fix: allow GH priv key from env in helm chart

[apr-1985]

Allowing the ability to get the GH priv key from the env when using the helm chart.
Feature Code added in #383

I have tested switching between Env and file by toggling the new helm chart variable and this works without issue.

This feature increases the interop with secrets managers that inject to ENV at run time.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[apr-1985]

Is there anything else I need to do get this reviewed please?

[marcencov]

I have the same issue - we are using vault and all secrets must be passed as ENV (not as file /etc/actions-runner-controller/github_app_private_key).
Is there any chance to review/merge this PR?
Thanks

[mumoshu]

We're going to review and merge this before our next controller minor release! Thanks for your patience.

[mumoshu]

@Marchenkov Hey! How does this PR solve your issue?

we are using vault and all secrets must be passed as ENV

If you're using vault-k8s' injector you should get files instead of envvars.
How are you integrating vault with actions-runner-controller in your setup?

[apr-1985]

We're going to review and merge this before our next controller minor release! Thanks for your patience.

Many thanks mainly commented to stop the stale bot 😀

[marcencov]

@Marchenkov Hey! How does this PR solve your issue?

we are using vault and all secrets must be passed as ENV

If you're using vault-k8s' injector you should get files instead of envvars. How are you integrating vault with actions-runner-controller in your setup?

I'm use vault-secrets-webhook and no way to inject to file.
https://banzaicloud.com/docs/bank-vaults/mutating-webhook/configuration/
So this PR can solve my problem, because I can read PEM from secret (now I receive error that file /etc/actions-runner-controller/github_app_private_key not contain PEM cert).

[mumoshu]

@Marchenkov I was also wondering if this hard-coded env name and secretKeyRef values might affect your use-case

key: github_app_private_key
name: {{ include "actions-runner-controller.secretName" . }}

But after reading how bank-vaults mutating webhook works, perhaps that's also no issue.

Thanks for confirming!

[mumoshu]

I'm now wondering if authSecret.enabled=false added via #937 with the existing env helm value can be an alternative to your use-case @apr-1985 @Marchenkov WDYT?

[mumoshu]

Merging. Thanks for your contribution and support @apr-1985 @Marchenkov ☺️