Create runners in custom resource group and subnet

[harsha-chamarthi]

Is it possible to create runners in custom resource group and subnet? I just see the option for passing vnet in extra-specs.

[gabriel-samfira]

Hi @harsha-chamarthi !

Not at this point, no. We currently create one resource group per runner and delete the entire resource group when the runner finishes running a job. By doing so we:

1. Attempt to isolate each runner from any other workload. The code that gets executed in a runner is potentially malicious and the systems running potentially harmful code that comes in via a PR need to be treated as adversarial.
2. It makes cleaning up a lot easier. By removing the resource group, everything in it is removed at once.

Could you detail your use case? It would help in determining if there is an easy way to achieve it in the current form.

[harsha-chamarthi]

I am trying to create a runner pool with extra specs and attach an already existing vnet and subnet. Instead of creating a new subnet everytime. Also do we need to open any additional ports on the runner vm for it to communicate to github?

[gabriel-samfira]

Then it should be enough to set extra specs to:

{
  "vnet_subnet_id": "THE_ID_OF_THE_SUBNET",
  "disable_isolated_networks": true
}

In terms of access for the VM, it needs to be able to call back home into your GARM server. So if your GARM server is (for example) running at https://garm.example.com, the runners that spin up in Azure need to have egress access to that URL.

[boldandbusted]

So, this model seems good for the popular case of wanting to just run runners in isolation from the rest of an Azure tenancy or subscription. A scenario I'm considering is where we have a runner inside a Virtual Network with RBAC to push code to a private Azure Container Registry to automate code deployments from GitHub Repos in an Organization as part of Azure Container Apps. In that case the nice and neat model of deleting the resource group wouldn't be a great fit! :)

In this case, I guess a way to think about it is this kind of Runner would be part of a service, rather than just a place to run isolated jobs.

Quite possible my overall model is missing something significant, however.

[gabriel-samfira]

you could connect the runner to a vnet with access to any service you wish. It could remain isolated in its own RG, but be connected to a vnet you can create policies on. Would that suffice?

[boldandbusted]

you could connect the runner to a vnet with access to any service you wish. It could remain isolated in its own RG, but be connected to a vnet you can create policies on. Would that suffice?

@gabriel-samfira Thanks for thinking through this with me. So, if I did that, you're thinking I'd add a NIC in the 'foreign' VNET from the Runner in the other Resource Group? Would Garm manage that?

[gabriel-samfira]

The provider allows you to create a pool with extra specs (essentially configuration tweaks) that override the default network isolation:

{
  "vnet_subnet_id": "THE_ID_OF_THE_SUBNET",
  "disable_isolated_networks": true
}

This allows you to create runners that are connected to any VNET you wish. GARM (or rather, the provider) will ensure the runner is connected to that network instead of creating a new one in the rg.

[gabriel-samfira]

Details on the supported extra specs and how to set them on a pool can be found here:

https://github.com/cloudbase/garm-provider-azure?tab=readme-ov-file#tweaking-the-provider

Each provider has details in their readme vis-a-vis the extra specs they support.