglistener_controller_test.go b/controllers/actions.github.com/autoscalinglistener_controller_test.go index d48d613e6c..8ec0ebc27c 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller_test.go +++ b/controllers/actions.github.com/autoscalinglistener_controller_test.go @@ -954,11 +954,11 @@ var _ = Describe("Test AutoScalingListener controller with proxy", func() { proxy := &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: "http://localhost:8080", + URL: "http://localhost:8080", CredentialSecretRef: "proxy-credentials", }, HTTPS: &v1alpha1.ProxyServerConfig{ - Url: "https://localhost:8443", + URL: "https://localhost:8443", CredentialSecretRef: "proxy-credentials", }, NoProxy: []string{ diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 11a03dc482..28d44ad1b2 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -1241,7 +1241,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() { RunnerGroup: "testgroup", Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: proxy.URL, + URL: proxy.URL, }, }, Template: corev1.PodTemplateSpec{ @@ -1319,7 +1319,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() { RunnerGroup: "testgroup", Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: "http://test:password@" + proxy.Listener.Addr().String(), + URL: "http://test:password@" + proxy.Listener.Addr().String(), CredentialSecretRef: "proxy-credentials", }, }, diff --git a/controllers/actions.github.com/ephemeralrunner_controller_test.go b/controllers/actions.github.com/ephemeralrunner_controller_test.go index 80c27134a7..74aafb71a1 100644 --- a/controllers/actions.github.com/ephemeralrunner_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunner_controller_test.go @@ -1367,7 +1367,7 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunner.Spec.GitHubConfigURL = "http://example.com/org/repo" ephemeralRunner.Spec.Proxy = &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: proxy.URL, + URL: proxy.URL, CredentialSecretRef: "proxy-credentials", }, } @@ -1388,10 +1388,10 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunner := newExampleRunner("test-runner", autoScalingNS.Name, configSecret.Name) ephemeralRunner.Spec.Proxy = &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: "http://proxy.example.com:8080", + URL: "http://proxy.example.com:8080", }, HTTPS: &v1alpha1.ProxyServerConfig{ - Url: "http://proxy.example.com:8080", + URL: "http://proxy.example.com:8080", }, NoProxy: []string{"example.com"}, } diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go index 76cf98ab88..4526a5b0ff 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go @@ -1546,11 +1546,11 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func( RunnerScaleSetID: 100, Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: "http://proxy.example.com", + URL: "http://proxy.example.com", CredentialSecretRef: secretCredentials.Name, }, HTTPS: &v1alpha1.ProxyServerConfig{ - Url: "https://proxy.example.com", + URL: "https://proxy.example.com", CredentialSecretRef: secretCredentials.Name, }, NoProxy: []string{"example.com", "example.org"}, @@ -1729,7 +1729,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func( RunnerScaleSetID: 100, Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - Url: proxy.URL, + URL: proxy.URL, CredentialSecretRef: "proxy-credentials", }, }, diff --git a/controllers/actions.github.com/secretresolver/secret_resolver.go b/controllers/actions.github.com/secretresolver/secret_resolver.go index 5f3e95612d..b9f9d9ccba 100644 --- a/controllers/actions.github.com/secretresolver/secret_resolver.go +++ b/controllers/actions.github.com/secretresolver/secret_resolver.go @@ -85,9 +85,9 @@ func (sr *SecretResolver) GetActionsService(ctx context.Context, obj object.Acti } if proxy.HTTP != nil { - u, err := url.Parse(proxy.HTTP.Url) + u, err := url.Parse(proxy.HTTP.URL) if err != nil { - return nil, fmt.Errorf("failed to parse proxy http url %q: %w", proxy.HTTP.Url, err) + return nil, fmt.Errorf("failed to parse proxy http url %q: %w", proxy.HTTP.URL, err) } if ref := proxy.HTTP.CredentialSecretRef; ref != "" { @@ -101,9 +101,9 @@ func (sr *SecretResolver) GetActionsService(ctx context.Context, obj object.Acti } if proxy.HTTPS != nil { - u, err := url.Parse(proxy.HTTPS.Url) + u, err := url.Parse(proxy.HTTPS.URL) if err != nil { - return nil, fmt.Errorf("failed to parse proxy https url %q: %w", proxy.HTTPS.Url, err) + return nil, fmt.Errorf("failed to parse proxy https url %q: %w", proxy.HTTPS.URL, err) } if ref := proxy.HTTPS.CredentialSecretRef; ref != "" { From ae9b446095e9439ef4d90af5690ae5cefb8fae52 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 15 Jun 2026 12:21:17 +0200 Subject: [PATCH 04/22] wip --- .../v1alpha1/autoscalingrunnerset_types.go | 13 ++++---- ...tions.github.com_autoscalinglisteners.yaml | 30 +++++++++++++++---- ...ions.github.com_autoscalingrunnersets.yaml | 30 ++++++++++++------- .../actions.github.com_ephemeralrunners.yaml | 19 ++++++++---- ...ctions.github.com_ephemeralrunnersets.yaml | 19 ++++++++---- ...tions.github.com_autoscalinglisteners.yaml | 30 +++++++++++++++---- ...ions.github.com_autoscalingrunnersets.yaml | 30 ++++++++++++------- .../actions.github.com_ephemeralrunners.yaml | 19 ++++++++---- ...ctions.github.com_ephemeralrunnersets.yaml | 19 ++++++++---- ...tions.github.com_autoscalinglisteners.yaml | 30 +++++++++++++++---- ...ions.github.com_autoscalingrunnersets.yaml | 30 ++++++++++++------- .../actions.github.com_ephemeralrunners.yaml | 19 ++++++++---- ...ctions.github.com_ephemeralrunnersets.yaml | 19 ++++++++---- 13 files changed, 213 insertions(+), 94 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index 21aa5e9059..7435e88c45 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -40,8 +40,7 @@ import ( // +kubebuilder:printcolumn:JSONPath=".status.phase",name=Phase,type=string // +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.failedEphemeralRunners",name=Failed Runners,type=integer // AutoscalingRunnerSet is the Schema for the autoscalingrunnersets API type AutoscalingRunnerSet struct { @@ -115,16 +114,16 @@ type AutoscalingRunnerSetSpec struct { EphemeralRunnerConfigSecretMetadata *ResourceMeta `json:"ephemeralRunnerConfigSecretMetadata,omitempty"` // +optional - // +kubebuilder:validation:Minimum:=0 + // +kubebuilder:validation:Minimum=0 MaxRunners *int `json:"maxRunners,omitempty"` // +optional - // +kubebuilder:validation:Minimum:=0 + // +kubebuilder:validation:Minimum=0 MinRunners *int `json:"minRunners,omitempty"` } type TLSConfig struct { - // Required + // +required CertificateFrom *TLSCertificateSource `json:"certificateFrom,omitempty"` } @@ -161,7 +160,7 @@ func (c *TLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error) } type TLSCertificateSource struct { - // Required + // +required ConfigMapKeyRef *corev1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty"` } @@ -262,7 +261,7 @@ func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, erro } type ProxyServerConfig struct { - // Required + // +required URL string `json:"url,omitempty"` // +optional diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml index 29cc9bb4bc..756cb9662d 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml @@ -76,10 +76,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -101,7 +100,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object image: type: string @@ -184,16 +187,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8772,16 +8777,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8794,6 +8801,17 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - autoscalingRunnerSetName + - autoscalingRunnerSetNamespace + - ephemeralRunnerSetName + - githubConfigSecret + - githubConfigUrl + - image + - imagePullSecrets + - maxRunners + - minRunners + - runnerScaleSetId type: object status: description: AutoscalingListenerStatus defines the observed state of AutoscalingListener diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml index a2dfd46d9f..083c3d175d 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml @@ -33,11 +33,8 @@ spec: - jsonPath: .status.runningEphemeralRunners name: Running Runners type: integer - - jsonPath: .status.finishedEphemeralRunners - name: Finished Runners - type: integer - - jsonPath: .status.deletingEphemeralRunners - name: Deleting Runners + - jsonPath: .status.failedEphemeralRunners + name: Failed Runners type: integer name: v1alpha1 schema: @@ -119,10 +116,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -143,7 +139,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object listenerConfigSecretMetadata: description: ResourceMeta carries metadata common to all internal resources @@ -8364,16 +8364,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -16515,16 +16517,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -16537,6 +16541,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - template type: object status: description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml index a174d751d4..8248263e7d 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml @@ -89,10 +89,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -113,7 +112,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object metadata: description: |- @@ -144,16 +147,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8268,16 +8273,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml index a6f9758bfa..70b21c9ad6 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml @@ -83,10 +83,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -107,7 +106,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object metadata: description: |- @@ -138,16 +141,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8262,16 +8267,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml index 29cc9bb4bc..756cb9662d 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml @@ -76,10 +76,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -101,7 +100,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object image: type: string @@ -184,16 +187,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8772,16 +8777,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8794,6 +8801,17 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - autoscalingRunnerSetName + - autoscalingRunnerSetNamespace + - ephemeralRunnerSetName + - githubConfigSecret + - githubConfigUrl + - image + - imagePullSecrets + - maxRunners + - minRunners + - runnerScaleSetId type: object status: description: AutoscalingListenerStatus defines the observed state of AutoscalingListener diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml index a2dfd46d9f..083c3d175d 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml @@ -33,11 +33,8 @@ spec: - jsonPath: .status.runningEphemeralRunners name: Running Runners type: integer - - jsonPath: .status.finishedEphemeralRunners - name: Finished Runners - type: integer - - jsonPath: .status.deletingEphemeralRunners - name: Deleting Runners + - jsonPath: .status.failedEphemeralRunners + name: Failed Runners type: integer name: v1alpha1 schema: @@ -119,10 +116,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -143,7 +139,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object listenerConfigSecretMetadata: description: ResourceMeta carries metadata common to all internal resources @@ -8364,16 +8364,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -16515,16 +16517,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -16537,6 +16541,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - template type: object status: description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml index a174d751d4..8248263e7d 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml @@ -89,10 +89,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -113,7 +112,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object metadata: description: |- @@ -144,16 +147,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8268,16 +8273,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml index a6f9758bfa..70b21c9ad6 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml @@ -83,10 +83,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -107,7 +106,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object metadata: description: |- @@ -138,16 +141,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8262,16 +8267,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: diff --git a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml index 29cc9bb4bc..756cb9662d 100644 --- a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml +++ b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml @@ -76,10 +76,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -101,7 +100,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object image: type: string @@ -184,16 +187,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8772,16 +8777,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8794,6 +8801,17 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - autoscalingRunnerSetName + - autoscalingRunnerSetNamespace + - ephemeralRunnerSetName + - githubConfigSecret + - githubConfigUrl + - image + - imagePullSecrets + - maxRunners + - minRunners + - runnerScaleSetId type: object status: description: AutoscalingListenerStatus defines the observed state of AutoscalingListener diff --git a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml index a2dfd46d9f..083c3d175d 100644 --- a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml +++ b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml @@ -33,11 +33,8 @@ spec: - jsonPath: .status.runningEphemeralRunners name: Running Runners type: integer - - jsonPath: .status.finishedEphemeralRunners - name: Finished Runners - type: integer - - jsonPath: .status.deletingEphemeralRunners - name: Deleting Runners + - jsonPath: .status.failedEphemeralRunners + name: Failed Runners type: integer name: v1alpha1 schema: @@ -119,10 +116,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -143,7 +139,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object listenerConfigSecretMetadata: description: ResourceMeta carries metadata common to all internal resources @@ -8364,16 +8364,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -16515,16 +16517,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -16537,6 +16541,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - template type: object status: description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet diff --git a/config/crd/bases/actions.github.com_ephemeralrunners.yaml b/config/crd/bases/actions.github.com_ephemeralrunners.yaml index a174d751d4..8248263e7d 100644 --- a/config/crd/bases/actions.github.com_ephemeralrunners.yaml +++ b/config/crd/bases/actions.github.com_ephemeralrunners.yaml @@ -89,10 +89,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -113,7 +112,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object metadata: description: |- @@ -144,16 +147,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8268,16 +8273,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: diff --git a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml index a6f9758bfa..70b21c9ad6 100644 --- a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml +++ b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml @@ -83,10 +83,9 @@ spec: githubServerTLS: properties: certificateFrom: - description: Required properties: configMapKeyRef: - description: Required + description: Selects a key from a ConfigMap. properties: key: description: The key to select. @@ -107,7 +106,11 @@ spec: - key type: object x-kubernetes-map-type: atomic + required: + - configMapKeyRef type: object + required: + - certificateFrom type: object metadata: description: |- @@ -138,16 +141,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: @@ -8262,16 +8267,18 @@ spec: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object https: properties: credentialSecretRef: type: string url: - description: Required type: string + required: + - url type: object noProxy: items: From 34ef44ea4c8301c0f3ebaed1dccb98cc7a161479 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 15 Jun 2026 12:41:07 +0200 Subject: [PATCH 05/22] wip --- .../crds/actions.github.com_autoscalinglisteners.yaml | 2 +- .../crds/actions.github.com_autoscalinglisteners.yaml | 2 +- config/crd/bases/actions.github.com_autoscalinglisteners.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml index 756cb9662d..9265298660 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml @@ -232,6 +232,7 @@ spec: type: object type: object runnerScaleSetId: + minimum: 1 type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal @@ -8808,7 +8809,6 @@ spec: - githubConfigSecret - githubConfigUrl - image - - imagePullSecrets - maxRunners - minRunners - runnerScaleSetId diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml index 756cb9662d..9265298660 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml @@ -232,6 +232,7 @@ spec: type: object type: object runnerScaleSetId: + minimum: 1 type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal @@ -8808,7 +8809,6 @@ spec: - githubConfigSecret - githubConfigUrl - image - - imagePullSecrets - maxRunners - minRunners - runnerScaleSetId diff --git a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml index 756cb9662d..9265298660 100644 --- a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml +++ b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml @@ -232,6 +232,7 @@ spec: type: object type: object runnerScaleSetId: + minimum: 1 type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal @@ -8808,7 +8809,6 @@ spec: - githubConfigSecret - githubConfigUrl - image - - imagePullSecrets - maxRunners - minRunners - runnerScaleSetId From 7a59fea6a90e72215bb1783618a58b74302fc1d8 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 15 Jun 2026 16:22:15 +0200 Subject: [PATCH 06/22] Fix ephemeral runner set annotation propagation --- .../templates/manager_role.yaml | 2 + .../templates/manager_role.yaml | 2 + .../autoscalinglistener_controller.go | 14 +-- .../autoscalingrunnerset_controller.go | 10 +- .../autoscalingrunnerset_controller_test.go | 8 +- .../ephemeralrunnerset_controller.go | 6 +- .../actions.github.com/resourcebuilder.go | 105 ++++++++++-------- .../resourcebuilder_test.go | 8 +- 8 files changed, 86 insertions(+), 69 deletions(-) diff --git a/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml b/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml index 2990ccc49f..a5c9a258ca 100644 --- a/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml +++ b/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml @@ -17,6 +17,8 @@ rules: verbs: - create - delete + - update + - patch - get - apiGroups: - "" diff --git a/charts/gha-runner-scale-set/templates/manager_role.yaml b/charts/gha-runner-scale-set/templates/manager_role.yaml index bbf9279999..88ca5a3f76 100644 --- a/charts/gha-runner-scale-set/templates/manager_role.yaml +++ b/charts/gha-runner-scale-set/templates/manager_role.yaml @@ -41,6 +41,8 @@ rules: verbs: - create - delete + - update + - patch - get - apiGroups: - "" diff --git a/controllers/actions.github.com/autoscalinglistener_controller.go b/controllers/actions.github.com/autoscalinglistener_controller.go index c0aa81114c..3b61a3baab 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller.go +++ b/controllers/actions.github.com/autoscalinglistener_controller.go @@ -165,7 +165,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. desiredLabels := r.filterAndMergeLabels(serviceAccount.Labels, desiredServiceAccount.Labels) labelsModified := !maps.Equal(serviceAccount.Labels, desiredLabels) - desiredAnnotations := r.mergeAnnotations(serviceAccount.Annotations, desiredServiceAccount.Annotations) + desiredAnnotations := r.filterAndMergeAnnotations(serviceAccount.Annotations, desiredServiceAccount.Annotations) annotationsModified := !maps.Equal(serviceAccount.Annotations, desiredAnnotations) if labelsModified || annotationsModified { updatedServiceAccount := serviceAccount.DeepCopy() @@ -208,7 +208,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. desiredRole := r.newScaleSetListenerRole(&autoscalingListener) desiredLabels := r.filterAndMergeLabels(listenerRole.Labels, desiredRole.Labels) labelsModified := !maps.Equal(listenerRole.Labels, desiredLabels) - desiredAnnotations := r.mergeAnnotations(listenerRole.Annotations, desiredRole.Annotations) + desiredAnnotations := r.filterAndMergeAnnotations(listenerRole.Annotations, desiredRole.Annotations) annotationsModified := !maps.Equal(listenerRole.Annotations, desiredAnnotations) rulesModified := !reflect.DeepEqual(listenerRole.Rules, desiredRole.Rules) if labelsModified || annotationsModified || rulesModified { @@ -250,7 +250,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. ) desiredLabels := r.filterAndMergeLabels(listenerRoleBinding.Labels, desiredRoleBinding.Labels) labelsModified := !maps.Equal(listenerRoleBinding.Labels, desiredLabels) - desiredAnnotations := r.mergeAnnotations(listenerRoleBinding.Annotations, desiredRoleBinding.Annotations) + desiredAnnotations := r.filterAndMergeAnnotations(listenerRoleBinding.Annotations, desiredRoleBinding.Annotations) annotationsModified := !maps.Equal(listenerRoleBinding.Annotations, desiredAnnotations) if labelsModified || annotationsModified { updatedRoleBinding := listenerRoleBinding.DeepCopy() @@ -305,7 +305,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. } desiredLabels := r.filterAndMergeLabels(proxySecret.Labels, desiredListenerProxy.Labels) labelsModified := !maps.Equal(proxySecret.Labels, desiredLabels) - desiredAnnotations := r.mergeAnnotations(proxySecret.Annotations, desiredListenerProxy.Annotations) + desiredAnnotations := r.filterAndMergeAnnotations(proxySecret.Annotations, desiredListenerProxy.Annotations) annotationsModified := !maps.Equal(proxySecret.Annotations, desiredAnnotations) if labelsModified || annotationsModified { updatedProxySecret := proxySecret.DeepCopy() @@ -391,7 +391,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. } desiredLabels := r.filterAndMergeLabels(listenerConfigSecret.Labels, desiredSecret.Labels) labelsModified := !maps.Equal(listenerConfigSecret.Labels, desiredLabels) - desiredAnnotations := r.mergeAnnotations(listenerConfigSecret.Annotations, desiredSecret.Annotations) + desiredAnnotations := r.filterAndMergeAnnotations(listenerConfigSecret.Annotations, desiredSecret.Annotations) annotationsModified := !maps.Equal(listenerConfigSecret.Annotations, desiredAnnotations) if labelsModified || annotationsModified { @@ -462,7 +462,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, err } - shouldReCreate := desiredPod.Annotations[annotationKeyIntegrityHash] != listenerPod.Annotations[annotationKeyIntegrityHash] + shouldReCreate := desiredPod.Annotations[AnnotationKeyIntegrityHash] != listenerPod.Annotations[AnnotationKeyIntegrityHash] if shouldReCreate { log.Info("Listener pod dependency changed, recreating listener pod") if err := r.deleteListenerPod(ctx, &autoscalingListener, &listenerPod, log); err != nil { @@ -475,7 +475,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. desiredLabels := r.filterAndMergeLabels(listenerPod.Labels, desiredPod.Labels) labelsModified := !maps.Equal(listenerPod.Labels, desiredLabels) - desiredAnnotations := r.mergeAnnotations(listenerPod.Annotations, desiredPod.Annotations) + desiredAnnotations := r.filterAndMergeAnnotations(listenerPod.Annotations, desiredPod.Annotations) annotationsModified := !maps.Equal(listenerPod.Annotations, desiredAnnotations) if labelsModified || annotationsModified { diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index e48f75ff15..1e1e2bb44c 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -142,13 +142,13 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl } // Something has changed, we need to re-apply the pending phase and change hash annotation to trigger the update of runner scale set and listener. - if targetHash := autoscalingRunnerSet.Hash(); autoscalingRunnerSet.Annotations[annotationKeyIntegrityHash] != targetHash { + if targetHash := autoscalingRunnerSet.Hash(); autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] != targetHash { // TODO: apply the version label original := autoscalingRunnerSet.DeepCopy() if autoscalingRunnerSet.Annotations == nil { autoscalingRunnerSet.Annotations = map[string]string{} } - autoscalingRunnerSet.Annotations[annotationKeyIntegrityHash] = targetHash + autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] = targetHash if err := r.Patch(ctx, &autoscalingRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update autoscaling runner set with new change hash and pending phase") return ctrl.Result{}, err @@ -291,12 +291,12 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl return ctrl.Result{}, nil } - if ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash] != desired.Annotations[annotationKeyIntegrityHash] { + if ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] != desired.Annotations[AnnotationKeyIntegrityHash] { original := ephemeralRunnerSet.DeepCopy() ephemeralRunnerSet.Spec.EphemeralRunnerMetadata = desired.Spec.EphemeralRunnerMetadata ephemeralRunnerSet.Spec.EphemeralRunnerSpec = desired.Spec.EphemeralRunnerSpec ephemeralRunnerSet.Labels = r.filterAndMergeLabels(ephemeralRunnerSet.Labels, desired.Labels) - ephemeralRunnerSet.Annotations = r.mergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) + ephemeralRunnerSet.Annotations = r.filterAndMergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) log.Info("Updating ephemeral runner set spec to match the desired spec") if err := r.Patch(ctx, &ephemeralRunnerSet, client.MergeFrom(original)); err != nil { @@ -315,7 +315,7 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl if ephemeralRunnerLabelsModified || ephemeralRunnerAnnotationsModified || ephemeralRunnerMetadataModified { original := ephemeralRunnerSet.DeepCopy() ephemeralRunnerSet.Labels = r.filterAndMergeLabels(ephemeralRunnerSet.Labels, desired.Labels) - ephemeralRunnerSet.Annotations = r.mergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) + ephemeralRunnerSet.Annotations = r.filterAndMergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) ephemeralRunnerSet.Spec.EphemeralRunnerMetadata = desired.Spec.EphemeralRunnerMetadata log.Info("Updating ephemeral runner set metadata to match desired labels and annotations") if err := r.Patch(ctx, &ephemeralRunnerSet, client.MergeFrom(original)); err != nil { diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 28d44ad1b2..d67832718d 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -478,7 +478,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") originalRunnerSetUID := runnerSet.UID - originalRunnerSetHash := runnerSet.Annotations[annotationKeyIntegrityHash] + originalRunnerSetHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] patched := autoscalingRunnerSet.DeepCopy() patched.Spec.Template.Spec.Containers[0].Image = "ghcr.io/actions/runner:updated" @@ -492,7 +492,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should be updated in place") g.Expect(current.Spec.EphemeralRunnerSpec.PodTemplateSpec.Spec.Containers[0].Image).To(Equal("ghcr.io/actions/runner:updated")) - g.Expect(current.Annotations[annotationKeyIntegrityHash]).NotTo(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec hash should change") + g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).NotTo(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec hash should change") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -531,7 +531,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") originalRunnerSetUID := runnerSet.UID - originalRunnerSetHash := runnerSet.Annotations[annotationKeyIntegrityHash] + originalRunnerSetHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] patched := autoscalingRunnerSet.DeepCopy() max := 20 @@ -557,7 +557,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should not be recreated") - g.Expect(current.Annotations[annotationKeyIntegrityHash]).To(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec should not change") + g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec should not change") }, time.Second*5, autoscalingRunnerSetTestInterval, diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller.go b/controllers/actions.github.com/ephemeralrunnerset_controller.go index 092b93f6e0..a6cb4d27ba 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller.go @@ -135,7 +135,7 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R // If hash spec has changed, delete idle ephemeral runners // in order to apply the change to the runners that did not yet receive a job. ephemeralRunnerIntegrityHash := ephemeralRunnerSetIntegrityHash(&ephemeralRunnerSet) - if ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash] != ephemeralRunnerIntegrityHash { + if ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] != ephemeralRunnerIntegrityHash { log.Info("EphemeralRunnerSpec has changed, deleting idle ephemeral runners to apply the new spec") if _, err := r.cleanUpEphemeralRunners(ctx, &ephemeralRunnerSet, log); err != nil { log.Error(err, "Failed to clean up EphemeralRunners") @@ -152,7 +152,7 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R if ephemeralRunnerSet.Annotations == nil { ephemeralRunnerSet.Annotations = make(map[string]string) } - ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash] = ephemeralRunnerIntegrityHash + ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] = ephemeralRunnerIntegrityHash if err := r.Patch(ctx, &ephemeralRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update ephemeral runner set with new spec hash") return ctrl.Result{}, err @@ -467,7 +467,7 @@ func (r *EphemeralRunnerSetReconciler) reconcileEphemeralRunnerSetProxySecret(ct dataModified := !maps.EqualFunc(proxySecret.Data, desiredRunnerSetProxy.Data, bytes.Equal) desiredLabels := r.filterAndMergeLabels(proxySecret.Labels, desiredRunnerSetProxy.Labels) labelsModified := !maps.Equal(proxySecret.Labels, desiredLabels) - desiredAnnotations := r.mergeAnnotations(proxySecret.Annotations, desiredRunnerSetProxy.Annotations) + desiredAnnotations := r.filterAndMergeAnnotations(proxySecret.Annotations, desiredRunnerSetProxy.Annotations) annotationsModified := !maps.Equal(proxySecret.Annotations, desiredAnnotations) if dataModified || labelsModified || annotationsModified { updatedProxySecret := proxySecret.DeepCopy() diff --git a/controllers/actions.github.com/resourcebuilder.go b/controllers/actions.github.com/resourcebuilder.go index fd456b56f1..7c50a092e8 100644 --- a/controllers/actions.github.com/resourcebuilder.go +++ b/controllers/actions.github.com/resourcebuilder.go @@ -46,14 +46,14 @@ var commonLabelKeys = [...]string{ LabelKeyGitHubRepository, } -// annotationKeyIntegrityHash is used as a hash of the important fields +// AnnotationKeyIntegrityHash is used as a hash of the important fields // of each resource to determine if more drastic action should be taken. // // For example, annotations/labels are not something that should modify // the behavior of a resource, while the change in spec is. Therefore, // the spec hash should contain the spec fields in order to determine // modifications. -const annotationKeyIntegrityHash = "actions.github.com/integrity-hash" +const AnnotationKeyIntegrityHash = "actions.github.com/integrity-hash" const labelValueKubernetesPartOf = "gha-runner-scale-set" @@ -165,12 +165,12 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. } annotations := map[string]string{ - annotationKeyIntegrityHash: spec.Hash(), + AnnotationKeyIntegrityHash: spec.Hash(), } if autoscalingRunnerSet.Spec.AutoscalingListenerMetadata != nil { labels = b.filterAndMergeLabels(autoscalingRunnerSet.Spec.AutoscalingListenerMetadata.Labels, labels) - annotations = b.mergeAnnotations(autoscalingRunnerSet.Spec.AutoscalingListenerMetadata.Annotations, annotations) + annotations = b.filterAndMergeAnnotations(autoscalingRunnerSet.Spec.AutoscalingListenerMetadata.Annotations, annotations) } autoscalingListener := &v1alpha1.AutoscalingListener{ @@ -278,7 +278,7 @@ func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha }, } - desiredSecret.Annotations[annotationKeyIntegrityHash] = scaleSetListenerConfigIntegrityHash(desiredSecret) + desiredSecret.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerConfigIntegrityHash(desiredSecret) if err := b.setControllerReference(autoscalingListener, desiredSecret); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener config secret: %w", err) @@ -426,7 +426,7 @@ func (b *ResourceBuilder) newScaleSetListenerPod( Spec: podSpec, } - newRunnerScaleSetListenerPod.Annotations[annotationKeyIntegrityHash] = scaleSetListenerPodIntegrity( + newRunnerScaleSetListenerPod.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerPodIntegrity( newRunnerScaleSetListenerPod, autoscalingListener, podConfig, @@ -468,11 +468,11 @@ func scaleSetListenerPodIntegrity( d := data{ ListenerPodSpec: &pod.Spec, - AutoscalingListenerIntegrityHash: autoscalingListener.Annotations[annotationKeyIntegrityHash], - ConfigSecretIntegrityHash: podConfig.Annotations[annotationKeyIntegrityHash], - ServiceAccountIntegrityHash: serviceAccount.Annotations[annotationKeyIntegrityHash], - RoleIntegrityHash: role.Annotations[annotationKeyIntegrityHash], - RoleBindingIntegrityHash: roleBinding.Annotations[annotationKeyIntegrityHash], + AutoscalingListenerIntegrityHash: autoscalingListener.Annotations[AnnotationKeyIntegrityHash], + ConfigSecretIntegrityHash: podConfig.Annotations[AnnotationKeyIntegrityHash], + ServiceAccountIntegrityHash: serviceAccount.Annotations[AnnotationKeyIntegrityHash], + RoleIntegrityHash: role.Annotations[AnnotationKeyIntegrityHash], + RoleBindingIntegrityHash: roleBinding.Annotations[AnnotationKeyIntegrityHash], MetricsConfig: metricsConfig, } @@ -611,10 +611,10 @@ func (b *ResourceBuilder) newScaleSetListenerServiceAccount(autoscalingListener if autoscalingListener.Spec.ServiceAccountMetadata != nil { base.Labels = b.filterAndMergeLabels(autoscalingListener.Spec.ServiceAccountMetadata.Labels, base.Labels) - base.Annotations = b.mergeAnnotations(autoscalingListener.Spec.ServiceAccountMetadata.Annotations, base.Annotations) + base.Annotations = b.filterAndMergeAnnotations(autoscalingListener.Spec.ServiceAccountMetadata.Annotations, base.Annotations) } - base.Annotations[annotationKeyIntegrityHash] = scaleSetListenerServiceAccountIntegrityHash(base) + base.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerServiceAccountIntegrityHash(base) if err := b.setControllerReference(autoscalingListener, base); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener service account: %w", err) @@ -650,7 +650,7 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. annotations := make(map[string]string) if autoscalingListener.Spec.RoleMetadata != nil { labels = b.filterAndMergeLabels(autoscalingListener.Spec.RoleMetadata.Labels, labels) - annotations = b.mergeAnnotations(autoscalingListener.Spec.RoleMetadata.Annotations, nil) + annotations = b.filterAndMergeAnnotations(autoscalingListener.Spec.RoleMetadata.Annotations, nil) } newRole := &rbacv1.Role{ @@ -663,7 +663,7 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. Rules: rulesForListenerRole([]string{autoscalingListener.Spec.EphemeralRunnerSetName}), } - newRole.Annotations[annotationKeyIntegrityHash] = scaleSetRoleIntegrityHash(newRole) + newRole.Annotations[AnnotationKeyIntegrityHash] = scaleSetRoleIntegrityHash(newRole) return newRole } @@ -718,7 +718,7 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1 Subjects: subjects, } - newRoleBinding.Annotations[annotationKeyIntegrityHash] = scaleSetListenerRoleBindingIntegrityHash(newRoleBinding) + newRoleBinding.