Securing Self-Hosted GitHub Actions with Kubernetes & Actions-Runner-Controller
summary
Open-source actions-runner-controller provides autoscaling, ephemeral GitHub Actions runners on Kubernetes but hands all infrastructure security to operators; Marketplace has ~17,000 actions and hosted Ubuntu images resemble 50 GB VMs. The talk names three risk areas: cluster settings (limit blast radius, avoid broad scopes), controller auth (use GitHub Apps, upcoming just-in-time tokens, don’t over-check API scopes), and runner pods (Docker-in-Docker requires privileged pods, prefer runner with kubernetes jobs or rootless alternatives, and absolutely never use latest for images).
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:08Where are we headed?
- 2:02I have a bias!
- 2:54What's GitHub Actions?
- 4:49Why self-hosted?
- 6:44Unique security challenges
- 10:32types of Actions
- 12:033 types of security concerns
- 14:072- Do you trust your neighbors?
- 16:23Docker-in-Docker is risky, but...
- 17:36Rootless?
- 19:28Firecracker
- 23:09Runner with Kubernetes jobs
- 25:043- Right-sizing your runners
- 25:41Controller authorizations
- 27:24Multi-tenant in practice
- 28:08Recommendations
- 28:51Secure runner images
- 30:18Examples to get started!
- 30:50You may have forgotten
- 31:49Logging is easy to overlook
- 32:46Sharing (mounts) isn't caring!
- 33:57Building and deploying
- 34:25Sharing is caring!
- 35:42in)conclusions
- 37:18Questions!
related talks
50mGitHub Actions Self-Hosting Runners in k8s
56mHow to use GitHub Actions with Security in mind
05m⚡️Lightning Talk: Github Actions on Kubernetes
45mGitHub Actions & Security
51mHow to secure your GitHub Actions
15mGitHub Actions: a time bomb for supply chain security
34mMigrating GitHub Actions with Nested Virtualization to a Cloud Native Ecosystem
30mPragmatic, scalable, and ergonomic CI/CD using Github Actions and K8s.