Can't create Org runners 403 Must have admin rights to Repository

[trent-abc]

I came across an issue where when creating organization level runners I was getting 0 pods online. Just thought I'd share my experience for any future readers.

When searching through the manager logs: k -n actions-runner-system logs controller-manager-755dc6577f-6zqtz I got the following error:

2023-05-24T18:13:40Z	ERROR	actions-runner-controller.runner	Failed to get new registration token	{"runner": "k8s-ephemeral-actions-runners-7gbzv-pxb5f", "error": "failed to create registration token: POST https://api.github.com/orgs/SomeOrg/actions/runners/registration-token: 403 Must have admin rights to Repository. []"}
github.com/actions-runner-controller/actions-runner-controller/controllers.(*RunnerReconciler).processRunnerCreation
	/workspace/controllers/runner_controller.go:213
github.com/actions-runner-controller/actions-runner-controller/controllers.(*RunnerReconciler).Reconcile
	/workspace/controllers/runner_controller.go:127
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:114
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227

Turns out it wasn't enough to delete the secret PAT and re-create it

 k -n actions-runner-system delete secret controller-manager
 k create secret generic controller-manager -n actions-runner-system --from-literal=github_token=<MY_SUPER_ADMIN_TOKEN>

I also had to delete the controller-manager pod to get things working:

k -n actions-runner-system delete pod controller-manager-755dc6577f-6zqtz

I was also unsure about what exact privileges were needed in the PAT, maybe I missed that in the documentation.

[trent-abc]

No answer required