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerRoleBindingIntegrityHash(newRoleBinding) return newRoleBinding } @@ -777,7 +777,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A if autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata != nil { labels = b.filterAndMergeLabels(autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata.Labels, labels) - annotations = b.mergeAnnotations(autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata.Annotations, annotations) + annotations = b.filterAndMergeAnnotations(autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata.Annotations, annotations) } newEphemeralRunnerSet := &v1alpha1.EphemeralRunnerSet{ @@ -791,7 +791,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A Spec: spec, } - newEphemeralRunnerSet.Annotations[annotationKeyIntegrityHash] = ephemeralRunnerSetIntegrityHash(newEphemeralRunnerSet) + newEphemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] = ephemeralRunnerSetIntegrityHash(newEphemeralRunnerSet) if err := b.setControllerReference(autoscalingRunnerSet, newEphemeralRunnerSet); err != nil { return nil, fmt.Errorf("failed to set controller reference for ephemeral runner set: %w", err) @@ -825,7 +825,7 @@ func (b *ResourceBuilder) newAutoscalingListenerProxySecret(autoscalingListener Data: data, } - newProxySecret.Annotations[annotationKeyIntegrityHash] = autoscalingListenerProxySecretIntegrityHash(newProxySecret) + newProxySecret.Annotations[AnnotationKeyIntegrityHash] = autoscalingListenerProxySecretIntegrityHash(newProxySecret) if err := b.setControllerReference(autoscalingListener, newProxySecret); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener proxy secret: %w", err) @@ -857,7 +857,7 @@ func (b *ResourceBuilder) newEphemeralRunner(ephemeralRunnerSet *v1alpha1.Epheme if ephemeralRunnerSet.Spec.EphemeralRunnerMetadata != nil { labels = b.filterAndMergeLabels(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata.Labels, labels) - annotations = b.mergeAnnotations(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata.Annotations, annotations) + annotations = b.filterAndMergeAnnotations(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata.Annotations, annotations) } ephemeralRunner := &v1alpha1.EphemeralRunner{ @@ -992,7 +992,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSetProxySecret(ephemeralRunnerSet *v Data: data, } - runnerPodProxySecret.Annotations[annotationKeyIntegrityHash] = ephemeralRunnerSetProxySecretZIdentityHash(runnerPodProxySecret) + runnerPodProxySecret.Annotations[AnnotationKeyIntegrityHash] = ephemeralRunnerSetProxySecretZIdentityHash(runnerPodProxySecret) if err := b.setControllerReference(ephemeralRunnerSet, runnerPodProxySecret); err != nil { return nil, fmt.Errorf("failed to set controller reference for ephemeral runner set proxy secret: %w", err) @@ -1093,40 +1093,53 @@ func trimLabelValue(val string) string { return strings.Trim(val, "-_.") } +func (b *ResourceBuilder) filterLabels(k, v string) bool { + for _, prefix := range b.ExcludeLabelPropagationPrefixes { + if strings.HasPrefix(k, prefix) { + return true + } + } + return false +} + func (b *ResourceBuilder) filterAndMergeLabels(base, overwrite map[string]string) map[string]string { + return filterAndMergeMaps(base, overwrite, b.filterLabels) +} + +func filterAndMergeMaps(base, overwrite map[string]string, filter func(k, v string) bool) map[string]string { if base == nil && overwrite == nil { return nil } - - mergedLabels := make(map[string]string, len(base)) -base: - for k, v := range base { - for _, prefix := range b.ExcludeLabelPropagationPrefixes { - if strings.HasPrefix(k, prefix) { - continue base - } - } - mergedLabels[k] = v + var result map[string]string + if len(base) == 0 { + result = make(map[string]string) + } else { + result = maps.Clone(base) } - -overwrite: - for k, v := range overwrite { - for _, prefix := range b.ExcludeLabelPropagationPrefixes { - if strings.HasPrefix(k, prefix) { - continue overwrite - } - } - mergedLabels[k] = v + if len(overwrite) > 0 { + maps.Copy(result, overwrite) } - - return mergedLabels + maps.DeleteFunc(result, filter) + return result } -func (b *ResourceBuilder) mergeAnnotations(base, overwrite map[string]string) map[string]string { +func (b *ResourceBuilder) filterAndMergeAnnotations(base, overwrite map[string]string) map[string]string { if base == nil && overwrite == nil { return nil } - base = maps.Clone(base) - maps.Copy(base, overwrite) - return base + var result map[string]string + if len(base) == 0 { + result = make(map[string]string) + } else { + result = maps.Clone(base) + } + + for k, v := range overwrite { + if k == AnnotationKeyIntegrityHash { + continue + } + result[k] = v + } + + return result } diff --git a/controllers/actions.github.com/resourcebuilder_test.go b/controllers/actions.github.com/resourcebuilder_test.go index d08851173a..206e610748 100644 --- a/controllers/actions.github.com/resourcebuilder_test.go +++ b/controllers/actions.github.com/resourcebuilder_test.go @@ -113,7 +113,7 @@ func TestMetadataPropagation(t *testing.T) { assert.Equal(t, labelValueKubernetesPartOf, ephemeralRunnerSet.Labels[LabelKeyKubernetesPartOf]) assert.Equal(t, "runner-set", ephemeralRunnerSet.Labels[LabelKeyKubernetesComponent]) assert.Equal(t, autoscalingRunnerSet.Labels[LabelKeyKubernetesVersion], ephemeralRunnerSet.Labels[LabelKeyKubernetesVersion]) - assert.NotEmpty(t, ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash]) + assert.NotEmpty(t, ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash]) assert.Equal(t, autoscalingRunnerSet.Name, ephemeralRunnerSet.Labels[LabelKeyGitHubScaleSetName]) assert.Equal(t, autoscalingRunnerSet.Namespace, ephemeralRunnerSet.Labels[LabelKeyGitHubScaleSetNamespace]) assert.Equal(t, "", ephemeralRunnerSet.Labels[LabelKeyGitHubEnterprise]) @@ -130,7 +130,7 @@ func TestMetadataPropagation(t *testing.T) { assert.Equal(t, labelValueKubernetesPartOf, listener.Labels[LabelKeyKubernetesPartOf]) assert.Equal(t, "runner-scale-set-listener", listener.Labels[LabelKeyKubernetesComponent]) assert.Equal(t, autoscalingRunnerSet.Labels[LabelKeyKubernetesVersion], listener.Labels[LabelKeyKubernetesVersion]) - assert.NotEmpty(t, ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash]) + assert.NotEmpty(t, ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash]) assert.Equal(t, autoscalingRunnerSet.Name, listener.Labels[LabelKeyGitHubScaleSetName]) assert.Equal(t, autoscalingRunnerSet.Namespace, listener.Labels[LabelKeyGitHubScaleSetNamespace]) assert.Equal(t, "", listener.Labels[LabelKeyGitHubEnterprise]) @@ -221,7 +221,7 @@ func TestEphemeralRunnerSetProxySecretZIdentityHash(t *testing.T) { }) require.NoError(t, err) - actualHash := proxySecret.Annotations[annotationKeyIntegrityHash] + actualHash := proxySecret.Annotations[AnnotationKeyIntegrityHash] assert.NotEmpty(t, actualHash) assert.Equal(t, ephemeralRunnerSetProxySecretZIdentityHash(proxySecret), actualHash) @@ -313,7 +313,7 @@ func TestOwnershipRelationships(t *testing.T) { runnerScaleSetIDAnnotationKey: "1", AnnotationKeyGitHubRunnerGroupName: "test-group", AnnotationKeyGitHubRunnerScaleSetName: "test-scale-set", - annotationKeyIntegrityHash: "test-hash", + AnnotationKeyIntegrityHash: "test-hash", }, }, Spec: v1alpha1.AutoscalingRunnerSetSpec{ From 1f5444706a8ed52e0d221c626334c709a271eb0a Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Tue, 16 Jun 2026 00:09:25 +0200 Subject: [PATCH 07/22] fix min/max runners --- controllers/actions.github.com/resourcebuilder.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/controllers/actions.github.com/resourcebuilder.go b/controllers/actions.github.com/resourcebuilder.go index 7c50a092e8..bdce614aaf 100644 --- a/controllers/actions.github.com/resourcebuilder.go +++ b/controllers/actions.github.com/resourcebuilder.go @@ -122,13 +122,14 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. } effectiveMinRunners := 0 + if autoscalingRunnerSet.Spec.MinRunners != nil { + effectiveMinRunners = *autoscalingRunnerSet.Spec.MinRunners + } + effectiveMaxRunners := math.MaxInt32 if autoscalingRunnerSet.Spec.MaxRunners != nil { effectiveMaxRunners = *autoscalingRunnerSet.Spec.MaxRunners } - if autoscalingRunnerSet.Spec.MinRunners != nil { - effectiveMinRunners = *autoscalingRunnerSet.Spec.MinRunners - } spec := v1alpha1.AutoscalingListenerSpec{ GitHubConfigURL: autoscalingRunnerSet.Spec.GitHubConfigUrl, From 3b15137eca08551e94096095d23d62522b51251f Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Wed, 17 Jun 2026 00:56:20 +0200 Subject: [PATCH 08/22] wip --- .../v1alpha1/autoscalingrunnerset_types.go | 14 -- ...tions.github.com_autoscalinglisteners.yaml | 10 -- ...ions.github.com_autoscalingrunnersets.yaml | 4 - ...tions.github.com_autoscalinglisteners.yaml | 10 -- ...ions.github.com_autoscalingrunnersets.yaml | 4 - ...tions.github.com_autoscalinglisteners.yaml | 10 -- ...ions.github.com_autoscalingrunnersets.yaml | 4 - .../autoscalinglistener_controller.go | 166 ++++++++++-------- .../autoscalingrunnerset_controller.go | 24 +-- .../autoscalingrunnerset_controller_test.go | 138 ++++++++++++--- .../actions.github.com/resourcebuilder.go | 21 +++ controllers/actions.github.com/utils.go | 10 ++ 12 files changed, 247 insertions(+), 168 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index 7435e88c45..f268d874a5 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -330,20 +330,6 @@ const ( AutoscalingRunnerSetPhaseOutdated AutoscalingRunnerSetPhase = "Outdated" ) -func (ars *AutoscalingRunnerSet) Hash() string { - type data struct { - Spec *AutoscalingRunnerSetSpec - Labels map[string]string - } - - d := &data{ - Spec: ars.Spec.DeepCopy(), - Labels: ars.Labels, - } - - return hash.ComputeTemplateHash(d) -} - func (ars *AutoscalingRunnerSet) ListenerSpecHash() string { arsSpec := ars.Spec.DeepCopy() spec := arsSpec diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml index 9265298660..84e243f9a6 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml @@ -8802,16 +8802,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - autoscalingRunnerSetName - - autoscalingRunnerSetNamespace - - ephemeralRunnerSetName - - githubConfigSecret - - githubConfigUrl - - image - - maxRunners - - minRunners - - runnerScaleSetId type: object status: description: AutoscalingListenerStatus defines the observed state of AutoscalingListener diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml index 083c3d175d..d236b1a99b 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml @@ -16541,10 +16541,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - template type: object status: description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml index 9265298660..84e243f9a6 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml @@ -8802,16 +8802,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - autoscalingRunnerSetName - - autoscalingRunnerSetNamespace - - ephemeralRunnerSetName - - githubConfigSecret - - githubConfigUrl - - image - - maxRunners - - minRunners - - runnerScaleSetId type: object status: description: AutoscalingListenerStatus defines the observed state of AutoscalingListener diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml index 083c3d175d..d236b1a99b 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml @@ -16541,10 +16541,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - template type: object status: description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet diff --git a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml index 9265298660..84e243f9a6 100644 --- a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml +++ b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml @@ -8802,16 +8802,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - autoscalingRunnerSetName - - autoscalingRunnerSetNamespace - - ephemeralRunnerSetName - - githubConfigSecret - - githubConfigUrl - - image - - maxRunners - - minRunners - - runnerScaleSetId type: object status: description: AutoscalingListenerStatus defines the observed state of AutoscalingListener diff --git a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml index 083c3d175d..d236b1a99b 100644 --- a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml +++ b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml @@ -16541,10 +16541,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - template type: object status: description: AutoscalingRunnerSetStatus defines the observed state of AutoscalingRunnerSet diff --git a/controllers/actions.github.com/autoscalinglistener_controller.go b/controllers/actions.github.com/autoscalinglistener_controller.go index 3b61a3baab..431bdbdd6d 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller.go +++ b/controllers/actions.github.com/autoscalinglistener_controller.go @@ -163,21 +163,22 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, err } + updatedServiceAccount := serviceAccount.DeepCopy() + var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(serviceAccount.Labels, desiredServiceAccount.Labels) - labelsModified := !maps.Equal(serviceAccount.Labels, desiredLabels) + if !maps.Equal(serviceAccount.Labels, desiredLabels) { + updatedServiceAccount.Labels = desiredLabels + shouldUpdate = true + } desiredAnnotations := r.filterAndMergeAnnotations(serviceAccount.Annotations, desiredServiceAccount.Annotations) - annotationsModified := !maps.Equal(serviceAccount.Annotations, desiredAnnotations) - if labelsModified || annotationsModified { - updatedServiceAccount := serviceAccount.DeepCopy() - if labelsModified { - updatedServiceAccount.Labels = desiredLabels - } - if annotationsModified { - updatedServiceAccount.Annotations = desiredAnnotations - } + if !r.annotationsEqual(serviceAccount.Annotations, desiredAnnotations) { + updatedServiceAccount.Annotations = desiredAnnotations + shouldUpdate = true + } + if shouldUpdate { log.Info("Updating listener service account") - if err := r.Patch(ctx, updatedServiceAccount, client.MergeFrom(&serviceAccount)); err != nil { + if err := r.Update(ctx, updatedServiceAccount); err != nil { log.Error(err, "Failed to update listener service account") return ctrl.Result{}, err } @@ -206,24 +207,25 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. switch { case err == nil: desiredRole := r.newScaleSetListenerRole(&autoscalingListener) + updatedRole := listenerRole.DeepCopy() + var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerRole.Labels, desiredRole.Labels) - labelsModified := !maps.Equal(listenerRole.Labels, desiredLabels) + if !maps.Equal(listenerRole.Labels, desiredLabels) { + updatedRole.Labels = desiredLabels + shouldUpdate = true + } desiredAnnotations := r.filterAndMergeAnnotations(listenerRole.Annotations, desiredRole.Annotations) - annotationsModified := !maps.Equal(listenerRole.Annotations, desiredAnnotations) - rulesModified := !reflect.DeepEqual(listenerRole.Rules, desiredRole.Rules) - if labelsModified || annotationsModified || rulesModified { - updatedRole := listenerRole.DeepCopy() - if labelsModified { - updatedRole.Labels = desiredLabels - } - if annotationsModified { - updatedRole.Annotations = desiredAnnotations - } - if rulesModified { - updatedRole.Rules = desiredRole.Rules - } + if !r.annotationsEqual(listenerRole.Annotations, desiredAnnotations) { + updatedRole.Annotations = desiredAnnotations + shouldUpdate = true + } + if !reflect.DeepEqual(listenerRole.Rules, desiredRole.Rules) { + updatedRole.Rules = desiredRole.Rules + shouldUpdate = true + } + if shouldUpdate { log.Info("Updating listener role") - if err := r.Patch(ctx, updatedRole, client.MergeFrom(&listenerRole)); err != nil { + if err := r.Update(ctx, updatedRole); err != nil { log.Error(err, "Failed to update listener role") return ctrl.Result{}, err } @@ -248,20 +250,21 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. &listenerRole, &serviceAccount, ) + updatedRoleBinding := listenerRoleBinding.DeepCopy() + var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerRoleBinding.Labels, desiredRoleBinding.Labels) - labelsModified := !maps.Equal(listenerRoleBinding.Labels, desiredLabels) + if !maps.Equal(listenerRoleBinding.Labels, desiredLabels) { + updatedRoleBinding.Labels = desiredLabels + shouldUpdate = true + } desiredAnnotations := r.filterAndMergeAnnotations(listenerRoleBinding.Annotations, desiredRoleBinding.Annotations) - annotationsModified := !maps.Equal(listenerRoleBinding.Annotations, desiredAnnotations) - if labelsModified || annotationsModified { - updatedRoleBinding := listenerRoleBinding.DeepCopy() - if labelsModified { - updatedRoleBinding.Labels = desiredLabels - } - if annotationsModified { - updatedRoleBinding.Annotations = desiredAnnotations - } + if !r.annotationsEqual(listenerRoleBinding.Annotations, desiredAnnotations) { + updatedRoleBinding.Annotations = desiredAnnotations + shouldUpdate = true + } + if shouldUpdate { log.Info("Updating listener role binding") - if err := r.Patch(ctx, updatedRoleBinding, client.MergeFrom(&listenerRoleBinding)); err != nil { + if err := r.Update(ctx, updatedRoleBinding); err != nil { log.Error(err, "Failed to update listener role binding") return ctrl.Result{}, err } @@ -303,20 +306,21 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. log.Error(err, "Failed to build desired listener proxy secret") return ctrl.Result{}, err } + updatedProxySecret := proxySecret.DeepCopy() + var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(proxySecret.Labels, desiredListenerProxy.Labels) - labelsModified := !maps.Equal(proxySecret.Labels, desiredLabels) + if !maps.Equal(proxySecret.Labels, desiredLabels) { + updatedProxySecret.Labels = desiredLabels + shouldUpdate = true + } desiredAnnotations := r.filterAndMergeAnnotations(proxySecret.Annotations, desiredListenerProxy.Annotations) - annotationsModified := !maps.Equal(proxySecret.Annotations, desiredAnnotations) - if labelsModified || annotationsModified { - updatedProxySecret := proxySecret.DeepCopy() - if labelsModified { - updatedProxySecret.Labels = desiredLabels - } - if annotationsModified { - updatedProxySecret.Annotations = desiredAnnotations - } + if !r.annotationsEqual(proxySecret.Annotations, desiredAnnotations) { + updatedProxySecret.Annotations = desiredAnnotations + shouldUpdate = true + } + if shouldUpdate { log.Info("Updating listener proxy secret") - if err := r.Patch(ctx, updatedProxySecret, client.MergeFrom(&proxySecret)); err != nil { + if err := r.Update(ctx, updatedProxySecret); err != nil { log.Error(err, "Failed to update listener proxy secret") return ctrl.Result{}, err } @@ -389,21 +393,22 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. if err != nil { return ctrl.Result{}, fmt.Errorf("failed to build listener config secret: %w", err) } + updatedSecret := listenerConfigSecret.DeepCopy() + var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerConfigSecret.Labels, desiredSecret.Labels) - labelsModified := !maps.Equal(listenerConfigSecret.Labels, desiredLabels) + if !maps.Equal(listenerConfigSecret.Labels, desiredLabels) { + updatedSecret.Labels = desiredLabels + shouldUpdate = true + } desiredAnnotations := r.filterAndMergeAnnotations(listenerConfigSecret.Annotations, desiredSecret.Annotations) - annotationsModified := !maps.Equal(listenerConfigSecret.Annotations, desiredAnnotations) + if !r.annotationsEqual(listenerConfigSecret.Annotations, desiredAnnotations) { + updatedSecret.Annotations = desiredAnnotations + shouldUpdate = true + } - if labelsModified || annotationsModified { - updatedSecret := listenerConfigSecret.DeepCopy() - if labelsModified { - updatedSecret.Labels = desiredLabels - } - if annotationsModified { - updatedSecret.Annotations = desiredAnnotations - } + if shouldUpdate { log.Info("Updating listener config secret", "namespace", updatedSecret.Namespace, "name", updatedSecret.Name) - if err := r.Patch(ctx, updatedSecret, client.MergeFrom(&listenerConfigSecret)); err != nil { + if err := r.Update(ctx, updatedSecret); err != nil { return ctrl.Result{}, fmt.Errorf("failed to update listener config secret: %w", err) } return ctrl.Result{Requeue: true}, nil @@ -462,9 +467,17 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, err } - shouldReCreate := desiredPod.Annotations[AnnotationKeyIntegrityHash] != listenerPod.Annotations[AnnotationKeyIntegrityHash] - if shouldReCreate { - log.Info("Listener pod dependency changed, recreating listener pod") + if desiredPod.Annotations[AnnotationKeyIntegrityHash] != listenerPod.Annotations[AnnotationKeyIntegrityHash] { + // Since the pod is controlled by a pod controller, we tag the pod with integrity hash. + // If the integrity hash is changed, that means the new spec is different. Keep in mind, the tagged hash + // is created by hashing only the fields this controller sets. + log.Info( + "Listener pod dependency changed, recreating listener pod", + "desiredSpec", + mustJSON(desiredPod.Spec), + "currentSpec", + mustJSON(listenerPod.Spec), + ) if err := r.deleteListenerPod(ctx, &autoscalingListener, &listenerPod, log); err != nil { return ctrl.Result{}, err } @@ -473,21 +486,22 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, nil } + updatedPod := listenerPod.DeepCopy() + var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerPod.Labels, desiredPod.Labels) - labelsModified := !maps.Equal(listenerPod.Labels, desiredLabels) + if !maps.Equal(listenerPod.Labels, desiredLabels) { + updatedPod.Labels = desiredLabels + shouldUpdate = true + } desiredAnnotations := r.filterAndMergeAnnotations(listenerPod.Annotations, desiredPod.Annotations) - annotationsModified := !maps.Equal(listenerPod.Annotations, desiredAnnotations) + if !r.annotationsEqual(listenerPod.Annotations, desiredAnnotations) { + updatedPod.Annotations = desiredAnnotations + shouldUpdate = true + } - if labelsModified || annotationsModified { - updatedPod := listenerPod.DeepCopy() - if labelsModified { - updatedPod.Labels = desiredLabels - } - if annotationsModified { - updatedPod.Annotations = desiredAnnotations - } + if shouldUpdate { log.Info("Updating listener pod", "namespace", updatedPod.Namespace, "name", updatedPod.Name) - if err := r.Patch(ctx, updatedPod, client.MergeFrom(&listenerPod)); err != nil { + if err := r.Update(ctx, updatedPod); err != nil { log.Error(err, "Unable to update listener pod", "namespace", updatedPod.Namespace, "name", updatedPod.Name) return ctrl.Result{}, err } @@ -513,7 +527,11 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, err } - log.Info("Creating listener pod", "namespace", desiredPod.Namespace, "name", desiredPod.Name) + log.Info( + "Creating listener pod", + "namespace", desiredPod.Namespace, + "name", desiredPod.Name, + ) if err := r.Create(ctx, desiredPod); err != nil { log.Error(err, "Unable to create listener pod", "namespace", desiredPod.Namespace, "name", desiredPod.Name) return ctrl.Result{}, err diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index 1e1e2bb44c..74356ca05f 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -142,13 +142,11 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl } // Something has changed, we need to re-apply the pending phase and change hash annotation to trigger the update of runner scale set and listener. - if targetHash := autoscalingRunnerSet.Hash(); autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] != targetHash { - // TODO: apply the version label + if targetHash := autoscalingRunnerSetIntegrityHash(&autoscalingRunnerSet); autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] != targetHash { original := autoscalingRunnerSet.DeepCopy() if autoscalingRunnerSet.Annotations == nil { autoscalingRunnerSet.Annotations = map[string]string{} } - autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] = targetHash if err := r.Patch(ctx, &autoscalingRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update autoscaling runner set with new change hash and pending phase") return ctrl.Result{}, err @@ -291,7 +289,8 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl return ctrl.Result{}, nil } - if ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] != desired.Annotations[AnnotationKeyIntegrityHash] { + integrityDiff := desired.Annotations[AnnotationKeyIntegrityHash] != ephemeralRunnerSetIntegrityHash(&ephemeralRunnerSet) + if integrityDiff { original := ephemeralRunnerSet.DeepCopy() ephemeralRunnerSet.Spec.EphemeralRunnerMetadata = desired.Spec.EphemeralRunnerMetadata ephemeralRunnerSet.Spec.EphemeralRunnerSpec = desired.Spec.EphemeralRunnerSpec @@ -310,7 +309,7 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl ephemeralRunnerMetadataModified := !cmp.Equal(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata, desired.Spec.EphemeralRunnerMetadata) ephemeralRunnerLabelsModified := !maps.Equal(ephemeralRunnerSet.Labels, desired.Labels) - ephemeralRunnerAnnotationsModified := !maps.Equal(ephemeralRunnerSet.Annotations, desired.Annotations) + ephemeralRunnerAnnotationsModified := !r.annotationsEqual(ephemeralRunnerSet.Annotations, desired.Annotations) if ephemeralRunnerLabelsModified || ephemeralRunnerAnnotationsModified || ephemeralRunnerMetadataModified { original := ephemeralRunnerSet.DeepCopy() @@ -358,14 +357,17 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl } if !cmp.Equal(listener.Spec, desired.Spec) || - !cmp.Equal(listener.Labels, desired.Labels) || - !cmp.Equal(listener.Annotations, desired.Annotations) { - log.Info("Deleting AutoscalingListener to re-create with updated spec") - if err := r.Delete(ctx, &listener); err != nil { - log.Error(err, "Failed to delete AutoscalingListener for re-creation") + !maps.Equal(listener.Labels, desired.Labels) || + !r.annotationsEqual(listener.Annotations, desired.Annotations) { + log.Info("Updating listener") + listener.Spec = desired.Spec + listener.Annotations = r.filterAndMergeAnnotations(listener.Annotations, desired.Annotations) + listener.Labels = r.filterAndMergeLabels(listener.Labels, desired.Labels) + if err := r.Update(ctx, &listener); err != nil { + log.Error(err, "Failed to update AutoscalingListener with new spec") return ctrl.Result{}, err } - log.Info("Deleted AutoscalingListener, will re-create on next reconcile") + log.Info("Successfully updated AutoscalingListener with new spec") return ctrl.Result{}, nil } } diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index d67832718d..8b950e47b5 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -461,7 +461,14 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { listener := new(v1alpha1.AutoscalingListener) Eventually( func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) + return k8sClient.Get( + ctx, + client.ObjectKey{ + Name: scaleSetListenerName(autoscalingRunnerSet), + Namespace: autoscalingRunnerSet.Namespace, + }, + listener, + ) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -472,13 +479,21 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) + return k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + runnerSet, + ) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") originalRunnerSetUID := runnerSet.UID originalRunnerSetHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] + originalResourceVersion := runnerSet.ResourceVersion patched := autoscalingRunnerSet.DeepCopy() patched.Spec.Template.Spec.Containers[0].Image = "ghcr.io/actions/runner:updated" @@ -492,7 +507,8 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should be updated in place") g.Expect(current.Spec.EphemeralRunnerSpec.PodTemplateSpec.Spec.Containers[0].Image).To(Equal("ghcr.io/actions/runner:updated")) - g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).NotTo(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec hash should change") + g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalRunnerSetHash), "EphemeralRunnerSet hash integrity key should not be modified") + g.Expect(current.ResourceVersion).NotTo(Equal(originalResourceVersion), "EphemeralRunnerSet ResourceVersion should change after update") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -504,34 +520,50 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get Listener") g.Expect(current.UID).To(Equal(originalListenerUID), "Listener should not be recreated") - g.Expect(current.ResourceVersion).To(Equal(originalListenerResourceVersion), "Listener should not be updated") + g.Expect(current.ResourceVersion).To(Equal(originalListenerResourceVersion), "Listener ResourceVersion should not change after update") }, - time.Second*5, + autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed()) }) - It("recreates only the Listener when max runners changes", func() { + It("Updates only the Listener when max runners changes", func() { listener := new(v1alpha1.AutoscalingListener) Eventually( func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) + return k8sClient.Get( + ctx, + client.ObjectKey{ + Name: scaleSetListenerName(autoscalingRunnerSet), + Namespace: autoscalingRunnerSet.Namespace, + }, + listener, + ) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "Listener should be created") originalListenerUID := listener.UID + originalListenerResourceVersion := listener.ResourceVersion + originalListenerIntegrityHash := listener.Annotations[AnnotationKeyIntegrityHash] runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) + return k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + runnerSet, + ) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") - originalRunnerSetUID := runnerSet.UID - originalRunnerSetHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] + originalERSRunnerSetUID := runnerSet.UID + originalERSResourceVersion := runnerSet.ResourceVersion patched := autoscalingRunnerSet.DeepCopy() max := 20 @@ -544,8 +576,10 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.AutoscalingListener) err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get Listener") - g.Expect(current.UID).NotTo(Equal(originalListenerUID), "Listener should be recreated") + g.Expect(current.UID).To(Equal(originalListenerUID), "Listener should be updated") + g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalListenerIntegrityHash), "Listener hash integrity key should not be modified") g.Expect(current.Spec.MaxRunners).To(Equal(max)) + g.Expect(current.ResourceVersion).NotTo(Equal(originalListenerResourceVersion), "Listener ResourceVersion should change after update") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -556,8 +590,8 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.EphemeralRunnerSet) err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") - g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should not be recreated") - g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec should not change") + g.Expect(current.UID).To(Equal(originalERSRunnerSetUID), "EphemeralRunnerSet should not be recreated") + g.Expect(current.ResourceVersion).To(Equal(originalERSResourceVersion), "EphemeralRunnerSet spec should not change") }, time.Second*5, autoscalingRunnerSetTestInterval, @@ -568,7 +602,14 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() (string, error) { - err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) + err := k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + runnerSet, + ) if err != nil { return "", err } @@ -586,7 +627,14 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { Eventually( func() (string, error) { current := new(v1alpha1.EphemeralRunnerSet) - err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, current) + err := k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + current, + ) if err != nil { return "", err } @@ -601,7 +649,14 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() (string, error) { - err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) + err := k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + runnerSet, + ) if err != nil { return "", err } @@ -614,6 +669,8 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { patched := autoscalingRunnerSet.DeepCopy() patched.Spec.EphemeralRunnerSetMetadata.Annotations["arc.test/metadata-annotation"] = "updated" patched.Spec.EphemeralRunnerSetMetadata.Annotations["arc.test/new-metadata-annotation"] = "added" + originalERSIntegrityHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] + patched.Spec.EphemeralRunnerSetMetadata.Annotations[AnnotationKeyIntegrityHash] = "must-not-be-modified" err := k8sClient.Patch(ctx, patched, client.MergeFrom(autoscalingRunnerSet)) Expect(err).NotTo(HaveOccurred(), "failed to patch AutoScalingRunnerSet EphemeralRunnerSet metadata") @@ -624,6 +681,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(current.Annotations["arc.test/metadata-annotation"]).To(Equal("updated")) g.Expect(current.Annotations["arc.test/new-metadata-annotation"]).To(Equal("added")) + g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalERSIntegrityHash), "EphemeralRunnerSet hash integrity key should not be modified") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -634,7 +692,14 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func(g Gomega) { - err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) + err := k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + runnerSet, + ) g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(runnerSet.Spec.EphemeralRunnerMetadata).NotTo(BeNil()) g.Expect(runnerSet.Spec.EphemeralRunnerMetadata.Labels["arc.test/runner-metadata-label"]).To(Equal("initial")) @@ -719,22 +784,38 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { listener := new(v1alpha1.AutoscalingListener) Eventually( func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) + return k8sClient.Get( + ctx, + client.ObjectKey{ + Name: scaleSetListenerName(autoscalingRunnerSet), + Namespace: autoscalingRunnerSet.Namespace, + }, + listener, + ) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "Listener should be created") originalListenerUID := listener.UID + originalListenerIntegrityHash := listener.Annotations[AnnotationKeyIntegrityHash] runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) + return k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + runnerSet, + ) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") - originalRunnerSetUID := runnerSet.UID + originalEphemeralRunnerSetUID := runnerSet.UID + originalEphemeralRunnerSetIntegrityHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] patched := autoscalingRunnerSet.DeepCopy() patched.Spec.GitHubConfigSecret = updatedSecret.Name @@ -757,8 +838,9 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.EphemeralRunnerSet) err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") - g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should be updated in place") + g.Expect(current.UID).To(Equal(originalEphemeralRunnerSetUID), "EphemeralRunnerSet should be updated in place") g.Expect(current.Spec.EphemeralRunnerSpec.GitHubConfigSecret).To(Equal(updatedSecret.Name)) + g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalEphemeralRunnerSetIntegrityHash), "EphemeralRunnerSet hash integrity key should not be modified") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -769,8 +851,9 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.AutoscalingListener) err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get Listener") - g.Expect(current.UID).NotTo(Equal(originalListenerUID), "Listener should be recreated") - g.Expect(current.Spec.GitHubConfigSecret).To(Equal(updatedSecret.Name)) + g.Expect(current.UID).To(Equal(originalListenerUID), "Listener should be updated in place") + g.Expect(updatedSecret.Name).To(Equal(current.Spec.GitHubConfigSecret)) + g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalListenerIntegrityHash), "Listener hash integrity key should not be modified") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -1099,10 +1182,11 @@ var _ = Describe("Test AutoscalingController creation failures", Ordered, func() }, }, Spec: v1alpha1.AutoscalingRunnerSetSpec{ - GitHubConfigUrl: "https://github.com/owner/repo", - MaxRunners: &max, - MinRunners: &min, - RunnerGroup: "testgroup", + GitHubConfigUrl: "https://github.com/owner/repo", + GitHubConfigSecret: "secret1", + MaxRunners: &max, + MinRunners: &min, + RunnerGroup: "testgroup", Template: corev1.PodTemplateSpec{ Spec: corev1.PodSpec{ Containers: []corev1.Container{ diff --git a/controllers/actions.github.com/resourcebuilder.go b/controllers/actions.github.com/resourcebuilder.go index bdce614aaf..e08be51a41 100644 --- a/controllers/actions.github.com/resourcebuilder.go +++ b/controllers/actions.github.com/resourcebuilder.go @@ -115,6 +115,10 @@ func (b *ResourceBuilder) setControllerReference(owner client.Object, object cli return ctrl.SetControllerReference(owner, object, b.Scheme) } +func autoscalingRunnerSetIntegrityHash(ars *v1alpha1.AutoscalingRunnerSet) string { + return hash.ComputeTemplateHash(&ars.Spec) +} + func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet, namespace, image string, imagePullSecrets []corev1.LocalObjectReference) (*v1alpha1.AutoscalingListener, error) { runnerScaleSetID, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey]) if err != nil { @@ -1144,3 +1148,20 @@ func (b *ResourceBuilder) filterAndMergeAnnotations(base, overwrite map[string]s return result } + +// compareAnnotations compares two maps of annotations, ignoring the integrity hash annotation. +func (b *ResourceBuilder) annotationsEqual(m1, m2 map[string]string) bool { + if len(m1) != len(m2) { + return false + } + + for k, v1 := range m1 { + if k == AnnotationKeyIntegrityHash { + continue + } + if v2, ok := m2[k]; !ok || v1 != v2 { + return false + } + } + return true +} diff --git a/controllers/actions.github.com/utils.go b/controllers/actions.github.com/utils.go index a77b24ba17..da87eb7b21 100644 --- a/controllers/actions.github.com/utils.go +++ b/controllers/actions.github.com/utils.go @@ -1,6 +1,8 @@ package actionsgithubcom import ( + "encoding/json" + "k8s.io/apimachinery/pkg/util/rand" ) @@ -25,3 +27,11 @@ func RandStringRunes(n int) string { } return string(b) } + +func mustJSON(v any) string { + val, err := json.Marshal(v) + if err != nil { + panic(err) + } + return string(val) +} From 10ae75d55760c128332bd4434002280ec5d8c287 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Wed, 17 Jun 2026 14:07:12 +0200 Subject: [PATCH 09/22] wip --- .../actions.github.com/autoscalingrunnerset_controller.go | 1 + 1 file changed, 1 insertion(+) diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index 74356ca05f..323d0ff613 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -147,6 +147,7 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl if autoscalingRunnerSet.Annotations == nil { autoscalingRunnerSet.Annotations = map[string]string{} } + autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] = targetHash if err := r.Patch(ctx, &autoscalingRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update autoscaling runner set with new change hash and pending phase") return ctrl.Result{}, err From d2e63d7ca79468906681201448e2bfbc1ebec90d Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Wed, 17 Jun 2026 19:33:56 +0200 Subject: [PATCH 10/22] wip --- config/rbac/role.yaml | 4 +- .../autoscalinglistener_controller.go | 20 +-- .../autoscalinglistener_controller_test.go | 6 +- .../autoscalingrunnerset_controller.go | 3 +- .../autoscalingrunnerset_controller_test.go | 5 +- .../ephemeralrunner_controller_test.go | 121 ++++++++++-------- .../ephemeralrunnerset_controller.go | 7 +- .../ephemeralrunnerset_controller_test.go | 6 +- 8 files changed, 97 insertions(+), 75 deletions(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index dc0becfdf7..007b85160e 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -52,7 +52,7 @@ rules: - delete - get - list - - update + - patch - watch - apiGroups: - actions.github.com @@ -167,5 +167,5 @@ rules: - delete - get - list - - update + - patch - watch diff --git a/controllers/actions.github.com/autoscalinglistener_controller.go b/controllers/actions.github.com/autoscalinglistener_controller.go index 431bdbdd6d..a62462e9fc 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller.go +++ b/controllers/actions.github.com/autoscalinglistener_controller.go @@ -62,10 +62,10 @@ type AutoscalingListenerReconciler struct { // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=core,resources=pods/status,verbs=get -// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update -// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;delete;get;list;watch;update -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;delete;get;list;watch;update +// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;patch +// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;patch +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;delete;get;list;watch;patch +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;delete;get;list;watch;patch // +kubebuilder:rbac:groups=actions.github.com,resources=autoscalinglisteners,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=actions.github.com,resources=autoscalinglisteners/status,verbs=get;update;patch // +kubebuilder:rbac:groups=actions.github.com,resources=autoscalinglisteners/finalizers,verbs=update @@ -178,7 +178,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. if shouldUpdate { log.Info("Updating listener service account") - if err := r.Update(ctx, updatedServiceAccount); err != nil { + if err := r.Patch(ctx, updatedServiceAccount, client.MergeFrom(&serviceAccount)); err != nil { log.Error(err, "Failed to update listener service account") return ctrl.Result{}, err } @@ -225,7 +225,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. } if shouldUpdate { log.Info("Updating listener role") - if err := r.Update(ctx, updatedRole); err != nil { + if err := r.Patch(ctx, updatedRole, client.MergeFrom(&listenerRole)); err != nil { log.Error(err, "Failed to update listener role") return ctrl.Result{}, err } @@ -264,7 +264,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. } if shouldUpdate { log.Info("Updating listener role binding") - if err := r.Update(ctx, updatedRoleBinding); err != nil { + if err := r.Patch(ctx, updatedRoleBinding, client.MergeFrom(&listenerRoleBinding)); err != nil { log.Error(err, "Failed to update listener role binding") return ctrl.Result{}, err } @@ -320,7 +320,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. } if shouldUpdate { log.Info("Updating listener proxy secret") - if err := r.Update(ctx, updatedProxySecret); err != nil { + if err := r.Patch(ctx, updatedProxySecret, client.MergeFrom(&proxySecret)); err != nil { log.Error(err, "Failed to update listener proxy secret") return ctrl.Result{}, err } @@ -408,7 +408,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. if shouldUpdate { log.Info("Updating listener config secret", "namespace", updatedSecret.Namespace, "name", updatedSecret.Name) - if err := r.Update(ctx, updatedSecret); err != nil { + if err := r.Patch(ctx, updatedSecret, client.MergeFrom(&listenerConfigSecret)); err != nil { return ctrl.Result{}, fmt.Errorf("failed to update listener config secret: %w", err) } return ctrl.Result{Requeue: true}, nil @@ -501,7 +501,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. if shouldUpdate { log.Info("Updating listener pod", "namespace", updatedPod.Namespace, "name", updatedPod.Name) - if err := r.Update(ctx, updatedPod); err != nil { + if err := r.Patch(ctx, updatedPod, client.MergeFrom(&listenerPod)); err != nil { log.Error(err, "Unable to update listener pod", "namespace", updatedPod.Namespace, "name", updatedPod.Name) return ctrl.Result{}, err } diff --git a/controllers/actions.github.com/autoscalinglistener_controller_test.go b/controllers/actions.github.com/autoscalinglistener_controller_test.go index 8ec0ebc27c..1d8958066a 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller_test.go +++ b/controllers/actions.github.com/autoscalinglistener_controller_test.go @@ -516,7 +516,7 @@ var _ = Describe("Test AutoScalingListener controller", func() { }, }, } - err := k8sClient.Status().Update(ctx, updated) + err := k8sClient.Status().Patch(ctx, updated, client.MergeFrom(pod)) Expect(err).NotTo(HaveOccurred(), "failed to update test pod") // Waiting for the new pod is created @@ -785,7 +785,7 @@ var _ = Describe("Test AutoScalingListener customization", func() { }, }, } - err := k8sClient.Status().Update(ctx, updated) + err := k8sClient.Status().Patch(ctx, updated, client.MergeFrom(pod)) Expect(err).NotTo(HaveOccurred(), "failed to update pod status") pod = new(corev1.Pod) @@ -831,7 +831,7 @@ var _ = Describe("Test AutoScalingListener customization", func() { updated := pod.DeepCopy() oldPodUID := string(pod.UID) updated.Status.Reason = "Evicted" - err := k8sClient.Status().Update(ctx, updated) + err := k8sClient.Status().Patch(ctx, updated, client.MergeFrom(pod)) Expect(err).NotTo(HaveOccurred(), "failed to update pod status") pod = new(corev1.Pod) diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index 323d0ff613..14df0d61e6 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -361,10 +361,11 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl !maps.Equal(listener.Labels, desired.Labels) || !r.annotationsEqual(listener.Annotations, desired.Annotations) { log.Info("Updating listener") + original := listener.DeepCopy() listener.Spec = desired.Spec listener.Annotations = r.filterAndMergeAnnotations(listener.Annotations, desired.Annotations) listener.Labels = r.filterAndMergeLabels(listener.Labels, desired.Labels) - if err := r.Update(ctx, &listener); err != nil { + if err := r.Patch(ctx, &listener, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update AutoscalingListener with new spec") return ctrl.Result{}, err } diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 8b950e47b5..400ebcdc57 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -1220,8 +1220,9 @@ var _ = Describe("Test AutoscalingController creation failures", Ordered, func() autoscalingRunnerSetTestInterval, ).Should(BeEquivalentTo(autoscalingRunnerSetFinalizerName), "AutoScalingRunnerSet should have a finalizer") - ars.Annotations = make(map[string]string) - err = k8sClient.Update(ctx, ars) + updated := ars.DeepCopy() + updated.Annotations = make(map[string]string) + err = k8sClient.Patch(ctx, updated, client.MergeFrom(ars)) Expect(err).NotTo(HaveOccurred(), "Update autoscaling runner set without annotation should be successful") Eventually( diff --git a/controllers/actions.github.com/ephemeralrunner_controller_test.go b/controllers/actions.github.com/ephemeralrunner_controller_test.go index 74aafb71a1..506355acf8 100644 --- a/controllers/actions.github.com/ephemeralrunner_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunner_controller_test.go @@ -223,8 +223,9 @@ var _ = Describe("EphemeralRunner", func() { ).Should(Succeed(), "failed to get ephemeral runner") // update job id to simulate job assigned - er.Status.JobID = "1" - err := k8sClient.Status().Update(ctx, er) + updatedER := er.DeepCopy() + updatedER.Status.JobID = "1" + err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) Expect(err).To(BeNil(), "failed to update ephemeral runner status") er = new(v1alpha1.EphemeralRunner) @@ -249,7 +250,8 @@ var _ = Describe("EphemeralRunner", func() { }).Should(BeEquivalentTo(true)) // delete pod to simulate failure - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -257,7 +259,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err = k8sClient.Status().Update(ctx, pod) + err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") er = new(v1alpha1.EphemeralRunner) @@ -277,8 +279,9 @@ var _ = Describe("EphemeralRunner", func() { return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er) }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner") - er.Status.JobID = "1" - err := k8sClient.Status().Update(ctx, er) + updatedER := er.DeepCopy() + updatedER.Status.JobID = "1" + err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) Expect(err).To(BeNil(), "failed to update ephemeral runner status") Eventually(func() (string, error) { @@ -297,9 +300,10 @@ var _ = Describe("EphemeralRunner", func() { return true, nil }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true)) - pod.Status.Phase = corev1.PodFailed - pod.Status.ContainerStatuses = nil - err = k8sClient.Status().Update(ctx, pod) + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodFailed + updatedPod.Status.ContainerStatuses = nil + err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") Eventually(func() bool { @@ -320,9 +324,10 @@ var _ = Describe("EphemeralRunner", func() { oldPodUID := pod.UID - pod.Status.Phase = corev1.PodFailed - pod.Status.ContainerStatuses = nil - err := k8sClient.Status().Update(ctx, pod) + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodFailed + updatedPod.Status.ContainerStatuses = nil + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -369,8 +374,9 @@ var _ = Describe("EphemeralRunner", func() { // Simulate init container failure without PodFailed phase. // This can happen when the kubelet has not yet transitioned the pod phase. - pod.Status.Phase = corev1.PodPending - pod.Status.InitContainerStatuses = []corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodPending + updatedPod.Status.InitContainerStatuses = []corev1.ContainerStatus{ { Name: "setup", State: corev1.ContainerState{ @@ -382,7 +388,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, } - err := k8sClient.Status().Update(ctx, pod) + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -422,8 +428,9 @@ var _ = Describe("EphemeralRunner", func() { return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er) }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner") - er.Status.JobID = "1" - err := k8sClient.Status().Update(ctx, er) + updatedER := er.DeepCopy() + updatedER.Status.JobID = "1" + err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) Expect(err).To(BeNil(), "failed to update ephemeral runner status") Eventually(func() (string, error) { @@ -443,8 +450,9 @@ var _ = Describe("EphemeralRunner", func() { }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true)) // Simulate init container failure with job assigned - pod.Status.Phase = corev1.PodPending - pod.Status.InitContainerStatuses = []corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodPending + updatedPod.Status.InitContainerStatuses = []corev1.ContainerStatus{ { Name: "setup", State: corev1.ContainerState{ @@ -455,7 +463,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, } - err = k8sClient.Status().Update(ctx, pod) + err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") Eventually(func() bool { @@ -471,8 +479,9 @@ var _ = Describe("EphemeralRunner", func() { return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er) }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner") - er.Status.JobID = "1" - err := k8sClient.Status().Update(ctx, er) + updatedER := er.DeepCopy() + updatedER.Status.JobID = "1" + err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) Expect(err).To(BeNil(), "failed to update ephemeral runner status") pod := new(corev1.Pod) @@ -487,8 +496,9 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get pod") - pod.Status.Phase = corev1.PodFailed - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodFailed + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -496,7 +506,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err = k8sClient.Status().Update(ctx, pod) + err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -523,8 +533,9 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get pod") - pod.Status.Phase = corev1.PodFailed - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodFailed + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -532,7 +543,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err := k8sClient.Status().Update(ctx, pod) + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -568,9 +579,10 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get pod") - pod.Status.Phase = corev1.PodFailed + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodFailed oldPodUID := pod.UID - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -579,7 +591,7 @@ var _ = Describe("EphemeralRunner", func() { }, }) - err := k8sClient.Status().Update(ctx, pod) + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -939,8 +951,9 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(BeEquivalentTo(true)) - pod.Status.Phase = corev1.PodRunning - err := k8sClient.Status().Update(ctx, pod) + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodRunning + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "failed to patch pod status") Consistently( @@ -975,7 +988,8 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get ephemeral runner pod") - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -983,10 +997,10 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err := k8sClient.Status().Update(ctx, pod) + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "Failed to update pod status") - return pod + return updatedPod } for i := range 5 { @@ -1065,13 +1079,14 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(BeEquivalentTo(true)) - pod.Status.Phase = corev1.PodFailed - pod.Status.Reason = "Evicted" - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodFailed + updatedPod.Status.Reason = "Evicted" + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{}, }) - err := k8sClient.Status().Update(ctx, pod) + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "failed to patch pod status") updated := new(v1alpha1.EphemeralRunner) @@ -1111,13 +1126,14 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(BeEquivalentTo(true)) - pod.Status.Phase = corev1.PodFailed - pod.Status.Reason = "OutOfpods" - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.Phase = corev1.PodFailed + updatedPod.Status.Reason = "OutOfpods" + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{}, }) - err := k8sClient.Status().Update(ctx, pod) + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "failed to patch pod status") updated := new(v1alpha1.EphemeralRunner) @@ -1157,7 +1173,8 @@ var _ = Describe("EphemeralRunner", func() { ).Should(BeEquivalentTo(true)) // first set phase to running - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Running: &corev1.ContainerStateRunning{ @@ -1165,8 +1182,8 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - pod.Status.Phase = corev1.PodRunning - err := k8sClient.Status().Update(ctx, pod) + updatedPod.Status.Phase = corev1.PodRunning + err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil()) Eventually( @@ -1182,8 +1199,9 @@ var _ = Describe("EphemeralRunner", func() { ).Should(BeEquivalentTo(v1alpha1.EphemeralRunnerPhaseRunning)) // set phase to succeeded - pod.Status.Phase = corev1.PodSucceeded - err = k8sClient.Status().Update(ctx, pod) + nextPod := updatedPod.DeepCopy() + nextPod.Status.Phase = corev1.PodSucceeded + err = k8sClient.Status().Patch(ctx, nextPod, client.MergeFrom(updatedPod)) Expect(err).To(BeNil()) Consistently( @@ -1258,7 +1276,8 @@ var _ = Describe("EphemeralRunner", func() { return true, nil }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true)) - pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ + updatedPod := pod.DeepCopy() + updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -1266,7 +1285,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err = k8sClient.Status().Update(ctx, pod) + err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) Expect(err).To(BeNil(), "failed to update pod status") updated := new(v1alpha1.EphemeralRunner) diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller.go b/controllers/actions.github.com/ephemeralrunnerset_controller.go index a6cb4d27ba..ae5c6359b4 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller.go @@ -260,12 +260,13 @@ func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemer // Update the status if needed. if ephemeralRunnerSet.Status != desiredStatus { - ephemeralRunnerSet.Status = desiredStatus - if err := r.Status().Update(ctx, ephemeralRunnerSet); err != nil { + updated := ephemeralRunnerSet.DeepCopy() + updated.Status = desiredStatus + if err := r.Status().Patch(ctx, updated, client.MergeFrom(ephemeralRunnerSet)); err != nil { log.Error(err, "Failed to update EphemeralRunnerSet status") return err } - log.Info("Updated EphemeralRunnerSet status", "status", ephemeralRunnerSet.Status) + log.Info("Updated EphemeralRunnerSet status", "status", updated.Status) } return nil diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go index 4526a5b0ff..8d80ce0e55 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go @@ -240,7 +240,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { // Scaling up the EphemeralRunnerSet updated := created.DeepCopy() updated.Spec.Replicas = 5 - err := k8sClient.Update(ctx, updated) + err := k8sClient.Patch(ctx, updated, client.MergeFrom(created)) Expect(err).NotTo(HaveOccurred(), "failed to update EphemeralRunnerSet") // Check if the number of ephemeral runners are created @@ -302,7 +302,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { // Scale up the EphemeralRunnerSet updated := created.DeepCopy() updated.Spec.Replicas = 5 - err = k8sClient.Update(ctx, updated) + err = k8sClient.Patch(ctx, updated, client.MergeFrom(created)) Expect(err).NotTo(HaveOccurred(), "failed to update EphemeralRunnerSet") // Wait for the EphemeralRunnerSet to be scaled up @@ -1190,7 +1190,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { // Scale up the EphemeralRunnerSet updated := created.DeepCopy() updated.Spec.Replicas = 3 - err := k8sClient.Update(ctx, updated) + err := k8sClient.Patch(ctx, updated, client.MergeFrom(created)) Expect(err).NotTo(HaveOccurred(), "failed to update EphemeralRunnerSet replica count") runnerList := new(v1alpha1.EphemeralRunnerList) From 7803f191b1da43f90a0f94e10d0f76d69e6e3af5 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Tue, 23 Jun 2026 15:49:53 +0200 Subject: [PATCH 11/22] fix equal annotations --- controllers/actions.github.com/resourcebuilder.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/controllers/actions.github.com/resourcebuilder.go b/controllers/actions.github.com/resourcebuilder.go index e08be51a41..68ce5cbc69 100644 --- a/controllers/actions.github.com/resourcebuilder.go +++ b/controllers/actions.github.com/resourcebuilder.go @@ -1151,7 +1151,15 @@ func (b *ResourceBuilder) filterAndMergeAnnotations(base, overwrite map[string]s // compareAnnotations compares two maps of annotations, ignoring the integrity hash annotation. func (b *ResourceBuilder) annotationsEqual(m1, m2 map[string]string) bool { - if len(m1) != len(m2) { + l1 := len(m1) + if _, ok := m1[AnnotationKeyIntegrityHash]; !ok { + l1++ + } + l2 := len(m2) + if _, ok := m2[AnnotationKeyIntegrityHash]; !ok { + l2++ + } + if l1 != l2 { return false } From 6d2a1cdccec9112dddf9ce2be0742bc2bc521157 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 6 Jul 2026 14:37:20 +0200 Subject: [PATCH 12/22] Use metrics to display runner statuses instead of status field for EphemeralRunnerSet and AutoscalingRunnerSet --- .../v1alpha1/autoscalingrunnerset_types.go | 51 ++-- .../v1alpha1/ephemeralrunnerset_types.go | 10 +- .../v1alpha1/proxy_config_test.go | 8 +- ...tions.github.com_autoscalinglisteners.yaml | 30 +- ...ions.github.com_autoscalingrunnersets.yaml | 35 +-- .../actions.github.com_ephemeralrunners.yaml | 23 +- ...ctions.github.com_ephemeralrunnersets.yaml | 25 +- ...tions.github.com_autoscalinglisteners.yaml | 30 +- ...ions.github.com_autoscalingrunnersets.yaml | 35 +-- .../actions.github.com_ephemeralrunners.yaml | 23 +- ...ctions.github.com_ephemeralrunnersets.yaml | 25 +- .../templates/_mode_kubernetes.tpl | 5 +- .../templates/manager_role.yaml | 2 - .../templates/manager_role.yaml | 2 - .../tests/template_test.go | 4 +- ...tions.github.com_autoscalinglisteners.yaml | 30 +- ...ions.github.com_autoscalingrunnersets.yaml | 35 +-- .../actions.github.com_ephemeralrunners.yaml | 23 +- ...ctions.github.com_ephemeralrunnersets.yaml | 25 +- config/rbac/role.yaml | 4 +- .../autoscalinglistener_controller.go | 178 +++++------ .../autoscalinglistener_controller_test.go | 10 +- .../autoscalingrunnerset_controller.go | 52 ++-- .../autoscalingrunnerset_controller_test.go | 286 +++++++----------- .../ephemeralrunner_controller_test.go | 127 ++++---- .../ephemeralrunnerset_controller_test.go | 42 +-- .../actions.github.com/resourcebuilder.go | 135 +++------ .../resourcebuilder_test.go | 8 +- .../secretresolver/secret_resolver.go | 8 +- controllers/actions.github.com/utils.go | 10 - 30 files changed, 532 insertions(+), 749 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index f268d874a5..11c9edd915 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -36,30 +36,23 @@ import ( // +kubebuilder:subresource:status // +kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".status.phase",name=Phase,type=string -// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.failedEphemeralRunners",name=Failed Runners,type=integer // AutoscalingRunnerSet is the Schema for the autoscalingrunnersets API type AutoscalingRunnerSet struct { - metav1.TypeMeta `json:",inline"` - // +optional + metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // +optional - Spec AutoscalingRunnerSetSpec `json:"spec,omitempty"` - // +optional + Spec AutoscalingRunnerSetSpec `json:"spec,omitempty"` Status AutoscalingRunnerSetStatus `json:"status,omitempty"` } // AutoscalingRunnerSetSpec defines the desired state of AutoscalingRunnerSet type AutoscalingRunnerSetSpec struct { - // +optional + // Required GitHubConfigUrl string `json:"githubConfigUrl,omitempty"` - // +optional + // Required GitHubConfigSecret string `json:"githubConfigSecret,omitempty"` // +optional @@ -80,7 +73,7 @@ type AutoscalingRunnerSetSpec struct { // +optional VaultConfig *VaultConfig `json:"vaultConfig,omitempty"` - // +optional + // Required Template corev1.PodTemplateSpec `json:"template,omitempty"` // +optional @@ -114,16 +107,16 @@ type AutoscalingRunnerSetSpec struct { EphemeralRunnerConfigSecretMetadata *ResourceMeta `json:"ephemeralRunnerConfigSecretMetadata,omitempty"` // +optional - // +kubebuilder:validation:Minimum=0 + // +kubebuilder:validation:Minimum:=0 MaxRunners *int `json:"maxRunners,omitempty"` // +optional - // +kubebuilder:validation:Minimum=0 + // +kubebuilder:validation:Minimum:=0 MinRunners *int `json:"minRunners,omitempty"` } type TLSConfig struct { - // +required + // Required CertificateFrom *TLSCertificateSource `json:"certificateFrom,omitempty"` } @@ -160,7 +153,7 @@ func (c *TLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error) } type TLSCertificateSource struct { - // +required + // Required ConfigMapKeyRef *corev1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty"` } @@ -181,9 +174,9 @@ func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secr } if c.HTTP != nil { - u, err := url.Parse(c.HTTP.URL) + u, err := url.Parse(c.HTTP.Url) if err != nil { - return nil, fmt.Errorf("failed to parse proxy http url %q: %w", c.HTTP.URL, err) + return nil, fmt.Errorf("failed to parse proxy http url %q: %w", c.HTTP.Url, err) } if c.HTTP.CredentialSecretRef != "" { @@ -206,9 +199,9 @@ func (c *ProxyConfig) ToHTTPProxyConfig(secretFetcher func(string) (*corev1.Secr } if c.HTTPS != nil { - u, err := url.Parse(c.HTTPS.URL) + u, err := url.Parse(c.HTTPS.Url) if err != nil { - return nil, fmt.Errorf("failed to parse proxy https url %q: %w", c.HTTPS.URL, err) + return nil, fmt.Errorf("failed to parse proxy https url %q: %w", c.HTTPS.Url, err) } if c.HTTPS.CredentialSecretRef != "" { @@ -261,8 +254,8 @@ func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, erro } type ProxyServerConfig struct { - // +required - URL string `json:"url,omitempty"` + // Required + Url string `json:"url,omitempty"` // +optional CredentialSecretRef string `json:"credentialSecretRef,omitempty"` @@ -330,6 +323,20 @@ const ( AutoscalingRunnerSetPhaseOutdated AutoscalingRunnerSetPhase = "Outdated" ) +func (ars *AutoscalingRunnerSet) Hash() string { + type data struct { + Spec *AutoscalingRunnerSetSpec + Labels map[string]string + } + + d := &data{ + Spec: ars.Spec.DeepCopy(), + Labels: ars.Labels, + } + + return hash.ComputeTemplateHash(d) +} + func (ars *AutoscalingRunnerSet) ListenerSpecHash() string { arsSpec := ars.Spec.DeepCopy() spec := arsSpec diff --git a/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go b/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go index 641ec02f88..5e8f12d19f 100644 --- a/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go @@ -23,13 +23,10 @@ import ( // EphemeralRunnerSetSpec defines the desired state of EphemeralRunnerSet type EphemeralRunnerSetSpec struct { // Replicas is the number of desired EphemeralRunner resources in the k8s namespace. - // +optional Replicas int `json:"replicas,omitempty"` // PatchID is the unique identifier for the patch issued by the listener app - // +optional PatchID int `json:"patchID"` // EphemeralRunnerSpec is the spec of the ephemeral runner - // +optional EphemeralRunnerSpec EphemeralRunnerSpec `json:"ephemeralRunnerSpec,omitempty"` // EphemeralRunnerMetadata is the metadata to be applied to all ephemeral runners created by this set. // If the EphemeralRunnerMetadata is updated, the update applies to new ephemeral runners created after the update, @@ -61,13 +58,10 @@ const ( // EphemeralRunnerSet is the Schema for the ephemeralrunnersets API type EphemeralRunnerSet struct { - metav1.TypeMeta `json:",inline"` - // +optional + metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` - // +optional - Spec EphemeralRunnerSetSpec `json:"spec,omitempty"` - // +optional + Spec EphemeralRunnerSetSpec `json:"spec,omitempty"` Status EphemeralRunnerSetStatus `json:"status,omitempty"` } diff --git a/apis/actions.github.com/v1alpha1/proxy_config_test.go b/apis/actions.github.com/v1alpha1/proxy_config_test.go index 0357e5e268..9291cde4e0 100644 --- a/apis/actions.github.com/v1alpha1/proxy_config_test.go +++ b/apis/actions.github.com/v1alpha1/proxy_config_test.go @@ -14,11 +14,11 @@ import ( func TestProxyConfig_ToSecret(t *testing.T) { config := &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: "http://proxy.example.com:8080", + Url: "http://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, HTTPS: &v1alpha1.ProxyServerConfig{ - URL: "https://proxy.example.com:8080", + Url: "https://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, NoProxy: []string{ @@ -48,11 +48,11 @@ func TestProxyConfig_ToSecret(t *testing.T) { func TestProxyConfig_ProxyFunc(t *testing.T) { config := &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: "http://proxy.example.com:8080", + Url: "http://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, HTTPS: &v1alpha1.ProxyServerConfig{ - URL: "https://proxy.example.com:8080", + Url: "https://proxy.example.com:8080", CredentialSecretRef: "my-secret", }, NoProxy: []string{ diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml index 84e243f9a6..20e57e3398 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml @@ -51,8 +51,10 @@ spec: description: AutoscalingListenerSpec defines the desired state of AutoscalingListener properties: autoscalingRunnerSetName: + description: Required type: string autoscalingRunnerSetNamespace: + description: Required type: string configSecretMetadata: description: ResourceMeta carries metadata common to all internal @@ -68,17 +70,21 @@ spec: type: object type: object ephemeralRunnerSetName: + description: Required type: string githubConfigSecret: + description: Required type: string githubConfigUrl: + description: Required type: string githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -100,15 +106,13 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object image: + description: Required type: string imagePullSecrets: + description: Required items: description: |- LocalObjectReference contains enough information to let you locate the @@ -127,6 +131,7 @@ spec: x-kubernetes-map-type: atomic type: array maxRunners: + description: Required minimum: 0 type: integer metrics: @@ -178,6 +183,7 @@ spec: type: object type: object minRunners: + description: Required minimum: 0 type: integer proxy: @@ -187,18 +193,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -232,7 +236,7 @@ spec: type: object type: object runnerScaleSetId: - minimum: 1 + description: Required type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal @@ -8778,18 +8782,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml index d236b1a99b..1f4b63f32f 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,21 +21,9 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer - - jsonPath: .status.currentRunners - name: Current Runners - type: integer - jsonPath: .status.phase name: Phase type: string - - jsonPath: .status.pendingEphemeralRunners - name: Pending Runners - type: integer - - jsonPath: .status.runningEphemeralRunners - name: Running Runners - type: integer - - jsonPath: .status.failedEphemeralRunners - name: Failed Runners - type: integer name: v1alpha1 schema: openAPIV3Schema: @@ -110,15 +98,18 @@ spec: type: object type: object githubConfigSecret: + description: Required type: string githubConfigUrl: + description: Required type: string githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -139,11 +130,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object listenerConfigSecretMetadata: description: ResourceMeta carries metadata common to all internal resources @@ -8364,18 +8351,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8391,7 +8376,7 @@ spec: runnerScaleSetName: type: string template: - description: PodTemplateSpec describes the data a pod should have when created from a template + description: Required properties: metadata: description: |- @@ -16517,18 +16502,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml index 8248263e7d..3cd90148ca 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml @@ -89,9 +89,10 @@ spec: githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -112,11 +113,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object metadata: description: |- @@ -147,18 +144,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8273,18 +8268,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8297,6 +8290,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - runnerScaleSetId type: object status: description: EphemeralRunnerStatus defines the observed state of EphemeralRunner diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml index 70b21c9ad6..fa706e3ba6 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml @@ -83,9 +83,10 @@ spec: githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -106,11 +107,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object metadata: description: |- @@ -141,18 +138,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8267,18 +8262,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8291,6 +8284,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - runnerScaleSetId type: object patchID: description: PatchID is the unique identifier for the patch issued by the listener app @@ -8298,6 +8295,8 @@ spec: replicas: description: Replicas is the number of desired EphemeralRunner resources in the k8s namespace. type: integer + required: + - patchID type: object status: description: EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml index 84e243f9a6..20e57e3398 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml @@ -51,8 +51,10 @@ spec: description: AutoscalingListenerSpec defines the desired state of AutoscalingListener properties: autoscalingRunnerSetName: + description: Required type: string autoscalingRunnerSetNamespace: + description: Required type: string configSecretMetadata: description: ResourceMeta carries metadata common to all internal @@ -68,17 +70,21 @@ spec: type: object type: object ephemeralRunnerSetName: + description: Required type: string githubConfigSecret: + description: Required type: string githubConfigUrl: + description: Required type: string githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -100,15 +106,13 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object image: + description: Required type: string imagePullSecrets: + description: Required items: description: |- LocalObjectReference contains enough information to let you locate the @@ -127,6 +131,7 @@ spec: x-kubernetes-map-type: atomic type: array maxRunners: + description: Required minimum: 0 type: integer metrics: @@ -178,6 +183,7 @@ spec: type: object type: object minRunners: + description: Required minimum: 0 type: integer proxy: @@ -187,18 +193,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -232,7 +236,7 @@ spec: type: object type: object runnerScaleSetId: - minimum: 1 + description: Required type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal @@ -8778,18 +8782,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml index d236b1a99b..1f4b63f32f 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,21 +21,9 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer - - jsonPath: .status.currentRunners - name: Current Runners - type: integer - jsonPath: .status.phase name: Phase type: string - - jsonPath: .status.pendingEphemeralRunners - name: Pending Runners - type: integer - - jsonPath: .status.runningEphemeralRunners - name: Running Runners - type: integer - - jsonPath: .status.failedEphemeralRunners - name: Failed Runners - type: integer name: v1alpha1 schema: openAPIV3Schema: @@ -110,15 +98,18 @@ spec: type: object type: object githubConfigSecret: + description: Required type: string githubConfigUrl: + description: Required type: string githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -139,11 +130,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object listenerConfigSecretMetadata: description: ResourceMeta carries metadata common to all internal resources @@ -8364,18 +8351,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8391,7 +8376,7 @@ spec: runnerScaleSetName: type: string template: - description: PodTemplateSpec describes the data a pod should have when created from a template + description: Required properties: metadata: description: |- @@ -16517,18 +16502,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml index 8248263e7d..3cd90148ca 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml @@ -89,9 +89,10 @@ spec: githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -112,11 +113,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object metadata: description: |- @@ -147,18 +144,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8273,18 +8268,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8297,6 +8290,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - runnerScaleSetId type: object status: description: EphemeralRunnerStatus defines the observed state of EphemeralRunner diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml index 70b21c9ad6..fa706e3ba6 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml @@ -83,9 +83,10 @@ spec: githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -106,11 +107,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object metadata: description: |- @@ -141,18 +138,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8267,18 +8262,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8291,6 +8284,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - runnerScaleSetId type: object patchID: description: PatchID is the unique identifier for the patch issued by the listener app @@ -8298,6 +8295,8 @@ spec: replicas: description: Replicas is the number of desired EphemeralRunner resources in the k8s namespace. type: integer + required: + - patchID type: object status: description: EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet diff --git a/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl b/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl index 672c8495d4..6589d01d1c 100644 --- a/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl +++ b/charts/gha-runner-scale-set-experimental/templates/_mode_kubernetes.tpl @@ -82,10 +82,7 @@ volumeMounts: subPath: extension readOnly: true {{- end }} - {{- with .Values.runner.container.volumeMounts }} - {{- toYaml . | nindent 2 }} - {{- end }} - {{ include "githubServerTLS.volumeMountItem" (dict "root" $ "existingVolumeMounts" (.Values.runner.container.volumeMounts | default (list))) | nindent 2 }} + {{ include "githubServerTLS.volumeMountItem" (dict "root" $ "existingVolumeMounts" (list)) | nindent 2 }} {{- end }} {{- define "runner-mode-kubernetes.pod-volumes" -}} diff --git a/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml b/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml index a5c9a258ca..2990ccc49f 100644 --- a/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml +++ b/charts/gha-runner-scale-set-experimental/templates/manager_role.yaml @@ -17,8 +17,6 @@ rules: verbs: - create - delete - - update - - patch - get - apiGroups: - "" diff --git a/charts/gha-runner-scale-set/templates/manager_role.yaml b/charts/gha-runner-scale-set/templates/manager_role.yaml index 88ca5a3f76..bbf9279999 100644 --- a/charts/gha-runner-scale-set/templates/manager_role.yaml +++ b/charts/gha-runner-scale-set/templates/manager_role.yaml @@ -41,8 +41,6 @@ rules: verbs: - create - delete - - update - - patch - get - apiGroups: - "" diff --git a/charts/gha-runner-scale-set/tests/template_test.go b/charts/gha-runner-scale-set/tests/template_test.go index 8c74b956ed..e9aa4c9bcb 100644 --- a/charts/gha-runner-scale-set/tests/template_test.go +++ b/charts/gha-runner-scale-set/tests/template_test.go @@ -1365,11 +1365,11 @@ func TestTemplateRenderedWithProxy(t *testing.T) { require.NotNil(t, ars.Spec.Proxy) require.NotNil(t, ars.Spec.Proxy.HTTP) - assert.Equal(t, "http://proxy.example.com", ars.Spec.Proxy.HTTP.URL) + assert.Equal(t, "http://proxy.example.com", ars.Spec.Proxy.HTTP.Url) assert.Equal(t, "http-secret", ars.Spec.Proxy.HTTP.CredentialSecretRef) require.NotNil(t, ars.Spec.Proxy.HTTPS) - assert.Equal(t, "https://proxy.example.com", ars.Spec.Proxy.HTTPS.URL) + assert.Equal(t, "https://proxy.example.com", ars.Spec.Proxy.HTTPS.Url) assert.Equal(t, "https-secret", ars.Spec.Proxy.HTTPS.CredentialSecretRef) require.NotNil(t, ars.Spec.Proxy.NoProxy) diff --git a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml index 84e243f9a6..20e57e3398 100644 --- a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml +++ b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml @@ -51,8 +51,10 @@ spec: description: AutoscalingListenerSpec defines the desired state of AutoscalingListener properties: autoscalingRunnerSetName: + description: Required type: string autoscalingRunnerSetNamespace: + description: Required type: string configSecretMetadata: description: ResourceMeta carries metadata common to all internal @@ -68,17 +70,21 @@ spec: type: object type: object ephemeralRunnerSetName: + description: Required type: string githubConfigSecret: + description: Required type: string githubConfigUrl: + description: Required type: string githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -100,15 +106,13 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object image: + description: Required type: string imagePullSecrets: + description: Required items: description: |- LocalObjectReference contains enough information to let you locate the @@ -127,6 +131,7 @@ spec: x-kubernetes-map-type: atomic type: array maxRunners: + description: Required minimum: 0 type: integer metrics: @@ -178,6 +183,7 @@ spec: type: object type: object minRunners: + description: Required minimum: 0 type: integer proxy: @@ -187,18 +193,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -232,7 +236,7 @@ spec: type: object type: object runnerScaleSetId: - minimum: 1 + description: Required type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal @@ -8778,18 +8782,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: diff --git a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml index d236b1a99b..1f4b63f32f 100644 --- a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml +++ b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml @@ -21,21 +21,9 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer - - jsonPath: .status.currentRunners - name: Current Runners - type: integer - jsonPath: .status.phase name: Phase type: string - - jsonPath: .status.pendingEphemeralRunners - name: Pending Runners - type: integer - - jsonPath: .status.runningEphemeralRunners - name: Running Runners - type: integer - - jsonPath: .status.failedEphemeralRunners - name: Failed Runners - type: integer name: v1alpha1 schema: openAPIV3Schema: @@ -110,15 +98,18 @@ spec: type: object type: object githubConfigSecret: + description: Required type: string githubConfigUrl: + description: Required type: string githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -139,11 +130,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object listenerConfigSecretMetadata: description: ResourceMeta carries metadata common to all internal resources @@ -8364,18 +8351,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8391,7 +8376,7 @@ spec: runnerScaleSetName: type: string template: - description: PodTemplateSpec describes the data a pod should have when created from a template + description: Required properties: metadata: description: |- @@ -16517,18 +16502,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: diff --git a/config/crd/bases/actions.github.com_ephemeralrunners.yaml b/config/crd/bases/actions.github.com_ephemeralrunners.yaml index 8248263e7d..3cd90148ca 100644 --- a/config/crd/bases/actions.github.com_ephemeralrunners.yaml +++ b/config/crd/bases/actions.github.com_ephemeralrunners.yaml @@ -89,9 +89,10 @@ spec: githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -112,11 +113,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object metadata: description: |- @@ -147,18 +144,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8273,18 +8268,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8297,6 +8290,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - runnerScaleSetId type: object status: description: EphemeralRunnerStatus defines the observed state of EphemeralRunner diff --git a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml index 70b21c9ad6..fa706e3ba6 100644 --- a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml +++ b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml @@ -83,9 +83,10 @@ spec: githubServerTLS: properties: certificateFrom: + description: Required properties: configMapKeyRef: - description: Selects a key from a ConfigMap. + description: Required properties: key: description: The key to select. @@ -106,11 +107,7 @@ spec: - key type: object x-kubernetes-map-type: atomic - required: - - configMapKeyRef type: object - required: - - certificateFrom type: object metadata: description: |- @@ -141,18 +138,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8267,18 +8262,16 @@ spec: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object https: properties: credentialSecretRef: type: string url: + description: Required type: string - required: - - url type: object noProxy: items: @@ -8291,6 +8284,10 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object + required: + - githubConfigSecret + - githubConfigUrl + - runnerScaleSetId type: object patchID: description: PatchID is the unique identifier for the patch issued by the listener app @@ -8298,6 +8295,8 @@ spec: replicas: description: Replicas is the number of desired EphemeralRunner resources in the k8s namespace. type: integer + required: + - patchID type: object status: description: EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 007b85160e..dc0becfdf7 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -52,7 +52,7 @@ rules: - delete - get - list - - patch + - update - watch - apiGroups: - actions.github.com @@ -167,5 +167,5 @@ rules: - delete - get - list - - patch + - update - watch diff --git a/controllers/actions.github.com/autoscalinglistener_controller.go b/controllers/actions.github.com/autoscalinglistener_controller.go index a62462e9fc..c0aa81114c 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller.go +++ b/controllers/actions.github.com/autoscalinglistener_controller.go @@ -62,10 +62,10 @@ type AutoscalingListenerReconciler struct { // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=core,resources=pods/status,verbs=get -// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;patch -// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;patch -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;delete;get;list;watch;patch -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;delete;get;list;watch;patch +// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update +// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;delete;get;list;watch;update +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;delete;get;list;watch;update // +kubebuilder:rbac:groups=actions.github.com,resources=autoscalinglisteners,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=actions.github.com,resources=autoscalinglisteners/status,verbs=get;update;patch // +kubebuilder:rbac:groups=actions.github.com,resources=autoscalinglisteners/finalizers,verbs=update @@ -163,19 +163,18 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, err } - updatedServiceAccount := serviceAccount.DeepCopy() - var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(serviceAccount.Labels, desiredServiceAccount.Labels) - if !maps.Equal(serviceAccount.Labels, desiredLabels) { - updatedServiceAccount.Labels = desiredLabels - shouldUpdate = true - } - desiredAnnotations := r.filterAndMergeAnnotations(serviceAccount.Annotations, desiredServiceAccount.Annotations) - if !r.annotationsEqual(serviceAccount.Annotations, desiredAnnotations) { - updatedServiceAccount.Annotations = desiredAnnotations - shouldUpdate = true - } - if shouldUpdate { + labelsModified := !maps.Equal(serviceAccount.Labels, desiredLabels) + desiredAnnotations := r.mergeAnnotations(serviceAccount.Annotations, desiredServiceAccount.Annotations) + annotationsModified := !maps.Equal(serviceAccount.Annotations, desiredAnnotations) + if labelsModified || annotationsModified { + updatedServiceAccount := serviceAccount.DeepCopy() + if labelsModified { + updatedServiceAccount.Labels = desiredLabels + } + if annotationsModified { + updatedServiceAccount.Annotations = desiredAnnotations + } log.Info("Updating listener service account") if err := r.Patch(ctx, updatedServiceAccount, client.MergeFrom(&serviceAccount)); err != nil { @@ -207,23 +206,22 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. switch { case err == nil: desiredRole := r.newScaleSetListenerRole(&autoscalingListener) - updatedRole := listenerRole.DeepCopy() - var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerRole.Labels, desiredRole.Labels) - if !maps.Equal(listenerRole.Labels, desiredLabels) { - updatedRole.Labels = desiredLabels - shouldUpdate = true - } - desiredAnnotations := r.filterAndMergeAnnotations(listenerRole.Annotations, desiredRole.Annotations) - if !r.annotationsEqual(listenerRole.Annotations, desiredAnnotations) { - updatedRole.Annotations = desiredAnnotations - shouldUpdate = true - } - if !reflect.DeepEqual(listenerRole.Rules, desiredRole.Rules) { - updatedRole.Rules = desiredRole.Rules - shouldUpdate = true - } - if shouldUpdate { + labelsModified := !maps.Equal(listenerRole.Labels, desiredLabels) + desiredAnnotations := r.mergeAnnotations(listenerRole.Annotations, desiredRole.Annotations) + annotationsModified := !maps.Equal(listenerRole.Annotations, desiredAnnotations) + rulesModified := !reflect.DeepEqual(listenerRole.Rules, desiredRole.Rules) + if labelsModified || annotationsModified || rulesModified { + updatedRole := listenerRole.DeepCopy() + if labelsModified { + updatedRole.Labels = desiredLabels + } + if annotationsModified { + updatedRole.Annotations = desiredAnnotations + } + if rulesModified { + updatedRole.Rules = desiredRole.Rules + } log.Info("Updating listener role") if err := r.Patch(ctx, updatedRole, client.MergeFrom(&listenerRole)); err != nil { log.Error(err, "Failed to update listener role") @@ -250,19 +248,18 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. &listenerRole, &serviceAccount, ) - updatedRoleBinding := listenerRoleBinding.DeepCopy() - var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerRoleBinding.Labels, desiredRoleBinding.Labels) - if !maps.Equal(listenerRoleBinding.Labels, desiredLabels) { - updatedRoleBinding.Labels = desiredLabels - shouldUpdate = true - } - desiredAnnotations := r.filterAndMergeAnnotations(listenerRoleBinding.Annotations, desiredRoleBinding.Annotations) - if !r.annotationsEqual(listenerRoleBinding.Annotations, desiredAnnotations) { - updatedRoleBinding.Annotations = desiredAnnotations - shouldUpdate = true - } - if shouldUpdate { + labelsModified := !maps.Equal(listenerRoleBinding.Labels, desiredLabels) + desiredAnnotations := r.mergeAnnotations(listenerRoleBinding.Annotations, desiredRoleBinding.Annotations) + annotationsModified := !maps.Equal(listenerRoleBinding.Annotations, desiredAnnotations) + if labelsModified || annotationsModified { + updatedRoleBinding := listenerRoleBinding.DeepCopy() + if labelsModified { + updatedRoleBinding.Labels = desiredLabels + } + if annotationsModified { + updatedRoleBinding.Annotations = desiredAnnotations + } log.Info("Updating listener role binding") if err := r.Patch(ctx, updatedRoleBinding, client.MergeFrom(&listenerRoleBinding)); err != nil { log.Error(err, "Failed to update listener role binding") @@ -306,19 +303,18 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. log.Error(err, "Failed to build desired listener proxy secret") return ctrl.Result{}, err } - updatedProxySecret := proxySecret.DeepCopy() - var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(proxySecret.Labels, desiredListenerProxy.Labels) - if !maps.Equal(proxySecret.Labels, desiredLabels) { - updatedProxySecret.Labels = desiredLabels - shouldUpdate = true - } - desiredAnnotations := r.filterAndMergeAnnotations(proxySecret.Annotations, desiredListenerProxy.Annotations) - if !r.annotationsEqual(proxySecret.Annotations, desiredAnnotations) { - updatedProxySecret.Annotations = desiredAnnotations - shouldUpdate = true - } - if shouldUpdate { + labelsModified := !maps.Equal(proxySecret.Labels, desiredLabels) + desiredAnnotations := r.mergeAnnotations(proxySecret.Annotations, desiredListenerProxy.Annotations) + annotationsModified := !maps.Equal(proxySecret.Annotations, desiredAnnotations) + if labelsModified || annotationsModified { + updatedProxySecret := proxySecret.DeepCopy() + if labelsModified { + updatedProxySecret.Labels = desiredLabels + } + if annotationsModified { + updatedProxySecret.Annotations = desiredAnnotations + } log.Info("Updating listener proxy secret") if err := r.Patch(ctx, updatedProxySecret, client.MergeFrom(&proxySecret)); err != nil { log.Error(err, "Failed to update listener proxy secret") @@ -393,20 +389,19 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. if err != nil { return ctrl.Result{}, fmt.Errorf("failed to build listener config secret: %w", err) } - updatedSecret := listenerConfigSecret.DeepCopy() - var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerConfigSecret.Labels, desiredSecret.Labels) - if !maps.Equal(listenerConfigSecret.Labels, desiredLabels) { - updatedSecret.Labels = desiredLabels - shouldUpdate = true - } - desiredAnnotations := r.filterAndMergeAnnotations(listenerConfigSecret.Annotations, desiredSecret.Annotations) - if !r.annotationsEqual(listenerConfigSecret.Annotations, desiredAnnotations) { - updatedSecret.Annotations = desiredAnnotations - shouldUpdate = true - } - - if shouldUpdate { + labelsModified := !maps.Equal(listenerConfigSecret.Labels, desiredLabels) + desiredAnnotations := r.mergeAnnotations(listenerConfigSecret.Annotations, desiredSecret.Annotations) + annotationsModified := !maps.Equal(listenerConfigSecret.Annotations, desiredAnnotations) + + if labelsModified || annotationsModified { + updatedSecret := listenerConfigSecret.DeepCopy() + if labelsModified { + updatedSecret.Labels = desiredLabels + } + if annotationsModified { + updatedSecret.Annotations = desiredAnnotations + } log.Info("Updating listener config secret", "namespace", updatedSecret.Namespace, "name", updatedSecret.Name) if err := r.Patch(ctx, updatedSecret, client.MergeFrom(&listenerConfigSecret)); err != nil { return ctrl.Result{}, fmt.Errorf("failed to update listener config secret: %w", err) @@ -467,17 +462,9 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, err } - if desiredPod.Annotations[AnnotationKeyIntegrityHash] != listenerPod.Annotations[AnnotationKeyIntegrityHash] { - // Since the pod is controlled by a pod controller, we tag the pod with integrity hash. - // If the integrity hash is changed, that means the new spec is different. Keep in mind, the tagged hash - // is created by hashing only the fields this controller sets. - log.Info( - "Listener pod dependency changed, recreating listener pod", - "desiredSpec", - mustJSON(desiredPod.Spec), - "currentSpec", - mustJSON(listenerPod.Spec), - ) + shouldReCreate := desiredPod.Annotations[annotationKeyIntegrityHash] != listenerPod.Annotations[annotationKeyIntegrityHash] + if shouldReCreate { + log.Info("Listener pod dependency changed, recreating listener pod") if err := r.deleteListenerPod(ctx, &autoscalingListener, &listenerPod, log); err != nil { return ctrl.Result{}, err } @@ -486,20 +473,19 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, nil } - updatedPod := listenerPod.DeepCopy() - var shouldUpdate bool desiredLabels := r.filterAndMergeLabels(listenerPod.Labels, desiredPod.Labels) - if !maps.Equal(listenerPod.Labels, desiredLabels) { - updatedPod.Labels = desiredLabels - shouldUpdate = true - } - desiredAnnotations := r.filterAndMergeAnnotations(listenerPod.Annotations, desiredPod.Annotations) - if !r.annotationsEqual(listenerPod.Annotations, desiredAnnotations) { - updatedPod.Annotations = desiredAnnotations - shouldUpdate = true - } - - if shouldUpdate { + labelsModified := !maps.Equal(listenerPod.Labels, desiredLabels) + desiredAnnotations := r.mergeAnnotations(listenerPod.Annotations, desiredPod.Annotations) + annotationsModified := !maps.Equal(listenerPod.Annotations, desiredAnnotations) + + if labelsModified || annotationsModified { + updatedPod := listenerPod.DeepCopy() + if labelsModified { + updatedPod.Labels = desiredLabels + } + if annotationsModified { + updatedPod.Annotations = desiredAnnotations + } log.Info("Updating listener pod", "namespace", updatedPod.Namespace, "name", updatedPod.Name) if err := r.Patch(ctx, updatedPod, client.MergeFrom(&listenerPod)); err != nil { log.Error(err, "Unable to update listener pod", "namespace", updatedPod.Namespace, "name", updatedPod.Name) @@ -527,11 +513,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, err } - log.Info( - "Creating listener pod", - "namespace", desiredPod.Namespace, - "name", desiredPod.Name, - ) + log.Info("Creating listener pod", "namespace", desiredPod.Namespace, "name", desiredPod.Name) if err := r.Create(ctx, desiredPod); err != nil { log.Error(err, "Unable to create listener pod", "namespace", desiredPod.Namespace, "name", desiredPod.Name) return ctrl.Result{}, err diff --git a/controllers/actions.github.com/autoscalinglistener_controller_test.go b/controllers/actions.github.com/autoscalinglistener_controller_test.go index 1d8958066a..d48d613e6c 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller_test.go +++ b/controllers/actions.github.com/autoscalinglistener_controller_test.go @@ -516,7 +516,7 @@ var _ = Describe("Test AutoScalingListener controller", func() { }, }, } - err := k8sClient.Status().Patch(ctx, updated, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, updated) Expect(err).NotTo(HaveOccurred(), "failed to update test pod") // Waiting for the new pod is created @@ -785,7 +785,7 @@ var _ = Describe("Test AutoScalingListener customization", func() { }, }, } - err := k8sClient.Status().Patch(ctx, updated, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, updated) Expect(err).NotTo(HaveOccurred(), "failed to update pod status") pod = new(corev1.Pod) @@ -831,7 +831,7 @@ var _ = Describe("Test AutoScalingListener customization", func() { updated := pod.DeepCopy() oldPodUID := string(pod.UID) updated.Status.Reason = "Evicted" - err := k8sClient.Status().Patch(ctx, updated, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, updated) Expect(err).NotTo(HaveOccurred(), "failed to update pod status") pod = new(corev1.Pod) @@ -954,11 +954,11 @@ var _ = Describe("Test AutoScalingListener controller with proxy", func() { proxy := &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: "http://localhost:8080", + Url: "http://localhost:8080", CredentialSecretRef: "proxy-credentials", }, HTTPS: &v1alpha1.ProxyServerConfig{ - URL: "https://localhost:8443", + Url: "https://localhost:8443", CredentialSecretRef: "proxy-credentials", }, NoProxy: []string{ diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index 14df0d61e6..d1913f27c6 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -142,12 +142,13 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl } // Something has changed, we need to re-apply the pending phase and change hash annotation to trigger the update of runner scale set and listener. - if targetHash := autoscalingRunnerSetIntegrityHash(&autoscalingRunnerSet); autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] != targetHash { + if targetHash := autoscalingRunnerSet.Hash(); autoscalingRunnerSet.Annotations[annotationKeyIntegrityHash] != targetHash { + // TODO: apply the version label original := autoscalingRunnerSet.DeepCopy() if autoscalingRunnerSet.Annotations == nil { autoscalingRunnerSet.Annotations = map[string]string{} } - autoscalingRunnerSet.Annotations[AnnotationKeyIntegrityHash] = targetHash + autoscalingRunnerSet.Annotations[annotationKeyIntegrityHash] = targetHash if err := r.Patch(ctx, &autoscalingRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update autoscaling runner set with new change hash and pending phase") return ctrl.Result{}, err @@ -290,13 +291,34 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl return ctrl.Result{}, nil } - integrityDiff := desired.Annotations[AnnotationKeyIntegrityHash] != ephemeralRunnerSetIntegrityHash(&ephemeralRunnerSet) - if integrityDiff { + if ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash] != desired.Annotations[annotationKeyIntegrityHash] { + // When runners are actively processing jobs, defer the spec update: + // delete the listener to stop accepting new jobs, but leave the ERS + // (and its running pods) untouched until all jobs have drained. + var ephemeralRunnerList v1alpha1.EphemeralRunnerList + if err := r.List(ctx, &ephemeralRunnerList, + client.InNamespace(ephemeralRunnerSet.Namespace), + client.MatchingFields{resourceOwnerKey: ephemeralRunnerSet.Name}, + ); err != nil { + log.Error(err, "Failed to list ephemeral runners") + return ctrl.Result{}, err + } + + ephemeralRunnersByState := newEphemeralRunnersByStates(&ephemeralRunnerList) + if len(ephemeralRunnersByState.running)+len(ephemeralRunnersByState.pending) > 0 { + log.Info("Ephemeral runner set spec changed but runners are still active; deleting listener to stop new jobs") + if _, err := r.cleanupListener(ctx, &autoscalingRunnerSet, log); err != nil { + log.Error(err, "Failed to clean up listener while waiting for runners to drain") + return ctrl.Result{}, err + } + return ctrl.Result{RequeueAfter: 1 * time.Second}, nil + } + original := ephemeralRunnerSet.DeepCopy() ephemeralRunnerSet.Spec.EphemeralRunnerMetadata = desired.Spec.EphemeralRunnerMetadata ephemeralRunnerSet.Spec.EphemeralRunnerSpec = desired.Spec.EphemeralRunnerSpec ephemeralRunnerSet.Labels = r.filterAndMergeLabels(ephemeralRunnerSet.Labels, desired.Labels) - ephemeralRunnerSet.Annotations = r.filterAndMergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) + ephemeralRunnerSet.Annotations = r.mergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) log.Info("Updating ephemeral runner set spec to match the desired spec") if err := r.Patch(ctx, &ephemeralRunnerSet, client.MergeFrom(original)); err != nil { @@ -310,12 +332,12 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl ephemeralRunnerMetadataModified := !cmp.Equal(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata, desired.Spec.EphemeralRunnerMetadata) ephemeralRunnerLabelsModified := !maps.Equal(ephemeralRunnerSet.Labels, desired.Labels) - ephemeralRunnerAnnotationsModified := !r.annotationsEqual(ephemeralRunnerSet.Annotations, desired.Annotations) + ephemeralRunnerAnnotationsModified := !maps.Equal(ephemeralRunnerSet.Annotations, desired.Annotations) if ephemeralRunnerLabelsModified || ephemeralRunnerAnnotationsModified || ephemeralRunnerMetadataModified { original := ephemeralRunnerSet.DeepCopy() ephemeralRunnerSet.Labels = r.filterAndMergeLabels(ephemeralRunnerSet.Labels, desired.Labels) - ephemeralRunnerSet.Annotations = r.filterAndMergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) + ephemeralRunnerSet.Annotations = r.mergeAnnotations(ephemeralRunnerSet.Annotations, desired.Annotations) ephemeralRunnerSet.Spec.EphemeralRunnerMetadata = desired.Spec.EphemeralRunnerMetadata log.Info("Updating ephemeral runner set metadata to match desired labels and annotations") if err := r.Patch(ctx, &ephemeralRunnerSet, client.MergeFrom(original)); err != nil { @@ -358,18 +380,14 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl } if !cmp.Equal(listener.Spec, desired.Spec) || - !maps.Equal(listener.Labels, desired.Labels) || - !r.annotationsEqual(listener.Annotations, desired.Annotations) { - log.Info("Updating listener") - original := listener.DeepCopy() - listener.Spec = desired.Spec - listener.Annotations = r.filterAndMergeAnnotations(listener.Annotations, desired.Annotations) - listener.Labels = r.filterAndMergeLabels(listener.Labels, desired.Labels) - if err := r.Patch(ctx, &listener, client.MergeFrom(original)); err != nil { - log.Error(err, "Failed to update AutoscalingListener with new spec") + !cmp.Equal(listener.Labels, desired.Labels) || + !cmp.Equal(listener.Annotations, desired.Annotations) { + log.Info("Deleting AutoscalingListener to re-create with updated spec") + if err := r.Delete(ctx, &listener); err != nil { + log.Error(err, "Failed to delete AutoscalingListener for re-creation") return ctrl.Result{}, err } - log.Info("Successfully updated AutoscalingListener with new spec") + log.Info("Deleted AutoscalingListener, will re-create on next reconcile") return ctrl.Result{}, nil } } diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 400ebcdc57..e7bb6f0804 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -461,14 +461,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { listener := new(v1alpha1.AutoscalingListener) Eventually( func() error { - return k8sClient.Get( - ctx, - client.ObjectKey{ - Name: scaleSetListenerName(autoscalingRunnerSet), - Namespace: autoscalingRunnerSet.Namespace, - }, - listener, - ) + return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -479,21 +472,13 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() error { - return k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - runnerSet, - ) + return k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") originalRunnerSetUID := runnerSet.UID - originalRunnerSetHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] - originalResourceVersion := runnerSet.ResourceVersion + originalRunnerSetHash := runnerSet.Annotations[annotationKeyIntegrityHash] patched := autoscalingRunnerSet.DeepCopy() patched.Spec.Template.Spec.Containers[0].Image = "ghcr.io/actions/runner:updated" @@ -507,8 +492,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should be updated in place") g.Expect(current.Spec.EphemeralRunnerSpec.PodTemplateSpec.Spec.Containers[0].Image).To(Equal("ghcr.io/actions/runner:updated")) - g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalRunnerSetHash), "EphemeralRunnerSet hash integrity key should not be modified") - g.Expect(current.ResourceVersion).NotTo(Equal(originalResourceVersion), "EphemeralRunnerSet ResourceVersion should change after update") + g.Expect(current.Annotations[annotationKeyIntegrityHash]).NotTo(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec hash should change") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -520,50 +504,34 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get Listener") g.Expect(current.UID).To(Equal(originalListenerUID), "Listener should not be recreated") - g.Expect(current.ResourceVersion).To(Equal(originalListenerResourceVersion), "Listener ResourceVersion should not change after update") + g.Expect(current.ResourceVersion).To(Equal(originalListenerResourceVersion), "Listener should not be updated") }, - autoscalingRunnerSetTestTimeout, + time.Second*5, autoscalingRunnerSetTestInterval, ).Should(Succeed()) }) - It("Updates only the Listener when max runners changes", func() { + It("recreates only the Listener when max runners changes", func() { listener := new(v1alpha1.AutoscalingListener) Eventually( func() error { - return k8sClient.Get( - ctx, - client.ObjectKey{ - Name: scaleSetListenerName(autoscalingRunnerSet), - Namespace: autoscalingRunnerSet.Namespace, - }, - listener, - ) + return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "Listener should be created") originalListenerUID := listener.UID - originalListenerResourceVersion := listener.ResourceVersion - originalListenerIntegrityHash := listener.Annotations[AnnotationKeyIntegrityHash] runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() error { - return k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - runnerSet, - ) + return k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") - originalERSRunnerSetUID := runnerSet.UID - originalERSResourceVersion := runnerSet.ResourceVersion + originalRunnerSetUID := runnerSet.UID + originalRunnerSetHash := runnerSet.Annotations[annotationKeyIntegrityHash] patched := autoscalingRunnerSet.DeepCopy() max := 20 @@ -576,10 +544,8 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.AutoscalingListener) err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get Listener") - g.Expect(current.UID).To(Equal(originalListenerUID), "Listener should be updated") - g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalListenerIntegrityHash), "Listener hash integrity key should not be modified") + g.Expect(current.UID).NotTo(Equal(originalListenerUID), "Listener should be recreated") g.Expect(current.Spec.MaxRunners).To(Equal(max)) - g.Expect(current.ResourceVersion).NotTo(Equal(originalListenerResourceVersion), "Listener ResourceVersion should change after update") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -590,8 +556,8 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.EphemeralRunnerSet) err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") - g.Expect(current.UID).To(Equal(originalERSRunnerSetUID), "EphemeralRunnerSet should not be recreated") - g.Expect(current.ResourceVersion).To(Equal(originalERSResourceVersion), "EphemeralRunnerSet spec should not change") + g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should not be recreated") + g.Expect(current.Annotations[annotationKeyIntegrityHash]).To(Equal(originalRunnerSetHash), "EphemeralRunnerSet spec should not change") }, time.Second*5, autoscalingRunnerSetTestInterval, @@ -602,14 +568,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() (string, error) { - err := k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - runnerSet, - ) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) if err != nil { return "", err } @@ -627,14 +586,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { Eventually( func() (string, error) { current := new(v1alpha1.EphemeralRunnerSet) - err := k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - current, - ) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, current) if err != nil { return "", err } @@ -649,14 +601,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() (string, error) { - err := k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - runnerSet, - ) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) if err != nil { return "", err } @@ -669,8 +614,6 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { patched := autoscalingRunnerSet.DeepCopy() patched.Spec.EphemeralRunnerSetMetadata.Annotations["arc.test/metadata-annotation"] = "updated" patched.Spec.EphemeralRunnerSetMetadata.Annotations["arc.test/new-metadata-annotation"] = "added" - originalERSIntegrityHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] - patched.Spec.EphemeralRunnerSetMetadata.Annotations[AnnotationKeyIntegrityHash] = "must-not-be-modified" err := k8sClient.Patch(ctx, patched, client.MergeFrom(autoscalingRunnerSet)) Expect(err).NotTo(HaveOccurred(), "failed to patch AutoScalingRunnerSet EphemeralRunnerSet metadata") @@ -681,7 +624,6 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(current.Annotations["arc.test/metadata-annotation"]).To(Equal("updated")) g.Expect(current.Annotations["arc.test/new-metadata-annotation"]).To(Equal("added")) - g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalERSIntegrityHash), "EphemeralRunnerSet hash integrity key should not be modified") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -692,14 +634,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func(g Gomega) { - err := k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - runnerSet, - ) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") g.Expect(runnerSet.Spec.EphemeralRunnerMetadata).NotTo(BeNil()) g.Expect(runnerSet.Spec.EphemeralRunnerMetadata.Labels["arc.test/runner-metadata-label"]).To(Equal("initial")) @@ -784,38 +719,22 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { listener := new(v1alpha1.AutoscalingListener) Eventually( func() error { - return k8sClient.Get( - ctx, - client.ObjectKey{ - Name: scaleSetListenerName(autoscalingRunnerSet), - Namespace: autoscalingRunnerSet.Namespace, - }, - listener, - ) + return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "Listener should be created") originalListenerUID := listener.UID - originalListenerIntegrityHash := listener.Annotations[AnnotationKeyIntegrityHash] runnerSet := new(v1alpha1.EphemeralRunnerSet) Eventually( func() error { - return k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - runnerSet, - ) + return k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, runnerSet) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be created") - originalEphemeralRunnerSetUID := runnerSet.UID - originalEphemeralRunnerSetIntegrityHash := runnerSet.Annotations[AnnotationKeyIntegrityHash] + originalRunnerSetUID := runnerSet.UID patched := autoscalingRunnerSet.DeepCopy() patched.Spec.GitHubConfigSecret = updatedSecret.Name @@ -838,9 +757,8 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.EphemeralRunnerSet) err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") - g.Expect(current.UID).To(Equal(originalEphemeralRunnerSetUID), "EphemeralRunnerSet should be updated in place") + g.Expect(current.UID).To(Equal(originalRunnerSetUID), "EphemeralRunnerSet should be updated in place") g.Expect(current.Spec.EphemeralRunnerSpec.GitHubConfigSecret).To(Equal(updatedSecret.Name)) - g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalEphemeralRunnerSetIntegrityHash), "EphemeralRunnerSet hash integrity key should not be modified") }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -851,9 +769,8 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { current := new(v1alpha1.AutoscalingListener) err := k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, current) g.Expect(err).NotTo(HaveOccurred(), "failed to get Listener") - g.Expect(current.UID).To(Equal(originalListenerUID), "Listener should be updated in place") - g.Expect(updatedSecret.Name).To(Equal(current.Spec.GitHubConfigSecret)) - g.Expect(current.Annotations[AnnotationKeyIntegrityHash]).To(Equal(originalListenerIntegrityHash), "Listener hash integrity key should not be modified") + g.Expect(current.UID).NotTo(Equal(originalListenerUID), "Listener should be recreated") + g.Expect(current.Spec.GitHubConfigSecret).To(Equal(updatedSecret.Name)) }, autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, @@ -920,64 +837,97 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { }) }) - It("Should update Status on EphemeralRunnerSet status Update", func() { - ars := new(v1alpha1.AutoscalingRunnerSet) - Eventually( - func() (bool, error) { - err := k8sClient.Get( - ctx, - client.ObjectKey{ - Name: autoscalingRunnerSet.Name, - Namespace: autoscalingRunnerSet.Namespace, - }, - ars, - ) - if err != nil { - return false, err - } - return true, nil - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).Should(BeTrue(), "AutoscalingRunnerSet should be created") + Context("When updating an AutoscalingRunnerSet with running or pending jobs", func() { + It("It should wait for running and pending jobs to finish before applying the update.", func() { + // Wait till the listener is created + listener := new(v1alpha1.AutoscalingListener) + Eventually( + func() error { + return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(Succeed(), "Listener should be created") - runnerSetList := new(v1alpha1.EphemeralRunnerSetList) - Eventually( - func() (int, error) { - err := k8sClient.List(ctx, runnerSetList, client.InNamespace(ars.Namespace)) - if err != nil { - return 0, err - } - return len(runnerSetList.Items), nil - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).Should(BeEquivalentTo(1), "Failed to fetch runner set list") + // Wait till the ephemeral runner set is created + Eventually( + func() (int, error) { + runnerSetList := new(v1alpha1.EphemeralRunnerSetList) + err := k8sClient.List(ctx, runnerSetList, client.InNamespace(autoscalingRunnerSet.Namespace)) + if err != nil { + return 0, err + } - runnerSet := runnerSetList.Items[0] - statusUpdate := runnerSet.DeepCopy() - statusUpdate.Status.Phase = v1alpha1.EphemeralRunnerSetPhaseRunning + return len(runnerSetList.Items), nil + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeEquivalentTo(1), "Only one EphemeralRunnerSet should be created") - desiredStatus := v1alpha1.AutoscalingRunnerSetStatus{ - Phase: v1alpha1.AutoscalingRunnerSetPhaseRunning, - } + runnerSetList := new(v1alpha1.EphemeralRunnerSetList) + err := k8sClient.List(ctx, runnerSetList, client.InNamespace(autoscalingRunnerSet.Namespace)) + Expect(err).NotTo(HaveOccurred(), "failed to list EphemeralRunnerSet") - err := k8sClient.Status().Patch(ctx, statusUpdate, client.MergeFrom(&runnerSet)) - Expect(err).NotTo(HaveOccurred(), "Failed to patch runner set status") + // Emulate running and pending jobs + runnerSet := runnerSetList.Items[0] + activeRunnerSet := runnerSet.DeepCopy() + for _, phase := range []v1alpha1.EphemeralRunnerPhase{ + v1alpha1.EphemeralRunnerPhaseRunning, + v1alpha1.EphemeralRunnerPhasePending, + } { + runner, err := controller.newEphemeralRunner(activeRunnerSet) + Expect(err).NotTo(HaveOccurred(), "Failed to create active runner") + err = k8sClient.Create(ctx, runner) + Expect(err).NotTo(HaveOccurred(), "Failed to create active runner") + + updatedRunner := runner.DeepCopy() + updatedRunner.Status.Phase = phase + err = k8sClient.Status().Patch(ctx, updatedRunner, client.MergeFrom(runner)) + Expect(err).NotTo(HaveOccurred(), "Failed to patch active runner status") + } - Eventually( - func() (v1alpha1.AutoscalingRunnerSetStatus, error) { - updated := new(v1alpha1.AutoscalingRunnerSet) - err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, updated) - if err != nil { - return v1alpha1.AutoscalingRunnerSetStatus{}, fmt.Errorf("failed to get AutoScalingRunnerSet: %w", err) - } - return updated.Status, nil - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).Should(BeEquivalentTo(desiredStatus), "AutoScalingRunnerSet status should be updated") + // Patch the AutoScalingRunnerSet image which should trigger + // the recreation of the Listener and EphemeralRunnerSet + patched := autoscalingRunnerSet.DeepCopy() + if patched.Annotations == nil { + patched.Annotations = make(map[string]string) + } + patched.Annotations[annotationKeyIntegrityHash] = "testgroup2" + patched.Spec.Template.Spec = corev1.PodSpec{ + Containers: []corev1.Container{ + { + Name: "runner", + Image: "ghcr.io/actions/abcd:1.1.1", + }, + }, + } + err = k8sClient.Patch(ctx, patched, client.MergeFrom(autoscalingRunnerSet)) + Expect(err).NotTo(HaveOccurred(), "failed to patch AutoScalingRunnerSet") + autoscalingRunnerSet = patched.DeepCopy() + + // The EphemeralRunnerSet should not be recreated + Consistently( + func() (string, error) { + runnerSetList := new(v1alpha1.EphemeralRunnerSetList) + err := k8sClient.List(ctx, runnerSetList, client.InNamespace(autoscalingRunnerSet.Namespace)) + Expect(err).NotTo(HaveOccurred(), "failed to fetch AutoScalingRunnerSet") + return runnerSetList.Items[0].Name, nil + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(Equal(activeRunnerSet.Name), "The EphemeralRunnerSet should not be recreated") + + // The listener should not be recreated + Consistently( + func() error { + return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).ShouldNot(Succeed(), "Listener should not be recreated") + }) }) + }) var _ = Describe("Test AutoScalingController updates", Ordered, func() { @@ -1182,11 +1132,10 @@ var _ = Describe("Test AutoscalingController creation failures", Ordered, func() }, }, Spec: v1alpha1.AutoscalingRunnerSetSpec{ - GitHubConfigUrl: "https://github.com/owner/repo", - GitHubConfigSecret: "secret1", - MaxRunners: &max, - MinRunners: &min, - RunnerGroup: "testgroup", + GitHubConfigUrl: "https://github.com/owner/repo", + MaxRunners: &max, + MinRunners: &min, + RunnerGroup: "testgroup", Template: corev1.PodTemplateSpec{ Spec: corev1.PodSpec{ Containers: []corev1.Container{ @@ -1220,9 +1169,8 @@ var _ = Describe("Test AutoscalingController creation failures", Ordered, func() autoscalingRunnerSetTestInterval, ).Should(BeEquivalentTo(autoscalingRunnerSetFinalizerName), "AutoScalingRunnerSet should have a finalizer") - updated := ars.DeepCopy() - updated.Annotations = make(map[string]string) - err = k8sClient.Patch(ctx, updated, client.MergeFrom(ars)) + ars.Annotations = make(map[string]string) + err = k8sClient.Update(ctx, ars) Expect(err).NotTo(HaveOccurred(), "Update autoscaling runner set without annotation should be successful") Eventually( @@ -1326,7 +1274,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() { RunnerGroup: "testgroup", Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: proxy.URL, + Url: proxy.URL, }, }, Template: corev1.PodTemplateSpec{ @@ -1404,7 +1352,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() { RunnerGroup: "testgroup", Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: "http://test:password@" + proxy.Listener.Addr().String(), + Url: "http://test:password@" + proxy.Listener.Addr().String(), CredentialSecretRef: "proxy-credentials", }, }, diff --git a/controllers/actions.github.com/ephemeralrunner_controller_test.go b/controllers/actions.github.com/ephemeralrunner_controller_test.go index 506355acf8..80c27134a7 100644 --- a/controllers/actions.github.com/ephemeralrunner_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunner_controller_test.go @@ -223,9 +223,8 @@ var _ = Describe("EphemeralRunner", func() { ).Should(Succeed(), "failed to get ephemeral runner") // update job id to simulate job assigned - updatedER := er.DeepCopy() - updatedER.Status.JobID = "1" - err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) + er.Status.JobID = "1" + err := k8sClient.Status().Update(ctx, er) Expect(err).To(BeNil(), "failed to update ephemeral runner status") er = new(v1alpha1.EphemeralRunner) @@ -250,8 +249,7 @@ var _ = Describe("EphemeralRunner", func() { }).Should(BeEquivalentTo(true)) // delete pod to simulate failure - updatedPod := pod.DeepCopy() - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -259,7 +257,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err = k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") er = new(v1alpha1.EphemeralRunner) @@ -279,9 +277,8 @@ var _ = Describe("EphemeralRunner", func() { return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er) }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner") - updatedER := er.DeepCopy() - updatedER.Status.JobID = "1" - err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) + er.Status.JobID = "1" + err := k8sClient.Status().Update(ctx, er) Expect(err).To(BeNil(), "failed to update ephemeral runner status") Eventually(func() (string, error) { @@ -300,10 +297,9 @@ var _ = Describe("EphemeralRunner", func() { return true, nil }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true)) - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodFailed - updatedPod.Status.ContainerStatuses = nil - err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + pod.Status.Phase = corev1.PodFailed + pod.Status.ContainerStatuses = nil + err = k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") Eventually(func() bool { @@ -324,10 +320,9 @@ var _ = Describe("EphemeralRunner", func() { oldPodUID := pod.UID - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodFailed - updatedPod.Status.ContainerStatuses = nil - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + pod.Status.Phase = corev1.PodFailed + pod.Status.ContainerStatuses = nil + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -374,9 +369,8 @@ var _ = Describe("EphemeralRunner", func() { // Simulate init container failure without PodFailed phase. // This can happen when the kubelet has not yet transitioned the pod phase. - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodPending - updatedPod.Status.InitContainerStatuses = []corev1.ContainerStatus{ + pod.Status.Phase = corev1.PodPending + pod.Status.InitContainerStatuses = []corev1.ContainerStatus{ { Name: "setup", State: corev1.ContainerState{ @@ -388,7 +382,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, } - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -428,9 +422,8 @@ var _ = Describe("EphemeralRunner", func() { return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er) }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner") - updatedER := er.DeepCopy() - updatedER.Status.JobID = "1" - err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) + er.Status.JobID = "1" + err := k8sClient.Status().Update(ctx, er) Expect(err).To(BeNil(), "failed to update ephemeral runner status") Eventually(func() (string, error) { @@ -450,9 +443,8 @@ var _ = Describe("EphemeralRunner", func() { }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true)) // Simulate init container failure with job assigned - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodPending - updatedPod.Status.InitContainerStatuses = []corev1.ContainerStatus{ + pod.Status.Phase = corev1.PodPending + pod.Status.InitContainerStatuses = []corev1.ContainerStatus{ { Name: "setup", State: corev1.ContainerState{ @@ -463,7 +455,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, } - err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err = k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") Eventually(func() bool { @@ -479,9 +471,8 @@ var _ = Describe("EphemeralRunner", func() { return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er) }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner") - updatedER := er.DeepCopy() - updatedER.Status.JobID = "1" - err := k8sClient.Status().Patch(ctx, updatedER, client.MergeFrom(er)) + er.Status.JobID = "1" + err := k8sClient.Status().Update(ctx, er) Expect(err).To(BeNil(), "failed to update ephemeral runner status") pod := new(corev1.Pod) @@ -496,9 +487,8 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get pod") - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodFailed - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.Phase = corev1.PodFailed + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -506,7 +496,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err = k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -533,9 +523,8 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get pod") - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodFailed - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.Phase = corev1.PodFailed + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -543,7 +532,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -579,10 +568,9 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get pod") - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodFailed + pod.Status.Phase = corev1.PodFailed oldPodUID := pod.UID - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -591,7 +579,7 @@ var _ = Describe("EphemeralRunner", func() { }, }) - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") Eventually( @@ -951,9 +939,8 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(BeEquivalentTo(true)) - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodRunning - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + pod.Status.Phase = corev1.PodRunning + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "failed to patch pod status") Consistently( @@ -988,8 +975,7 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(Succeed(), "failed to get ephemeral runner pod") - updatedPod := pod.DeepCopy() - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -997,10 +983,10 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "Failed to update pod status") - return updatedPod + return pod } for i := range 5 { @@ -1079,14 +1065,13 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(BeEquivalentTo(true)) - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodFailed - updatedPod.Status.Reason = "Evicted" - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.Phase = corev1.PodFailed + pod.Status.Reason = "Evicted" + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{}, }) - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "failed to patch pod status") updated := new(v1alpha1.EphemeralRunner) @@ -1126,14 +1111,13 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerInterval, ).Should(BeEquivalentTo(true)) - updatedPod := pod.DeepCopy() - updatedPod.Status.Phase = corev1.PodFailed - updatedPod.Status.Reason = "OutOfpods" - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.Phase = corev1.PodFailed + pod.Status.Reason = "OutOfpods" + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{}, }) - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "failed to patch pod status") updated := new(v1alpha1.EphemeralRunner) @@ -1173,8 +1157,7 @@ var _ = Describe("EphemeralRunner", func() { ).Should(BeEquivalentTo(true)) // first set phase to running - updatedPod := pod.DeepCopy() - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Running: &corev1.ContainerStateRunning{ @@ -1182,8 +1165,8 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - updatedPod.Status.Phase = corev1.PodRunning - err := k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + pod.Status.Phase = corev1.PodRunning + err := k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil()) Eventually( @@ -1199,9 +1182,8 @@ var _ = Describe("EphemeralRunner", func() { ).Should(BeEquivalentTo(v1alpha1.EphemeralRunnerPhaseRunning)) // set phase to succeeded - nextPod := updatedPod.DeepCopy() - nextPod.Status.Phase = corev1.PodSucceeded - err = k8sClient.Status().Patch(ctx, nextPod, client.MergeFrom(updatedPod)) + pod.Status.Phase = corev1.PodSucceeded + err = k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil()) Consistently( @@ -1276,8 +1258,7 @@ var _ = Describe("EphemeralRunner", func() { return true, nil }, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true)) - updatedPod := pod.DeepCopy() - updatedPod.Status.ContainerStatuses = append(updatedPod.Status.ContainerStatuses, corev1.ContainerStatus{ + pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{ Name: v1alpha1.EphemeralRunnerContainerName, State: corev1.ContainerState{ Terminated: &corev1.ContainerStateTerminated{ @@ -1285,7 +1266,7 @@ var _ = Describe("EphemeralRunner", func() { }, }, }) - err = k8sClient.Status().Patch(ctx, updatedPod, client.MergeFrom(pod)) + err = k8sClient.Status().Update(ctx, pod) Expect(err).To(BeNil(), "failed to update pod status") updated := new(v1alpha1.EphemeralRunner) @@ -1386,7 +1367,7 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunner.Spec.GitHubConfigURL = "http://example.com/org/repo" ephemeralRunner.Spec.Proxy = &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: proxy.URL, + Url: proxy.URL, CredentialSecretRef: "proxy-credentials", }, } @@ -1407,10 +1388,10 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunner := newExampleRunner("test-runner", autoScalingNS.Name, configSecret.Name) ephemeralRunner.Spec.Proxy = &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: "http://proxy.example.com:8080", + Url: "http://proxy.example.com:8080", }, HTTPS: &v1alpha1.ProxyServerConfig{ - URL: "http://proxy.example.com:8080", + Url: "http://proxy.example.com:8080", }, NoProxy: []string{"example.com"}, } diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go index 8d80ce0e55..3c3910240d 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go @@ -222,25 +222,10 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ephemeralRunnerSetTestInterval, ).Should(BeEquivalentTo(0), "No EphemeralRunner should be created") - // Check if the status is initialized - Consistently( - func() (v1alpha1.EphemeralRunnerSetPhase, error) { - runnerSet := new(v1alpha1.EphemeralRunnerSet) - err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunnerSet.Name, Namespace: ephemeralRunnerSet.Namespace}, runnerSet) - if err != nil { - return "", err - } - - return runnerSet.Status.Phase, nil - }, - ephemeralRunnerSetTestTimeout, - ephemeralRunnerSetTestInterval, - ).Should(BeEquivalentTo(v1alpha1.EphemeralRunnerSetPhaseRunning), "EphemeralRunnerSet status should be running") - // Scaling up the EphemeralRunnerSet updated := created.DeepCopy() updated.Spec.Replicas = 5 - err := k8sClient.Patch(ctx, updated, client.MergeFrom(created)) + err := k8sClient.Update(ctx, updated) Expect(err).NotTo(HaveOccurred(), "failed to update EphemeralRunnerSet") // Check if the number of ephemeral runners are created @@ -275,21 +260,6 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ephemeralRunnerSetTestTimeout, ephemeralRunnerSetTestInterval, ).Should(BeEquivalentTo(5), "5 EphemeralRunner should be created") - - // Check if the status stays running - Eventually( - func() (v1alpha1.EphemeralRunnerSetPhase, error) { - runnerSet := new(v1alpha1.EphemeralRunnerSet) - err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunnerSet.Name, Namespace: ephemeralRunnerSet.Namespace}, runnerSet) - if err != nil { - return "", err - } - - return runnerSet.Status.Phase, nil - }, - ephemeralRunnerSetTestTimeout, - ephemeralRunnerSetTestInterval, - ).Should(BeEquivalentTo(v1alpha1.EphemeralRunnerSetPhaseRunning), "EphemeralRunnerSet status should be running") }) }) @@ -302,7 +272,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { // Scale up the EphemeralRunnerSet updated := created.DeepCopy() updated.Spec.Replicas = 5 - err = k8sClient.Patch(ctx, updated, client.MergeFrom(created)) + err = k8sClient.Update(ctx, updated) Expect(err).NotTo(HaveOccurred(), "failed to update EphemeralRunnerSet") // Wait for the EphemeralRunnerSet to be scaled up @@ -1190,7 +1160,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { // Scale up the EphemeralRunnerSet updated := created.DeepCopy() updated.Spec.Replicas = 3 - err := k8sClient.Patch(ctx, updated, client.MergeFrom(created)) + err := k8sClient.Update(ctx, updated) Expect(err).NotTo(HaveOccurred(), "failed to update EphemeralRunnerSet replica count") runnerList := new(v1alpha1.EphemeralRunnerList) @@ -1546,11 +1516,11 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func( RunnerScaleSetID: 100, Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: "http://proxy.example.com", + Url: "http://proxy.example.com", CredentialSecretRef: secretCredentials.Name, }, HTTPS: &v1alpha1.ProxyServerConfig{ - URL: "https://proxy.example.com", + Url: "https://proxy.example.com", CredentialSecretRef: secretCredentials.Name, }, NoProxy: []string{"example.com", "example.org"}, @@ -1729,7 +1699,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func( RunnerScaleSetID: 100, Proxy: &v1alpha1.ProxyConfig{ HTTP: &v1alpha1.ProxyServerConfig{ - URL: proxy.URL, + Url: proxy.URL, CredentialSecretRef: "proxy-credentials", }, }, diff --git a/controllers/actions.github.com/resourcebuilder.go b/controllers/actions.github.com/resourcebuilder.go index 68ce5cbc69..fd456b56f1 100644 --- a/controllers/actions.github.com/resourcebuilder.go +++ b/controllers/actions.github.com/resourcebuilder.go @@ -46,14 +46,14 @@ var commonLabelKeys = [...]string{ LabelKeyGitHubRepository, } -// AnnotationKeyIntegrityHash is used as a hash of the important fields +// annotationKeyIntegrityHash is used as a hash of the important fields // of each resource to determine if more drastic action should be taken. // // For example, annotations/labels are not something that should modify // the behavior of a resource, while the change in spec is. Therefore, // the spec hash should contain the spec fields in order to determine // modifications. -const AnnotationKeyIntegrityHash = "actions.github.com/integrity-hash" +const annotationKeyIntegrityHash = "actions.github.com/integrity-hash" const labelValueKubernetesPartOf = "gha-runner-scale-set" @@ -115,10 +115,6 @@ func (b *ResourceBuilder) setControllerReference(owner client.Object, object cli return ctrl.SetControllerReference(owner, object, b.Scheme) } -func autoscalingRunnerSetIntegrityHash(ars *v1alpha1.AutoscalingRunnerSet) string { - return hash.ComputeTemplateHash(&ars.Spec) -} - func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet, namespace, image string, imagePullSecrets []corev1.LocalObjectReference) (*v1alpha1.AutoscalingListener, error) { runnerScaleSetID, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey]) if err != nil { @@ -126,14 +122,13 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. } effectiveMinRunners := 0 - if autoscalingRunnerSet.Spec.MinRunners != nil { - effectiveMinRunners = *autoscalingRunnerSet.Spec.MinRunners - } - effectiveMaxRunners := math.MaxInt32 if autoscalingRunnerSet.Spec.MaxRunners != nil { effectiveMaxRunners = *autoscalingRunnerSet.Spec.MaxRunners } + if autoscalingRunnerSet.Spec.MinRunners != nil { + effectiveMinRunners = *autoscalingRunnerSet.Spec.MinRunners + } spec := v1alpha1.AutoscalingListenerSpec{ GitHubConfigURL: autoscalingRunnerSet.Spec.GitHubConfigUrl, @@ -170,12 +165,12 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. } annotations := map[string]string{ - AnnotationKeyIntegrityHash: spec.Hash(), + annotationKeyIntegrityHash: spec.Hash(), } if autoscalingRunnerSet.Spec.AutoscalingListenerMetadata != nil { labels = b.filterAndMergeLabels(autoscalingRunnerSet.Spec.AutoscalingListenerMetadata.Labels, labels) - annotations = b.filterAndMergeAnnotations(autoscalingRunnerSet.Spec.AutoscalingListenerMetadata.Annotations, annotations) + annotations = b.mergeAnnotations(autoscalingRunnerSet.Spec.AutoscalingListenerMetadata.Annotations, annotations) } autoscalingListener := &v1alpha1.AutoscalingListener{ @@ -283,7 +278,7 @@ func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha }, } - desiredSecret.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerConfigIntegrityHash(desiredSecret) + desiredSecret.Annotations[annotationKeyIntegrityHash] = scaleSetListenerConfigIntegrityHash(desiredSecret) if err := b.setControllerReference(autoscalingListener, desiredSecret); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener config secret: %w", err) @@ -431,7 +426,7 @@ func (b *ResourceBuilder) newScaleSetListenerPod( Spec: podSpec, } - newRunnerScaleSetListenerPod.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerPodIntegrity( + newRunnerScaleSetListenerPod.Annotations[annotationKeyIntegrityHash] = scaleSetListenerPodIntegrity( newRunnerScaleSetListenerPod, autoscalingListener, podConfig, @@ -473,11 +468,11 @@ func scaleSetListenerPodIntegrity( d := data{ ListenerPodSpec: &pod.Spec, - AutoscalingListenerIntegrityHash: autoscalingListener.Annotations[AnnotationKeyIntegrityHash], - ConfigSecretIntegrityHash: podConfig.Annotations[AnnotationKeyIntegrityHash], - ServiceAccountIntegrityHash: serviceAccount.Annotations[AnnotationKeyIntegrityHash], - RoleIntegrityHash: role.Annotations[AnnotationKeyIntegrityHash], - RoleBindingIntegrityHash: roleBinding.Annotations[AnnotationKeyIntegrityHash], + AutoscalingListenerIntegrityHash: autoscalingListener.Annotations[annotationKeyIntegrityHash], + ConfigSecretIntegrityHash: podConfig.Annotations[annotationKeyIntegrityHash], + ServiceAccountIntegrityHash: serviceAccount.Annotations[annotationKeyIntegrityHash], + RoleIntegrityHash: role.Annotations[annotationKeyIntegrityHash], + RoleBindingIntegrityHash: roleBinding.Annotations[annotationKeyIntegrityHash], MetricsConfig: metricsConfig, } @@ -616,10 +611,10 @@ func (b *ResourceBuilder) newScaleSetListenerServiceAccount(autoscalingListener if autoscalingListener.Spec.ServiceAccountMetadata != nil { base.Labels = b.filterAndMergeLabels(autoscalingListener.Spec.ServiceAccountMetadata.Labels, base.Labels) - base.Annotations = b.filterAndMergeAnnotations(autoscalingListener.Spec.ServiceAccountMetadata.Annotations, base.Annotations) + base.Annotations = b.mergeAnnotations(autoscalingListener.Spec.ServiceAccountMetadata.Annotations, base.Annotations) } - base.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerServiceAccountIntegrityHash(base) + base.Annotations[annotationKeyIntegrityHash] = scaleSetListenerServiceAccountIntegrityHash(base) if err := b.setControllerReference(autoscalingListener, base); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener service account: %w", err) @@ -655,7 +650,7 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. annotations := make(map[string]string) if autoscalingListener.Spec.RoleMetadata != nil { labels = b.filterAndMergeLabels(autoscalingListener.Spec.RoleMetadata.Labels, labels) - annotations = b.filterAndMergeAnnotations(autoscalingListener.Spec.RoleMetadata.Annotations, nil) + annotations = b.mergeAnnotations(autoscalingListener.Spec.RoleMetadata.Annotations, nil) } newRole := &rbacv1.Role{ @@ -668,7 +663,7 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. Rules: rulesForListenerRole([]string{autoscalingListener.Spec.EphemeralRunnerSetName}), } - newRole.Annotations[AnnotationKeyIntegrityHash] = scaleSetRoleIntegrityHash(newRole) + newRole.Annotations[annotationKeyIntegrityHash] = scaleSetRoleIntegrityHash(newRole) return newRole } @@ -723,7 +718,7 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1 Subjects: subjects, } - newRoleBinding.Annotations[AnnotationKeyIntegrityHash] = scaleSetListenerRoleBindingIntegrityHash(newRoleBinding) + newRoleBinding.Annotations[annotationKeyIntegrityHash] = scaleSetListenerRoleBindingIntegrityHash(newRoleBinding) return newRoleBinding } @@ -782,7 +777,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A if autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata != nil { labels = b.filterAndMergeLabels(autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata.Labels, labels) - annotations = b.filterAndMergeAnnotations(autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata.Annotations, annotations) + annotations = b.mergeAnnotations(autoscalingRunnerSet.Spec.EphemeralRunnerSetMetadata.Annotations, annotations) } newEphemeralRunnerSet := &v1alpha1.EphemeralRunnerSet{ @@ -796,7 +791,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A Spec: spec, } - newEphemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] = ephemeralRunnerSetIntegrityHash(newEphemeralRunnerSet) + newEphemeralRunnerSet.Annotations[annotationKeyIntegrityHash] = ephemeralRunnerSetIntegrityHash(newEphemeralRunnerSet) if err := b.setControllerReference(autoscalingRunnerSet, newEphemeralRunnerSet); err != nil { return nil, fmt.Errorf("failed to set controller reference for ephemeral runner set: %w", err) @@ -830,7 +825,7 @@ func (b *ResourceBuilder) newAutoscalingListenerProxySecret(autoscalingListener Data: data, } - newProxySecret.Annotations[AnnotationKeyIntegrityHash] = autoscalingListenerProxySecretIntegrityHash(newProxySecret) + newProxySecret.Annotations[annotationKeyIntegrityHash] = autoscalingListenerProxySecretIntegrityHash(newProxySecret) if err := b.setControllerReference(autoscalingListener, newProxySecret); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener proxy secret: %w", err) @@ -862,7 +857,7 @@ func (b *ResourceBuilder) newEphemeralRunner(ephemeralRunnerSet *v1alpha1.Epheme if ephemeralRunnerSet.Spec.EphemeralRunnerMetadata != nil { labels = b.filterAndMergeLabels(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata.Labels, labels) - annotations = b.filterAndMergeAnnotations(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata.Annotations, annotations) + annotations = b.mergeAnnotations(ephemeralRunnerSet.Spec.EphemeralRunnerMetadata.Annotations, annotations) } ephemeralRunner := &v1alpha1.EphemeralRunner{ @@ -997,7 +992,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSetProxySecret(ephemeralRunnerSet *v Data: data, } - runnerPodProxySecret.Annotations[AnnotationKeyIntegrityHash] = ephemeralRunnerSetProxySecretZIdentityHash(runnerPodProxySecret) + runnerPodProxySecret.Annotations[annotationKeyIntegrityHash] = ephemeralRunnerSetProxySecretZIdentityHash(runnerPodProxySecret) if err := b.setControllerReference(ephemeralRunnerSet, runnerPodProxySecret); err != nil { return nil, fmt.Errorf("failed to set controller reference for ephemeral runner set proxy secret: %w", err) @@ -1098,78 +1093,40 @@ func trimLabelValue(val string) string { return strings.Trim(val, "-_.") } -func (b *ResourceBuilder) filterLabels(k, v string) bool { - for _, prefix := range b.ExcludeLabelPropagationPrefixes { - if strings.HasPrefix(k, prefix) { - return true - } - } - return false -} - func (b *ResourceBuilder) filterAndMergeLabels(base, overwrite map[string]string) map[string]string { - return filterAndMergeMaps(base, overwrite, b.filterLabels) -} - -func filterAndMergeMaps(base, overwrite map[string]string, filter func(k, v string) bool) map[string]string { if base == nil && overwrite == nil { return nil } - var result map[string]string - if len(base) == 0 { - result = make(map[string]string) - } else { - result = maps.Clone(base) - } - if len(overwrite) > 0 { - maps.Copy(result, overwrite) - } - maps.DeleteFunc(result, filter) - return result -} -func (b *ResourceBuilder) filterAndMergeAnnotations(base, overwrite map[string]string) map[string]string { - if base == nil && overwrite == nil { - return nil - } - var result map[string]string - if len(base) == 0 { - result = make(map[string]string) - } else { - result = maps.Clone(base) + mergedLabels := make(map[string]string, len(base)) +base: + for k, v := range base { + for _, prefix := range b.ExcludeLabelPropagationPrefixes { + if strings.HasPrefix(k, prefix) { + continue base + } + } + mergedLabels[k] = v } +overwrite: for k, v := range overwrite { - if k == AnnotationKeyIntegrityHash { - continue + for _, prefix := range b.ExcludeLabelPropagationPrefixes { + if strings.HasPrefix(k, prefix) { + continue overwrite + } } - result[k] = v + mergedLabels[k] = v } - return result + return mergedLabels } -// compareAnnotations compares two maps of annotations, ignoring the integrity hash annotation. -func (b *ResourceBuilder) annotationsEqual(m1, m2 map[string]string) bool { - l1 := len(m1) - if _, ok := m1[AnnotationKeyIntegrityHash]; !ok { - l1++ - } - l2 := len(m2) - if _, ok := m2[AnnotationKeyIntegrityHash]; !ok { - l2++ - } - if l1 != l2 { - return false - } - - for k, v1 := range m1 { - if k == AnnotationKeyIntegrityHash { - continue - } - if v2, ok := m2[k]; !ok || v1 != v2 { - return false - } +func (b *ResourceBuilder) mergeAnnotations(base, overwrite map[string]string) map[string]string { + if base == nil && overwrite == nil { + return nil } - return true + base = maps.Clone(base) + maps.Copy(base, overwrite) + return base } diff --git a/controllers/actions.github.com/resourcebuilder_test.go b/controllers/actions.github.com/resourcebuilder_test.go index 206e610748..d08851173a 100644 --- a/controllers/actions.github.com/resourcebuilder_test.go +++ b/controllers/actions.github.com/resourcebuilder_test.go @@ -113,7 +113,7 @@ func TestMetadataPropagation(t *testing.T) { assert.Equal(t, labelValueKubernetesPartOf, ephemeralRunnerSet.Labels[LabelKeyKubernetesPartOf]) assert.Equal(t, "runner-set", ephemeralRunnerSet.Labels[LabelKeyKubernetesComponent]) assert.Equal(t, autoscalingRunnerSet.Labels[LabelKeyKubernetesVersion], ephemeralRunnerSet.Labels[LabelKeyKubernetesVersion]) - assert.NotEmpty(t, ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash]) + assert.NotEmpty(t, ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash]) assert.Equal(t, autoscalingRunnerSet.Name, ephemeralRunnerSet.Labels[LabelKeyGitHubScaleSetName]) assert.Equal(t, autoscalingRunnerSet.Namespace, ephemeralRunnerSet.Labels[LabelKeyGitHubScaleSetNamespace]) assert.Equal(t, "", ephemeralRunnerSet.Labels[LabelKeyGitHubEnterprise]) @@ -130,7 +130,7 @@ func TestMetadataPropagation(t *testing.T) { assert.Equal(t, labelValueKubernetesPartOf, listener.Labels[LabelKeyKubernetesPartOf]) assert.Equal(t, "runner-scale-set-listener", listener.Labels[LabelKeyKubernetesComponent]) assert.Equal(t, autoscalingRunnerSet.Labels[LabelKeyKubernetesVersion], listener.Labels[LabelKeyKubernetesVersion]) - assert.NotEmpty(t, ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash]) + assert.NotEmpty(t, ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash]) assert.Equal(t, autoscalingRunnerSet.Name, listener.Labels[LabelKeyGitHubScaleSetName]) assert.Equal(t, autoscalingRunnerSet.Namespace, listener.Labels[LabelKeyGitHubScaleSetNamespace]) assert.Equal(t, "", listener.Labels[LabelKeyGitHubEnterprise]) @@ -221,7 +221,7 @@ func TestEphemeralRunnerSetProxySecretZIdentityHash(t *testing.T) { }) require.NoError(t, err) - actualHash := proxySecret.Annotations[AnnotationKeyIntegrityHash] + actualHash := proxySecret.Annotations[annotationKeyIntegrityHash] assert.NotEmpty(t, actualHash) assert.Equal(t, ephemeralRunnerSetProxySecretZIdentityHash(proxySecret), actualHash) @@ -313,7 +313,7 @@ func TestOwnershipRelationships(t *testing.T) { runnerScaleSetIDAnnotationKey: "1", AnnotationKeyGitHubRunnerGroupName: "test-group", AnnotationKeyGitHubRunnerScaleSetName: "test-scale-set", - AnnotationKeyIntegrityHash: "test-hash", + annotationKeyIntegrityHash: "test-hash", }, }, Spec: v1alpha1.AutoscalingRunnerSetSpec{ diff --git a/controllers/actions.github.com/secretresolver/secret_resolver.go b/controllers/actions.github.com/secretresolver/secret_resolver.go index b9f9d9ccba..5f3e95612d 100644 --- a/controllers/actions.github.com/secretresolver/secret_resolver.go +++ b/controllers/actions.github.com/secretresolver/secret_resolver.go @@ -85,9 +85,9 @@ func (sr *SecretResolver) GetActionsService(ctx context.Context, obj object.Acti } if proxy.HTTP != nil { - u, err := url.Parse(proxy.HTTP.URL) + u, err := url.Parse(proxy.HTTP.Url) if err != nil { - return nil, fmt.Errorf("failed to parse proxy http url %q: %w", proxy.HTTP.URL, err) + return nil, fmt.Errorf("failed to parse proxy http url %q: %w", proxy.HTTP.Url, err) } if ref := proxy.HTTP.CredentialSecretRef; ref != "" { @@ -101,9 +101,9 @@ func (sr *SecretResolver) GetActionsService(ctx context.Context, obj object.Acti } if proxy.HTTPS != nil { - u, err := url.Parse(proxy.HTTPS.URL) + u, err := url.Parse(proxy.HTTPS.Url) if err != nil { - return nil, fmt.Errorf("failed to parse proxy https url %q: %w", proxy.HTTPS.URL, err) + return nil, fmt.Errorf("failed to parse proxy https url %q: %w", proxy.HTTPS.Url, err) } if ref := proxy.HTTPS.CredentialSecretRef; ref != "" { diff --git a/controllers/actions.github.com/utils.go b/controllers/actions.github.com/utils.go index da87eb7b21..a77b24ba17 100644 --- a/controllers/actions.github.com/utils.go +++ b/controllers/actions.github.com/utils.go @@ -1,8 +1,6 @@ package actionsgithubcom import ( - "encoding/json" - "k8s.io/apimachinery/pkg/util/rand" ) @@ -27,11 +25,3 @@ func RandStringRunes(n int) string { } return string(b) } - -func mustJSON(v any) string { - val, err := json.Marshal(v) - if err != nil { - panic(err) - } - return string(val) -} From 3de12eca0061455cde6a674960620ec39a6b0400 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Fri, 10 Jul 2026 22:47:27 +0200 Subject: [PATCH 13/22] wip --- .../crds/actions.github.com_autoscalinglisteners.yaml | 10 ---------- .../crds/actions.github.com_ephemeralrunners.yaml | 4 ---- .../crds/actions.github.com_ephemeralrunnersets.yaml | 4 ---- .../crds/actions.github.com_autoscalinglisteners.yaml | 10 ---------- .../crds/actions.github.com_ephemeralrunners.yaml | 4 ---- .../crds/actions.github.com_ephemeralrunnersets.yaml | 4 ---- .../bases/actions.github.com_autoscalinglisteners.yaml | 10 ---------- .../crd/bases/actions.github.com_ephemeralrunners.yaml | 4 ---- .../bases/actions.github.com_ephemeralrunnersets.yaml | 4 ---- .../ephemeralrunnerset_controller.go | 10 ++++------ 10 files changed, 4 insertions(+), 60 deletions(-) diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml index 20e57e3398..29cc9bb4bc 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalinglisteners.yaml @@ -51,10 +51,8 @@ spec: description: AutoscalingListenerSpec defines the desired state of AutoscalingListener properties: autoscalingRunnerSetName: - description: Required type: string autoscalingRunnerSetNamespace: - description: Required type: string configSecretMetadata: description: ResourceMeta carries metadata common to all internal @@ -70,13 +68,10 @@ spec: type: object type: object ephemeralRunnerSetName: - description: Required type: string githubConfigSecret: - description: Required type: string githubConfigUrl: - description: Required type: string githubServerTLS: properties: @@ -109,10 +104,8 @@ spec: type: object type: object image: - description: Required type: string imagePullSecrets: - description: Required items: description: |- LocalObjectReference contains enough information to let you locate the @@ -131,7 +124,6 @@ spec: x-kubernetes-map-type: atomic type: array maxRunners: - description: Required minimum: 0 type: integer metrics: @@ -183,7 +175,6 @@ spec: type: object type: object minRunners: - description: Required minimum: 0 type: integer proxy: @@ -236,7 +227,6 @@ spec: type: object type: object runnerScaleSetId: - description: Required type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml index 3cd90148ca..a174d751d4 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunners.yaml @@ -8290,10 +8290,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - runnerScaleSetId type: object status: description: EphemeralRunnerStatus defines the observed state of EphemeralRunner diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml index fa706e3ba6..2d17def801 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml @@ -8284,10 +8284,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - runnerScaleSetId type: object patchID: description: PatchID is the unique identifier for the patch issued by the listener app diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml index 20e57e3398..29cc9bb4bc 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml @@ -51,10 +51,8 @@ spec: description: AutoscalingListenerSpec defines the desired state of AutoscalingListener properties: autoscalingRunnerSetName: - description: Required type: string autoscalingRunnerSetNamespace: - description: Required type: string configSecretMetadata: description: ResourceMeta carries metadata common to all internal @@ -70,13 +68,10 @@ spec: type: object type: object ephemeralRunnerSetName: - description: Required type: string githubConfigSecret: - description: Required type: string githubConfigUrl: - description: Required type: string githubServerTLS: properties: @@ -109,10 +104,8 @@ spec: type: object type: object image: - description: Required type: string imagePullSecrets: - description: Required items: description: |- LocalObjectReference contains enough information to let you locate the @@ -131,7 +124,6 @@ spec: x-kubernetes-map-type: atomic type: array maxRunners: - description: Required minimum: 0 type: integer metrics: @@ -183,7 +175,6 @@ spec: type: object type: object minRunners: - description: Required minimum: 0 type: integer proxy: @@ -236,7 +227,6 @@ spec: type: object type: object runnerScaleSetId: - description: Required type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml index 3cd90148ca..a174d751d4 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml @@ -8290,10 +8290,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - runnerScaleSetId type: object status: description: EphemeralRunnerStatus defines the observed state of EphemeralRunner diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml index fa706e3ba6..2d17def801 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml @@ -8284,10 +8284,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - runnerScaleSetId type: object patchID: description: PatchID is the unique identifier for the patch issued by the listener app diff --git a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml index 20e57e3398..29cc9bb4bc 100644 --- a/config/crd/bases/actions.github.com_autoscalinglisteners.yaml +++ b/config/crd/bases/actions.github.com_autoscalinglisteners.yaml @@ -51,10 +51,8 @@ spec: description: AutoscalingListenerSpec defines the desired state of AutoscalingListener properties: autoscalingRunnerSetName: - description: Required type: string autoscalingRunnerSetNamespace: - description: Required type: string configSecretMetadata: description: ResourceMeta carries metadata common to all internal @@ -70,13 +68,10 @@ spec: type: object type: object ephemeralRunnerSetName: - description: Required type: string githubConfigSecret: - description: Required type: string githubConfigUrl: - description: Required type: string githubServerTLS: properties: @@ -109,10 +104,8 @@ spec: type: object type: object image: - description: Required type: string imagePullSecrets: - description: Required items: description: |- LocalObjectReference contains enough information to let you locate the @@ -131,7 +124,6 @@ spec: x-kubernetes-map-type: atomic type: array maxRunners: - description: Required minimum: 0 type: integer metrics: @@ -183,7 +175,6 @@ spec: type: object type: object minRunners: - description: Required minimum: 0 type: integer proxy: @@ -236,7 +227,6 @@ spec: type: object type: object runnerScaleSetId: - description: Required type: integer serviceAccountMetadata: description: ResourceMeta carries metadata common to all internal diff --git a/config/crd/bases/actions.github.com_ephemeralrunners.yaml b/config/crd/bases/actions.github.com_ephemeralrunners.yaml index 3cd90148ca..a174d751d4 100644 --- a/config/crd/bases/actions.github.com_ephemeralrunners.yaml +++ b/config/crd/bases/actions.github.com_ephemeralrunners.yaml @@ -8290,10 +8290,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - runnerScaleSetId type: object status: description: EphemeralRunnerStatus defines the observed state of EphemeralRunner diff --git a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml index fa706e3ba6..2d17def801 100644 --- a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml +++ b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml @@ -8284,10 +8284,6 @@ spec: It is used to identify which vault integration should be used to resolve secrets. type: string type: object - required: - - githubConfigSecret - - githubConfigUrl - - runnerScaleSetId type: object patchID: description: PatchID is the unique identifier for the patch issued by the listener app diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller.go b/controllers/actions.github.com/ephemeralrunnerset_controller.go index ae5c6359b4..df214e51e8 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller.go @@ -135,7 +135,7 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R // If hash spec has changed, delete idle ephemeral runners // in order to apply the change to the runners that did not yet receive a job. ephemeralRunnerIntegrityHash := ephemeralRunnerSetIntegrityHash(&ephemeralRunnerSet) - if ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] != ephemeralRunnerIntegrityHash { + if ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash] != ephemeralRunnerIntegrityHash { log.Info("EphemeralRunnerSpec has changed, deleting idle ephemeral runners to apply the new spec") if _, err := r.cleanUpEphemeralRunners(ctx, &ephemeralRunnerSet, log); err != nil { log.Error(err, "Failed to clean up EphemeralRunners") @@ -152,7 +152,7 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R if ephemeralRunnerSet.Annotations == nil { ephemeralRunnerSet.Annotations = make(map[string]string) } - ephemeralRunnerSet.Annotations[AnnotationKeyIntegrityHash] = ephemeralRunnerIntegrityHash + ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash] = ephemeralRunnerIntegrityHash if err := r.Patch(ctx, &ephemeralRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update ephemeral runner set with new spec hash") return ctrl.Result{}, err @@ -254,9 +254,7 @@ func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemer default: phase = ephemeralRunnerSet.Status.Phase } - desiredStatus := v1alpha1.EphemeralRunnerSetStatus{ - Phase: phase, - } + desiredStatus := v1alpha1.EphemeralRunnerSetStatus{Phase: phase} // Update the status if needed. if ephemeralRunnerSet.Status != desiredStatus { @@ -468,7 +466,7 @@ func (r *EphemeralRunnerSetReconciler) reconcileEphemeralRunnerSetProxySecret(ct dataModified := !maps.EqualFunc(proxySecret.Data, desiredRunnerSetProxy.Data, bytes.Equal) desiredLabels := r.filterAndMergeLabels(proxySecret.Labels, desiredRunnerSetProxy.Labels) labelsModified := !maps.Equal(proxySecret.Labels, desiredLabels) - desiredAnnotations := r.filterAndMergeAnnotations(proxySecret.Annotations, desiredRunnerSetProxy.Annotations) + desiredAnnotations := r.mergeAnnotations(proxySecret.Annotations, desiredRunnerSetProxy.Annotations) annotationsModified := !maps.Equal(proxySecret.Annotations, desiredAnnotations) if dataModified || labelsModified || annotationsModified { updatedProxySecret := proxySecret.DeepCopy() From 32a8d208c826094eb282ec8eed20df1da8bf4ccc Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Sat, 11 Jul 2026 00:55:57 +0200 Subject: [PATCH 14/22] revert optional --- .../v1alpha1/autoscalingrunnerset_types.go | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index 11c9edd915..91fd6e60b2 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -49,10 +49,10 @@ type AutoscalingRunnerSet struct { // AutoscalingRunnerSetSpec defines the desired state of AutoscalingRunnerSet type AutoscalingRunnerSetSpec struct { - // Required + // +optional GitHubConfigUrl string `json:"githubConfigUrl,omitempty"` - // Required + // +optional GitHubConfigSecret string `json:"githubConfigSecret,omitempty"` // +optional @@ -73,7 +73,7 @@ type AutoscalingRunnerSetSpec struct { // +optional VaultConfig *VaultConfig `json:"vaultConfig,omitempty"` - // Required + // +optional Template corev1.PodTemplateSpec `json:"template,omitempty"` // +optional @@ -116,7 +116,7 @@ type AutoscalingRunnerSetSpec struct { } type TLSConfig struct { - // Required + // +optional CertificateFrom *TLSCertificateSource `json:"certificateFrom,omitempty"` } @@ -153,7 +153,7 @@ func (c *TLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error) } type TLSCertificateSource struct { - // Required + // +optional ConfigMapKeyRef *corev1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty"` } @@ -254,7 +254,7 @@ func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, erro } type ProxyServerConfig struct { - // Required + // +optional Url string `json:"url,omitempty"` // +optional From 