### Install Dependencies with Homebrew

Source: https://github.com/actions/actions-runner-controller/blob/master/test/platforms/aws-eks/README.md

Installs awscli, aws-iam-authenticator, and terraform using Homebrew. Ensure you have Homebrew installed and configured.

```bash
brew install awscli aws-iam-authenticator terraform
```

--------------------------------

### Install GitHub Webhook Server with Helm (NodePort)

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Installs the GitHub webhook server using Helm, enabling it and exposing it via NodePort 33080. This requires subsequent configuration of an external load balancer.

```console
helm upgrade --install --namespace actions-runner-system --create-namespace \
             --wait actions-runner-controller actions-runner-controller/actions-runner-controller \
             --set "githubWebhookServer.enabled=true,service.type=NodePort,githubWebhookServer.ports[0].nodePort=33080"
```

--------------------------------

### Install ARC with Helm

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/about-arc.md

Installs the Actions Runner Controller and its custom resources into the specified namespace using Helm. Ensure custom-values.yaml is configured appropriately.

```bash
helm install -f custom-values.yaml --wait --namespace actions-runner-system \
  --create-namespace actions-runner-controller \
  actions-runner-controller/actions-runner-controller
```

--------------------------------

### Advanced RunnerSet Configuration

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/deploying-arc-runners.md

A complex RunnerSet example demonstrating SELinux options, resource limits, and container-specific configurations for runner and docker containers.

```yaml
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerSet
metadata:
  name: example
spec:
  replicas: 1
  repository: mumoshu/actions-runner-controller-ci
  dockerdWithinRunnerContainer: true
  template:
    spec:
      securityContext:
        # All level/role/type/user values will vary based on your SELinux policies.
        # See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atomic_host/7/html/container_security_guide/docker_selinux_security_policy for information about SELinux with containers
        seLinuxOptions:
          level: "s0"
          role: "system_r"
          type: "super_t"
          user: "system_u"
      containers:
      - name: runner
        env: []
        resources:
          limits:
            cpu: "4.0"
            memory: "8Gi"
          requests:
            cpu: "2.0"
            memory: "4Gi"
        # This is an advanced configuration. Don't touch it unless you know what you're doing.
        securityContext:
          # Usually, the runner container's privileged field is derived from dockerdWithinRunnerContainer.
          # But in the case where you need to run privileged job steps even if you don't use docker/don't need dockerd within the runner container,
          # just specified `privileged: true` like this.
          # See https://github.com/actions/actions-runner-controller/issues/1282
          # Do note that specifying `privileged: false` while using dind is very likely to fail, even if you use some vm-based container runtimes
          # like firecracker and kata. Basically they run containers within dedicated micro vms and so
          # it's more like you can use `privileged: true` safer with those runtimes.
          #
          # privileged: true
      - name: docker
        resources:
          limits:
            cpu: "4.0"
            memory: "8Gi"
          requests:
            cpu: "2.0"
            memory: "4Gi"
```

--------------------------------

### Run integration tests with Ginkgo

Source: https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md

Executes the integration test suite using make or manual setup.

```shell
make test-with-deps
```

```shell
go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
export KUBEBUILDER_ASSETS=$(setup-envtest use -p path)
go test -v -run TestAPIs github.com/actions/actions-runner-controller/controllers/actions.summerwind.net
```

```shell
GINKGO_FOCUS='[It] should create a new Runner resource from the specified template, add a another Runner on replicas increased, and removes all the replicas when set to 0' \
  go test -v -run TestAPIs github.com/actions/actions-runner-controller/controllers/actions.summerwind.net
```

--------------------------------

### Kustomize Configuration for Webhook Server

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Example of how to include the GitHub webhook server resources in a Kustomize `kustomization.yaml` file. This snippet shows the basic structure for adding resources.

```yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:

```

--------------------------------

### Install GitHub Webhook Server with Helm (Ingress)

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Installs the GitHub webhook server using Helm without explicitly setting a NodePort, suitable for use with Kubernetes Ingress controllers. This creates a deployment and service for receiving webhooks.

```console
helm upgrade --install --namespace actions-runner-system --create-namespace \
             --wait actions-runner-controller actions-runner-controller/actions-runner-controller \
             --set "githubWebhookServer.enabled=true"
```

--------------------------------

### Install cert-manager

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/quickstart.md

Installs the required cert-manager dependency into the Kubernetes cluster using kubectl.

```shell
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.8.2/cert-manager.yaml
```

