Sharing service account permissions with Github action

[aanogueira]

Hi,

I'm looking for help with the following scenario:

I'm running a local install of the runners.
When using a Github action with kubectl I get the error:

The connection to the server localhost:8080 was refused - did you specify the right host or port?
Error: Process completed with exit code 1.

If I set a kubeconfig it will work.

The problem is:

When using short lived tokens, I would have to be constantly updating the kubeconfig with the service account token.

Is there a way to share the RunnerDeployment token/config with the actual Github action executing kubectl?

Current configuration:

---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  name: runner
  namespace: default
---
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: runner
  namespace: default
spec:
  replicas: 1
  template:
    spec:
      automountServiceAccountToken: true
      dockerdWithinRunnerContainer: true
      env:
      - name: STARTUP_DELAY_IN_SECONDS
        value: "0"
      - name: DISABLE_WAIT_FOR_DOCKER
        value: "true"
      - name: DISABLE_RUNNER_UPDATE
        value: "true"
      ephemeral: true
      image: summerwind/actions-runner-dind:latest
      labels:
      - dev-enterprise
      - deepgram/dev-enterprise
      - infrastructure/dev-enterprise
      - platform/dev-enterprise
      - security/dev-enterprise
      - system/dev-enterprise
      organization: org
      serviceAccountName: runner
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: runner
rules:
- apiGroups:
  - ""
  resources:
  - '*'
  verbs:
  - get
  - list
  - create
  - patch
- apiGroups:
  - apps
  resources:
  - '*'
  verbs:
  - get
  - list
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: runner
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: runner
subjects:
- kind: ServiceAccount
  name: runner
  namespace: default

Thank you in advance.