{"id":17918306,"url":"https://github.com/link-/actions-at-scale-ghoh","last_synced_at":"2025-03-23T23:31:08.479Z","repository":{"id":44104878,"uuid":"442114101","full_name":"Link-/actions-at-scale-ghoh","owner":"Link-","description":"GitHub Office Hours - Adopting GitHub Actions at scale in the Enterprise","archived":true,"fork":false,"pushed_at":"2023-04-08T09:31:47.000Z","size":42,"stargazers_count":54,"open_issues_count":0,"forks_count":36,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-02-14T05:24:50.292Z","etag":null,"topics":["aks","azure","github-actions","helm","kubernetes","tutorial-demos"],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Link-.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-12-27T09:33:49.000Z","updated_at":"2024-11-17T22:27:02.000Z","dependencies_parsed_at":"2023-01-19T00:30:15.411Z","dependency_job_id":null,"html_url":"https://github.com/Link-/actions-at-scale-ghoh","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Link-%2Factions-at-scale-ghoh","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Link-%2Factions-at-scale-ghoh/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Link-%2Factions-at-scale-ghoh/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Link-%2Factions-at-scale-ghoh/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Link-","download_url":"https://codeload.github.com/Link-/actions-at-scale-ghoh/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245186591,"owners_count":20574551,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aks","azure","github-actions","helm","kubernetes","tutorial-demos"],"created_at":"2024-10-28T20:10:42.395Z","updated_at":"2025-03-23T23:31:08.016Z","avatar_url":"https://github.com/Link-.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ⚠️ IMPORTANT NOTICE \n\n**This project has not been updated since its release. Some of the instructions shared below (and in the videos) might not be applicable any more. Use your best judgement when following these instructions!**\n\nWith the release of the [Autoscaling Runner Scale Set mode](https://github.com/actions/actions-runner-controller/tree/master/docs/preview/gha-runner-scale-set-controller) you are highly encouraged to use it as opposed to these legacy options.\n\n# Adopting GitHub Actions at scale in the Enterprise\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)\n\n\u003e GitHub Office Hours: Adopting GitHub Actions at scale in the Enterprise\n\nThis repository contains the scripts and configuration files for the GitHub Actions at scale in the Enterprise office hours video series.\n\n## Agenda\n\n*All episodes were followed by a live Q\u0026A.*\n\n**Episode 1:**\n\n\u003ca href=\"https://www.youtube.com/watch?v=OhNroaLxMzc\" target=\"_blank\"\u003e\u003cimg src=\"./images/episode_1.png\" width=\"70%\" /\u003e\u003c/a\u003e\n\n- Setup and configure AKS\n- Deploy and attach an Application Gateway as our Ingress Controller\n\n**Episode 2:**\n\n\u003ca href=\"https://www.youtube.com/watch?v=8Lw8CjEV-FA\" target=\"_blank\"\u003e\u003cimg src=\"./images/episode_2.png\" width=\"70%\" /\u003e\u003c/a\u003e\n\n- Configure cert-manager for TLS termination\n- Create a GitHub App\n- Install \u0026 configure actions-runner-controller\n- Demonstrate auto-scaling\n\n**Episode 3:**\n\n\u003ca href=\"https://www.youtube.com/watch?v=9kE8FsQSnDU\" target=\"_blank\"\u003e\u003cimg src=\"./images/episode_3.png\" width=\"70%\" /\u003e\u003c/a\u003e\n\n- Configure our Web Application Firewall (WAF)\n- Enable and use Docker in Docker\n- Create a custom self-hosted runner image\n- Install multiple actions-runner-controllers for different namespaces\n\n## Reference Architecture\n\n![Reference architecture diagram](./images/GitHub-Actions_shr-arch-ref_v03BD-Azure.png)\n\n## Pre-Requisites\n- Azure Subscription with at least [Contributor](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor) + [User Access Administrator](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator) built-in roles. You will be performing role assignments when using the Azure Application Gateway with AKS and when integrating Azure Container Registry with AKS.