--------------------------------

### Deploy ARC with Helm

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/installing-arc.md

Adds the official repository and installs the controller into the actions-runner-system namespace.

```shell
helm repo add actions-runner-controller https://actions-runner-controller.github.io/actions-runner-controller
helm upgrade --install --namespace actions-runner-system --create-namespace \
             --wait actions-runner-controller actions-runner-controller/actions-runner-controller
```

--------------------------------

### Install ARC in Single Namespace Mode

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/adrs/2023-04-11-limit-manager-role-permission.md

Use this Helm command to install the actions-runner-controller, configuring it to watch resources in a specific namespace. Ensure the target namespace is created beforehand.

```bash
helm install arc --namespace arc-system --set watchSingleNamespace=test-namespace oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller
```

--------------------------------

### Controller Pod Log Error Example

Source: https://github.com/actions/actions-runner-controller/blob/master/test/platforms/aws-eks/README.md

An example log output from a controller pod indicating a failure to initialize the Actions service client, specifically a DNS resolution timeout when trying to reach api.github.com.

```log
ERROR   AutoscalingRunnerSet    Failed to initialize Actions service client for creating a new runner scale set {"autoscalingrunnerset": "arc-runners/arc-runner-set", "error": "failed to get runner registration token: Post \"https://api.github.com/app/installations/33454774/access_tokens\": POST https://api.github.com/app/installations/33454774/access_tokens giving up after 5 attempt(s): Post \"https://api.github.com/app/installations/33454774/access_tokens\": dial tcp: lookup api.github.com: i/o timeout"}
```

--------------------------------

### Verify Kubectl Installation

Source: https://github.com/actions/actions-runner-controller/blob/master/test/platforms/aws-eks/README.md

Verifies that kubectl is correctly configured and connected to the cluster by displaying cluster information.

```bash
# Verify your installation
kubectl cluster-info
```

--------------------------------

### Add Startup Delay to Runner Pod

Source: https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md

Set the STARTUP_DELAY_IN_SECONDS environment variable to introduce a delay before the runner script starts. This helps when the runner pod starts before network services like Istio are fully configured.

```yaml
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: example-runnerdeployment-with-sleep
spec:
  template:
    spec:
      ...
      env:
        - name: STARTUP_DELAY_IN_SECONDS
          value: "5"
```

--------------------------------

### RunnerDeployment Configuration Example

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

This YAML defines a RunnerDeployment with various settings including replicas, node selectors, SELinux options, tolerations, repository, image, resource limits, and Docker configurations.

```yaml
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: actions-runner
  namespace: default
spec:
  replicas: 2
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
    spec:
      priorityClassName: "high"
      nodeSelector:
        node-role.kubernetes.io/test: ""

      securityContext:
        #All level/role/type/user values will vary based on your SELinux policies.
        #See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atomic_host/7/html/container_security_guide/docker_selinux_security_policy for information about SELinux with containers
        seLinuxOptions:
          level: "s0"
          role: "system_r"
          type: "super_t"
          user: "system_u"

      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/test
        operator: Exists

      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              runner-deployment-name: actions-runner

      repository: mumoshu/actions-runner-controller-ci
      # The default "summerwind/actions-runner" images are available at DockerHub:
      # https://hub.docker.com/r/summerwind/actions-runner
      # You can also build your own and specify it like the below:
      image: custom-image/actions-runner:latest
      imagePullPolicy: Always
      resources:
        limits:
          cpu: "4.0"
          memory: "8Gi"
        requests:
          cpu: "2.0"
          memory: "4Gi"
      # Timeout after a node crashed or became unreachable to evict your pods somewhere else (default 5mins)
      tolerations:
        - key: "node.kubernetes.io/unreachable"
          operator: "Exists"
          effect: "NoExecute"
          tolerationSeconds: 10
      # true (default) = The runner restarts after running jobs, to ensure a clean and reproducible build environment
      # false = The runner is persistent across jobs and doesn't automatically restart
      # This directly controls the behaviour of `--once` flag provided to the github runner
      ephemeral: false
      # true (default) = A privileged docker sidecar container is included in the runner pod.
      # false = A docker sidecar container is not included in the runner pod and you can't use docker.
      # If set to false, there are no privileged container and you cannot use docker.
      dockerEnabled: false
      # Optional Docker containers network MTU
      # If your network card MTU is smaller than Docker's default 1500, you might encounter Docker networking issues.
      # To fix these issues, you should setup Docker MTU smaller than or equal to that on the outgoing network card.
      # More information:
      # - https://mlohr.com/docker-mtu/
      dockerMTU: 1500
      # Optional Docker registry mirror
      # Docker Hub has an aggressive rate-limit configuration for free plans.
      # To avoid disruptions in your CI/CD pipelines, you might want to setup an external or on-premises Docker registry mirror.
      # More information:
      # - https://docs.docker.com/docker-hub/download-rate-limit/
      # - https://cloud.google.com/container-registry/docs/pulling-cached-images
      dockerRegistryMirror: https://mirror.gcr.io/
      # false (default) = Docker support is provided by a sidecar container deployed in the runner pod.
      # true = No docker sidecar container is deployed in the runner pod but docker can be used within the runner container instead. The image summerwind/actions-runner-dind is used by default.
      dockerdWithinRunnerContainer: true
      #Optional environment variables for docker container
      # Valid only when dockerdWithinRunnerContainer=false
      dockerEnv:
        - name: HTTP_PROXY
          value: http://example.com
      # Docker sidecar container image tweaks examples below, only applicable if dockerdWithinRunnerContainer = false
      dockerdContainerResources:
        limits:
          cpu: "4.0"
          memory: "8Gi"
        requests:
          cpu: "2.0"
          memory: "4Gi"
      # Additional N number of sidecar containers
      sidecarContainers:
        - name: mysql
          image: mysql:5.7
          env:
            - name: MYSQL_ROOT_PASSWORD
              value: abcd1234
          securityContext:
            runAsUser: 0
      # workDir if not specified (default = /runner/_work)
      # You can customise this setting allowing you to change the default working directory location
      # for example, the below setting is the same as on the ubuntu-18.04 image
      workDir: /home/runner/work
      # You can mount some of the shared volumes to the dind container using dockerVolumeMounts, like any other volume mounting.

