remove runner is not working

[jaswanthikolla]

As per following github-act-runner remove --help, I can use jitconfig to remove the self hosted runner. But, It's not working if I use that, It just says success without any effect of removing the runner, and using trace doesn't give any information either. Is jitconfig is only used for registering the runner but can't be used for removing the runner?

Remove your self-hosted runner

Usage:
  github-act-runner remove [flags]

Flags:
      --jitconfig string   read the runner configuration from the jitconfig 
     

[ChristopherHX]

I would have expected a "Please enter your runner registration token" prompt in your example or an error message.

It's technically prohibited by the GitHub Actions Service doing removal without an runner add/remove token (or a PAT then it is possible to fetch the other token), because jitconfig is just a base64 map of the runner registration including an rsa private key

[ChristopherHX]

Since my project doesn't write jitconfig to disk, is the jitconfig flag here intended to allow removing them with a runner token. Cloning description can cause confusion

[jaswanthikolla]

yeah, I am expecting passing the jitconfig github-act-runner remove --jitconfig my_jitconfig_string_generated_by_github to remove the runner. I am not sure if it github allows this.

[ChristopherHX]

Thank you for telling me that jitconfig removal is broken, need to debug this

[jaswanthikolla]

In the latest Github's scaled sets, Controller only passes JITCONFIG to the runner. It doesn't quite make sense to pass both Registration token ( you can use registration token to remove) and JITCONFIG. we can register a runner using JITCONFIG's RSA private key, I think Github should allow doing the same for removal as well using RSA private key.

Use case for doing this on the runner removal at runner side:

k8s + karpenter will like to move the pods around to optimize for the cost savings. k8s sends a SIGTERM to us, and which we use wrapper script to capture and do config.sh remove and it's error code. We want the behaviour to be if it is just listening, we want it to terminated ( so that k8s will spin up new pod in another kubenode), and if it is running a job we want it to complete it in a reasonable configurable time. config.sh remove does the removal at the github side API level only if a job is not assigned.

Why can't we do this runner removal by checking if it's running a job?

There can be race conditions between the removal and a job being assigned. Because the API can have locking Data structure, and even without locking data structure doing the removal through API minimizes the race conditions.

[ChristopherHX]

I think Github should allow doing the same for removal as well using RSA private key.

Yes this is unfortunate, but I can't change anything here. I did reverse engineer their service just for fun (client here / server is runner.server), even tried to use the rsa auth back some months to remove it's own configuration and ended up with permission denied (wrong auth scope)

[jaswanthikolla]

I am going to enter a support ticket to ask for this feature

[ChristopherHX]

There can be race conditions between the removal and a job being assigned. Because the API can have locking Data structure, and even without locking data structure doing the removal through API minimizes the race conditions.

Did you observe a race condition? Or is the following example different to what you mean

I could send runner removal via api, never check if a job is running, do it always if you want to exit an possible idle runner. Then two cases occured for me

• runner removed (outcome runner is idle), then it should exit by itself (Does auto exit still work?, the service changed the error)
• runner remove failed (outcome a job is running, maybe also a GitHub Outage), then it is autoremoved after the job is done (jitconfig is always ephemeral, if not created by my tool without that flag)

[ChristopherHX]

Fixed the bug https://github.com/ChristopherHX/github-act-runner/releases/tag/v0.7.1, still needs --pat/--token and maybe --url if the jitconfig is from ARC (e.g. your comment actions/runner#2920)

It actually didn't remove any runner for ca. one year, due to an logic inversion in an if added a test