K8s ARC Runner

Deploys a per-tenant GitHub Actions runner scale set into the Rabbit cluster via Actions Runner Controller.

Use this module when a repository's workflows need to run inside the Rabbit compute boundary: direct private-IP access to the tenant's Cloud SQL instance, a scoped GCP identity via Workload Identity, and no dependence on GitHub-hosted runner capacity.

Supported Features

• Repo-scoped runner scale set (runs-on: <runner_name>) via the official gha-runner-scale-set Helm chart.
• Dedicated namespace per tenant with ResourceQuota isolation.
• Workload Identity: KSA bound to a new minimal GSA in the client project.
• Granular, reviewable Secret Manager access grants (empty by default).
• GitHub App authentication materialized from Secret Manager (no PATs).
• Ephemeral runners with configurable min/max scaling and pod resources.

Prerequisites

• k8s-arc-controller deployed to the cluster.
• GitHub App credentials in Secret Manager and the repository added to the App installation.

Important Notes

• Runners deliberately start with no data access; add Secret Manager secret ids to secret_access to grant read access one secret at a time.
• The scale set registers on the repository, not the organization - it appears under the repo's Settings -> Actions -> Runners.
• chart_version must match the controller's chart version line.