```

--------------------------------

### Deploy ARC via Helm

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/quickstart.md

Adds the ARC Helm repository and installs the controller with a GitHub authentication token.

```shell
helm repo add actions-runner-controller https://actions-runner-controller.github.io/actions-runner-controller
```

```shell
helm upgrade --install --namespace actions-runner-system --create-namespace\
  --set=authSecret.create=true\
  --set=authSecret.github_token="REPLACE_YOUR_TOKEN_HERE"\
  --wait actions-runner-controller actions-runner-controller/actions-runner-controller
```

--------------------------------

### Get Application URL with Ingress

Source: https://github.com/actions/actions-runner-controller/blob/master/charts/actions-runner-controller/templates/NOTES.txt

Use this command when the application is exposed via Ingress. It iterates through configured hosts and paths to construct the URLs.

```go-template
{{- if .Values.githubWebhookServer.ingress.enabled }}
{{- range $host := .Values.githubWebhookServer.ingress.hosts }}
  {{- range .paths }}
  http{{ if $.Values.githubWebhookServer.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
  {{- end }}
{{- end }}
{{- end }}
```

--------------------------------

### Dockerfile for Runner Image Build Stage

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/adrs/2022-10-17-runner-image.md

This Dockerfile defines the build stage for the runner image. It installs necessary utilities, downloads the runner binary and container hooks, and configures the working directory. Build arguments can control the runner version, platform, and hooks version.

```docker
FROM mcr.microsoft.com/dotnet/runtime-deps:6.0 as build

ARG RUNNER_ARCH="x64"
ARG RUNNER_VERSION=2.298.2
ARG RUNNER_CONTAINER_HOOKS_VERSION=0.1.3

RUN apt update -y && apt install curl unzip -y

WORKDIR /actions-runner
RUN curl -f -L -o runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${RUNNER_ARCH}-${RUNNER_VERSION}.tar.gz 
    && tar xzf ./runner.tar.gz 
    && rm runner.tar.gz

RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip 
    && unzip ./runner-container-hooks.zip -d ./k8s 
    && rm runner-container-hooks.zip
```

--------------------------------

### Legacy `HorizontalRunnerAutoscaler` Spec for `push` Event

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/releasenotes/0.27.md

This example shows the previous configuration for triggering autoscaling based on a `push` event. Update this to use `workflowJob`.

```yaml
kind: HorizontalRunnerAutoscaler
spec:
  scaleUpTriggers:
    - githubEvent:
        push: {}

```

--------------------------------

### Pod Spec Example with Init Container

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/adrs/2022-10-17-runner-image.md

