Need help customizing ARC runner deployment pod Role permissions

[trjate]

Hi all -

I want to do helm deployments using ARC on our self-hosted runner, but can't figure out how to get around the following error.

[helm-secrets] Decrypt: helm/secrets.yaml
Error: query: failed to query with labels: secrets is forbidden: User "system:serviceaccount:github-actions-runner:<our_org>-2hdbb-7v5x6" cannot list resource "secrets" in API group "" in the namespace "test"

Here is my Github workflow:

name: Deploy to EKS

on:
  workflow_dispatch:
    inputs:
      docker_image:
        description: 'Docker Image to Deploy'
        required: true
      environment:
        description: 'Environment to Deploy Against'
        type: environment
        required: true

jobs:
  deploy:
    runs-on: self-hosted
    environment: staging

    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Decrypt secrets, Deploy, Re-encrypt secrets
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        AWS_REGION: eu-west-1
      run: |
        helm secrets upgrade --debug --install --create-namespace --timeout 30s --atomic --set image.tag=${{ github.event.inputs.docker_image }} -f helm/values.yaml -f helm/secrets.yaml --dependency-update --dry-run -n test test <our_org>/base-app

I have provisioned ARC using helmfile, with fairly default values, and the following CRD:

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: <our_org>
  namespace: github-actions-runner
spec:
  replicas: 1
  template:
    spec:
      organization: <our_org>

The dynamically created Role has the following permissions:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: "2023-08-28T20:47:00Z"
  name: <our_org>-q6twb-q7bzj
  namespace: github-actions-runner
  ownerReferences:
  - apiVersion: actions.summerwind.dev/v1alpha1
    blockOwnerDeletion: true
    controller: true
    kind: Runner
    name: <our_org>-q6twb-q7bzj
rules:
- apiGroups:
  - actions.summerwind.dev
  resourceNames:
  - <our_org>-q6twb-q7bzj
  resources:
  - runners/status
  verbs:
  - get
  - update
  - patch

Basically, I can't figure out how to get these dynamically created Roles to have sufficient permissions to satisfy this error:

[helm-secrets] Decrypt: helm/secrets.yaml
Error: query: failed to query with labels: secrets is forbidden: User "system:serviceaccount:github-actions-runner:<our_org>-2hdbb-7v5x6" cannot list resource "secrets" in API group "" in the namespace "test"

There doesn't seem to be a way to use the values to customize the permissions of the Runner's role so that the ServiceAccount using it can do what I need it to. It is possible I'm missing something totally obvious though.

[elcidowneador]

Same problem here. In my case, i need to customize to build images using docker/build-push-action because it lacks "deployments" permissions in the role.