\n\n## Folder Structure\n\n```text\n.\n├── LICENSE\n├── README.md\n├── actions-runner-controller\n│   ├── alt-namespace\n│   │   ├── autoscale_webhook.yaml\n│   │   └── values.yaml.example\n│   ├── autoscale_webhook.yaml\n│   ├── dind_deployment.yaml\n│   ├── go-runners-autoscale_webhook.yaml\n│   ├── multi_namespace_values.yaml\n│   └── values.yaml.example\n├── apps\n│   └── test-app.yaml\n├── cert-manager\n│   ├── cluster-issuer-prod.yaml\n│   └── cluster-issuer-staging.yaml\n├── custom-runners\n│   └── Dockerfile\n├── ingress\n│   ├── altns-ingress.yaml\n│   ├── ingress-tls-runners.yaml\n│   ├── ingress-tls.yaml\n│   ├── ingress.yaml\n│   └── multi-namespaces-ingress.yaml\n└── sample-workflows\n    ├── custom-runner.yaml\n    ├── docker_job.yaml\n    ├── matrix_jobs.yaml\n    ├── multi_job.yaml\n    └── single_job.yml\n```\n\n- `actions-runner-controller/`: contains the actions-runner-controller configuration and helm chart values file for the default namespace\n- `actions-runner-controller/alt-namespace/`: contains the actions-runner-controller configuration and helm chart values file for the alternate namespace\n- `apps/`: contains the sample applications used for sanity checks\n- `cert-manager/`: contains the cert-manager configuration\n- `custom-runners/`: contains the Dockerfile of a custom runner image\n- `ingress/`: contains the ingress controller configuration\n- `sample-workflows/`: contains the sample workflows used for sanity checks\n\n## Setup\n\n:warning: *All the below assumes you are running `Bash`.*\n\n### Install az cli\n\n```bash\n# Refresh packages\napt-get update\napt-get upgrade\n\n# From:\n# https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt\nsudo apt-get update\nsudo apt-get install ca-certificates curl apt-transport-https lsb-release gnupg\n\n# Download the microsoft signing keys\ncurl -sL https://packages.microsoft.com/keys/microsoft.asc |\n    gpg --dearmor |\n    sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg \u003e /dev/null\n\n# Add the Azure CLI software repository:\nAZ_REPO=$(lsb_release -cs)\necho \"deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main\" |\n    sudo tee /etc/apt/sources.list.d/azure-cli.list\n\n# Update repository information and install the azure-cli package:\nsudo apt-get update\nsudo apt-get install azure-cli\n```\n\n### Install kubectl (latest stable version)\n\n```bash\n# Download the latest release \ncurl -LO \"https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl\"\n\n# Download the kubectl checksum file:\ncurl -LO \"https://dl.k8s.io/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl.sha256\"\n\n# Validate the kubectl binary against the checksum file:\necho \"$(\u003ckubectl.sha256)  kubectl\" | sha256sum --check\n\n# Install kubectl\nsudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl\n\n# Verify\nkubectl version --client\n\n# Install auto-completion\n# OPTIONAL\n# -\nsudo apt-get install bash-completion\nsource /usr/share/bash-completion/bash_completion\n```\n\n### Install Helm\n\n```bash\n\n# Add signing keys\ncurl https://baltocdn.com/helm/signing.asc | sudo apt-key add -\n\n# Install dependencies\nsudo apt-get install apt-transport-https --yes\n\n# Add repository\necho \"deb https://baltocdn.com/helm/stable/debian/ all main\" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list\nsudo apt-get update\n\n# Install helm\nsudo apt-get install helm\n\n# Verify\nhelm version\n\n```\n\n### Setup AKS via Azure CLI\n\n```bash\n# Authenticate with Azure CLI\naz login\n\n# list regions with az\naz account list-locations\n\n# Create a resource group for our AKS cluster\naz group create --name GitHubActionsRunners --location westeurope\n\n# Get list of resources in the resource group\naz group show --resource-group GitHubActionsRunners\n\n# Verify Microsoft.OperationsManagement and Microsoft.OperationalInsights \n# are registered on your subscription.