This YAML defines a Kubernetes Pod specification that uses an init container to copy runner assets into a shared volume. The main container then uses these assets to run the GitHub Actions runner.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: <name>
spec:
  containers:
    - name: runner
      image: <image>
      command: ["/runner/run.sh"]
      volumeMounts:
        - name: runner
          mountPath: /runner
  initContainers:
    - name: setup
      image: <image>
      command: ["sh", "-c", "cp -r /actions-runner/* /runner/"]
      volumeMounts:
        - name: runner
          mountPath: /runner
  volumes:
    - name: runner
      emptyDir: {}

```

--------------------------------

### Configure RunnerDeployment and HRA for Webhook Scaling

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Example configuration for a RunnerDeployment and its associated HorizontalRunnerAutoscaler (HRA) to enable scaling based on the 'workflow_job' webhook event. Ensure the HRA's scaleTargetRef points to the correct RunnerDeployment or RunnerSet.

```yaml
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: example-runners
spec:
  template:
    spec:
      repository: example/myrepo
---
apiVersion: actions.summerwind.dev/v1alpha1
kind: HorizontalRunnerAutoscaler
metadata:
  name: example-runners
spec:
  minReplicas: 1
  maxReplicas: 10
  scaleTargetRef:
    kind: RunnerDeployment
    # # In case the scale target is RunnerSet:
    # kind: RunnerSet
    name: example-runners
  scaleUpTriggers:
    - githubEvent:
        workflowJob: {}
      duration: "30m"
```

--------------------------------

### Build and deploy controller and runner images

Source: https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md

Updates the controller and runner images and deploys them to a kind cluster. Requires environment variables like DOCKER_USER and GITHUB_TOKEN to be set.

```shell
VERSION=controller1 \
  RUNNER_TAG=runner1 \
  make acceptance/pull acceptance/kind docker-buildx acceptance/load acceptance/deploy
```

--------------------------------

### Set githubWebhookServer Pod Disruption Budget Min Available

Source: https://github.com/actions/actions-runner-controller/blob/master/charts/actions-runner-controller/README.md

Configure the minimum number of githubWebhookServer pods that must remain available after an eviction.

```yaml
githubWebhookServer.podDisruptionBudget.minAvailable
```

--------------------------------

### Enable githubWebhookServer Ingress

Source: https://github.com/actions/actions-runner-controller/blob/master/charts/actions-runner-controller/README.md

Deploy an ingress resource for the githubWebhookServer. Defaults to false.

```yaml
githubWebhookServer.ingress.enabled: false
```

--------------------------------

### HTTP DELETE Request Example

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/adrs/2022-12-27-pick-the-right-runner-to-scale-down.md

This is an example of an HTTP DELETE request made to the Actions service to remove a runner. The Actions service returns 204 for success or 400 with an error like JobStillRunningException if the runner is busy.

```http
DELETE https://pipelines.actions.githubusercontent.com/WoxlUxJHrKEzIp4Nz3YmrmLlZBonrmj9xCJ1lrzcJ9ZsD1Tnw7/_apis/distributedtask/pools/0/agents/1024
```

--------------------------------

### Get Application URL with LoadBalancer

Source: https://github.com/actions/actions-runner-controller/blob/master/charts/actions-runner-controller/templates/NOTES.txt

Use this command for LoadBalancer service types. Note that it may take a few minutes for the LoadBalancer IP to become available. You can monitor its status using 'kubectl get svc -w'.

```bash
export SERVICE_IP=$(kubectl get svc --namespace {{ include "actions-runner-controller.namespace" . }} {{ include "actions-runner-controller.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}})
echo http://$SERVICE_IP:{{ .Values.service.port }}
```

--------------------------------

### Initialize Terraform

Source: https://github.com/actions/actions-runner-controller/blob/master/test/platforms/aws-eks/README.md

Initializes the Terraform working directory. This command downloads the necessary providers and modules. You can use Terraform Cloud, but ensure your main.tf is updated accordingly.

```bash
# You're free to use terraform cloud but you need to update main.tf first
terraform init
```

--------------------------------

### Configure Runner Storage and Runtime

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Set storage medium, size limits, and runtime class for runner pods. Use volumeSizeLimit to manage local storage resources per pod.

```yaml
      volumeStorageMedium: ""
      volumeSizeLimit: 4Gi
      runtimeClassName: "runc"
```

--------------------------------

### Implement TotalNumberOfQueuedAndInProgressWorkflowRuns metric

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Example of a RunnerDeployment paired with a HorizontalRunnerAutoscaler using the TotalNumberOfQueuedAndInProgressWorkflowRuns metric.

