Actions Runner Controller 0.14.2

FractalOps pins the upstream scale-set controller and runner chart tag gha-runner-scale-set-0.14.2. Investigation date: 2026-07-30. Assembly owns the controller, the fractalops-agentsquad-evidence scale set, scheduling, resource limits, and durable evidence state. GitHub owns runner registration and job assignment.

Supported Path

Install the controller in arc-systems and runner pods in arc-runners.
Authenticate with the predefined fractalops-arc-github-runtime Secret. External Secrets maps OpenBao FRACTALOPS_GITHUB_ORG_TOKEN to ARC’s required github_token key; credentials never enter Git.
Keep minRunners: 0 and maxRunners: 1. The 24-hour evidence workflow needs one isolated ephemeral runner, not a permanent Deployment or one runner per agent.
Use controller flags.updateStrategy: eventual so chart changes wait for assigned jobs instead of replacing their runner.
Mount fractalops-agentsquad-evidence-state at /var/lib/fractalops-agentsquad-evidence. The state path is keyed by stable GitHub run ID, so rerunning a failed attempt resumes the same digest-bound observation.

Traps

ARC protects normal scale-set lifecycle; it cannot keep a process alive through node loss, disk-pressure eviction, or kubelet failure. Durable state is mandatory.
github.run_attempt changes on rerun. Do not bind the observation bundle or state path to it.
A valid image manifest does not prove every registry blob exists. Release reuse must perform the copy and rebuild through Kubernetes BuildKit on a missing layer.
Scale-set jobs route by runnerScaleSetName, not arbitrary legacy runner labels.
Keep the evidence runner off nodes labeled with the constrained storage tier. Prefer workload-tier: storage-main, but allow another healthy node when that tier lacks memory headroom.

Verification

kubectl -n arc-systems get deploy
kubectl -n arc-runners get autoscalingrunnersets,ephemeralrunners,pvc
kubectl -n arc-runners get externalsecret

Authoritative references: ARC quickstart and runner scale-set deployment.