Kubernetes runner install

Kubernetes support is available as preview support. This page describes the current install shape and operational cautions.

For Kubernetes runners, cicd-sensor runs at the node level and uses cicd-sensor Manager for config, rules, and log delivery. Workflow- and job-created Pods do not mount host container runtime sockets or cicd-sensor internal sockets. GitHub ARC runner containers mount one exception: the dedicated GitHub Kubernetes runner socket, which exposes job start only. In ARC default and dind modes, workflow steps run inside the runner container and can therefore reach that socket; see the listener trust model for what it does and does not guarantee.

Supported setups

Basic architecture

cicd-sensor uses a node-level DaemonSet for the shared Kubernetes setup. The agent runs on each node, monitors Kubernetes runner workloads on that node, and sends logs to cicd-sensor Manager. Modes that create Kubernetes job containers also run the NRI observer on each node.

flowchart LR
    subgraph CLUSTER["Kubernetes cluster"]
      subgraph NODE["Kubernetes node"]
        DS["cicd-sensor DaemonSet"]
        AGENT["cicd-sensor agent"]
        NRI["cicd-sensor nri"]
        PODS["Runner / Job Pods"]
        DS --> AGENT
        DS --> NRI
        NRI --> PODS
        AGENT --> PODS
      end
    end

    MANAGER["cicd-sensor-manager"]
    OUTPUTS["Cloud Outputs / SIEM"]
    AGENT -->|"Summary / Detection / Runtime Event Logs"| MANAGER
    MANAGER --> OUTPUTS

    classDef cicdSensor fill:#ecfdf5,stroke:#0f766e,color:#134e4a,stroke-width:1.5px;
    class DS,AGENT,NRI,MANAGER cicdSensor

Node requirements

Kubernetes nodes must provide:

• Linux with cgroup v2.
• containerd with NRI enabled.
• runc systemd cgroups.
• A privileged node-level cicd-sensor DaemonSet running as root (runAsUser: 0).
• Host cgroup v2 mounted into the agent container.

cicd-sensor does not patch or restart containerd. Before installing the DaemonSet, verify that the node already exposes the NRI socket:

test -S /var/run/nri/nri.sock

GKE Standard with COS, containerd 2.x, and systemd cgroups has been verified.

Community verified AKS node images (GitHub ARC Preview):

Managed Kubernetes environments that do not allow privileged node agents or required host mounts are not supported. This includes GKE Autopilot, AKS Virtual Nodes / ACI, and managed container services outside Kubernetes, such as Amazon ECS.

cicd-sensor components

Kubernetes runner deployments use:

YAML

Use the mode-specific examples listed on the GitHub ARC runner scale sets and GitLab Runner Kubernetes executor pages.

Security notes

Do not mount host containerd.sock, CRI socket, NRI socket, or cicd-sensor staging socket into CI/CD job Pods. Those sockets are host-control surfaces, and exposing them to jobs makes the Kubernetes boundary substantially weaker.

GitHub ARC dind mode requires a privileged dind sidecar. cicd-sensor can track that mode, but the deployment should be treated as a higher-risk compatibility mode.

For implementation details, see Kubernetes Runtime.

Next pages

• GitHub ARC runner scale sets
• GitLab Runner Kubernetes executor