```yaml
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: example-runner-deployment
spec:
  template:
    spec:
      repository: example/myrepo
---
apiVersion: actions.summerwind.dev/v1alpha1
kind: HorizontalRunnerAutoscaler
metadata:
  name: example-runner-deployment-autoscaler
spec:
  scaleTargetRef:
    kind: RunnerDeployment
    # # In case the scale target is RunnerSet:
    # kind: RunnerSet
    name: example-runner-deployment
  minReplicas: 1
  maxReplicas: 5
  metrics:
  - type: TotalNumberOfQueuedAndInProgressWorkflowRuns
    repositoryNames:
    # A repository name is the REPO part of `github.com/OWNER/REPO`
    - myrepo
```

--------------------------------

### Retrieve Release Tags

Source: https://github.com/actions/actions-runner-controller/blob/master/hack/signrel/README.md

List all available release tags for the project.

```console
$ go run . tags | jq -r .[].tag_name
```

--------------------------------

### List Webhook Configurations

Source: https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md

Use these commands to identify existing webhook configurations that may need to be removed.

```bash
kubectl get validatingwebhookconfiguration -A
kubectl get mutatingwebhookconfiguration -A
```

--------------------------------

### Build and push runner images

Source: https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md

Builds and pushes the runner image and restarts pods to apply changes.

```makefile
NAME=$DOCKER_USER/actions-runner make \
  -C runner docker-{build,push}-ubuntu && \
  (kubectl get po -ojsonpath={.items[*].metadata.name} | xargs -n1 kubectl delete po)
```

--------------------------------

### Create Kubernetes Secret for GitHub App

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/authenticating-to-the-github-api.md

Registers the App ID, Installation ID, and private key as a Kubernetes secret for the controller manager.

```shell
$ kubectl create secret generic controller-manager \
    -n actions-runner-system \
    --from-literal=github_app_id=${APP_ID} \
    --from-literal=github_app_installation_id=${INSTALLATION_ID} \
    --from-file=github_app_private_key=${PRIVATE_KEY_FILE_PATH}
```

--------------------------------

### Get Application URL with NodePort

Source: https://github.com/actions/actions-runner-controller/blob/master/charts/actions-runner-controller/templates/NOTES.txt

This command is used when the service type is NodePort. It retrieves the NodePort and Node IP to construct the application URL.

```bash
export NODE_PORT=$(kubectl get --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "actions-runner-controller.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ include "actions-runner-controller.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
```

--------------------------------

### Configure Docker Startup Wait Time

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/releasenotes/0.27.md

Use the WAIT_FOR_DOCKER_SECONDS environment variable to define the duration the runner startup script waits for the Docker daemon to become available.

```bash
WAIT_FOR_DOCKER_SECONDS
```

--------------------------------

### Deploy AutoScalingRunnerSet in a Specific Namespace

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/adrs/2023-04-11-limit-manager-role-permission.md

Deploy an AutoScalingRunnerSet within a designated namespace using this Helm command. This is used in conjunction with the single-namespace installation of ARC.

```bash
helm install demo --namespace TestNamespace oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set
```

--------------------------------

### Configure Runner Volumes and Mounts

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Define hostPath volumes and mount them to the runner container. Ensure pod anti-affinity is configured when using hostPath to prevent scheduling conflicts.

```yaml
      volumes:
        - name: docker-extra
          hostPath:
            path: /mnt/docker-extra
            type: DirectoryOrCreate
        - name: repo
          hostPath:
            path: /mnt/repo
            type: DirectoryOrCreate
      dockerVolumeMounts:
        - mountPath: /var/lib/docker
          name: docker-extra
      volumeMounts:
        - mountPath: /home/runner/work/repo
          name: repo
```

--------------------------------

### Legacy `HorizontalRunnerAutoscaler` Spec for `pullRequest` Event

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/releasenotes/0.27.md

This example shows the previous configuration for triggering autoscaling based on a `pullRequest` event. Update this to use `workflowJob`.

```yaml
kind: HorizontalRunnerAutoscaler
spec:
  scaleUpTriggers:
    - githubEvent:
        pullRequest: {}

```

--------------------------------

### Run acceptance tests

Source: https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md

Executes acceptance tests with specific authentication configurations.