\naz provider show -n Microsoft.OperationsManagement -o table\naz provider show -n Microsoft.OperationalInsights -o table\n\n# Create AKS cluster in resource group\n# --name cannot exceed 63 characters and can only contain letters, \n# numbers, or dashes (-).\naz aks create \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster \\\n  --enable-addons monitoring \\\n  --node-count 1 \\\n  --generate-ssh-keys\n\n###############################################################################\n# Access K8s cluster\n###############################################################################\n\n# Configure kubectl to connect to your Kubernetes cluster\n# Downloads credentials and configures the Kubernetes CLI to use them.\n  # Uses ~/.kube/config, the default location for the Kubernetes configuration \n  # file. Specify a different location for your Kubernetes configuration file \n  # using --file.\naz aks get-credentials \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster\n\n# Verify\nkubectl config get-contexts\n# AND\nkubectl get nodes\n\n###############################################################################\n# Manually scaling nodes\n###############################################################################\n\n# Scale up\naz aks scale \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster \\\n  --node-count 3\n\n# Scale down\n# (OPTIONAL)\naz aks scale \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster \\\n  --node-count 1\n\n# Check progress\nwatch -n 3 kubectl get nodes\n\n```\n\n### Create ACR\n\n```bash\n###############################################################################\n# Reference: https://docs.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli\n###############################################################################\n\n# Create an Azure Container Registry instance\n  # The Basic SKU is a cost-optimized entry point for development purposes \n  # that provides a balance of storage and throughput.\n  # --name | 'registry_name': must conform to the following pattern: '^[a-zA-Z0-9]*$'\naz acr create \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsOHACR \\\n  --sku Basic\n\n# Integrate the new ACR with our existing AKS cluster\naz aks update \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster \\\n  --attach-acr GitHubActionsOHACR\n\n# Check that AKS can successfully connect to our ACR\n# 1. Get ACR FQDN\nACR_URL=$(az acr show \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsOHACR \\\n  --query loginServer \\\n  --output tsv) \\\n  \u0026\u0026 echo $ACR_URL\n\n# 2. Do the check\n  # REPLACE VALUE OF LOGIN_SERVER WITH YOUR ACR FQDN\naz aks check-acr \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster \\\n  --acr $ACR_URL\n```\n\n### Enable application gateway for our AKS cluster\n\n```bash\n# First create a public IP resource\naz network public-ip create \\\n  --resource-group GitHubActionsRunners \\\n  --name APGWPublicIp \\\n  --allocation-method Static \\\n  --sku Standard\n\n# Create the AppGW VNet\naz network vnet create \\\n  --name appgwVNet \\\n  --resource-group GitHubActionsRunners \\\n  --address-prefix 11.0.0.0/8 \\\n  --subnet-name appgwSubnet \\\n  --subnet-prefix 11.1.0.0/16\n\n# Create application gateway\naz network application-gateway create \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersAPGW \\\n  --location westeurope \\\n  --sku Standard_v2 \\\n  --public-ip-address APGWPublicIp \\\n  --vnet-name appgwVNet \\\n  --subnet appgwSubnet\n\n# Attach APGW to our AKS\nAPPGW_ID=$(az network application-gateway show \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersAPGW \\\n  --query \"id\" \\\n  --output tsv) \\\n  \u0026\u0026 echo $APPGW_ID\n\n# Enable APGW addon\naz aks enable-addons \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster \\\n  --addons ingress-appgw \\\n  --appgw-id $APPGW_ID\n\n# Peer the 2 VNets\n##################\n\n# Get AKS Cluster associated resource group\nNODERESOURCEGROUP=$(az aks show \\\n  --name GitHubActionsRunnersK8sCluster \\\n  --resource-group GitHubActionsRunners \\\n  --query \"nodeResourceGroup\" \\\n  --output tsv) \\\n  \u0026\u0026 echo $NODERESOURCEGROUP\n\n# Get AKS