Aks automatic garc blog

[Steve Griffith (swgriffith)]

This PR adds a new AKS blog post that walks through setting up GitHub Actions Runner Controller on AKS Automatic and validating an end-to-end GitHub Actions workflow on an ephemeral runner pod.

What’s included:

• A step-by-step walkthrough for creating an AKS Automatic cluster
• Installation of the ARC controller and runner scale set
• Storage of the GitHub token in Kubernetes
• Configuration adjustments required for AKS Automatic secure-by-default settings
• A sample GitHub Actions workflow that targets the runner scale set
• Troubleshooting guidance for common AKS Automatic-specific issues
• Cleanup steps for removing the lab resources

[Copilot]

Pull request overview

This PR adds a new AKS blog post under website/blog/ that provides a hands-on walkthrough for setting up GitHub Actions Runner Controller (ARC) on AKS Automatic and validating an end-to-end GitHub Actions workflow using ephemeral runner pods.

Changes:

• Adds a new tutorial-style blog post covering AKS Automatic cluster creation, ARC install/config, workflow validation, troubleshooting, and cleanup.
• Includes example Helm values and a sample GitHub Actions workflow targeting an ARC runner scale set.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Ray Kao (raykao)]

One more resiliency note worth calling out somewhere in the post (e.g. near cluster creation or in a "production considerations" aside): avoid spot/preemptible node pools for ARC runner nodes. Spot reclamation can kill a runner pod mid-job; since ARC runners are ephemeral, the pod isn't rescheduled and the job fails and has to be resubmitted from scratch rather than gracefully recovering like a stateless workload would.

[Brian Redmond (chzbrgr71)]

Looks ready to publish. Approved.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (6)

Previously missed (5) — in code that hasn't changed since the last review.

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:11

• This Learn URL is locale-specific (/en-us/). Repo blog guidelines prefer non-locale Learn URLs to avoid unnecessary redirects and keep links consistent.

The combination of ARC and AKS Automatic gives you the power of ARC on a production-ready AKS cluster with managed node pools, built-in monitoring, scaling, security settings, and other defaults that follow [AKS best practices](https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-kubernetes-service). For runner workloads specifically, the [pod readiness SLA](https://learn.microsoft.com/azure/aks/intro-aks-automatic#pod-readiness-sla) is also a strong fit because CI/CD jobs depend on predictable pod startup.

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:4

• The front matter description looks significantly shorter than the blog guideline target (150–160 characters), which can hurt SEO consistency across posts. Consider expanding it to a 150–160 character summary.

description: "A hands-on walkthrough for creating an AKS Automatic cluster and running GitHub Actions Runner Controller runner scale sets on it."

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:155

• Creating the secret with --from-literal expands the token into the kubectl process arguments, which can be observable on the machine (for example via ps) while the command runs. Prefer passing the token via stdin (and optionally unset it afterward).

kubectl create secret generic github-pat \
  --namespace "${ARC_RUNNERS_NAMESPACE}" \
  --from-literal=github_token="${GITHUB_TOKEN}"

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:17

• The truncate marker line has trailing whitespace, which can trip markdown linters and creates noisy diffs. Remove the trailing space.

<!-- truncate --> 

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:19

• The blog post structure guidelines call for a hero image after the truncate marker with descriptive alt text (for accessibility and consistent previews). This post doesn’t include one yet.

<!-- truncate --> 

Let’s walk through the full setup.

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:6

• The tag IDs in front matter should match keys in website/blog/tags.yml. automatic, github-actions, arc, and devops don’t appear to exist there, so the post will be inconsistent with the repo’s centralized tag metadata (and may break tag pages). Use existing tag keys (for example, aks-automatic) and/or add the missing tags to tags.yml.

tags: ["automatic", "github-actions", "arc", "devops"]

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Suppressed comments (2)

website/blog/tags.yml:174

• The tags.yml entries appear to be kept in alphabetical order in this section (for example: gateway-api, general, ...). github-actions should sort before grafana, but it’s currently placed after it, which makes the file harder to scan and maintain.

entra:
  label: Entra
  permalink: /entra
  description: Microsoft Entra identity and access management for AKS clusters and workloads.

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:11

• This link uses a locale-specific Microsoft Learn URL (/en-us/). Our blog guidelines recommend using locale-agnostic Learn URLs to avoid hard-coding locale in published content.

The combination of ARC and AKS Automatic gives you the power of ARC on a production-ready AKS cluster with managed node pools, built-in monitoring, scaling, security settings, and other defaults that follow [AKS best practices](https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-kubernetes-service). For runner workloads specifically, the [pod readiness SLA](https://learn.microsoft.com/azure/aks/intro-aks-automatic#pod-readiness-sla) is also a strong fit because CI/CD jobs depend on predictable pod startup.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Suppressed comments (3)

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:4

• The front matter description is ~129 characters. Our blog guidelines call for an SEO description in the 150–160 character range.

description: "A hands-on walkthrough for creating an AKS Automatic cluster and running GitHub Actions Runner Controller runner scale sets on it."

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:17

• The truncate marker has trailing whitespace. Trim it to avoid markdown lint/formatting issues.

<!-- truncate --> 

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:19

• This post is missing the hero image that should appear right after <!-- truncate --> (typically ![...](./hero-image.png)). Also, the truncate marker is after 4 intro paragraphs; guidelines suggest placing it after 2–3 paragraphs so the listing excerpt stays short.

AKS Automatic is secure by default and has production-minded safeguards enabled. That's a good thing, but it also means the default public ARC Helm chart values need a little tuning. In particular, we need to be explicit about resource requests and image tags.

<!-- truncate --> 

Let’s walk through the full setup.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:11

• This link uses a locale-specific Learn URL (/en-us/). The repo blog guidelines recommend using the generic Learn URL to avoid regional redirects and keep links consistent.

The combination of ARC and AKS Automatic gives you the power of ARC on a production-ready AKS cluster with managed node pools, built-in monitoring, scaling, security settings, and other defaults that follow [AKS best practices](https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-kubernetes-service). For runner workloads specifically, the [pod readiness SLA](https://learn.microsoft.com/azure/aks/intro-aks-automatic#pod-readiness-sla) is also a strong fit because CI/CD jobs depend on predictable pod startup.

website/blog/2026-08-19-github-actions-runner-controller-aks-automatic/index.md:153

• Creating the secret with --from-literal=..."${GITHUB_TOKEN}" puts the token value on the command line after shell expansion, which can leak via process listing on multi-user systems. Prefer piping to stdin and using --from-file so the token value isn’t an argv argument.

kubectl create secret generic github-pat \
  --namespace "${ARC_RUNNERS_NAMESPACE}" \
  --from-literal=github_token="${GITHUB_TOKEN}"