Kubernetes runner install

Kubernetes support is available as preview support. This page describes the current install shape and operational cautions.

For Kubernetes runners, cicd-sensor runs at the node level and uses cicd-sensor Manager for config, rules, and log delivery. Workflow- and job-created Pods do not mount host container runtime sockets or cicd-sensor internal sockets. GitHub ARC runner containers mount one exception: the dedicated GitHub Kubernetes runner socket, which exposes job start only. In ARC default and dind modes, workflow steps run inside the runner container and can therefore reach that socket; see the listener trust model for what it does and does not guarantee.

Supported setups

Basic architecture

cicd-sensor uses a node-level DaemonSet for the shared Kubernetes setup. The agent runs on each node, monitors Kubernetes runner workloads on that node, and sends logs to cicd-sensor Manager. Modes that create Kubernetes job containers also run the NRI observer on each node.

flowchart LR
    subgraph CLUSTER["Kubernetes cluster"]
      subgraph NODE["Kubernetes node"]
        DS["cicd-sensor DaemonSet"]
        AGENT["cicd-sensor agent"]
        NRI["cicd-sensor nri"]
        PODS["Runner / Job Pods"]
        DS --> AGENT
        DS --> NRI
        NRI --> PODS
        AGENT --> PODS
      end
    end

    MANAGER["cicd-sensor-manager"]
    OUTPUTS["Cloud Outputs / SIEM"]
    AGENT -->|"Summary / Detection / Runtime Event Logs"| MANAGER
    MANAGER --> OUTPUTS

    classDef cicdSensor fill:#ecfdf5,stroke:#0f766e,color:#134e4a,stroke-width:1.5px;
    class DS,AGENT,NRI,MANAGER cicdSensor

Node requirements

Kubernetes nodes must provide:

• Linux with cgroup v2.
• containerd with NRI enabled.
• runc systemd cgroups.
• A privileged node-level cicd-sensor DaemonSet running as root (runAsUser: 0).
• Host cgroup v2 mounted into the agent container.

cicd-sensor does not patch or restart containerd. Before installing the DaemonSet, verify that the node already exposes the NRI socket:

test -S /var/run/nri/nri.sock

GKE Standard with COS, containerd 2.x, and systemd cgroups has been verified. Managed Kubernetes environments that do not allow privileged node agents or required host mounts are not supported. This includes GKE Autopilot and managed container services outside Kubernetes, such as Amazon ECS.

cicd-sensor components

Kubernetes runner deployments use:

YAML

Use the mode-specific examples listed on the GitHub ARC runner scale sets and GitLab Runner Kubernetes executor pages.

Security notes

Do not mount host containerd.sock, CRI socket, NRI socket, or cicd-sensor staging socket into CI/CD job Pods. Those sockets are host-control surfaces, and exposing them to jobs makes the Kubernetes boundary substantially weaker.

GitHub ARC dind mode requires a privileged dind sidecar. cicd-sensor can track that mode, but the deployment should be treated as a higher-risk compatibility mode.

For implementation details, see Kubernetes Runtime.

Next pages

• GitHub ARC runner scale sets
• GitLab Runner Kubernetes executor