Cluster associated VNet from the resource group\nAKSVNETNAME=$(az network vnet list \\\n  --resource-group $NODERESOURCEGROUP \\\n  --query \"[0].name\" \\\n  --output tsv) \\\n  \u0026\u0026 echo $AKSVNETNAME\n\n# Get the AKS Cluster VNet ID\nAKSVNETID=$(az network vnet show \\\n  --name $AKSVNETNAME \\\n  --resource-group $NODERESOURCEGROUP \\\n  --query \"id\" \\\n  --output tsv) \\\n  \u0026\u0026 echo $AKSVNETID\n\n# Peer the AppGateway VNet to the AKS VNet\naz network vnet peering create \\\n  --name AppGWtoAKSVnetPeering \\\n  --resource-group GitHubActionsRunners \\\n  --vnet-name appgwVNet \\\n  --remote-vnet $AKSVNETID \\\n  --allow-vnet-access\n\n# Get AppGateway VNet ID\nAPPGWVNETID=$(az network vnet show \\\n  --name appgwVNet \\\n  --resource-group GitHubActionsRunners \\\n  --query \"id\" \\\n  --output tsv) \\\n  \u0026\u0026 echo $APPGWVNETID\n\n# Peer the AKS VNet to the AppGateway VNet\naz network vnet peering create \\\n  --name AKStoAppGWVnetPeering \\\n  --resource-group $NODERESOURCEGROUP \\\n  --vnet-name $AKSVNETNAME \\\n  --remote-vnet $APPGWVNETID \\\n  --allow-vnet-access\n```\n\n### Create and deploy a simple testing app\n\n```bash\nkubectl apply -f apps/test-app.yaml --namespace default\nkubectl apply -f ingress/ingress.yaml --namespace default\n\n# !!! IMPORTANT !!!\n#\n# Add a DNS alias for the public ip manually before proceeding\n#\n# !!! IMPORTANT !!!\n\n# Fetch the DNS alias\nAPGW_FQDN=$(az network public-ip show \\\n  --resource-group GitHubActionsRunners \\\n  --name APGWPublicIp \\\n  --query dnsSettings.fqdn \\\n  --output tsv) \\\n  \u0026\u0026 echo $APGW_FQDN\n\ncurl -G https://${APGW_FQDN}\n\n```\n\n### Create Cert Manager and setup TLS termination\n\n```bash\nACR_URL=$(az acr show \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsOHACR \\\n  --query loginServer \\\n  --output tsv) \\\n  \u0026\u0026 echo $ACR_URL\nREGISTRY_NAME=GitHubActionsOHACR\nCERT_MANAGER_REGISTRY=quay.io\nCERT_MANAGER_TAG=v1.6.1\nCERT_MANAGER_IMAGE_CONTROLLER=jetstack/cert-manager-controller\nCERT_MANAGER_IMAGE_WEBHOOK=jetstack/cert-manager-webhook\nCERT_MANAGER_IMAGE_CAINJECTOR=jetstack/cert-manager-cainjector\n\n# Import all the images and helm charts to our ACR\naz acr import \\\n  --name $REGISTRY_NAME \\\n  --source $CERT_MANAGER_REGISTRY/$CERT_MANAGER_IMAGE_CONTROLLER:$CERT_MANAGER_TAG \\\n  --image $CERT_MANAGER_IMAGE_CONTROLLER:$CERT_MANAGER_TAG \\\n\u0026\u0026 az acr import \\\n  --name $REGISTRY_NAME \\\n  --source $CERT_MANAGER_REGISTRY/$CERT_MANAGER_IMAGE_WEBHOOK:$CERT_MANAGER_TAG \\\n  --image $CERT_MANAGER_IMAGE_WEBHOOK:$CERT_MANAGER_TAG \\\n\u0026\u0026 az acr import \\\n  --name $REGISTRY_NAME \\\n  --source $CERT_MANAGER_REGISTRY/$CERT_MANAGER_IMAGE_CAINJECTOR:$CERT_MANAGER_TAG \\\n  --image $CERT_MANAGER_IMAGE_CAINJECTOR:$CERT_MANAGER_TAG\n\n# Create cert-manager namespace\nkubectl create namespace cert-manager\n\n# Label the cert-manager namespace to disable resource validation\nkubectl label namespace cert-manager cert-manager.io/disable-validation=true\n\n# Add the Jetstack Helm repository\nhelm repo add jetstack https://charts.jetstack.io\n\n# Update your local Helm chart repository cache\nhelm repo update\n\n# Install the cert-manager Helm chart\nhelm install cert-manager jetstack/cert-manager \\\n  --namespace cert-manager \\\n  --version $CERT_MANAGER_TAG \\\n  --set installCRDs=true \\\n  --set nodeSelector.\"kubernetes\\.io/os\"=linux \\\n  --set image.repository=$ACR_URL/$CERT_MANAGER_IMAGE_CONTROLLER \\\n  --set image.tag=$CERT_MANAGER_TAG \\\n  --set webhook.image.repository=$ACR_URL/$CERT_MANAGER_IMAGE_WEBHOOK \\\n  --set webhook.image.tag=$CERT_MANAGER_TAG \\\n  --set cainjector.image.repository=$ACR_URL/$CERT_MANAGER_IMAGE_CAINJECTOR \\\n  --set cainjector.image.tag=$CERT_MANAGER_TAG\n\n# Create an issuer: cluster-issuer.yaml;\n# Apply the configuration - it has to be without a namespace!!\nkubectl apply -f cert-manager/cluster-issuer-staging.yaml\n\n# Update the ingress controller to use the cert-manager issuer\nkubectl apply -f ingress/ingress-tls.yaml -n default\n```\n\n### Setup actions-runner-controller\n\n```bash\n# !!! IMPORTANT !!!