```shell
# This sets `VERSION` envvar to some appropriate value
. hack/make-env.sh

DOCKER_USER=*** \
  GITHUB_TOKEN=*** \
  APP_ID=*** \
  PRIVATE_KEY_FILE_PATH=path/to/pem/file \
  INSTALLATION_ID=*** \
  make acceptance
```

```shell
DOCKER_USER=*** \
  GITHUB_TOKEN=*** \
  ACCEPTANCE_TEST_DEPLOYMENT_TOOL=helm \
  ACCEPTANCE_TEST_SECRET_TYPE=token \
  make acceptance/run
```

```shell
KUBECONFIG=path/to/kubeconfig \
  DOCKER_USER=*** \
  GITHUB_TOKEN=*** \
  APP_ID=*** \
  PRIVATE_KEY_FILE_PATH=path/to/pem/file \
  INSTALLATION_ID=*** \
  ACCEPTANCE_TEST_SECRET_TYPE=token \
  make docker-build acceptance/setup \
       acceptance/deploy \
       acceptance/tests
```

--------------------------------

### Verify Release Asset Signature

Source: https://github.com/actions/actions-runner-controller/blob/master/hack/signrel/README.md

Use GPG to verify the authenticity of a downloaded release asset against its signature file.

```console
# Download the asset
curl -LO https://github.com/actions/actions-runner-controller/releases/download/v0.23.0/actions-runner-controller.yaml

# Download the signature file
curl -LO https://github.com/actions/actions-runner-controller/releases/download/v0.23.0/actions-runner-controller.yaml.asc

# Verify
gpg --verify actions-runner-controller.yaml{.asc,}
```

--------------------------------

### Legacy `HorizontalRunnerAutoscaler` Spec for `checkRun` Event

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/releasenotes/0.27.md

This example shows the previous configuration for triggering autoscaling based on a `checkRun` event. Update this to use `workflowJob`.

```yaml
kind: HorizontalRunnerAutoscaler
spec:
  scaleUpTriggers:
    - githubEvent:
        checkRun: {}

```

--------------------------------

### Configure RAM Disk for Runner Volumes

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/using-custom-volumes.md

Mounts runner work directories, Docker sidecars, and /tmp to memory-backed volumes for improved performance.

```yaml
kind: RunnerDeployment
spec:
  template:
    spec:
      dockerVolumeMounts:
        - mountPath: /var/lib/docker
          name: docker
      volumeMounts:
        - mountPath: /tmp
          name: tmp
      volumes:
        - name: docker
          emptyDir:
            medium: Memory
        - name: work # this volume gets automatically used up for the workdir
          emptyDir:
            medium: Memory
        - name: tmp
          emptyDir:
            medium: Memory
      ephemeral: true # recommended to not leak data between builds.
```

--------------------------------

### Dockerfile Snippet: 20.04 Runner

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/releasenotes/0.27.md

This snippet shows the package installations for the Ubuntu 20.04 based runner image. Some packages present here might not be in the 22.04 images.

```dockerfile
RUN apt-get update && apt-get install -y --no-install-recommends 
	ca-certificates 
	curl 
	git 
	gettext 
	gnupg 
	jq 
	libicu-dev 
	libssl-dev 
	libtool 
	libtool-bin 
	procps 
	python3 
	python3-pip 
	rsync 
	sudo 
	tar 
	# For dind
	docker-ce 
	docker-ce-cli 
	# For rootless
	uidmap 
	gettext 
	# For testing
	ftp 
	telnet 
	upx 
	# For python
	python3-dev 
	# For nodejs
	nodejs 
	npm 
&& apt-get clean 
&& rm -rf /var/lib/apt/lists/*
```

--------------------------------

### Recreate controller pods with new image

Source: https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md

Builds a new controller image, loads it into the cluster, and deletes existing controller pods to force a restart with the updated image.

```shell
NAME=$DOCKER_USER/actions-runner-controller \
  make docker-build acceptance/load && \
  kubectl -n actions-runner-system delete po $(kubectl -n actions-runner-system get po -ojsonpath={.items[*].metadata.name})
```

--------------------------------

### Define Runner Labels in RunnerDeployment Spec

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/using-arc-runners-in-a-workflow.md

Specify one or more labels in your `Runner` or `RunnerDeployment` spec to distinguish self-hosted runners. This example uses the `custom-runner` label.

```yaml
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: custom-runner
spec:
  replicas: 1
  template:
    spec:
      repository: actions/actions-runner-controller
      labels:
        - custom-runner
```

--------------------------------

### Verify Runner Deployment

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/deploying-arc-runners.md

Use `kubectl get runners` to check the status and names of the deployed runners. This command confirms that the runners have been created according to the `replicas` setting in the `RunnerDeployment`.

```shell
kubectl get runners
```

--------------------------------

### Dockerfile Snippet: 22.04 Runner

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/releasenotes/0.27.md

This snippet shows the package installations for the Ubuntu 22.04 based runner image. Note the absence of packages like ftp, telnet, and upx compared to the 20.04 version.

