CodeQL actions is failing because of the self-signed certificate

[Edarjak]

Hi community,

Perhaps someone can recommend the workaround for this issue?

RunnerDeployment:

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: github-actions-runners-micro
  namespace: github-actions-runners-micro
spec:
  replicas: 3
  template:
    spec:
      env:
        - name: NODE_EXTRA_CA_CERTS
          value: /etc/ssl/certs/root-ca.pem
      organization: myorg
      labels:
        - x-micro
        - micro
      group: Default
      resources:
        limits:
          cpu: "0.25"
          memory: "0.5Gi"
          ephemeral-storage: "20Gi"
        requests:
          cpu: "0.125"
          memory: "0.5Gi"
          ephemeral-storage: "20Gi"
      volumes:
        - name: ca-cert
          configMap:
            name: ca-cert
      volumeMounts:
        - name: ca-cert
          mountPath: /etc/ssl/certs/root-ca.pem
          subPath: root-ca.pem
          readOnly: true
      containers:
        - name: docker
          image: my-docker-images.artifactory.myhost.com/repo/docker:dind

Would be very thankful for help!

[Edarjak]

I have created a configMap with certificate chain (contains root CA). But would be nice to understand the location where that chain should be added on the runner and how it should look like in the RunnerDeplyment (as an env variable or Volume?)

[HotelSixXrayOne]

Bump for visibility, running into this same issue.

[kalined]

Hi @HotelSixXrayOne and @Edarjak,

You may try to create .env file:

NODE_EXTRA_CA_CERTS=/etc/ssl/certs/root-ca.pem

And attach it to the runner using configMap (add .env as configMap), volumes and volumeMounts:

    volumes:
        - name: env-file
          configMap:
            name: env-file
        - name: ca-cert
          configMap:
            name: ca-cert
      volumeMounts:
        - name: env-file
          mountPath: /runner/.env
          subPath: .env
          readOnly: true
        - name: ca-cert
          mountPath: /etc/ssl/certs/root-ca.pem
          subPath: root-ca.pem
          readOnly: true

If you are running GHES in the isolated environment, try to sync CodeQL action, more info here: https://github.com/github/codeql-action-sync-tool

Br,

[Edarjak]

Hi @kalined,

Thanks, that helped!

Br,