\n#\n# Setup a GitHub App manually before proceeding\n#\n# # Permissions \n# - Actions: Read-only\n# - Contents: Read-only\n# - Metadata: Read-only\n# - Self-hosted runners: Read and Write\n# \n# # Webhook events\n# - Workflow job\n# - Workflow dispatch\n# - Workflow run\n#\n# !!! IMPORTANT !!!\n\n# Fetch the installation id\n# This requires the setup of:\n# - https://cli.github.com/\n# - https://github.com/link-/gh-token\ngh token installations -i \u003cAPPLICATION_ID\u003e -k \u003cPATH_TO_PKEY\u003e\n\n# !!! IMPORTANT !!!\n#\n# Update the values.yaml file with the appropriate values\n#\n# !!! IMPORTANT !!!\n\n# Install actions-runner-controller\n# Add the actions-runner-controller Helm chart repository\nhelm repo add \\\n  actions-runner-controller \\\n  https://actions-runner-controller.github.io/actions-runner-controller\n\n# Update your local Helm chart repository cache\nhelm repo update\n\n# Install the actions-runner-controller Helm chart\nhelm upgrade --install \\\n  -f actions-runner-controller/values.yaml \\\n  --namespace default \\\n  --create-namespace \\\n  --wait \\\n  actions-runner-controller \\\n  actions-runner-controller/actions-runner-controller\n\n#\n# Update the ingress/ingress-tls-runners.yaml with the appropriate \n# hostname and the actions-runner-controller service name\n#\n\n# Update the ingress controller\nkubectl apply -f ingress/ingress-tls-runners.yaml --namespace default\n\n# !!! IMPORTANT !!!\n#\n# Update the actions-runner-controller/autoscale_webhook.yaml file with your organization's name\n#\n# !!! IMPORTANT !!!\n\n# Create a new runner deployment\nkubectl apply -f actions-runner-controller/autoscale_webhook.yaml --namespace default\n\n# Execute some sample runs\n```\n\n### Start / Stop AKS\n\n```bash\n# Stop AKS\naz aks stop \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster\n\n# Stop application gateway\naz network application-gateway stop \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersAPGW\n\n# Start AKS\naz aks start \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersK8sCluster\n\n# Start application gateway\naz network application-gateway start \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsRunnersAPGW\n\n# !!! IMPORTANT !!!\n#\n# Remember, when you start the application gateway, you need to \n# reapply the Ingress configuration, otherwise you'll get 502 errors\n#\n# !!! IMPORTANT !!!\n```\n\n## Advanced Configuration\n\n### Configuring our Web Application Firewall (WAF)\n\nDescribed in the video\n\n### Enable and use Docker in Docker\n\nThis is as simple as updating the runner deployment with these properties:\n\n```yaml\nspec:\n  replicas: 0\n  template:\n    spec:\n      organization: Inner-Sanctum\n      labels:\n        - azure\n        - docker\n      image: summerwind/actions-runner-dind\n      dockerdWithinRunnerContainer: true\n```\n\nThen create the new DinD enabled deployment:\n\n```bash\nkubectl apply -f actions-runner-controller/dind_deployment.yaml --namespace default\n```\n\n### Creating custom self-hosted runner images\n\nStart by editing `custom-runners/Dockerfile` to include the dependencies you need in your runners:\n\n```Dockerfile\nFROM summerwind/actions-runner:latest\n\n# This will be a good place to add your CA bundle if you're using\n# a custom CA.\n\n# If you have proxy configurations, you can also add them here\n\n# Change the work dir to tmp because these are disposable files\nWORKDIR /tmp\n\n# EXAMPLE\n# Install a stable version of Go\n# and verify checksum of the tarball\n# \n# Go releases URL: https://go.dev/dl/\n#\nRUN curl -OL https://go.dev/dl/go1.17.6.linux-amd64.tar.gz \u0026\u0026 \\\n    echo \"231654bbf2dab3d86c1619ce799e77b03d96f9b50770297c8f4dff8836fc8ca2  go1.17.6.linux-amd64.tar.gz\" | sha256sum -c - \u0026\u0026 \\\n    sudo tar -C /usr/local -xvf go1.17.6.linux-amd64.tar.gz \u0026\u0026 \\\n    export PATH=$PATH:/usr/local/go/bin \u0026\u0026 \\\n    go version\n```\n\nThen we need to tag and push the image to our Azure Container Registry:\n\n```bash\n# Fetch ACR's FQDN\nACR_URL=$(az acr show \\\n  --resource-group GitHubActionsRunners \\\n  --name GitHubActionsOHACR \\\n  --query loginServer \\\n  --output tsv) \\\n  \u0026\u0026 echo $ACR_URL\n\n# Login to ACR\naz acr login --name GitHubActionsOHACR\n\n# Verify we're logged in\ncat ~/.docker/config.json | jq \".auths\"\n\n# You need to be in the root directory of this repository for this to work\n# Build and tag the new runner image\ndocker build --tag $ACR_URL/runner-image:go1.17.6 --file $(pwd)/custom-runners/Dockerfile .