```dockerfile
RUN apt-get update && apt-get install -y --no-install-recommends 
	ca-certificates 
	curl 
	git 
	gettext 
	gnupg 
	jq 
	libicu-dev 
	libssl-dev 
	libtool 
	libtool-bin 
	procps 
	python3 
	python3-pip 
	rsync 
	sudo 
	tar 
	# For dind
	docker-ce 
	docker-ce-cli 
	# For rootless
	uidmap 
	gettext 
	# For python
	python3-dev 
	# For nodejs
	nodejs 
	npm 
&& apt-get clean 
&& rm -rf /var/lib/apt/lists/*
```

--------------------------------

### Apply and verify RunnerDeployment

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/choosing-runner-destination.md

Commands to apply the Kubernetes manifest and verify the status of runners and pods.

```shell
$ kubectl apply -f runnerdeployment.yaml
runnerdeployment.actions.summerwind.dev/example-runnerdeploy created
```

```shell
$ kubectl get runners
NAME                             REPOSITORY                             STATUS
example-runnerdeploy2475h595fr   mumoshu/actions-runner-controller-ci   Running

$ kubectl get pods
NAME                           READY   STATUS    RESTARTS   AGE
example-runnerdeploy2475ht2qbr 2/2     Running   0          1m
```

--------------------------------

### Configure runner entrypoint environment variables

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/using-entrypoint-features.md

Use environment variables within the RunnerDeployment spec to control logging levels, startup delays, and runner update behavior.

```yaml
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: example-runnerdeployment
spec:
  template:
    spec:
      env:
        # Disable various runner entrypoint log levels 
        - name: LOG_DEBUG_DISABLED
          value: "true"
        - name: LOG_NOTICE_DISABLED
          value: "true"
        - name: LOG_WARNING_DISABLED
          value: "true"
        - name: LOG_ERROR_DISABLED
          value: "true"
        - name: LOG_SUCCESS_DISABLED
          value: "true"
        # Issues a sleep command at the start of the entrypoint
        - name: STARTUP_DELAY_IN_SECONDS
          value: "2"
        # Specify the duration to wait for the docker daemon to be available
        # The default duration of 120 seconds is sometimes too short
        # to reliably wait for the docker daemon to start
        # See https://github.com/actions/actions-runner-controller/issues/1804
        - name: WAIT_FOR_DOCKER_SECONDS
          value: 120
        # Disables the wait for the docker daemon to be available check
        - name: DISABLE_WAIT_FOR_DOCKER
          value: "true"
        # Disables automatic runner updates
        # WARNING : Upon a new version of the actions/runner software being released 
        # GitHub stops allocating jobs to runners on the previous version of the
        # actions/runner software after 30 days.
        - name: DISABLE_RUNNER_UPDATE
          value: "true"
```

--------------------------------

### Sign and Upload Release Assets

Source: https://github.com/actions/actions-runner-controller/blob/master/hack/signrel/README.md

Maintainers can use this command to automatically sign release assets and upload the resulting signature files.

```console
$ cd hack/signrel

$ for v in v0.23.0 actions-runner-controller-0.18.0 v0.22.3 v0.22.2 actions-runner-controller-0.17.2; do TAG=$v go run . sign; done
```

--------------------------------

### Kubernetes Secret and ARC Resources for Multitenancy

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/using-arc-across-organizations.md

This example shows a Kubernetes Secret containing GitHub App credentials and the corresponding `RunnerDeployment` and `HorizontalRunnerAutoscaler` resources configured for multitenancy. Ensure the `secretRef.name` matches the Kubernetes secret containing your GitHub App credentials.

```yaml
kind: Secret
data:
  github_app_id: ...
  github_app_installation_id: ...
  github_app_private_key: ...
---
kind: RunnerDeployment
metadata:
  namespace: org1-runners
spec:
  template:
    spec:
      githubAPICredentialsFrom:
        secretRef:
          name: org1-github-app
---
kind: HorizontalRunnerAutoscaler
metadata:
  namespace: org1-runners
spec:
  githubAPICredentialsFrom:
    secretRef:
      name: org1-github-app
```

--------------------------------

### Configure Prometheus Scraping Annotations

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/monitoring-and-troubleshooting.md

Add `podAnnotations` to enable Prometheus to scrape metrics from the controller. Ensure the port matches the configured metrics port.