2148a623f5bf97ba59601e74c76ab5bf039ef0a4 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Sat, 11 Jul 2026 01:54:24 +0200 Subject: [PATCH 15/22] wip --- .../v1alpha1/autoscalingrunnerset_types.go | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index 91fd6e60b2..dd1bce7fa1 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -36,14 +36,22 @@ import ( // +kubebuilder:subresource:status // +kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".status.phase",name=Phase,type=string +// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer // AutoscalingRunnerSet is the Schema for the autoscalingrunnersets API type AutoscalingRunnerSet struct { - metav1.TypeMeta `json:",inline"` + metav1.TypeMeta `json:",inline"` + // +optional metav1.ObjectMeta `json:"metadata,omitempty"` - Spec AutoscalingRunnerSetSpec `json:"spec,omitempty"` + // +optional + Spec AutoscalingRunnerSetSpec `json:"spec,omitempty"` + // +optional Status AutoscalingRunnerSetStatus `json:"status,omitempty"` } @@ -116,7 +124,7 @@ type AutoscalingRunnerSetSpec struct { } type TLSConfig struct { - // +optional + // Required CertificateFrom *TLSCertificateSource `json:"certificateFrom,omitempty"` } @@ -153,7 +161,7 @@ func (c *TLSConfig) ToCertPool(keyFetcher func(name, key string) ([]byte, error) } type TLSCertificateSource struct { - // +optional + // Required ConfigMapKeyRef *corev1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty"` } @@ -254,7 +262,7 @@ func (c *ProxyConfig) ProxyFunc(secretFetcher func(string) (*corev1.Secret, erro } type ProxyServerConfig struct { - // +optional + // Required Url string `json:"url,omitempty"` // +optional From 3a6ce796724b4d81219a496441577eb0d2ac4825 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 13 Jul 2026 11:25:37 +0200 Subject: [PATCH 16/22] wip --- .../autoscalingrunnerset_controller.go | 16 +-- .../autoscalingrunnerset_controller_test.go | 105 +++++++++++++++--- .../ephemeralrunnerset_controller.go | 17 ++- .../ephemeralrunnerset_controller_test.go | 33 +++++- 4 files changed, 138 insertions(+), 33 deletions(-) diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index d1913f27c6..40be4d25bf 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -295,17 +295,7 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl // When runners are actively processing jobs, defer the spec update: // delete the listener to stop accepting new jobs, but leave the ERS // (and its running pods) untouched until all jobs have drained. - var ephemeralRunnerList v1alpha1.EphemeralRunnerList - if err := r.List(ctx, &ephemeralRunnerList, - client.InNamespace(ephemeralRunnerSet.Namespace), - client.MatchingFields{resourceOwnerKey: ephemeralRunnerSet.Name}, - ); err != nil { - log.Error(err, "Failed to list ephemeral runners") - return ctrl.Result{}, err - } - - ephemeralRunnersByState := newEphemeralRunnersByStates(&ephemeralRunnerList) - if len(ephemeralRunnersByState.running)+len(ephemeralRunnersByState.pending) > 0 { + if ephemeralRunnerSet.Status.RunningEphemeralRunners+ephemeralRunnerSet.Status.PendingEphemeralRunners > 0 { log.Info("Ephemeral runner set spec changed but runners are still active; deleting listener to stop new jobs") if _, err := r.cleanupListener(ctx, &autoscalingRunnerSet, log); err != nil { log.Error(err, "Failed to clean up listener while waiting for runners to drain") @@ -448,7 +438,9 @@ func (r *AutoscalingRunnerSetReconciler) updateStatus(ctx context.Context, autos } original := autoscalingRunnerSet.DeepCopy() - autoscalingRunnerSet.Status.Phase = phase + if phaseDiff { + autoscalingRunnerSet.Status.Phase = phase + } if err := r.Status().Patch(ctx, autoscalingRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to patch autoscaling runner set status") diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index e7bb6f0804..55ebe5c6ae 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -871,21 +871,35 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { // Emulate running and pending jobs runnerSet := runnerSetList.Items[0] activeRunnerSet := runnerSet.DeepCopy() - for _, phase := range []v1alpha1.EphemeralRunnerPhase{ - v1alpha1.EphemeralRunnerPhaseRunning, - v1alpha1.EphemeralRunnerPhasePending, - } { - runner, err := controller.newEphemeralRunner(activeRunnerSet) - Expect(err).NotTo(HaveOccurred(), "Failed to create active runner") - err = k8sClient.Create(ctx, runner) - Expect(err).NotTo(HaveOccurred(), "Failed to create active runner") - - updatedRunner := runner.DeepCopy() - updatedRunner.Status.Phase = phase - err = k8sClient.Status().Patch(ctx, updatedRunner, client.MergeFrom(runner)) - Expect(err).NotTo(HaveOccurred(), "Failed to patch active runner status") + activeRunnerSet.Status.CurrentReplicas = 6 + activeRunnerSet.Status.FailedEphemeralRunners = 1 + activeRunnerSet.Status.RunningEphemeralRunners = 2 + activeRunnerSet.Status.PendingEphemeralRunners = 3 + + desiredStatus := v1alpha1.AutoscalingRunnerSetStatus{ + CurrentRunners: activeRunnerSet.Status.CurrentReplicas, + Phase: v1alpha1.AutoscalingRunnerSetPhaseRunning, + PendingEphemeralRunners: activeRunnerSet.Status.PendingEphemeralRunners, + RunningEphemeralRunners: activeRunnerSet.Status.RunningEphemeralRunners, + FailedEphemeralRunners: activeRunnerSet.Status.FailedEphemeralRunners, } + err = k8sClient.Status().Patch(ctx, activeRunnerSet, client.MergeFrom(&runnerSet)) + Expect(err).NotTo(HaveOccurred(), "Failed to patch runner set status") + + Eventually( + func() (v1alpha1.AutoscalingRunnerSetStatus, error) { + updated := new(v1alpha1.AutoscalingRunnerSet) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, updated) + if err != nil { + return v1alpha1.AutoscalingRunnerSetStatus{}, fmt.Errorf("failed to get AutoScalingRunnerSet: %w", err) + } + return updated.Status, nil + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeEquivalentTo(desiredStatus), "AutoScalingRunnerSet status should be updated") + // Patch the AutoScalingRunnerSet image which should trigger // the recreation of the Listener and EphemeralRunnerSet patched := autoscalingRunnerSet.DeepCopy() @@ -928,6 +942,71 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { }) }) + It("Should update Status on EphemeralRunnerSet status Update", func() { + ars := new(v1alpha1.AutoscalingRunnerSet) + Eventually( + func() (bool, error) { + err := k8sClient.Get( + ctx, + client.ObjectKey{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + ars, + ) + if err != nil { + return false, err + } + return true, nil + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeTrue(), "AutoscalingRunnerSet should be created") + + runnerSetList := new(v1alpha1.EphemeralRunnerSetList) + Eventually( + func() (int, error) { + err := k8sClient.List(ctx, runnerSetList, client.InNamespace(ars.Namespace)) + if err != nil { + return 0, err + } + return len(runnerSetList.Items), nil + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeEquivalentTo(1), "Failed to fetch runner set list") + + runnerSet := runnerSetList.Items[0] + statusUpdate := runnerSet.DeepCopy() + statusUpdate.Status.CurrentReplicas = 6 + statusUpdate.Status.FailedEphemeralRunners = 1 + statusUpdate.Status.RunningEphemeralRunners = 2 + statusUpdate.Status.PendingEphemeralRunners = 3 + + desiredStatus := v1alpha1.AutoscalingRunnerSetStatus{ + CurrentRunners: statusUpdate.Status.CurrentReplicas, + Phase: v1alpha1.AutoscalingRunnerSetPhaseRunning, + PendingEphemeralRunners: statusUpdate.Status.PendingEphemeralRunners, + RunningEphemeralRunners: statusUpdate.Status.RunningEphemeralRunners, + FailedEphemeralRunners: statusUpdate.Status.FailedEphemeralRunners, + } + + err := k8sClient.Status().Patch(ctx, statusUpdate, client.MergeFrom(&runnerSet)) + Expect(err).NotTo(HaveOccurred(), "Failed to patch runner set status") + + Eventually( + func() (v1alpha1.AutoscalingRunnerSetStatus, error) { + updated := new(v1alpha1.AutoscalingRunnerSet) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, updated) + if err != nil { + return v1alpha1.AutoscalingRunnerSetStatus{}, fmt.Errorf("failed to get AutoScalingRunnerSet: %w", err) + } + return updated.Status, nil + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeEquivalentTo(desiredStatus), "AutoScalingRunnerSet status should be updated") + }) }) var _ = Describe("Test AutoScalingController updates", Ordered, func() { diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller.go b/controllers/actions.github.com/ephemeralrunnerset_controller.go index df214e51e8..54aa85ae90 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller.go @@ -245,6 +245,8 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R } func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet, state *ephemeralRunnersByState, log logr.Logger) error { + original := ephemeralRunnerSet.DeepCopy() + total := state.scaleTotal() var phase v1alpha1.EphemeralRunnerSetPhase switch { case len(state.outdated) > 0: @@ -254,17 +256,22 @@ func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemer default: phase = ephemeralRunnerSet.Status.Phase } - desiredStatus := v1alpha1.EphemeralRunnerSetStatus{Phase: phase} + desiredStatus := v1alpha1.EphemeralRunnerSetStatus{ + CurrentReplicas: total, + Phase: phase, + PendingEphemeralRunners: len(state.pending), + RunningEphemeralRunners: len(state.running), + FailedEphemeralRunners: len(state.failed), + } // Update the status if needed. if ephemeralRunnerSet.Status != desiredStatus { - updated := ephemeralRunnerSet.DeepCopy() - updated.Status = desiredStatus - if err := r.Status().Patch(ctx, updated, client.MergeFrom(ephemeralRunnerSet)); err != nil { + ephemeralRunnerSet.Status = desiredStatus + if err := r.Status().Patch(ctx, ephemeralRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to update EphemeralRunnerSet status") return err } - log.Info("Updated EphemeralRunnerSet status", "status", updated.Status) + log.Info("Updated EphemeralRunnerSet status", "status", ephemeralRunnerSet.Status) } return nil diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go index 3c3910240d..3533e0dd4c 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go @@ -222,6 +222,21 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ephemeralRunnerSetTestInterval, ).Should(BeEquivalentTo(0), "No EphemeralRunner should be created") + // Check if the status stay 0 + Consistently( + func() (int, error) { + runnerSet := new(v1alpha1.EphemeralRunnerSet) + err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunnerSet.Name, Namespace: ephemeralRunnerSet.Namespace}, runnerSet) + if err != nil { + return -1, err + } + + return int(runnerSet.Status.CurrentReplicas), nil + }, + ephemeralRunnerSetTestTimeout, + ephemeralRunnerSetTestInterval, + ).Should(BeEquivalentTo(0), "EphemeralRunnerSet status should be 0") + // Scaling up the EphemeralRunnerSet updated := created.DeepCopy() updated.Spec.Replicas = 5 @@ -1243,7 +1258,11 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ).Should(BeTrue(), "Failed to eventually update to one pending, one running and one failed") desiredStatus := v1alpha1.EphemeralRunnerSetStatus{ - Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, + Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, + CurrentReplicas: 3, + PendingEphemeralRunners: 1, + RunningEphemeralRunners: 1, + FailedEphemeralRunners: 1, } Eventually( func() (v1alpha1.EphemeralRunnerSetStatus, error) { @@ -1282,7 +1301,11 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ).Should(BeEquivalentTo(1), "Failed to eventually scale down") desiredStatus = v1alpha1.EphemeralRunnerSetStatus{ - Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, + CurrentReplicas: 1, + PendingEphemeralRunners: 0, + RunningEphemeralRunners: 0, + FailedEphemeralRunners: 1, + Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, } Eventually( @@ -1302,7 +1325,11 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { Expect(err).To(BeNil(), "Failed to delete failed ephemeral runner") desiredStatus = v1alpha1.EphemeralRunnerSetStatus{ - Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, + CurrentReplicas: 0, + PendingEphemeralRunners: 0, + RunningEphemeralRunners: 0, + FailedEphemeralRunners: 0, + Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, } Eventually( func() (v1alpha1.EphemeralRunnerSetStatus, error) { From 195f9a4e85a9532e44fc1270f69a116e8f62092f Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 13 Jul 2026 12:58:55 +0200 Subject: [PATCH 17/22] wip --- ...ions.github.com_autoscalingrunnersets.yaml | 19 ++- ...ions.github.com_autoscalingrunnersets.yaml | 19 ++- ...ions.github.com_autoscalingrunnersets.yaml | 19 ++- .../autoscalingrunnerset_controller.go | 16 +-- .../autoscalingrunnerset_controller_test.go | 116 +----------------- .../ephemeralrunnerset_controller.go | 7 +- .../ephemeralrunnerset_controller_test.go | 28 ++--- 7 files changed, 60 insertions(+), 164 deletions(-) diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml index 1f4b63f32f..a2dfd46d9f 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,9 +21,24 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer + - jsonPath: .status.currentRunners + name: Current Runners + type: integer - jsonPath: .status.phase name: Phase type: string + - jsonPath: .status.pendingEphemeralRunners + name: Pending Runners + type: integer + - jsonPath: .status.runningEphemeralRunners + name: Running Runners + type: integer + - jsonPath: .status.finishedEphemeralRunners + name: Finished Runners + type: integer + - jsonPath: .status.deletingEphemeralRunners + name: Deleting Runners + type: integer name: v1alpha1 schema: openAPIV3Schema: @@ -98,10 +113,8 @@ spec: type: object type: object githubConfigSecret: - description: Required type: string githubConfigUrl: - description: Required type: string githubServerTLS: properties: @@ -8376,7 +8389,7 @@ spec: runnerScaleSetName: type: string template: - description: Required + description: PodTemplateSpec describes the data a pod should have when created from a template properties: metadata: description: |- diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml index 1f4b63f32f..a2dfd46d9f 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,9 +21,24 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer + - jsonPath: .status.currentRunners + name: Current Runners + type: integer - jsonPath: .status.phase name: Phase type: string + - jsonPath: .status.pendingEphemeralRunners + name: Pending Runners + type: integer + - jsonPath: .status.runningEphemeralRunners + name: Running Runners + type: integer + - jsonPath: .status.finishedEphemeralRunners + name: Finished Runners + type: integer + - jsonPath: .status.deletingEphemeralRunners + name: Deleting Runners + type: integer name: v1alpha1 schema: openAPIV3Schema: @@ -98,10 +113,8 @@ spec: type: object type: object githubConfigSecret: - description: Required type: string githubConfigUrl: - description: Required type: string githubServerTLS: properties: @@ -8376,7 +8389,7 @@ spec: runnerScaleSetName: type: string template: - description: Required + description: PodTemplateSpec describes the data a pod should have when created from a template properties: metadata: description: |- diff --git a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml index 1f4b63f32f..a2dfd46d9f 100644 --- a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml +++ b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml @@ -21,9 +21,24 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer + - jsonPath: .status.currentRunners + name: Current Runners + type: integer - jsonPath: .status.phase name: Phase type: string + - jsonPath: .status.pendingEphemeralRunners + name: Pending Runners + type: integer + - jsonPath: .status.runningEphemeralRunners + name: Running Runners + type: integer + - jsonPath: .status.finishedEphemeralRunners + name: Finished Runners + type: integer + - jsonPath: .status.deletingEphemeralRunners + name: Deleting Runners + type: integer name: v1alpha1 schema: openAPIV3Schema: @@ -98,10 +113,8 @@ spec: type: object type: object githubConfigSecret: - description: Required type: string githubConfigUrl: - description: Required type: string githubServerTLS: properties: @@ -8376,7 +8389,7 @@ spec: runnerScaleSetName: type: string template: - description: Required + description: PodTemplateSpec describes the data a pod should have when created from a template properties: metadata: description: |- diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index 40be4d25bf..e48f75ff15 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -292,18 +292,6 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl } if ephemeralRunnerSet.Annotations[annotationKeyIntegrityHash] != desired.Annotations[annotationKeyIntegrityHash] { - // When runners are actively processing jobs, defer the spec update: - // delete the listener to stop accepting new jobs, but leave the ERS - // (and its running pods) untouched until all jobs have drained. - if ephemeralRunnerSet.Status.RunningEphemeralRunners+ephemeralRunnerSet.Status.PendingEphemeralRunners > 0 { - log.Info("Ephemeral runner set spec changed but runners are still active; deleting listener to stop new jobs") - if _, err := r.cleanupListener(ctx, &autoscalingRunnerSet, log); err != nil { - log.Error(err, "Failed to clean up listener while waiting for runners to drain") - return ctrl.Result{}, err - } - return ctrl.Result{RequeueAfter: 1 * time.Second}, nil - } - original := ephemeralRunnerSet.DeepCopy() ephemeralRunnerSet.Spec.EphemeralRunnerMetadata = desired.Spec.EphemeralRunnerMetadata ephemeralRunnerSet.Spec.EphemeralRunnerSpec = desired.Spec.EphemeralRunnerSpec @@ -438,9 +426,7 @@ func (r *AutoscalingRunnerSetReconciler) updateStatus(ctx context.Context, autos } original := autoscalingRunnerSet.DeepCopy() - if phaseDiff { - autoscalingRunnerSet.Status.Phase = phase - } + autoscalingRunnerSet.Status.Phase = phase if err := r.Status().Patch(ctx, autoscalingRunnerSet, client.MergeFrom(original)); err != nil { log.Error(err, "Failed to patch autoscaling runner set status") diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 55ebe5c6ae..11a03dc482 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -837,111 +837,6 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { }) }) - Context("When updating an AutoscalingRunnerSet with running or pending jobs", func() { - It("It should wait for running and pending jobs to finish before applying the update.", func() { - // Wait till the listener is created - listener := new(v1alpha1.AutoscalingListener) - Eventually( - func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).Should(Succeed(), "Listener should be created") - - // Wait till the ephemeral runner set is created - Eventually( - func() (int, error) { - runnerSetList := new(v1alpha1.EphemeralRunnerSetList) - err := k8sClient.List(ctx, runnerSetList, client.InNamespace(autoscalingRunnerSet.Namespace)) - if err != nil { - return 0, err - } - - return len(runnerSetList.Items), nil - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).Should(BeEquivalentTo(1), "Only one EphemeralRunnerSet should be created") - - runnerSetList := new(v1alpha1.EphemeralRunnerSetList) - err := k8sClient.List(ctx, runnerSetList, client.InNamespace(autoscalingRunnerSet.Namespace)) - Expect(err).NotTo(HaveOccurred(), "failed to list EphemeralRunnerSet") - - // Emulate running and pending jobs - runnerSet := runnerSetList.Items[0] - activeRunnerSet := runnerSet.DeepCopy() - activeRunnerSet.Status.CurrentReplicas = 6 - activeRunnerSet.Status.FailedEphemeralRunners = 1 - activeRunnerSet.Status.RunningEphemeralRunners = 2 - activeRunnerSet.Status.PendingEphemeralRunners = 3 - - desiredStatus := v1alpha1.AutoscalingRunnerSetStatus{ - CurrentRunners: activeRunnerSet.Status.CurrentReplicas, - Phase: v1alpha1.AutoscalingRunnerSetPhaseRunning, - PendingEphemeralRunners: activeRunnerSet.Status.PendingEphemeralRunners, - RunningEphemeralRunners: activeRunnerSet.Status.RunningEphemeralRunners, - FailedEphemeralRunners: activeRunnerSet.Status.FailedEphemeralRunners, - } - - err = k8sClient.Status().Patch(ctx, activeRunnerSet, client.MergeFrom(&runnerSet)) - Expect(err).NotTo(HaveOccurred(), "Failed to patch runner set status") - - Eventually( - func() (v1alpha1.AutoscalingRunnerSetStatus, error) { - updated := new(v1alpha1.AutoscalingRunnerSet) - err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, updated) - if err != nil { - return v1alpha1.AutoscalingRunnerSetStatus{}, fmt.Errorf("failed to get AutoScalingRunnerSet: %w", err) - } - return updated.Status, nil - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).Should(BeEquivalentTo(desiredStatus), "AutoScalingRunnerSet status should be updated") - - // Patch the AutoScalingRunnerSet image which should trigger - // the recreation of the Listener and EphemeralRunnerSet - patched := autoscalingRunnerSet.DeepCopy() - if patched.Annotations == nil { - patched.Annotations = make(map[string]string) - } - patched.Annotations[annotationKeyIntegrityHash] = "testgroup2" - patched.Spec.Template.Spec = corev1.PodSpec{ - Containers: []corev1.Container{ - { - Name: "runner", - Image: "ghcr.io/actions/abcd:1.1.1", - }, - }, - } - err = k8sClient.Patch(ctx, patched, client.MergeFrom(autoscalingRunnerSet)) - Expect(err).NotTo(HaveOccurred(), "failed to patch AutoScalingRunnerSet") - autoscalingRunnerSet = patched.DeepCopy() - - // The EphemeralRunnerSet should not be recreated - Consistently( - func() (string, error) { - runnerSetList := new(v1alpha1.EphemeralRunnerSetList) - err := k8sClient.List(ctx, runnerSetList, client.InNamespace(autoscalingRunnerSet.Namespace)) - Expect(err).NotTo(HaveOccurred(), "failed to fetch AutoScalingRunnerSet") - return runnerSetList.Items[0].Name, nil - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).Should(Equal(activeRunnerSet.Name), "The EphemeralRunnerSet should not be recreated") - - // The listener should not be recreated - Consistently( - func() error { - return k8sClient.Get(ctx, client.ObjectKey{Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: autoscalingRunnerSet.Namespace}, listener) - }, - autoscalingRunnerSetTestTimeout, - autoscalingRunnerSetTestInterval, - ).ShouldNot(Succeed(), "Listener should not be recreated") - }) - }) - It("Should update Status on EphemeralRunnerSet status Update", func() { ars := new(v1alpha1.AutoscalingRunnerSet) Eventually( @@ -978,17 +873,10 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { runnerSet := runnerSetList.Items[0] statusUpdate := runnerSet.DeepCopy() - statusUpdate.Status.CurrentReplicas = 6 - statusUpdate.Status.FailedEphemeralRunners = 1 - statusUpdate.Status.RunningEphemeralRunners = 2 - statusUpdate.Status.PendingEphemeralRunners = 3 + statusUpdate.Status.Phase = v1alpha1.EphemeralRunnerSetPhaseRunning desiredStatus := v1alpha1.AutoscalingRunnerSetStatus{ - CurrentRunners: statusUpdate.Status.CurrentReplicas, - Phase: v1alpha1.AutoscalingRunnerSetPhaseRunning, - PendingEphemeralRunners: statusUpdate.Status.PendingEphemeralRunners, - RunningEphemeralRunners: statusUpdate.Status.RunningEphemeralRunners, - FailedEphemeralRunners: statusUpdate.Status.FailedEphemeralRunners, + Phase: v1alpha1.AutoscalingRunnerSetPhaseRunning, } err := k8sClient.Status().Patch(ctx, statusUpdate, client.MergeFrom(&runnerSet)) diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller.go b/controllers/actions.github.com/ephemeralrunnerset_controller.go index 54aa85ae90..919a46419f 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller.go @@ -246,7 +246,6 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet, state *ephemeralRunnersByState, log logr.Logger) error { original := ephemeralRunnerSet.DeepCopy() - total := state.scaleTotal() var phase v1alpha1.EphemeralRunnerSetPhase switch { case len(state.outdated) > 0: @@ -257,11 +256,7 @@ func (r *EphemeralRunnerSetReconciler) updateStatus(ctx context.Context, ephemer phase = ephemeralRunnerSet.Status.Phase } desiredStatus := v1alpha1.EphemeralRunnerSetStatus{ - CurrentReplicas: total, - Phase: phase, - PendingEphemeralRunners: len(state.pending), - RunningEphemeralRunners: len(state.running), - FailedEphemeralRunners: len(state.failed), + Phase: phase, } // Update the status if needed. diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go index 3533e0dd4c..c68c569c31 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go @@ -222,20 +222,20 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ephemeralRunnerSetTestInterval, ).Should(BeEquivalentTo(0), "No EphemeralRunner should be created") - // Check if the status stay 0 + // Check if the status is initialized Consistently( - func() (int, error) { + func() (v1alpha1.EphemeralRunnerSetPhase, error) { runnerSet := new(v1alpha1.EphemeralRunnerSet) err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunnerSet.Name, Namespace: ephemeralRunnerSet.Namespace}, runnerSet) if err != nil { - return -1, err + return "", err } - return int(runnerSet.Status.CurrentReplicas), nil + return runnerSet.Status.Phase, nil }, ephemeralRunnerSetTestTimeout, ephemeralRunnerSetTestInterval, - ).Should(BeEquivalentTo(0), "EphemeralRunnerSet status should be 0") + ).Should(BeEquivalentTo(v1alpha1.EphemeralRunnerSetPhaseRunning), "EphemeralRunnerSet status should be running") // Scaling up the EphemeralRunnerSet updated := created.DeepCopy() @@ -1258,11 +1258,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ).Should(BeTrue(), "Failed to eventually update to one pending, one running and one failed") desiredStatus := v1alpha1.EphemeralRunnerSetStatus{ - Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, - CurrentReplicas: 3, - PendingEphemeralRunners: 1, - RunningEphemeralRunners: 1, - FailedEphemeralRunners: 1, + Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, } Eventually( func() (v1alpha1.EphemeralRunnerSetStatus, error) { @@ -1301,11 +1297,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ).Should(BeEquivalentTo(1), "Failed to eventually scale down") desiredStatus = v1alpha1.EphemeralRunnerSetStatus{ - CurrentReplicas: 1, - PendingEphemeralRunners: 0, - RunningEphemeralRunners: 0, - FailedEphemeralRunners: 1, - Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, + Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, } Eventually( @@ -1325,11 +1317,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { Expect(err).To(BeNil(), "Failed to delete failed ephemeral runner") desiredStatus = v1alpha1.EphemeralRunnerSetStatus{ - CurrentReplicas: 0, - PendingEphemeralRunners: 0, - RunningEphemeralRunners: 0, - FailedEphemeralRunners: 0, - Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, + Phase: v1alpha1.EphemeralRunnerSetPhaseRunning, } Eventually( func() (v1alpha1.EphemeralRunnerSetStatus, error) { From 0243eb13e0263a056e74186552f9969df2f212dd Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 13 Jul 2026 14:46:10 +0200 Subject: [PATCH 18/22] revert optional tags --- .../v1alpha1/ephemeralrunnerset_types.go | 10 ++++++++-- .../crds/actions.github.com_ephemeralrunnersets.yaml | 2 -- .../crds/actions.github.com_ephemeralrunnersets.yaml | 2 -- .../bases/actions.github.com_ephemeralrunnersets.yaml | 2 -- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go b/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go index 5e8f12d19f..641ec02f88 100644 --- a/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go @@ -23,10 +23,13 @@ import ( // EphemeralRunnerSetSpec defines the desired state of EphemeralRunnerSet type EphemeralRunnerSetSpec struct { // Replicas is the number of desired EphemeralRunner resources in the k8s namespace. + // +optional Replicas int `json:"replicas,omitempty"` // PatchID is the unique identifier for the patch issued by the listener app + // +optional PatchID int `json:"patchID"` // EphemeralRunnerSpec is the spec of the ephemeral runner + // +optional EphemeralRunnerSpec EphemeralRunnerSpec `json:"ephemeralRunnerSpec,omitempty"` // EphemeralRunnerMetadata is the metadata to be applied to all ephemeral runners created by this set. // If the EphemeralRunnerMetadata is updated, the update applies to new ephemeral runners created after the update, @@ -58,10 +61,13 @@ const ( // EphemeralRunnerSet is the Schema for the ephemeralrunnersets API type EphemeralRunnerSet struct { - metav1.TypeMeta `json:",inline"` + metav1.TypeMeta `json:",inline"` + // +optional metav1.ObjectMeta `json:"metadata,omitempty"` - Spec EphemeralRunnerSetSpec `json:"spec,omitempty"` + // +optional + Spec EphemeralRunnerSetSpec `json:"spec,omitempty"` + // +optional Status EphemeralRunnerSetStatus `json:"status,omitempty"` } diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml index 2d17def801..a6f9758bfa 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_ephemeralrunnersets.yaml @@ -8291,8 +8291,6 @@ spec: replicas: description: Replicas is the number of desired EphemeralRunner resources in the k8s namespace. type: integer - required: - - patchID type: object status: description: EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml index 2d17def801..a6f9758bfa 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml @@ -8291,8 +8291,6 @@ spec: replicas: description: Replicas is the number of desired EphemeralRunner resources in the k8s namespace. type: integer - required: - - patchID type: object status: description: EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet diff --git a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml index 2d17def801..a6f9758bfa 100644 --- a/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml +++ b/config/crd/bases/actions.github.com_ephemeralrunnersets.yaml @@ -8291,8 +8291,6 @@ spec: replicas: description: Replicas is the number of desired EphemeralRunner resources in the k8s namespace. type: integer - required: - - patchID type: object status: description: EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet From 9ad6faacb34534f49fa72ab6de2ff2e4397f8be8 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 6 Jul 2026 14:37:20 +0200 Subject: [PATCH 19/22] Use metrics to display runner statuses instead of status field for EphemeralRunnerSet and AutoscalingRunnerSet --- .../v1alpha1/autoscalingrunnerset_types.go | 5 ----- .../actions.github.com_autoscalingrunnersets.yaml | 15 --------------- .../actions.github.com_autoscalingrunnersets.yaml | 15 --------------- .../actions.github.com_autoscalingrunnersets.yaml | 15 --------------- .../autoscalingrunnerset_controller_test.go | 1 - 5 files changed, 51 deletions(-) diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index dd1bce7fa1..465df33026 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -36,12 +36,7 @@ import ( // +kubebuilder:subresource:status // +kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".status.phase",name=Phase,type=string -// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer -// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer // AutoscalingRunnerSet is the Schema for the autoscalingrunnersets API type AutoscalingRunnerSet struct { diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml index a2dfd46d9f..c05ad9fc1b 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,24 +21,9 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer - - jsonPath: .status.currentRunners - name: Current Runners - type: integer - jsonPath: .status.phase name: Phase type: string - - jsonPath: .status.pendingEphemeralRunners - name: Pending Runners - type: integer - - jsonPath: .status.runningEphemeralRunners - name: Running Runners - type: integer - - jsonPath: .status.finishedEphemeralRunners - name: Finished Runners - type: integer - - jsonPath: .status.deletingEphemeralRunners - name: Deleting Runners - type: integer name: v1alpha1 schema: openAPIV3Schema: diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml index a2dfd46d9f..c05ad9fc1b 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,24 +21,9 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer - - jsonPath: .status.currentRunners - name: Current Runners - type: integer - jsonPath: .status.phase name: Phase type: string - - jsonPath: .status.pendingEphemeralRunners - name: Pending Runners - type: integer - - jsonPath: .status.runningEphemeralRunners - name: Running Runners - type: integer - - jsonPath: .status.finishedEphemeralRunners - name: Finished Runners - type: integer - - jsonPath: .status.deletingEphemeralRunners - name: Deleting Runners - type: integer name: v1alpha1 schema: openAPIV3Schema: diff --git a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml index a2dfd46d9f..c05ad9fc1b 100644 --- a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml +++ b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml @@ -21,24 +21,9 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer - - jsonPath: .status.currentRunners - name: Current Runners - type: integer - jsonPath: .status.phase name: Phase type: string - - jsonPath: .status.pendingEphemeralRunners - name: Pending Runners - type: integer - - jsonPath: .status.runningEphemeralRunners - name: Running Runners - type: integer - - jsonPath: .status.finishedEphemeralRunners - name: Finished Runners - type: integer - - jsonPath: .status.deletingEphemeralRunners - name: Deleting Runners - type: integer name: v1alpha1 schema: openAPIV3Schema: diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 11a03dc482..796dcd6ecf 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -836,7 +836,6 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { ).Should(BeEquivalentTo("testgroup2"), "AutoScalingRunnerSet should have the runner group in its annotation") }) }) - It("Should update Status on EphemeralRunnerSet status Update", func() { ars := new(v1alpha1.AutoscalingRunnerSet) Eventually( From 76027003c7cb011d0f8ed4269d4c6e3ab01f73a5 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Mon, 13 Jul 2026 17:27:51 +0200 Subject: [PATCH 20/22] Include resource cache for desired resources --- .../v1alpha1/autoscalingrunnerset_types.go | 5 + ...ions.github.com_autoscalingrunnersets.yaml | 15 + ...ions.github.com_autoscalingrunnersets.yaml | 15 + ...ions.github.com_autoscalingrunnersets.yaml | 15 + .../autoscalinglistener_controller.go | 1 + .../autoscalinglistener_controller_test.go | 5 + .../autoscalingrunnerset_controller.go | 1 + .../autoscalingrunnerset_controller_test.go | 9 + .../ephemeralrunner_controller.go | 2 +- .../ephemeralrunner_controller_test.go | 6 + .../ephemeralrunnerset_controller.go | 1 + .../ephemeralrunnerset_controller_test.go | 4 + .../actions.github.com/resourcebuilder.go | 111 +++++- .../resourcebuilder_test.go | 1 + .../actions.github.com/resourcecache.go | 263 +++++++++++++ .../actions.github.com/resourcecache_test.go | 351 ++++++++++++++++++ main.go | 2 + 17 files changed, 805 insertions(+), 2 deletions(-) create mode 100644 controllers/actions.github.com/resourcecache.go create mode 100644 controllers/actions.github.com/resourcecache_test.go diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go index 465df33026..dd1bce7fa1 100644 --- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go +++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go @@ -36,7 +36,12 @@ import ( // +kubebuilder:subresource:status // +kubebuilder:printcolumn:JSONPath=".spec.minRunners",name=Minimum Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".spec.maxRunners",name=Maximum Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.currentRunners",name=Current Runners,type=integer // +kubebuilder:printcolumn:JSONPath=".status.phase",name=Phase,type=string +// +kubebuilder:printcolumn:JSONPath=".status.pendingEphemeralRunners",name=Pending Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.runningEphemeralRunners",name=Running Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.finishedEphemeralRunners",name=Finished Runners,type=integer +// +kubebuilder:printcolumn:JSONPath=".status.deletingEphemeralRunners",name=Deleting Runners,type=integer // AutoscalingRunnerSet is the Schema for the autoscalingrunnersets API type AutoscalingRunnerSet struct { diff --git a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml index c05ad9fc1b..a2dfd46d9f 100644 --- a/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller-experimental/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,9 +21,24 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer + - jsonPath: .status.currentRunners + name: Current Runners + type: integer - jsonPath: .status.phase name: Phase type: string + - jsonPath: .status.pendingEphemeralRunners + name: Pending Runners + type: integer + - jsonPath: .status.runningEphemeralRunners + name: Running Runners + type: integer + - jsonPath: .status.finishedEphemeralRunners + name: Finished Runners + type: integer + - jsonPath: .status.deletingEphemeralRunners + name: Deleting Runners + type: integer name: v1alpha1 schema: openAPIV3Schema: diff --git a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml index c05ad9fc1b..a2dfd46d9f 100644 --- a/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml +++ b/charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml @@ -21,9 +21,24 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer + - jsonPath: .status.currentRunners + name: Current Runners + type: integer - jsonPath: .status.phase name: Phase type: string + - jsonPath: .status.pendingEphemeralRunners + name: Pending Runners + type: integer + - jsonPath: .status.runningEphemeralRunners + name: Running Runners + type: integer + - jsonPath: .status.finishedEphemeralRunners + name: Finished Runners + type: integer + - jsonPath: .status.deletingEphemeralRunners + name: Deleting Runners + type: integer name: v1alpha1 schema: openAPIV3Schema: diff --git a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml index c05ad9fc1b..a2dfd46d9f 100644 --- a/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml +++ b/config/crd/bases/actions.github.com_autoscalingrunnersets.yaml @@ -21,9 +21,24 @@ spec: - jsonPath: .spec.maxRunners name: Maximum Runners type: integer + - jsonPath: .status.currentRunners + name: Current Runners + type: integer - jsonPath: .status.phase name: Phase type: string + - jsonPath: .status.pendingEphemeralRunners + name: Pending Runners + type: integer + - jsonPath: .status.runningEphemeralRunners + name: Running Runners + type: integer + - jsonPath: .status.finishedEphemeralRunners + name: Finished Runners + type: integer + - jsonPath: .status.deletingEphemeralRunners + name: Deleting Runners + type: integer name: v1alpha1 schema: openAPIV3Schema: diff --git a/controllers/actions.github.com/autoscalinglistener_controller.go b/controllers/actions.github.com/autoscalinglistener_controller.go index c0aa81114c..af19a6f2fe 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller.go +++ b/controllers/actions.github.com/autoscalinglistener_controller.go @@ -105,6 +105,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. } log.Info("Successfully removed finalizer after cleanup") + r.ResourceCache.Delete(&autoscalingListener) return ctrl.Result{}, nil } diff --git a/controllers/actions.github.com/autoscalinglistener_controller_test.go b/controllers/actions.github.com/autoscalinglistener_controller_test.go index d48d613e6c..83a499c4f9 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller_test.go +++ b/controllers/actions.github.com/autoscalinglistener_controller_test.go @@ -50,6 +50,7 @@ var _ = Describe("Test AutoScalingListener controller", func() { ) rb := ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretResolver, } @@ -593,6 +594,7 @@ var _ = Describe("Test AutoScalingListener customization", func() { secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()) rb := ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretResolver, } @@ -922,6 +924,7 @@ var _ = Describe("Test AutoScalingListener controller with proxy", func() { secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()) rb := ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretResolver, } @@ -1127,6 +1130,7 @@ var _ = Describe("Test AutoScalingListener controller with template modification secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()) rb := ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretResolver, } @@ -1232,6 +1236,7 @@ var _ = Describe("Test GitHub Server TLS configuration", func() { secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()) rb := ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretResolver, } diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index e48f75ff15..9d56ffc711 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -108,6 +108,7 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl } log.Info("Successfully removed finalizer after cleanup") + r.ResourceCache.Delete(&autoscalingRunnerSet) return ctrl.Result{}, nil } diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 796dcd6ecf..82177acb4c 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -73,6 +73,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient( scalefake.WithClient( scalefake.NewClient( @@ -836,6 +837,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { ).Should(BeEquivalentTo("testgroup2"), "AutoScalingRunnerSet should have the runner group in its annotation") }) }) + It("Should update Status on EphemeralRunnerSet status Update", func() { ars := new(v1alpha1.AutoscalingRunnerSet) Eventually( @@ -960,6 +962,7 @@ var _ = Describe("Test AutoScalingController updates", Ordered, func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), multiClient), }, } @@ -1077,6 +1080,7 @@ var _ = Describe("Test AutoscalingController creation failures", Ordered, func() ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()), }, } @@ -1204,6 +1208,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), multiclient.NewScaleset()), }, } @@ -1399,6 +1404,7 @@ var _ = Describe("Test client optional configuration", Ordered, func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient( scalefake.WithClient( scalefake.NewClient( @@ -1646,6 +1652,7 @@ var _ = Describe("Test external permissions cleanup", Ordered, func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()), }, } @@ -1806,6 +1813,7 @@ var _ = Describe("Test external permissions cleanup", Ordered, func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()), }, } @@ -2016,6 +2024,7 @@ var _ = Describe("Test resource version and build version mismatch", func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()), }, } diff --git a/controllers/actions.github.com/ephemeralrunner_controller.go b/controllers/actions.github.com/ephemeralrunner_controller.go index e78ede68ff..256ed311c4 100644 --- a/controllers/actions.github.com/ephemeralrunner_controller.go +++ b/controllers/actions.github.com/ephemeralrunner_controller.go @@ -151,7 +151,7 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ } } - log.Info("Successfully removed finalizer after cleanup") + r.ResourceCache.Delete(&ephemeralRunner) return ctrl.Result{}, nil } diff --git a/controllers/actions.github.com/ephemeralrunner_controller_test.go b/controllers/actions.github.com/ephemeralrunner_controller_test.go index 80c27134a7..ddd666bb24 100644 --- a/controllers/actions.github.com/ephemeralrunner_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunner_controller_test.go @@ -111,6 +111,7 @@ var _ = Describe("EphemeralRunner", func() { Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient( scalefake.WithClient( scalefake.NewClient( @@ -1216,6 +1217,7 @@ var _ = Describe("EphemeralRunner", func() { Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New( mgr.GetClient(), scalefake.NewMultiClient( @@ -1302,6 +1304,7 @@ var _ = Describe("EphemeralRunner", func() { Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient( scalefake.WithClient( scalefake.NewClient( @@ -1326,6 +1329,7 @@ var _ = Describe("EphemeralRunner", func() { It("uses an actions client with proxy transport", func() { // Use an actual client controller.ResourceBuilder = ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New( mgr.GetClient(), multiclient.NewScaleset(), @@ -1485,6 +1489,7 @@ var _ = Describe("EphemeralRunner", func() { Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient()), }, } @@ -1519,6 +1524,7 @@ var _ = Describe("EphemeralRunner", func() { // Use an actual client controller.ResourceBuilder = ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New( mgr.GetClient(), multiclient.NewScaleset(), diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller.go b/controllers/actions.github.com/ephemeralrunnerset_controller.go index 919a46419f..c4f6d8c025 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller.go @@ -117,6 +117,7 @@ func (r *EphemeralRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl.R } log.Info("Successfully removed finalizer after cleanup") + r.ResourceCache.Delete(&ephemeralRunnerSet) return ctrl.Result{}, nil } diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go index c68c569c31..2ee42ac274 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go @@ -144,6 +144,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), fake.NewMultiClient( fake.WithClient( fake.NewClient( @@ -1363,6 +1364,7 @@ var _ = Describe("EphemeralRunner phase metrics", func() { Log: logf.Log, PublishMetrics: true, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(k8sClient, fake.NewMultiClient( fake.WithClient( fake.NewClient( @@ -1494,6 +1496,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func( Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), multiclient.NewScaleset()), }, } @@ -1812,6 +1815,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with custom root CA", func( Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ + ResourceCache: newTestResourceCache(), SecretResolver: secretresolver.New(mgr.GetClient(), multiclient.NewScaleset()), }, } diff --git a/controllers/actions.github.com/resourcebuilder.go b/controllers/actions.github.com/resourcebuilder.go index fd456b56f1..8d6ae26cb6 100644 --- a/controllers/actions.github.com/resourcebuilder.go +++ b/controllers/actions.github.com/resourcebuilder.go @@ -95,7 +95,8 @@ type SecretResolver interface { type ResourceBuilder struct { ExcludeLabelPropagationPrefixes []string SecretResolver - Scheme *runtime.Scheme + Scheme *runtime.Scheme + ResourceCache *ResourceCache } func (b *ResourceBuilder) setSchemeIfUnset(scheme *runtime.Scheme) { @@ -121,6 +122,27 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. return nil, err } + cacheKeyObject := &v1alpha1.AutoscalingListener{ + ObjectMeta: metav1.ObjectMeta{ + Name: scaleSetListenerName(autoscalingRunnerSet), + Namespace: namespace, + }, + } + inputDependency := resourceCacheInputObject("autoscaling-listener-inputs", struct { + Namespace string + Image string + ImagePullSecrets []corev1.LocalObjectReference + }{ + Namespace: namespace, + Image: image, + ImagePullSecrets: imagePullSecrets, + }) + if b.ResourceCache != nil { + if cached, ok := b.ResourceCache.autoscalingListener.Get(autoscalingRunnerSet, cacheKeyObject, ephemeralRunnerSet, inputDependency); ok { + return cached, nil + } + } + effectiveMinRunners := 0 effectiveMaxRunners := math.MaxInt32 if autoscalingRunnerSet.Spec.MaxRunners != nil { @@ -182,10 +204,22 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. }, Spec: spec, } + if b.ResourceCache != nil { + b.ResourceCache.autoscalingListener.Upsert(autoscalingRunnerSet, autoscalingListener, ephemeralRunnerSet, inputDependency) + } return autoscalingListener, nil } +func resourceCacheInputObject(name string, value any) client.Object { + return &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + ResourceVersion: hash.ComputeTemplateHash(value), + }, + } +} + type listenerMetricsServerConfig struct { addr string endpoint string @@ -307,6 +341,18 @@ func (b *ResourceBuilder) newScaleSetListenerPod( roleBinding *rbacv1.RoleBinding, metricsConfig *listenerMetricsServerConfig, ) (*corev1.Pod, error) { + cacheKeyObject := &corev1.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: autoscalingListener.Name, + Namespace: autoscalingListener.Namespace, + }, + } + if b.ResourceCache != nil { + if cached, ok := b.ResourceCache.listenerPod.Get(autoscalingListener, cacheKeyObject, podConfig, serviceAccount, role, roleBinding); ok { + return cached, nil + } + } + envs := []corev1.EnvVar{ { Name: "LISTENER_CONFIG_PATH", @@ -443,6 +489,9 @@ func (b *ResourceBuilder) newScaleSetListenerPod( if autoscalingListener.Spec.Template != nil { mergeListenerPodWithTemplate(newRunnerScaleSetListenerPod, autoscalingListener.Spec.Template) } + if b.ResourceCache != nil { + b.ResourceCache.listenerPod.Upsert(autoscalingListener, newRunnerScaleSetListenerPod, podConfig, serviceAccount, role, roleBinding) + } return newRunnerScaleSetListenerPod, nil } @@ -597,6 +646,18 @@ func mergeListenerContainer(base, from *corev1.Container) { } func (b *ResourceBuilder) newScaleSetListenerServiceAccount(autoscalingListener *v1alpha1.AutoscalingListener) (*corev1.ServiceAccount, error) { + cacheKeyObject := &corev1.ServiceAccount{ + ObjectMeta: metav1.ObjectMeta{ + Name: autoscalingListener.Name, + Namespace: autoscalingListener.Namespace, + }, + } + if b.ResourceCache != nil { + if cached, ok := b.ResourceCache.listenerServiceAccount.Get(autoscalingListener, cacheKeyObject); ok { + return cached, nil + } + } + base := &corev1.ServiceAccount{ ObjectMeta: metav1.ObjectMeta{ Name: autoscalingListener.Name, @@ -619,6 +680,9 @@ func (b *ResourceBuilder) newScaleSetListenerServiceAccount(autoscalingListener if err := b.setControllerReference(autoscalingListener, base); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener service account: %w", err) } + if b.ResourceCache != nil { + b.ResourceCache.listenerServiceAccount.Upsert(autoscalingListener, base) + } return base, nil } @@ -640,6 +704,18 @@ func scaleSetListenerServiceAccountIntegrityHash(sa *corev1.ServiceAccount) stri } func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1.AutoscalingListener) *rbacv1.Role { + cacheKeyObject := &rbacv1.Role{ + ObjectMeta: metav1.ObjectMeta{ + Name: autoscalingListener.Name, + Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, + }, + } + if b.ResourceCache != nil { + if cached, ok := b.ResourceCache.listenerRole.Get(autoscalingListener, cacheKeyObject); ok { + return cached + } + } + labels := b.filterAndMergeLabels(autoscalingListener.Labels, map[string]string{ LabelKeyGitHubScaleSetNamespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, LabelKeyGitHubScaleSetName: autoscalingListener.Spec.AutoscalingRunnerSetName, @@ -664,6 +740,9 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. } newRole.Annotations[annotationKeyIntegrityHash] = scaleSetRoleIntegrityHash(newRole) + if b.ResourceCache != nil { + b.ResourceCache.listenerRole.Upsert(autoscalingListener, newRole) + } return newRole } @@ -681,6 +760,18 @@ func scaleSetRoleIntegrityHash(role *rbacv1.Role) string { } func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1alpha1.AutoscalingListener, listenerRole *rbacv1.Role, serviceAccount *corev1.ServiceAccount) *rbacv1.RoleBinding { + cacheKeyObject := &rbacv1.RoleBinding{ + ObjectMeta: metav1.ObjectMeta{ + Name: autoscalingListener.Name, + Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, + }, + } + if b.ResourceCache != nil { + if cached, ok := b.ResourceCache.listenerRoleBinding.Get(autoscalingListener, cacheKeyObject, listenerRole, serviceAccount); ok { + return cached + } + } + roleRef := rbacv1.RoleRef{ Kind: "Role", Name: listenerRole.Name, @@ -719,6 +810,9 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1 } newRoleBinding.Annotations[annotationKeyIntegrityHash] = scaleSetListenerRoleBindingIntegrityHash(newRoleBinding) + if b.ResourceCache != nil { + b.ResourceCache.listenerRoleBinding.Upsert(autoscalingListener, newRoleBinding, listenerRole, serviceAccount) + } return newRoleBinding } @@ -743,6 +837,18 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A return nil, err } + cacheKeyObject := &v1alpha1.EphemeralRunnerSet{ + ObjectMeta: metav1.ObjectMeta{ + Name: autoscalingRunnerSet.Name, + Namespace: autoscalingRunnerSet.Namespace, + }, + } + if b.ResourceCache != nil { + if cached, ok := b.ResourceCache.ephemeralRunnerSet.Get(autoscalingRunnerSet, cacheKeyObject); ok { + return cached, nil + } + } + spec := v1alpha1.EphemeralRunnerSetSpec{ Replicas: 0, EphemeralRunnerSpec: v1alpha1.EphemeralRunnerSpec{ @@ -796,6 +902,9 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A if err := b.setControllerReference(autoscalingRunnerSet, newEphemeralRunnerSet); err != nil { return nil, fmt.Errorf("failed to set controller reference for ephemeral runner set: %w", err) } + if b.ResourceCache != nil { + b.ResourceCache.ephemeralRunnerSet.Upsert(autoscalingRunnerSet, newEphemeralRunnerSet) + } return newEphemeralRunnerSet, nil } diff --git a/controllers/actions.github.com/resourcebuilder_test.go b/controllers/actions.github.com/resourcebuilder_test.go index d08851173a..4324401e11 100644 --- a/controllers/actions.github.com/resourcebuilder_test.go +++ b/controllers/actions.github.com/resourcebuilder_test.go @@ -171,6 +171,7 @@ func TestMetadataPropagation(t *testing.T) { ephemeralRunner, err := b.newEphemeralRunner(ephemeralRunnerSet) require.NoError(t, err) + assert.ElementsMatch(t, []string{ephemeralRunnerFinalizerName, ephemeralRunnerActionsFinalizerName}, ephemeralRunner.Finalizers) for _, key := range commonLabelKeys { if key == LabelKeyKubernetesComponent { diff --git a/controllers/actions.github.com/resourcecache.go b/controllers/actions.github.com/resourcecache.go new file mode 100644 index 0000000000..1f631be01b --- /dev/null +++ b/controllers/actions.github.com/resourcecache.go @@ -0,0 +1,263 @@ +package actionsgithubcom + +import ( + "reflect" + "slices" + "strings" + "sync" + + "github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1" + "github.com/actions/actions-runner-controller/hash" + corev1 "k8s.io/api/core/v1" + rbacv1 "k8s.io/api/rbac/v1" + "k8s.io/apimachinery/pkg/types" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +var resourceCacheObjectTypes sync.Map + +type ResourceCacheObjectRef struct { + ObjectType string + Namespace string + Name string + UID types.UID + ResourceVersion string +} + +type ResourceCacheKey struct { + MainUID types.UID + Namespace string + Name string +} + +type ResourceCacheValue[T client.Object] struct { + MainObject ResourceCacheObjectRef + ResourceVersion string + Dependencies []ResourceCacheObjectRef + Object T +} + +type ResourceCache struct { + autoscalingListener *resourceCacheState[*v1alpha1.AutoscalingListener] + ephemeralRunnerSet *resourceCacheState[*v1alpha1.EphemeralRunnerSet] + listenerPod *resourceCacheState[*corev1.Pod] + listenerServiceAccount *resourceCacheState[*corev1.ServiceAccount] + listenerRole *resourceCacheState[*rbacv1.Role] + listenerRoleBinding *resourceCacheState[*rbacv1.RoleBinding] +} + +func NewResourceCache() ResourceCache { + return ResourceCache{ + autoscalingListener: newResourceCacheState[*v1alpha1.AutoscalingListener](), + ephemeralRunnerSet: newResourceCacheState[*v1alpha1.EphemeralRunnerSet](), + listenerPod: newResourceCacheState[*corev1.Pod](), + listenerServiceAccount: newResourceCacheState[*corev1.ServiceAccount](), + listenerRole: newResourceCacheState[*rbacv1.Role](), + listenerRoleBinding: newResourceCacheState[*rbacv1.RoleBinding](), + } +} + +type resourceCacheState[T client.Object] struct { + mu sync.RWMutex + entries map[ResourceCacheKey]ResourceCacheValue[T] +} + +func newResourceCacheState[T client.Object]() *resourceCacheState[T] { + return &resourceCacheState[T]{ + entries: make(map[ResourceCacheKey]ResourceCacheValue[T], 512), + } +} + +func (s *resourceCacheState[T]) Get( + mainObject client.Object, + desiredObject T, + dependencies ...client.Object, +) (T, bool) { + key := newResourceCacheKey(mainObject, desiredObject) + + s.mu.RLock() + value, ok := s.entries[key] + s.mu.RUnlock() + if !ok || !value.Matches(mainObject, dependencies...) { + var zero T + return zero, false + } + + return cloneResourceCacheObject(value.Object), true +} + +func (s *resourceCacheState[T]) Upsert( + mainObject client.Object, + desiredObject T, + dependencies ...client.Object, +) (ResourceCacheValue[T], bool) { + key := newResourceCacheKey(mainObject, desiredObject) + mainObjectRef := newResourceCacheObjectRef(mainObject) + resourceVersion := desiredObject.GetResourceVersion() + + s.mu.RLock() + previous, ok := s.entries[key] + if ok && previous.MainObject == mainObjectRef && previous.ResourceVersion == resourceVersion && previous.dependenciesMatch(dependencies...) { + s.mu.RUnlock() + return previous, false + } + s.mu.RUnlock() + + s.mu.Lock() + defer s.mu.Unlock() + + previous, ok = s.entries[key] + if ok && previous.MainObject == mainObjectRef && previous.ResourceVersion == resourceVersion && previous.dependenciesMatch(dependencies...) { + return previous, false + } + + dependencyRefs := newResourceCacheObjectRefs(dependencies...) + value := newResourceCacheValue(mainObjectRef, resourceVersion, dependencyRefs, cloneResourceCacheObject(desiredObject)) + s.entries[key] = value + return value, true +} + +func (c *ResourceCache) Delete(mainObject client.Object) { + if mainObject == nil { + return + } + + c.autoscalingListener.Delete(mainObject) + c.ephemeralRunnerSet.Delete(mainObject) + c.listenerPod.Delete(mainObject) + c.listenerServiceAccount.Delete(mainObject) + c.listenerRole.Delete(mainObject) + c.listenerRoleBinding.Delete(mainObject) +} + +func (s *resourceCacheState[T]) Delete(mainObject client.Object) { + if mainObject == nil { + return + } + + uid := mainObject.GetUID() + if uid == "" { + return + } + + s.mu.Lock() + defer s.mu.Unlock() + + for key := range s.entries { + if key.MainUID == uid { + delete(s.entries, key) + } + } +} + +func (v ResourceCacheValue[T]) Matches(mainObject client.Object, dependencies ...client.Object) bool { + if v.MainObject != newResourceCacheObjectRef(mainObject) { + return false + } + + return v.dependenciesMatch(dependencies...) +} + +func newResourceCacheKey(mainObject client.Object, desiredObject client.Object) ResourceCacheKey { + return ResourceCacheKey{ + MainUID: mainObject.GetUID(), + Namespace: desiredObject.GetNamespace(), + Name: resourceCacheObjectName(desiredObject), + } +} + +func newResourceCacheValue[T client.Object]( + mainObjectRef ResourceCacheObjectRef, + resourceVersion string, + dependencyRefs []ResourceCacheObjectRef, + object T, +) ResourceCacheValue[T] { + return ResourceCacheValue[T]{ + MainObject: mainObjectRef, + ResourceVersion: resourceVersion, + Dependencies: dependencyRefs, + Object: object, + } +} + +func cloneResourceCacheObject[T client.Object](object T) T { + return object.DeepCopyObject().(T) +} + +func newResourceCacheObjectRefs(objects ...client.Object) []ResourceCacheObjectRef { + refs := make([]ResourceCacheObjectRef, 0, len(objects)) + for _, object := range objects { + refs = append(refs, newResourceCacheObjectRef(object)) + } + slices.SortFunc(refs, func(a, b ResourceCacheObjectRef) int { + return compareResourceCacheObjectRefs(a, b) + }) + return refs +} + +func (v ResourceCacheValue[T]) dependenciesMatch(objects ...client.Object) bool { + if len(v.Dependencies) != len(objects) { + return false + } + + for _, object := range objects { + ref := newResourceCacheObjectRef(object) + if !slices.Contains(v.Dependencies, ref) { + return false + } + } + + return true +} + +func newResourceCacheObjectRef(object client.Object) ResourceCacheObjectRef { + resourceVersion := object.GetResourceVersion() + if resourceVersion == "" { + resourceVersion = hash.ComputeTemplateHash(object) + } + + return ResourceCacheObjectRef{ + ObjectType: resourceCacheObjectType(object), + Namespace: object.GetNamespace(), + Name: resourceCacheObjectName(object), + UID: object.GetUID(), + ResourceVersion: resourceVersion, + } +} + +func compareResourceCacheObjectRefs(a, b ResourceCacheObjectRef) int { + if c := strings.Compare(a.ObjectType, b.ObjectType); c != 0 { + return c + } + if c := strings.Compare(a.Namespace, b.Namespace); c != 0 { + return c + } + if c := strings.Compare(a.Name, b.Name); c != 0 { + return c + } + if c := strings.Compare(string(a.UID), string(b.UID)); c != 0 { + return c + } + return strings.Compare(a.ResourceVersion, b.ResourceVersion) +} + +func resourceCacheObjectType(object client.Object) string { + t := reflect.TypeOf(object) + if t.Kind() == reflect.Pointer { + t = t.Elem() + } + if objectType, ok := resourceCacheObjectTypes.Load(t); ok { + return objectType.(string) + } + + objectType := t.PkgPath() + "." + t.Name() + actual, _ := resourceCacheObjectTypes.LoadOrStore(t, objectType) + return actual.(string) +} + +func resourceCacheObjectName(object client.Object) string { + if object.GetName() != "" { + return object.GetName() + } + return object.GetGenerateName() +} diff --git a/controllers/actions.github.com/resourcecache_test.go b/controllers/actions.github.com/resourcecache_test.go new file mode 100644 index 0000000000..0fe7aeb587 --- /dev/null +++ b/controllers/actions.github.com/resourcecache_test.go @@ -0,0 +1,351 @@ +package actionsgithubcom + +import ( + "fmt" + "testing" + + "github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + corev1 "k8s.io/api/core/v1" + rbacv1 "k8s.io/api/rbac/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +var benchmarkEphemeralRunnerSetSink *v1alpha1.EphemeralRunnerSet + +func newTestResourceCache() *ResourceCache { + cache := NewResourceCache() + return &cache +} + +func TestResourceCacheUpsertReplacesByDependencyResourceVersion(t *testing.T) { + mainObject := &v1alpha1.AutoscalingListener{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "controller-ns", + UID: "listener-uid", + ResourceVersion: "10", + }, + } + desiredPod := &corev1.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "controller-ns", + ResourceVersion: "1", + Labels: map[string]string{ + "app": "listener", + }, + }, + } + configSecret := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener-config", + Namespace: "controller-ns", + UID: "config-secret-uid", + ResourceVersion: "1", + }, + } + serviceAccount := &corev1.ServiceAccount{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "controller-ns", + UID: "service-account-uid", + ResourceVersion: "1", + }, + } + role := &rbacv1.Role{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "scale-set-ns", + UID: "role-uid", + ResourceVersion: "1", + }, + } + + cache := NewResourceCache() + value, replaced := cache.listenerPod.Upsert(mainObject, desiredPod, configSecret, serviceAccount, role) + assert.True(t, replaced) + _, ok := cache.listenerPod.Get(mainObject, desiredPod, configSecret, serviceAccount, role) + assert.True(t, ok) + assert.Equal(t, "1", value.ResourceVersion) + + _, replaced = cache.listenerPod.Upsert(mainObject, desiredPod, role, configSecret, serviceAccount) + assert.False(t, replaced, "dependency ordering should not affect the cache value") + _, ok = cache.listenerPod.Get(mainObject, desiredPod, configSecret, serviceAccount, role) + assert.True(t, ok) + + configSecret.ResourceVersion = "2" + value, replaced = cache.listenerPod.Upsert(mainObject, desiredPod, configSecret, serviceAccount, role) + assert.True(t, replaced) + assert.Contains(t, value.Dependencies, ResourceCacheObjectRef{ + ObjectType: resourceCacheObjectType(configSecret), + Namespace: "controller-ns", + Name: "listener-config", + UID: "config-secret-uid", + ResourceVersion: "2", + }) + + desiredPod.Labels["mutated"] = "after-cache" + cachedPod := value.Object + assert.NotContains(t, cachedPod.Labels, "mutated") +} + +func TestResourceCacheDeleteRemovesMainObjectEntries(t *testing.T) { + mainObject := &v1alpha1.AutoscalingListener{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "controller-ns", + UID: "listener-uid", + }, + } + otherMainObject := &v1alpha1.AutoscalingListener{ + ObjectMeta: metav1.ObjectMeta{ + Name: "other-listener", + Namespace: "controller-ns", + UID: "other-listener-uid", + }, + } + listenerPod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "listener", Namespace: "controller-ns"}} + listenerServiceAccount := &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: "listener", Namespace: "controller-ns"}} + otherListenerPod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "other-listener", Namespace: "controller-ns"}} + + cache := NewResourceCache() + cache.listenerPod.Upsert(mainObject, listenerPod) + cache.listenerServiceAccount.Upsert(mainObject, listenerServiceAccount) + cache.listenerPod.Upsert(otherMainObject, otherListenerPod) + + cache.Delete(mainObject) + + _, ok := cache.listenerPod.Get(mainObject, listenerPod) + assert.False(t, ok) + _, ok = cache.listenerServiceAccount.Get(mainObject, listenerServiceAccount) + assert.False(t, ok) + _, ok = cache.listenerPod.Get(otherMainObject, otherListenerPod) + assert.True(t, ok) +} + +func TestResourceBuilderCachesListenerPodDependencies(t *testing.T) { + listener := &v1alpha1.AutoscalingListener{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "controller-ns", + UID: "listener-uid", + Annotations: map[string]string{ + annotationKeyIntegrityHash: "listener-hash", + }, + }, + Spec: v1alpha1.AutoscalingListenerSpec{ + Image: "listener:latest", + AutoscalingRunnerSetName: "scale-set", + AutoscalingRunnerSetNamespace: "scale-set-ns", + EphemeralRunnerSetName: "scale-set", + }, + } + podConfig := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener-config", + Namespace: "controller-ns", + UID: "config-secret-uid", + ResourceVersion: "11", + Annotations: map[string]string{ + annotationKeyIntegrityHash: "config-hash", + }, + }, + } + serviceAccount := &corev1.ServiceAccount{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "controller-ns", + UID: "service-account-uid", + ResourceVersion: "12", + Annotations: map[string]string{ + annotationKeyIntegrityHash: "service-account-hash", + }, + }, + } + role := &rbacv1.Role{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "scale-set-ns", + UID: "role-uid", + ResourceVersion: "13", + Annotations: map[string]string{ + annotationKeyIntegrityHash: "role-hash", + }, + }, + } + roleBinding := &rbacv1.RoleBinding{ + ObjectMeta: metav1.ObjectMeta{ + Name: "listener", + Namespace: "scale-set-ns", + UID: "role-binding-uid", + ResourceVersion: "14", + Annotations: map[string]string{ + annotationKeyIntegrityHash: "role-binding-hash", + }, + }, + } + + cache := NewResourceCache() + b := ResourceBuilder{ResourceCache: &cache} + listenerPod, err := b.newScaleSetListenerPod(listener, podConfig, serviceAccount, role, roleBinding, nil) + require.NoError(t, err) + + cachedPod, ok := b.ResourceCache.listenerPod.Get(listener, listenerPod, podConfig, serviceAccount, role, roleBinding) + require.True(t, ok) + assert.IsType(t, &corev1.Pod{}, cachedPod) + + role.ResourceVersion = "changed" + _, ok = b.ResourceCache.listenerPod.Get(listener, listenerPod, podConfig, serviceAccount, role, roleBinding) + assert.False(t, ok) +} + +func TestResourceBuilderCachesEphemeralRunnerSet(t *testing.T) { + autoscalingRunnerSet := v1alpha1.AutoscalingRunnerSet{ + ObjectMeta: metav1.ObjectMeta{ + Name: "scale-set", + Namespace: "default", + UID: "scale-set-uid", + Annotations: map[string]string{ + runnerScaleSetIDAnnotationKey: "1", + }, + }, + Spec: v1alpha1.AutoscalingRunnerSetSpec{ + GitHubConfigUrl: "https://github.com/actions/actions-runner-controller", + }, + } + + cache := NewResourceCache() + b := ResourceBuilder{ResourceCache: &cache} + runnerSet, err := b.newEphemeralRunnerSet(&autoscalingRunnerSet) + require.NoError(t, err) + + cachedRunnerSet, ok := b.ResourceCache.ephemeralRunnerSet.Get(&autoscalingRunnerSet, runnerSet) + require.True(t, ok) + assert.Equal(t, runnerSet.Spec, cachedRunnerSet.Spec) + + runnerSet.Labels["mutated"] = "after-cache" + assert.NotContains(t, cachedRunnerSet.Labels, "mutated") + + fromBuilder, err := b.newEphemeralRunnerSet(&autoscalingRunnerSet) + require.NoError(t, err) + assert.NotContains(t, fromBuilder.Labels, "mutated") + + autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey] = "2" + _, ok = b.ResourceCache.ephemeralRunnerSet.Get(&autoscalingRunnerSet, runnerSet) + assert.False(t, ok) +} + +func BenchmarkNewEphemeralRunnerSetResourceCache(b *testing.B) { + autoscalingRunnerSet := newBenchmarkAutoscalingRunnerSet() + + b.Run("no_cache", func(b *testing.B) { + builder := ResourceBuilder{} + b.ReportAllocs() + b.ResetTimer() + + for i := 0; i < b.N; i++ { + runnerSet, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet) + if err != nil { + b.Fatal(err) + } + benchmarkEphemeralRunnerSetSink = runnerSet + } + }) + + b.Run("cache_hit", func(b *testing.B) { + cache := NewResourceCache() + builder := ResourceBuilder{ResourceCache: &cache} + if _, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet); err != nil { + b.Fatal(err) + } + + b.ReportAllocs() + b.ResetTimer() + + for i := 0; i < b.N; i++ { + runnerSet, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet) + if err != nil { + b.Fatal(err) + } + benchmarkEphemeralRunnerSetSink = runnerSet + } + }) + + b.Run("cache_miss", func(b *testing.B) { + cache := NewResourceCache() + builder := ResourceBuilder{ResourceCache: &cache} + autoscalingRunnerSet := autoscalingRunnerSet.DeepCopy() + + b.ReportAllocs() + b.ResetTimer() + + for i := 0; i < b.N; i++ { + autoscalingRunnerSet.ResourceVersion = fmt.Sprint(i) + runnerSet, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet) + if err != nil { + b.Fatal(err) + } + benchmarkEphemeralRunnerSetSink = runnerSet + } + }) +} + +func newBenchmarkAutoscalingRunnerSet() *v1alpha1.AutoscalingRunnerSet { + return &v1alpha1.AutoscalingRunnerSet{ + ObjectMeta: metav1.ObjectMeta{ + Name: "benchmark-scale-set", + Namespace: "benchmark-namespace", + UID: "benchmark-scale-set-uid", + ResourceVersion: "1", + Labels: map[string]string{ + LabelKeyKubernetesVersion: "0.12.0", + "example.com/label-1": "value-1", + "example.com/label-2": "value-2", + }, + Annotations: map[string]string{ + runnerScaleSetIDAnnotationKey: "123", + AnnotationKeyGitHubRunnerGroupName: "benchmark-runner-group", + AnnotationKeyGitHubRunnerScaleSetName: "benchmark-scale-set", + }, + }, + Spec: v1alpha1.AutoscalingRunnerSetSpec{ + GitHubConfigUrl: "https://github.com/actions/actions-runner-controller", + EphemeralRunnerSetMetadata: &v1alpha1.ResourceMeta{ + Labels: map[string]string{ + "example.com/runner-set-label": "runner-set-value", + }, + Annotations: map[string]string{ + "example.com/runner-set-annotation": "runner-set-value", + }, + }, + EphemeralRunnerMetadata: &v1alpha1.ResourceMeta{ + Labels: map[string]string{ + "example.com/runner-label": "runner-value", + }, + Annotations: map[string]string{ + "example.com/runner-annotation": "runner-value", + }, + }, + Template: corev1.PodTemplateSpec{ + ObjectMeta: metav1.ObjectMeta{ + Labels: map[string]string{ + "example.com/template-label": "template-value", + }, + }, + Spec: corev1.PodSpec{ + Containers: []corev1.Container{ + { + Name: v1alpha1.EphemeralRunnerContainerName, + Image: "ghcr.io/actions/actions-runner:latest", + Env: []corev1.EnvVar{ + {Name: "ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER", Value: "false"}, + }, + }, + }, + }, + }, + }, + } +} diff --git a/main.go b/main.go index 72c65f6bbb..c22fe7706c 100644 --- a/main.go +++ b/main.go @@ -299,10 +299,12 @@ func main() { secretresolver.WithLogger(slogLogger), ) + resourceCache := actionsgithubcom.NewResourceCache() rb := actionsgithubcom.ResourceBuilder{ ExcludeLabelPropagationPrefixes: excludeLabelPropagationPrefixes, SecretResolver: secretResolver, Scheme: mgr.GetScheme(), + ResourceCache: &resourceCache, } log.Info("Resource builder initializing") From a47cae6f494102a9387310252dcaeb93f8909dcc Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Wed, 15 Jul 2026 13:44:04 +0200 Subject: [PATCH 21/22] wip --- controllers/actions.github.com/resourcecache_test.go | 7 +++++++ main.go | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/controllers/actions.github.com/resourcecache_test.go b/controllers/actions.github.com/resourcecache_test.go index 0fe7aeb587..8bf576d539 100644 --- a/controllers/actions.github.com/resourcecache_test.go +++ b/controllers/actions.github.com/resourcecache_test.go @@ -125,6 +125,13 @@ func TestResourceCacheDeleteRemovesMainObjectEntries(t *testing.T) { assert.True(t, ok) } +func TestResourceCacheDeletePanicsWithNilCache(t *testing.T) { + var cache *ResourceCache + assert.Panics(t, func() { + cache.Delete(&v1alpha1.AutoscalingListener{}) + }) +} + func TestResourceBuilderCachesListenerPodDependencies(t *testing.T) { listener := &v1alpha1.AutoscalingListener{ ObjectMeta: metav1.ObjectMeta{ diff --git a/main.go b/main.go index c22fe7706c..5ec4a56645 100644 --- a/main.go +++ b/main.go @@ -218,6 +218,7 @@ func main() { } actionsgithubcom.SetListenerEntrypoint(os.Getenv("LISTENER_ENTRYPOINT")) + resourceCache := actionsgithubcom.NewResourceCache() var webhookServer webhook.Server if port != 0 { @@ -299,7 +300,6 @@ func main() { secretresolver.WithLogger(slogLogger), ) - resourceCache := actionsgithubcom.NewResourceCache() rb := actionsgithubcom.ResourceBuilder{ ExcludeLabelPropagationPrefixes: excludeLabelPropagationPrefixes, SecretResolver: secretResolver, From 4670f010ed011afd69550125721acba73e870bb1 Mon Sep 17 00:00:00 2001 From: Nikola Jokic Date: Wed, 15 Jul 2026 15:04:18 +0200 Subject: [PATCH 22/22] remove if checks, testing should catch nil references --- .../autoscalinglistener_controller.go | 4 + .../autoscalinglistener_controller_test.go | 42 +++- .../autoscalingrunnerset_controller.go | 2 + .../autoscalingrunnerset_controller_test.go | 36 +++- .../ephemeralrunner_controller_test.go | 20 +- .../ephemeralrunnerset_controller_test.go | 14 +- .../actions.github.com/resourcebuilder.go | 91 +++++---- .../resourcebuilder_test.go | 14 +- .../actions.github.com/resourcecache.go | 171 ++++++++++------ .../actions.github.com/resourcecache_test.go | 192 ++++++------------ 10 files changed, 338 insertions(+), 248 deletions(-) diff --git a/controllers/actions.github.com/autoscalinglistener_controller.go b/controllers/actions.github.com/autoscalinglistener_controller.go index af19a6f2fe..38e8d64fdb 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller.go +++ b/controllers/actions.github.com/autoscalinglistener_controller.go @@ -501,6 +501,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl. return ctrl.Result{}, nil } + r.ResourceCache.listenerPod.Delete(&autoscalingListener) desiredPod, err := r.newScaleSetListenerPod( &autoscalingListener, &listenerConfigSecret, @@ -686,6 +687,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au } func (r *AutoscalingListenerReconciler) createServiceAccountForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (ctrl.Result, error) { + r.ResourceCache.listenerServiceAccount.Delete(autoscalingListener) newServiceAccount, err := r.newScaleSetListenerServiceAccount(autoscalingListener) if err != nil { return ctrl.Result{}, err @@ -769,6 +771,7 @@ func (r *AutoscalingListenerReconciler) createProxySecret(ctx context.Context, a } func (r *AutoscalingListenerReconciler) createRoleForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (ctrl.Result, error) { + r.ResourceCache.listenerRole.Delete(autoscalingListener) newRole := r.newScaleSetListenerRole(autoscalingListener) logger.Info("Creating listener role", "namespace", newRole.Namespace, "name", newRole.Name, "rules", newRole.Rules) @@ -782,6 +785,7 @@ func (r *AutoscalingListenerReconciler) createRoleForListener(ctx context.Contex } func (r *AutoscalingListenerReconciler) createRoleBindingForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, listenerRole *rbacv1.Role, serviceAccount *corev1.ServiceAccount, logger logr.Logger) (ctrl.Result, error) { + r.ResourceCache.listenerRoleBinding.Delete(autoscalingListener) newRoleBinding := r.newScaleSetListenerRoleBinding(autoscalingListener, listenerRole, serviceAccount) logger.Info("Creating listener role binding", diff --git a/controllers/actions.github.com/autoscalinglistener_controller_test.go b/controllers/actions.github.com/autoscalinglistener_controller_test.go index 83a499c4f9..67f7ecf5e7 100644 --- a/controllers/actions.github.com/autoscalinglistener_controller_test.go +++ b/controllers/actions.github.com/autoscalinglistener_controller_test.go @@ -38,6 +38,7 @@ var _ = Describe("Test AutoScalingListener controller", func() { var autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet var configSecret *corev1.Secret var autoscalingListener *v1alpha1.AutoscalingListener + var resourceCache *ResourceCache BeforeEach(func() { ctx = context.Background() @@ -49,8 +50,9 @@ var _ = Describe("Test AutoScalingListener controller", func() { scalefake.NewMultiClient(), ) + resourceCache = newTestResourceCache() rb := ResourceBuilder{ - ResourceCache: newTestResourceCache(), + ResourceCache: resourceCache, SecretResolver: secretResolver, } @@ -231,6 +233,17 @@ var _ = Describe("Test AutoScalingListener controller", func() { autoscalingListenerTestTimeout, autoscalingListenerTestInterval, ).Should(BeEquivalentTo(autoscalingListener.Name), "Pod should be created") + + Eventually( + func() bool { + return resourceCacheStateHasMainObjectEntries(resourceCache.listenerServiceAccount, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.listenerRole, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.listenerRoleBinding, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.listenerPod, created) + }, + autoscalingListenerTestTimeout, + autoscalingListenerTestInterval, + ).Should(BeTrue(), "AutoScalingListener service account, role, role binding, and pod resources should be cached after reconciliation") }) }) @@ -251,8 +264,22 @@ var _ = Describe("Test AutoScalingListener controller", func() { autoscalingListenerTestInterval, ).Should(BeEquivalentTo(autoscalingListener.Name), "Pod should be created") + created := new(v1alpha1.AutoscalingListener) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, created) + Expect(err).NotTo(HaveOccurred(), "failed to get AutoScalingListener") + Eventually( + func() bool { + return resourceCacheStateHasMainObjectEntries(resourceCache.listenerServiceAccount, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.listenerRole, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.listenerRoleBinding, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.listenerPod, created) + }, + autoscalingListenerTestTimeout, + autoscalingListenerTestInterval, + ).Should(BeTrue(), "AutoScalingListener