\n\n# List the image and verify the tag\ndocker image list\n\n# Push the image to ACR\ndocker push $ACR_URL/runner-image:go1.17.6\n\n# !!! IMPORTANT !!!\n# \n# Edit the actions-runner-controller/go-runners-autoscale_webhook.yaml to point\n# to the correct container image and tag\n#\n# !!! IMPORTANT !!!\n\n# Now we need to create a new deployment for the custom runners:\nkubectl apply -f actions-runner-controller/go-runners-autoscale_webhook.yaml --namespace default\n\n# Run a test with the custom-runner.yaml workflow\n```\n\n### Setup multiple actions-runner-controllers in different namespaces\n\n```bash\n# Create the new namespace\nkubectl create namespace altns\n\n# !!! IMPORTANT !!!\n#\n# In order to configure multiple actions-runner-controllers in different\n# namesapces we have to introduce changes to these keys in the values.yaml\n# Replace \"altns\" with the name of your namespace\n#\n# - nameOverride: \"altns\"\n# - fullnameOverride: \"altns-actions-runner-controller\"\n# - scope.singleNamespace: true\n# - scope.watchNamespace: \"altns\"\n# - githubWebhookServer.nameOverride: \"altns\"\n# - githubWebhookServer.fullnameOverride: \"altns-github-webhook-server\"\n#\n# !!! IMPORTANT !!!\n\n# Update the previous installation of actions-runner-controller in the\n# default namespace to support multi-namespace installations\nhelm upgrade --install \\\n  -f actions-runner-controller/multi_namespace_values.yaml \\\n  --namespace default \\\n  --wait \\\n  actions-runner-controller \\\n  actions-runner-controller/actions-runner-controller\n\n# Install a new actions-runner-controller in the altns namespace\nhelm upgrade --install \\\n  -f actions-runner-controller/alt-namespace/values.yaml \\\n  --namespace altns \\\n  --wait \\\n  actions-runner-controller \\\n  actions-runner-controller/actions-runner-controller\n\n# !!! IMPORTANT !!!\n#\n# Update enterprise and organization settings to allow the \"Default\" group \n# to be used by all organizations and repositories\n#\n# !!! IMPORTANT !!!\n\n# Deploy new ingress configurations\nkubectl apply -f ingress/multi-namespaces-ingress.yaml --namespace default\n# altns ingress configuration\nkubectl apply -f ingress/altns-ingress.yaml --namespace altns\n\n# !!! IMPORTANT !!!\n#\n# Configure the Enterprise webhooks manually\n# https://github.com/enterprises/:ENTERPRISE_NAME/settings/hooks\n#\n# !!! IMPORTANT !!!\n\n# Deploy actions-runner-controllers\nkubectl apply -f actions-runner-controller/alt-namespace/autoscale_webhook.yaml\n```\n\n### NUKE THE SETUP\n\nThis will destroy the resource group and all the services associated with it (i.e. everything created above).\n\n```bash\naz group delete --name GitHubActionsRunners\n```\n\n## References\n\n- **Adopting GitHub Actions for Enterprise Guide:**\n  - GitHub Enterprise Cloud: \u003chttps://docs.github.com/en/enterprise-cloud@latest/admin/guides\u003e\n  - GitHub Enterprise Server: \u003chttps://docs.github.com/en/enterprise-server@latest/admin/guides\u003e\n- **Azure AKS docs:** \u003chttps://docs.microsoft.com/en-us/azure/aks/\u003e\n- **Azure Application Gateway docs:** \u003chttps://docs.microsoft.com/en-us/azure/application-gateway/\u003e\n- **Azure CLI docs:** \u003chttps://docs.microsoft.com/en-us/cli/azure/\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flink-%2Factions-at-scale-ghoh","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flink-%2Factions-at-scale-ghoh","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flink-%2Factions-at-scale-ghoh/lists"}