```diff
podAnnotations:
+ prometheus.io/scrape: "true"
+ prometheus.io/path: /metrics
+ prometheus.io/port: "8080"
```

--------------------------------

### Helm Chart Install Failure: Unknown Authority Error

Source: https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md

This error indicates a problem with cert-manager's webhook, often due to an invalid or missing CA certificate. It typically occurs when the Kubernetes cluster is version 1.22 or greater and cert-manager has not been updated to support the newer API versions.

```text
Error: UPGRADE FAILED: failed to create resource: Internal error occurred: failed calling webhook "webhook.cert-manager.io": failed to call webhook: Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": x509: certificate signed by unknown authority
```

```text
$ kubectl -n cert-manager logs cert-manager-cainjector-7cdbb9c945-g6bt4
I0703 03:31:55.159339       1 start.go:91] "starting" version="v1.1.1" revision="3ac7418070e22c87fae4b22603a6b952f797ae96"
I0703 03:31:55.615061       1 leaderelection.go:243] attempting to acquire leader lease  kube-system/cert-manager-cainjector-leader-election...
I0703 03:32:10.738039       1 leaderelection.go:253] successfully acquired lease kube-system/cert-manager-cainjector-leader-election
I0703 03:32:10.739941       1 recorder.go:52] cert-manager/controller-runtime/manager/events "msg"="Normal"  "message"="cert-manager-cainjector-7cdbb9c945-g6bt4_88e4bc70-eded-4343-a6fb-0ddd6434eb55 became leader" "object"={"kind":"ConfigMap","namespace":"kube-system","name":"cert-manager-cainjector-leader-election","uid":"942a021e-364c-461a-978c-f54a95723cdc","apiVersion":"v1","resourceVersion":"1576"} "reason"="LeaderElection"
E0703 03:32:11.192128       1 start.go:119] cert-manager/ca-injector "msg"="manager goroutine exited" "error"=null
I0703 03:32:12.339197       1 request.go:645] Throttling request took 1.047437675s, request: GET:https://10.96.0.1:443/apis/storage.k8s.io/v1beta1?timeout=32s
E0703 03:32:13.143790       1 start.go:151] cert-manager/ca-injector "msg"="Error registering certificate based controllers. Retrying after 5 seconds." "error"="no matches for kind \"MutatingWebhookConfiguration\" in version \"admissionregistration.k8s.io/v1beta1\""
Error: error registering secret controller: no matches for kind "MutatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1beta1"
```

--------------------------------

### Enable githubWebhookServer Pod Disruption Budget

Source: https://github.com/actions/actions-runner-controller/blob/master/charts/actions-runner-controller/README.md

Enable a Pod Disruption Budget (PDB) to ensure high availability of githubWebhookServer pods. Defaults to false.

```yaml
githubWebhookServer.podDisruptionBudget.enabled: false
```

--------------------------------

### Deploy ARC via Kubectl

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/quickstart.md

Deploys the ARC controller directly using a manifest file.

```shell
kubectl apply -f \
https://github.com/actions/actions-runner-controller/\
releases/download/v0.22.0/actions-runner-controller.yaml
```

--------------------------------

### Set githubWebhookServer Ingress Annotations

Source: https://github.com/actions/actions-runner-controller/blob/master/charts/actions-runner-controller/README.md

Configure annotations for the githubWebhookServer ingress resource.

```yaml
githubWebhookServer.ingress.annotations
```

--------------------------------

### Configure Autoscaling with PercentageRunnersBusy (Factor)

Source: https://github.com/actions/actions-runner-controller/blob/master/docs/automatically-scaling-runners.md

Use this configuration to scale runners based on a percentage of busy runners, adjusting the count by a factor. Ensure PercentageRunnersBusy is the primary metric.

```yaml
---
aspects: actions.summerwind.dev/v1alpha1
kind: HorizontalRunnerAutoscaler
metadata:
  name: example-runner-deployment-autoscaler
spec:
  scaleTargetRef:
    kind: RunnerDeployment
    # # In case the scale target is RunnerSet:
    # kind: RunnerSet
    name: example-runner-deployment
  minReplicas: 1
  maxReplicas: 5
  metrics:
  - type: PercentageRunnersBusy
    scaleUpThreshold: '0.75'    # The percentage of busy runners at which the number of desired runners are re-evaluated to scale up
    scaleDownThreshold: '0.3'   # The percentage of busy runners at which the number of desired runners are re-evaluated to scale down
    scaleUpFactor: '1.4'        # The scale up multiplier factor applied to desired count
    scaleDownFactor: '0.7'      # The scale down multiplier factor applied to desired count

```