service account, role, role binding, and pod resources should be cached before deletion") + // Delete the AutoScalingListener - err := k8sClient.Delete(ctx, autoscalingListener) + err = k8sClient.Delete(ctx, autoscalingListener) Expect(err).NotTo(HaveOccurred(), "failed to delete test AutoScalingListener") // Cleanup the listener pod @@ -343,6 +370,17 @@ var _ = Describe("Test AutoScalingListener controller", func() { autoscalingListenerTestTimeout, autoscalingListenerTestInterval, ).ShouldNot(Succeed(), "failed to delete AutoScalingListener") + + Eventually( + func() bool { + return resourceCacheStateHasMainObjectEntries(resourceCache.listenerServiceAccount, created) || + resourceCacheStateHasMainObjectEntries(resourceCache.listenerRole, created) || + resourceCacheStateHasMainObjectEntries(resourceCache.listenerRoleBinding, created) || + resourceCacheStateHasMainObjectEntries(resourceCache.listenerPod, created) + }, + autoscalingListenerTestTimeout, + autoscalingListenerTestInterval, + ).Should(BeFalse(), "AutoScalingListener service account, role, role binding, and pod resources should be removed from cache after deletion") }) }) diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller.go b/controllers/actions.github.com/autoscalingrunnerset_controller.go index 9d56ffc711..08c9ebc960 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller.go @@ -749,6 +749,7 @@ func (r *AutoscalingRunnerSetReconciler) deleteRunnerScaleSet(ctx context.Contex } func (r *AutoscalingRunnerSetReconciler) createEphemeralRunnerSet(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, log logr.Logger) (ctrl.Result, error) { + r.ResourceCache.ephemeralRunnerSet.Delete(autoscalingRunnerSet) desiredRunnerSet, err := r.newEphemeralRunnerSet(autoscalingRunnerSet) if err != nil { log.Error(err, "Could not create EphemeralRunnerSet") @@ -773,6 +774,7 @@ func (r *AutoscalingRunnerSetReconciler) createAutoScalingListenerForRunnerSet(c }) } + r.ResourceCache.autoscalingListener.Delete(autoscalingRunnerSet) autoscalingListener, err := r.newAutoscalingListener( autoscalingRunnerSet, ephemeralRunnerSet, diff --git a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go index 82177acb4c..3cbe719fc8 100644 --- a/controllers/actions.github.com/autoscalingrunnerset_controller_test.go +++ b/controllers/actions.github.com/autoscalingrunnerset_controller_test.go @@ -44,6 +44,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { var autoscalingNS *corev1.Namespace var autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet var configSecret *corev1.Secret + var resourceCache *ResourceCache var originalBuildVersion string buildVersion := "0.1.0" @@ -65,6 +66,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { // Track runner group mappings for dynamic responses runnerGroupMap := map[int]string{1: "testgroup"} // ID -> Name mapping runnerGroupMapLock := &sync.RWMutex{} // Thread-safe access + resourceCache = newTestResourceCache() controller = &AutoscalingRunnerSetReconciler{ Client: mgr.GetClient(), @@ -73,7 +75,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { ControllerNamespace: autoscalingNS.Name, DefaultRunnerScaleSetListenerImage: "ghcr.io/actions/arc", ResourceBuilder: ResourceBuilder{ - ResourceCache: newTestResourceCache(), + ResourceCache: resourceCache, SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient( scalefake.WithClient( scalefake.NewClient( @@ -252,6 +254,15 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { autoscalingRunnerSetTestInterval, ).Should(Succeed(), "Listener should be created") + Eventually( + func() bool { + return resourceCacheStateHasMainObjectEntries(resourceCache.ephemeralRunnerSet, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.autoscalingListener, created) + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeTrue(), "AutoScalingRunnerSet EphemeralRunnerSet and AutoScalingListener resources should be cached after reconciliation") + // Check if status is updated runnerSetList := new(v1alpha1.EphemeralRunnerSetList) err := k8sClient.List(ctx, runnerSetList, client.InNamespace(autoscalingRunnerSet.Namespace)) @@ -271,8 +282,20 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { autoscalingRunnerSetTestInterval, ).Should(Succeed(), "Listener should be created") + created := new(v1alpha1.AutoscalingRunnerSet) + err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace}, created) + Expect(err).NotTo(HaveOccurred(), "failed to get AutoScalingRunnerSet") + Eventually( + func() bool { + return resourceCacheStateHasMainObjectEntries(resourceCache.ephemeralRunnerSet, created) && + resourceCacheStateHasMainObjectEntries(resourceCache.autoscalingListener, created) + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeTrue(), "AutoScalingRunnerSet EphemeralRunnerSet and AutoScalingListener resources should be cached before deletion") + // Delete the AutoScalingRunnerSet - err := k8sClient.Delete(ctx, autoscalingRunnerSet) + err = k8sClient.Delete(ctx, autoscalingRunnerSet) Expect(err).NotTo(HaveOccurred(), "failed to delete AutoScalingRunnerSet") // Check if the listener is deleted @@ -321,6 +344,15 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() { autoscalingRunnerSetTestTimeout, autoscalingRunnerSetTestInterval, ).Should(Succeed(), "AutoScalingRunnerSet should be deleted") + + Eventually( + func() bool { + return resourceCacheStateHasMainObjectEntries(resourceCache.ephemeralRunnerSet, created) || + resourceCacheStateHasMainObjectEntries(resourceCache.autoscalingListener, created) + }, + autoscalingRunnerSetTestTimeout, + autoscalingRunnerSetTestInterval, + ).Should(BeFalse(), "AutoScalingRunnerSet EphemeralRunnerSet and AutoScalingListener resources should be removed from cache after deletion") }) }) diff --git a/controllers/actions.github.com/ephemeralrunner_controller_test.go b/controllers/actions.github.com/ephemeralrunner_controller_test.go index ddd666bb24..74f9fe9923 100644 --- a/controllers/actions.github.com/ephemeralrunner_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunner_controller_test.go @@ -100,18 +100,20 @@ var _ = Describe("EphemeralRunner", func() { var configSecret *corev1.Secret var controller *EphemeralRunnerReconciler var ephemeralRunner *v1alpha1.EphemeralRunner + var resourceCache *ResourceCache BeforeEach(func() { ctx = context.Background() autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient) configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name) + resourceCache = newTestResourceCache() controller = &EphemeralRunnerReconciler{ Client: mgr.GetClient(), Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ - ResourceCache: newTestResourceCache(), + ResourceCache: resourceCache, SecretResolver: secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient( scalefake.WithClient( scalefake.NewClient( @@ -652,6 +654,12 @@ var _ = Describe("EphemeralRunner", func() { return true, nil }).Should(BeEquivalentTo(true)) + created := new(v1alpha1.EphemeralRunner) + err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, created) + Expect(err).To(BeNil(), "failed to get ephemeral runner") + resourceCache.listenerPod.Upsert(created, &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "cached-runner-pod", Namespace: created.Namespace}}) + Expect(resourceCacheHasMainObjectEntries(resourceCache, created)).To(BeTrue(), "test setup should cache an EphemeralRunner-owned resource") + // create runner-linked pod runnerLinkedPod := &corev1.Pod{ ObjectMeta: metav1.ObjectMeta{ @@ -671,7 +679,7 @@ var _ = Describe("EphemeralRunner", func() { }, } - err := k8sClient.Create(ctx, runnerLinkedPod) + err = k8sClient.Create(ctx, runnerLinkedPod) Expect(err).To(BeNil(), "failed to create runner linked pod") Eventually( func() (bool, error) { @@ -778,6 +786,14 @@ var _ = Describe("EphemeralRunner", func() { ephemeralRunnerTimeout, ephemeralRunnerInterval, ).Should(BeEquivalentTo(true)) + + Eventually( + func() bool { + return resourceCacheHasMainObjectEntries(resourceCache, created) + }, + ephemeralRunnerTimeout, + ephemeralRunnerInterval, + ).Should(BeFalse(), "EphemeralRunner-owned resources should be removed from cache after deletion") }) It("It should eventually have runner id set", func() { diff --git a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go index 2ee42ac274..331e8e596c 100644 --- a/controllers/actions.github.com/ephemeralrunnerset_controller_test.go +++ b/controllers/actions.github.com/ephemeralrunnerset_controller_test.go @@ -133,18 +133,20 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { var autoscalingNS *corev1.Namespace var ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet var configSecret *corev1.Secret + var resourceCache *ResourceCache BeforeEach(func() { ctx = context.Background() autoscalingNS, mgr = createNamespace(GinkgoT(), k8sClient) configSecret = createDefaultSecret(GinkgoT(), k8sClient, autoscalingNS.Name) + resourceCache = newTestResourceCache() controller := &EphemeralRunnerSetReconciler{ Client: mgr.GetClient(), Scheme: mgr.GetScheme(), Log: logf.Log, ResourceBuilder: ResourceBuilder{ - ResourceCache: newTestResourceCache(), + ResourceCache: resourceCache, SecretResolver: secretresolver.New(mgr.GetClient(), fake.NewMultiClient( fake.WithClient( fake.NewClient( @@ -284,6 +286,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { created := new(v1alpha1.EphemeralRunnerSet) err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunnerSet.Name, Namespace: ephemeralRunnerSet.Namespace}, created) Expect(err).NotTo(HaveOccurred(), "failed to get EphemeralRunnerSet") + resourceCache.listenerPod.Upsert(created, &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "cached-runner-set-pod", Namespace: created.Namespace}}) + Expect(resourceCacheHasMainObjectEntries(resourceCache, created)).To(BeTrue(), "test setup should cache an EphemeralRunnerSet-owned resource") // Scale up the EphemeralRunnerSet updated := created.DeepCopy() @@ -360,6 +364,14 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() { ephemeralRunnerSetTestTimeout, ephemeralRunnerSetTestInterval, ).Should(Succeed(), "EphemeralRunnerSet should be deleted") + + Eventually( + func() bool { + return resourceCacheHasMainObjectEntries(resourceCache, created) + }, + ephemeralRunnerSetTestTimeout, + ephemeralRunnerSetTestInterval, + ).Should(BeFalse(), "EphemeralRunnerSet-owned resources should be removed from cache after deletion") }) }) diff --git a/controllers/actions.github.com/resourcebuilder.go b/controllers/actions.github.com/resourcebuilder.go index 8d6ae26cb6..a75d414c57 100644 --- a/controllers/actions.github.com/resourcebuilder.go +++ b/controllers/actions.github.com/resourcebuilder.go @@ -137,10 +137,8 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. Image: image, ImagePullSecrets: imagePullSecrets, }) - if b.ResourceCache != nil { - if cached, ok := b.ResourceCache.autoscalingListener.Get(autoscalingRunnerSet, cacheKeyObject, ephemeralRunnerSet, inputDependency); ok { - return cached, nil - } + if cached, ok := b.ResourceCache.autoscalingListener.Get(autoscalingRunnerSet, cacheKeyObject, ephemeralRunnerSet, inputDependency); ok { + return cached, nil } effectiveMinRunners := 0 @@ -196,6 +194,10 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. } autoscalingListener := &v1alpha1.AutoscalingListener{ + TypeMeta: metav1.TypeMeta{ + APIVersion: v1alpha1.GroupVersion.String(), + Kind: "AutoscalingListener", + }, ObjectMeta: metav1.ObjectMeta{ Name: scaleSetListenerName(autoscalingRunnerSet), Namespace: namespace, @@ -204,15 +206,17 @@ func (b *ResourceBuilder) newAutoscalingListener(autoscalingRunnerSet *v1alpha1. }, Spec: spec, } - if b.ResourceCache != nil { - b.ResourceCache.autoscalingListener.Upsert(autoscalingRunnerSet, autoscalingListener, ephemeralRunnerSet, inputDependency) - } + b.ResourceCache.autoscalingListener.Upsert(autoscalingRunnerSet, autoscalingListener, ephemeralRunnerSet, inputDependency) return autoscalingListener, nil } func resourceCacheInputObject(name string, value any) client.Object { return &corev1.ConfigMap{ + TypeMeta: metav1.TypeMeta{ + APIVersion: corev1.SchemeGroupVersion.String(), + Kind: "ConfigMap", + }, ObjectMeta: metav1.ObjectMeta{ Name: name, ResourceVersion: hash.ComputeTemplateHash(value), @@ -301,6 +305,10 @@ func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha } desiredSecret := &corev1.Secret{ + TypeMeta: metav1.TypeMeta{ + APIVersion: corev1.SchemeGroupVersion.String(), + Kind: "Secret", + }, ObjectMeta: metav1.ObjectMeta{ Name: scaleSetListenerConfigName(autoscalingListener), Namespace: autoscalingListener.Namespace, @@ -347,10 +355,8 @@ func (b *ResourceBuilder) newScaleSetListenerPod( Namespace: autoscalingListener.Namespace, }, } - if b.ResourceCache != nil { - if cached, ok := b.ResourceCache.listenerPod.Get(autoscalingListener, cacheKeyObject, podConfig, serviceAccount, role, roleBinding); ok { - return cached, nil - } + if cached, ok := b.ResourceCache.listenerPod.Get(autoscalingListener, cacheKeyObject, podConfig, serviceAccount, role, roleBinding); ok { + return cached, nil } envs := []corev1.EnvVar{ @@ -460,8 +466,8 @@ func (b *ResourceBuilder) newScaleSetListenerPod( newRunnerScaleSetListenerPod := &corev1.Pod{ TypeMeta: metav1.TypeMeta{ + APIVersion: corev1.SchemeGroupVersion.String(), Kind: "Pod", - APIVersion: "v1", }, ObjectMeta: metav1.ObjectMeta{ Name: autoscalingListener.Name, @@ -489,9 +495,7 @@ func (b *ResourceBuilder) newScaleSetListenerPod( if autoscalingListener.Spec.Template != nil { mergeListenerPodWithTemplate(newRunnerScaleSetListenerPod, autoscalingListener.Spec.Template) } - if b.ResourceCache != nil { - b.ResourceCache.listenerPod.Upsert(autoscalingListener, newRunnerScaleSetListenerPod, podConfig, serviceAccount, role, roleBinding) - } + b.ResourceCache.listenerPod.Upsert(autoscalingListener, newRunnerScaleSetListenerPod, podConfig, serviceAccount, role, roleBinding) return newRunnerScaleSetListenerPod, nil } @@ -652,13 +656,15 @@ func (b *ResourceBuilder) newScaleSetListenerServiceAccount(autoscalingListener Namespace: autoscalingListener.Namespace, }, } - if b.ResourceCache != nil { - if cached, ok := b.ResourceCache.listenerServiceAccount.Get(autoscalingListener, cacheKeyObject); ok { - return cached, nil - } + if cached, ok := b.ResourceCache.listenerServiceAccount.Get(autoscalingListener, cacheKeyObject); ok { + return cached, nil } base := &corev1.ServiceAccount{ + TypeMeta: metav1.TypeMeta{ + APIVersion: corev1.SchemeGroupVersion.String(), + Kind: "ServiceAccount", + }, ObjectMeta: metav1.ObjectMeta{ Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace, @@ -680,9 +686,7 @@ func (b *ResourceBuilder) newScaleSetListenerServiceAccount(autoscalingListener if err := b.setControllerReference(autoscalingListener, base); err != nil { return nil, fmt.Errorf("failed to set controller reference for listener service account: %w", err) } - if b.ResourceCache != nil { - b.ResourceCache.listenerServiceAccount.Upsert(autoscalingListener, base) - } + b.ResourceCache.listenerServiceAccount.Upsert(autoscalingListener, base) return base, nil } @@ -710,10 +714,8 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, }, } - if b.ResourceCache != nil { - if cached, ok := b.ResourceCache.listenerRole.Get(autoscalingListener, cacheKeyObject); ok { - return cached - } + if cached, ok := b.ResourceCache.listenerRole.Get(autoscalingListener, cacheKeyObject); ok { + return cached } labels := b.filterAndMergeLabels(autoscalingListener.Labels, map[string]string{ @@ -730,6 +732,10 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. } newRole := &rbacv1.Role{ + TypeMeta: metav1.TypeMeta{ + APIVersion: rbacv1.SchemeGroupVersion.String(), + Kind: "Role", + }, ObjectMeta: metav1.ObjectMeta{ Name: autoscalingListener.Name, Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, @@ -740,9 +746,7 @@ func (b *ResourceBuilder) newScaleSetListenerRole(autoscalingListener *v1alpha1. } newRole.Annotations[annotationKeyIntegrityHash] = scaleSetRoleIntegrityHash(newRole) - if b.ResourceCache != nil { - b.ResourceCache.listenerRole.Upsert(autoscalingListener, newRole) - } + b.ResourceCache.listenerRole.Upsert(autoscalingListener, newRole) return newRole } @@ -766,10 +770,8 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1 Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, }, } - if b.ResourceCache != nil { - if cached, ok := b.ResourceCache.listenerRoleBinding.Get(autoscalingListener, cacheKeyObject, listenerRole, serviceAccount); ok { - return cached - } + if cached, ok := b.ResourceCache.listenerRoleBinding.Get(autoscalingListener, cacheKeyObject, listenerRole, serviceAccount); ok { + return cached } roleRef := rbacv1.RoleRef{ @@ -799,6 +801,10 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1 } newRoleBinding := &rbacv1.RoleBinding{ + TypeMeta: metav1.TypeMeta{ + APIVersion: rbacv1.SchemeGroupVersion.String(), + Kind: "RoleBinding", + }, ObjectMeta: metav1.ObjectMeta{ Name: autoscalingListener.Name, Namespace: autoscalingListener.Spec.AutoscalingRunnerSetNamespace, @@ -810,9 +816,7 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1 } newRoleBinding.Annotations[annotationKeyIntegrityHash] = scaleSetListenerRoleBindingIntegrityHash(newRoleBinding) - if b.ResourceCache != nil { - b.ResourceCache.listenerRoleBinding.Upsert(autoscalingListener, newRoleBinding, listenerRole, serviceAccount) - } + b.ResourceCache.listenerRoleBinding.Upsert(autoscalingListener, newRoleBinding, listenerRole, serviceAccount) return newRoleBinding } @@ -843,10 +847,8 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A Namespace: autoscalingRunnerSet.Namespace, }, } - if b.ResourceCache != nil { - if cached, ok := b.ResourceCache.ephemeralRunnerSet.Get(autoscalingRunnerSet, cacheKeyObject); ok { - return cached, nil - } + if cached, ok := b.ResourceCache.ephemeralRunnerSet.Get(autoscalingRunnerSet, cacheKeyObject); ok { + return cached, nil } spec := v1alpha1.EphemeralRunnerSetSpec{ @@ -887,7 +889,10 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A } newEphemeralRunnerSet := &v1alpha1.EphemeralRunnerSet{ - TypeMeta: metav1.TypeMeta{}, + TypeMeta: metav1.TypeMeta{ + APIVersion: v1alpha1.GroupVersion.String(), + Kind: "EphemeralRunnerSet", + }, ObjectMeta: metav1.ObjectMeta{ Name: autoscalingRunnerSet.Name, Namespace: autoscalingRunnerSet.Namespace, @@ -902,9 +907,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A if err := b.setControllerReference(autoscalingRunnerSet, newEphemeralRunnerSet); err != nil { return nil, fmt.Errorf("failed to set controller reference for ephemeral runner set: %w", err) } - if b.ResourceCache != nil { - b.ResourceCache.ephemeralRunnerSet.Upsert(autoscalingRunnerSet, newEphemeralRunnerSet) - } + b.ResourceCache.ephemeralRunnerSet.Upsert(autoscalingRunnerSet, newEphemeralRunnerSet) return newEphemeralRunnerSet, nil } diff --git a/controllers/actions.github.com/resourcebuilder_test.go b/controllers/actions.github.com/resourcebuilder_test.go index 4324401e11..6097308d71 100644 --- a/controllers/actions.github.com/resourcebuilder_test.go +++ b/controllers/actions.github.com/resourcebuilder_test.go @@ -102,11 +102,13 @@ func TestMetadataPropagation(t *testing.T) { }, } + cache := NewResourceCache() b := ResourceBuilder{ ExcludeLabelPropagationPrefixes: []string{ "example.com/", "directly.excluded.org/label", }, + ResourceCache: &cache, } ephemeralRunnerSet, err := b.newEphemeralRunnerSet(&autoscalingRunnerSet) require.NoError(t, err) @@ -258,7 +260,8 @@ func TestGitHubURLTrimLabelValues(t *testing.T) { GitHubConfigUrl: fmt.Sprintf("https://github.com/%s/%s", organization, repository), } - var b ResourceBuilder + cache := NewResourceCache() + b := ResourceBuilder{ResourceCache: &cache} ephemeralRunnerSet, err := b.newEphemeralRunnerSet(autoscalingRunnerSet) require.NoError(t, err) assert.Len(t, ephemeralRunnerSet.Labels[LabelKeyGitHubEnterprise], 0) @@ -282,7 +285,8 @@ func TestGitHubURLTrimLabelValues(t *testing.T) { GitHubConfigUrl: fmt.Sprintf("https://github.com/enterprises/%s", enterprise), } - var b ResourceBuilder + cache := NewResourceCache() + b := ResourceBuilder{ResourceCache: &cache} ephemeralRunnerSet, err := b.newEphemeralRunnerSet(autoscalingRunnerSet) require.NoError(t, err) assert.Len(t, ephemeralRunnerSet.Labels[LabelKeyGitHubEnterprise], 63) @@ -323,7 +327,8 @@ func TestOwnershipRelationships(t *testing.T) { } // Initialize ResourceBuilder - b := ResourceBuilder{} + cache := NewResourceCache() + b := ResourceBuilder{ResourceCache: &cache} // Create EphemeralRunnerSet ephemeralRunnerSet, err := b.newEphemeralRunnerSet(&autoscalingRunnerSet) @@ -422,7 +427,8 @@ func TestListenerPodNodeSelector(t *testing.T) { }, } - b := ResourceBuilder{} + cache := NewResourceCache() + b := ResourceBuilder{ResourceCache: &cache} ephemeralRunnerSet, err := b.newEphemeralRunnerSet(&autoscalingRunnerSet) require.NoError(t, err) diff --git a/controllers/actions.github.com/resourcecache.go b/controllers/actions.github.com/resourcecache.go index 1f631be01b..2a4b1c1035 100644 --- a/controllers/actions.github.com/resourcecache.go +++ b/controllers/actions.github.com/resourcecache.go @@ -10,14 +10,20 @@ import ( "github.com/actions/actions-runner-controller/hash" corev1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" + "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/types" "sigs.k8s.io/controller-runtime/pkg/client" ) -var resourceCacheObjectTypes sync.Map +const ( + resourceCacheInitialEntries = 4096 + resourceCacheInitialMainUIDEntries = 4096 + resourceCacheInitialOwnerEntries = 8 + resourceCacheMaxDependencyRefs = 4 +) type ResourceCacheObjectRef struct { - ObjectType string + ObjectType schema.GroupVersionKind Namespace string Name string UID types.UID @@ -33,10 +39,15 @@ type ResourceCacheKey struct { type ResourceCacheValue[T client.Object] struct { MainObject ResourceCacheObjectRef ResourceVersion string - Dependencies []ResourceCacheObjectRef + dependencyKey resourceCacheDependencyKey Object T } +type resourceCacheDependencyKey struct { + count int + refs [resourceCacheMaxDependencyRefs]ResourceCacheObjectRef +} + type ResourceCache struct { autoscalingListener *resourceCacheState[*v1alpha1.AutoscalingListener] ephemeralRunnerSet *resourceCacheState[*v1alpha1.EphemeralRunnerSet] @@ -58,13 +69,15 @@ func NewResourceCache() ResourceCache { } type resourceCacheState[T client.Object] struct { - mu sync.RWMutex - entries map[ResourceCacheKey]ResourceCacheValue[T] + mu sync.RWMutex + entries map[ResourceCacheKey]ResourceCacheValue[T] + entriesByMainUID map[types.UID]map[ResourceCacheKey]struct{} } func newResourceCacheState[T client.Object]() *resourceCacheState[T] { return &resourceCacheState[T]{ - entries: make(map[ResourceCacheKey]ResourceCacheValue[T], 512), + entries: make(map[ResourceCacheKey]ResourceCacheValue[T], resourceCacheInitialEntries), + entriesByMainUID: make(map[types.UID]map[ResourceCacheKey]struct{}, resourceCacheInitialMainUIDEntries), } } @@ -73,17 +86,30 @@ func (s *resourceCacheState[T]) Get( desiredObject T, dependencies ...client.Object, ) (T, bool) { + var zero T + if s == nil || isNilResourceCacheObject(mainObject) || isNilResourceCacheObject(desiredObject) { + return zero, false + } + dependencyKey, ok := newResourceCacheDependencyKey(dependencies...) + if !ok { + return zero, false + } + if mainObject.GetUID() == "" { + return zero, false + } + key := newResourceCacheKey(mainObject, desiredObject) + mainObjectRef := newResourceCacheObjectRef(mainObject) s.mu.RLock() value, ok := s.entries[key] - s.mu.RUnlock() - if !ok || !value.Matches(mainObject, dependencies...) { - var zero T - return zero, false + if ok && value.MainObject == mainObjectRef && value.dependencyKey.Equal(dependencyKey) { + s.mu.RUnlock() + return value.Object, true } + s.mu.RUnlock() - return cloneResourceCacheObject(value.Object), true + return zero, false } func (s *resourceCacheState[T]) Upsert( @@ -91,13 +117,25 @@ func (s *resourceCacheState[T]) Upsert( desiredObject T, dependencies ...client.Object, ) (ResourceCacheValue[T], bool) { + var zero ResourceCacheValue[T] + if s == nil || isNilResourceCacheObject(mainObject) || isNilResourceCacheObject(desiredObject) { + return zero, false + } + dependencyKey, ok := newResourceCacheDependencyKey(dependencies...) + if !ok { + return zero, false + } + if mainObject.GetUID() == "" { + return zero, false + } + key := newResourceCacheKey(mainObject, desiredObject) mainObjectRef := newResourceCacheObjectRef(mainObject) resourceVersion := desiredObject.GetResourceVersion() s.mu.RLock() previous, ok := s.entries[key] - if ok && previous.MainObject == mainObjectRef && previous.ResourceVersion == resourceVersion && previous.dependenciesMatch(dependencies...) { + if ok && previous.MainObject == mainObjectRef && previous.ResourceVersion == resourceVersion && previous.dependencyKey.Equal(dependencyKey) { s.mu.RUnlock() return previous, false } @@ -107,13 +145,18 @@ func (s *resourceCacheState[T]) Upsert( defer s.mu.Unlock() previous, ok = s.entries[key] - if ok && previous.MainObject == mainObjectRef && previous.ResourceVersion == resourceVersion && previous.dependenciesMatch(dependencies...) { + if ok && previous.MainObject == mainObjectRef && previous.ResourceVersion == resourceVersion && previous.dependencyKey.Equal(dependencyKey) { return previous, false } - dependencyRefs := newResourceCacheObjectRefs(dependencies...) - value := newResourceCacheValue(mainObjectRef, resourceVersion, dependencyRefs, cloneResourceCacheObject(desiredObject)) + value := ResourceCacheValue[T]{ + MainObject: mainObjectRef, + ResourceVersion: resourceVersion, + dependencyKey: dependencyKey, + Object: desiredObject, + } s.entries[key] = value + s.indexKeyLocked(key) return value, true } @@ -131,7 +174,7 @@ func (c *ResourceCache) Delete(mainObject client.Object) { } func (s *resourceCacheState[T]) Delete(mainObject client.Object) { - if mainObject == nil { + if s == nil || mainObject == nil { return } @@ -143,19 +186,19 @@ func (s *resourceCacheState[T]) Delete(mainObject client.Object) { s.mu.Lock() defer s.mu.Unlock() - for key := range s.entries { - if key.MainUID == uid { - delete(s.entries, key) - } + for key := range s.entriesByMainUID[uid] { + delete(s.entries, key) } + delete(s.entriesByMainUID, uid) } -func (v ResourceCacheValue[T]) Matches(mainObject client.Object, dependencies ...client.Object) bool { - if v.MainObject != newResourceCacheObjectRef(mainObject) { - return false +func (s *resourceCacheState[T]) indexKeyLocked(key ResourceCacheKey) { + keys, ok := s.entriesByMainUID[key.MainUID] + if !ok { + keys = make(map[ResourceCacheKey]struct{}, resourceCacheInitialOwnerEntries) + s.entriesByMainUID[key.MainUID] = keys } - - return v.dependenciesMatch(dependencies...) + keys[key] = struct{}{} } func newResourceCacheKey(mainObject client.Object, desiredObject client.Object) ResourceCacheKey { @@ -166,43 +209,34 @@ func newResourceCacheKey(mainObject client.Object, desiredObject client.Object) } } -func newResourceCacheValue[T client.Object]( - mainObjectRef ResourceCacheObjectRef, - resourceVersion string, - dependencyRefs []ResourceCacheObjectRef, - object T, -) ResourceCacheValue[T] { - return ResourceCacheValue[T]{ - MainObject: mainObjectRef, - ResourceVersion: resourceVersion, - Dependencies: dependencyRefs, - Object: object, +func newResourceCacheDependencyKey(objects ...client.Object) (resourceCacheDependencyKey, bool) { + if len(objects) > resourceCacheMaxDependencyRefs { + return resourceCacheDependencyKey{}, false } -} -func cloneResourceCacheObject[T client.Object](object T) T { - return object.DeepCopyObject().(T) -} - -func newResourceCacheObjectRefs(objects ...client.Object) []ResourceCacheObjectRef { - refs := make([]ResourceCacheObjectRef, 0, len(objects)) - for _, object := range objects { - refs = append(refs, newResourceCacheObjectRef(object)) + key := resourceCacheDependencyKey{count: len(objects)} + for i, object := range objects { + if isNilResourceCacheObject(object) { + return resourceCacheDependencyKey{}, false + } + key.refs[i] = newResourceCacheObjectRef(object) } - slices.SortFunc(refs, func(a, b ResourceCacheObjectRef) int { + slices.SortFunc(key.refs[:key.count], func(a, b ResourceCacheObjectRef) int { return compareResourceCacheObjectRefs(a, b) }) - return refs + return key, true } -func (v ResourceCacheValue[T]) dependenciesMatch(objects ...client.Object) bool { - if len(v.Dependencies) != len(objects) { +func (k resourceCacheDependencyKey) Equal(other resourceCacheDependencyKey) bool { + if k.count != other.count { + return false + } + if k.count > len(k.refs) || other.count > len(other.refs) { return false } - for _, object := range objects { - ref := newResourceCacheObjectRef(object) - if !slices.Contains(v.Dependencies, ref) { + for i := range k.count { + if k.refs[i] != other.refs[i] { return false } } @@ -212,12 +246,15 @@ func (v ResourceCacheValue[T]) dependenciesMatch(objects ...client.Object) bool func newResourceCacheObjectRef(object client.Object) ResourceCacheObjectRef { resourceVersion := object.GetResourceVersion() + if resourceVersion == "" { + resourceVersion = object.GetAnnotations()[annotationKeyIntegrityHash] + } if resourceVersion == "" { resourceVersion = hash.ComputeTemplateHash(object) } return ResourceCacheObjectRef{ - ObjectType: resourceCacheObjectType(object), + ObjectType: object.GetObjectKind().GroupVersionKind(), Namespace: object.GetNamespace(), Name: resourceCacheObjectName(object), UID: object.GetUID(), @@ -226,7 +263,7 @@ func newResourceCacheObjectRef(object client.Object) ResourceCacheObjectRef { } func compareResourceCacheObjectRefs(a, b ResourceCacheObjectRef) int { - if c := strings.Compare(a.ObjectType, b.ObjectType); c != 0 { + if c := compareGroupVersionKinds(a.ObjectType, b.ObjectType); c != 0 { return c } if c := strings.Compare(a.Namespace, b.Namespace); c != 0 { @@ -241,18 +278,14 @@ func compareResourceCacheObjectRefs(a, b ResourceCacheObjectRef) int { return strings.Compare(a.ResourceVersion, b.ResourceVersion) } -func resourceCacheObjectType(object client.Object) string { - t := reflect.TypeOf(object) - if t.Kind() == reflect.Pointer { - t = t.Elem() +func compareGroupVersionKinds(a, b schema.GroupVersionKind) int { + if c := strings.Compare(a.Group, b.Group); c != 0 { + return c } - if objectType, ok := resourceCacheObjectTypes.Load(t); ok { - return objectType.(string) + if c := strings.Compare(a.Version, b.Version); c != 0 { + return c } - - objectType := t.PkgPath() + "." + t.Name() - actual, _ := resourceCacheObjectTypes.LoadOrStore(t, objectType) - return actual.(string) + return strings.Compare(a.Kind, b.Kind) } func resourceCacheObjectName(object client.Object) string { @@ -261,3 +294,13 @@ func resourceCacheObjectName(object client.Object) string { } return object.GetGenerateName() } + +func isNilResourceCacheObject[T client.Object](object T) bool { + var clientObject client.Object = object + if clientObject == nil { + return true + } + + value := reflect.ValueOf(clientObject) + return value.Kind() == reflect.Pointer && value.IsNil() +} diff --git a/controllers/actions.github.com/resourcecache_test.go b/controllers/actions.github.com/resourcecache_test.go index 8bf576d539..608ed9d95d 100644 --- a/controllers/actions.github.com/resourcecache_test.go +++ b/controllers/actions.github.com/resourcecache_test.go @@ -10,15 +10,35 @@ import ( corev1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "sigs.k8s.io/controller-runtime/pkg/client" ) -var benchmarkEphemeralRunnerSetSink *v1alpha1.EphemeralRunnerSet - func newTestResourceCache() *ResourceCache { cache := NewResourceCache() return &cache } +func resourceCacheHasMainObjectEntries(cache *ResourceCache, mainObject client.Object) bool { + return resourceCacheStateHasMainObjectEntries(cache.autoscalingListener, mainObject) || + resourceCacheStateHasMainObjectEntries(cache.ephemeralRunnerSet, mainObject) || + resourceCacheStateHasMainObjectEntries(cache.listenerPod, mainObject) || + resourceCacheStateHasMainObjectEntries(cache.listenerServiceAccount, mainObject) || + resourceCacheStateHasMainObjectEntries(cache.listenerRole, mainObject) || + resourceCacheStateHasMainObjectEntries(cache.listenerRoleBinding, mainObject) +} + +func resourceCacheStateHasMainObjectEntries[T client.Object](state *resourceCacheState[T], mainObject client.Object) bool { + uid := mainObject.GetUID() + if uid == "" { + return false + } + + state.mu.RLock() + defer state.mu.RUnlock() + + return len(state.entriesByMainUID[uid]) > 0 +} + func TestResourceCacheUpsertReplacesByDependencyResourceVersion(t *testing.T) { mainObject := &v1alpha1.AutoscalingListener{ ObjectMeta: metav1.ObjectMeta{ @@ -78,17 +98,14 @@ func TestResourceCacheUpsertReplacesByDependencyResourceVersion(t *testing.T) { configSecret.ResourceVersion = "2" value, replaced = cache.listenerPod.Upsert(mainObject, desiredPod, configSecret, serviceAccount, role) assert.True(t, replaced) - assert.Contains(t, value.Dependencies, ResourceCacheObjectRef{ - ObjectType: resourceCacheObjectType(configSecret), - Namespace: "controller-ns", - Name: "listener-config", - UID: "config-secret-uid", - ResourceVersion: "2", - }) + staleConfigSecret := configSecret.DeepCopy() + staleConfigSecret.ResourceVersion = "1" + _, ok = cache.listenerPod.Get(mainObject, desiredPod, staleConfigSecret, serviceAccount, role) + assert.False(t, ok) + _, ok = cache.listenerPod.Get(mainObject, desiredPod, configSecret, serviceAccount, role) + assert.True(t, ok) - desiredPod.Labels["mutated"] = "after-cache" - cachedPod := value.Object - assert.NotContains(t, cachedPod.Labels, "mutated") + assert.Same(t, desiredPod, value.Object) } func TestResourceCacheDeleteRemovesMainObjectEntries(t *testing.T) { @@ -132,6 +149,38 @@ func TestResourceCacheDeletePanicsWithNilCache(t *testing.T) { }) } +func TestResourceCacheIgnoresInvalidInputs(t *testing.T) { + cache := NewResourceCache() + desiredPod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "listener", Namespace: "controller-ns"}} + mainObjectWithoutUID := &v1alpha1.AutoscalingListener{ObjectMeta: metav1.ObjectMeta{Name: "listener", Namespace: "controller-ns"}} + mainObject := mainObjectWithoutUID.DeepCopy() + mainObject.UID = "listener-uid" + + _, replaced := cache.listenerPod.Upsert(mainObjectWithoutUID, desiredPod) + assert.False(t, replaced) + _, ok := cache.listenerPod.Get(mainObjectWithoutUID, desiredPod) + assert.False(t, ok) + + var nilDependency *corev1.Secret + assert.NotPanics(t, func() { + _, replaced = cache.listenerPod.Upsert(mainObject, desiredPod, nilDependency) + assert.False(t, replaced) + _, ok = cache.listenerPod.Get(mainObject, desiredPod, nilDependency) + assert.False(t, ok) + }) + + tooManyDependencies := make([]client.Object, resourceCacheMaxDependencyRefs+1) + for i := range tooManyDependencies { + tooManyDependencies[i] = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("dependency-%d", i), Namespace: "controller-ns"}} + } + assert.NotPanics(t, func() { + _, replaced = cache.listenerPod.Upsert(mainObject, desiredPod, tooManyDependencies...) + assert.False(t, replaced) + _, ok = cache.listenerPod.Get(mainObject, desiredPod, tooManyDependencies...) + assert.False(t, ok) + }) +} + func TestResourceBuilderCachesListenerPodDependencies(t *testing.T) { listener := &v1alpha1.AutoscalingListener{ ObjectMeta: metav1.ObjectMeta{ @@ -231,128 +280,13 @@ func TestResourceBuilderCachesEphemeralRunnerSet(t *testing.T) { cachedRunnerSet, ok := b.ResourceCache.ephemeralRunnerSet.Get(&autoscalingRunnerSet, runnerSet) require.True(t, ok) assert.Equal(t, runnerSet.Spec, cachedRunnerSet.Spec) - - runnerSet.Labels["mutated"] = "after-cache" - assert.NotContains(t, cachedRunnerSet.Labels, "mutated") + assert.Same(t, runnerSet, cachedRunnerSet) fromBuilder, err := b.newEphemeralRunnerSet(&autoscalingRunnerSet) require.NoError(t, err) - assert.NotContains(t, fromBuilder.Labels, "mutated") + assert.Same(t, runnerSet, fromBuilder) autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey] = "2" _, ok = b.ResourceCache.ephemeralRunnerSet.Get(&autoscalingRunnerSet, runnerSet) assert.False(t, ok) } - -func BenchmarkNewEphemeralRunnerSetResourceCache(b *testing.B) { - autoscalingRunnerSet := newBenchmarkAutoscalingRunnerSet() - - b.Run("no_cache", func(b *testing.B) { - builder := ResourceBuilder{} - b.ReportAllocs() - b.ResetTimer() - - for i := 0; i < b.N; i++ { - runnerSet, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet) - if err != nil { - b.Fatal(err) - } - benchmarkEphemeralRunnerSetSink = runnerSet - } - }) - - b.Run("cache_hit", func(b *testing.B) { - cache := NewResourceCache() - builder := ResourceBuilder{ResourceCache: &cache} - if _, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet); err != nil { - b.Fatal(err) - } - - b.ReportAllocs() - b.ResetTimer() - - for i := 0; i < b.N; i++ { - runnerSet, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet) - if err != nil { - b.Fatal(err) - } - benchmarkEphemeralRunnerSetSink = runnerSet - } - }) - - b.Run("cache_miss", func(b *testing.B) { - cache := NewResourceCache() - builder := ResourceBuilder{ResourceCache: &cache} - autoscalingRunnerSet := autoscalingRunnerSet.DeepCopy() - - b.ReportAllocs() - b.ResetTimer() - - for i := 0; i < b.N; i++ { - autoscalingRunnerSet.ResourceVersion = fmt.Sprint(i) - runnerSet, err := builder.newEphemeralRunnerSet(autoscalingRunnerSet) - if err != nil { - b.Fatal(err) - } - benchmarkEphemeralRunnerSetSink = runnerSet - } - }) -} - -func newBenchmarkAutoscalingRunnerSet() *v1alpha1.AutoscalingRunnerSet { - return &v1alpha1.AutoscalingRunnerSet{ - ObjectMeta: metav1.ObjectMeta{ - Name: "benchmark-scale-set", - Namespace: "benchmark-namespace", - UID: "benchmark-scale-set-uid", - ResourceVersion: "1", - Labels: map[string]string{ - LabelKeyKubernetesVersion: "0.12.0", - "example.com/label-1": "value-1", - "example.com/label-2": "value-2", - }, - Annotations: map[string]string{ - runnerScaleSetIDAnnotationKey: "123", - AnnotationKeyGitHubRunnerGroupName: "benchmark-runner-group", - AnnotationKeyGitHubRunnerScaleSetName: "benchmark-scale-set", - }, - }, - Spec: v1alpha1.AutoscalingRunnerSetSpec{ - GitHubConfigUrl: "https://github.com/actions/actions-runner-controller", - EphemeralRunnerSetMetadata: &v1alpha1.ResourceMeta{ - Labels: map[string]string{ - "example.com/runner-set-label": "runner-set-value", - }, - Annotations: map[string]string{ - "example.com/runner-set-annotation": "runner-set-value", - }, - }, - EphemeralRunnerMetadata: &v1alpha1.ResourceMeta{ - Labels: map[string]string{ - "example.com/runner-label": "runner-value", - }, - Annotations: map[string]string{ - "example.com/runner-annotation": "runner-value", - }, - }, - Template: corev1.PodTemplateSpec{ - ObjectMeta: metav1.ObjectMeta{ - Labels: map[string]string{ - "example.com/template-label": "template-value", - }, - }, - Spec: corev1.PodSpec{ - Containers: []corev1.Container{ - { - Name: v1alpha1.EphemeralRunnerContainerName, - Image: "ghcr.io/actions/actions-runner:latest", - Env: []corev1.EnvVar{ - {Name: "ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER", Value: "false"}, - }, - }, - }, - }, - }, - }, - } -}