GitHub Community
I have tested hitting this endpoint with curl, and it also gives back the 404. However, If I change the PAT to be incorrect, then it gives 401. So it seems the PAT is ok, but I suspect perhaps it does not have the right permissions. But with the docs not aligning to what I can see in the UI, I don't know which permissions to give it.
\nAny help would be greatly appreciated.
","upvoteCount":4,"answerCount":3,"acceptedAnswer":{"@type":"Answer","text":"Sorry for the delay, @alext-extracellular
\nThe githubConfigUrl needs to be the correct target endpoint.
You encountered this error because ARC is strict about what githubConfigUrl should point to:
\n- \n
- \n
It must correspond to the actual GitHub resource, a repository, organization, or enterprise, that the runners will be attached to
\n \n - \n
The Controller then infers the correct API endpoint (including adding
\n/api/...) for calls like fetching registration tokens \n
Based on the docs and community feedback, valid examples include:
\n- \n
https://github.com/<your_enterprise>/<your_org>/<repo>(per-repo) \nhttps://github.com/<your_enterprise>/<your_org>(organization) \nhttps://github.com/enterprises/<your_enterprise>(enterprise level) \n
In your case, since you're targeting enterprise-level runners, your githubConfigUrl should actually be:
https://github.com/enterprises/<your_enterprise>\nnot https://<domain>.ghe.com/enterprises/<domain>/, because that looks like a GitHub Enterprise Server style address, not the GitHub Cloud format. And https://<domain>.ghe.com/ alone is too generic and gets rejected as malformed.
Next step: Update your Helm manifest or values.yaml:
githubConfigUrl: \"https://github.com/enterprises/<your_enterprise>\"Or in your Helm command:
\n--set githubConfigUrl=\"https://github.com/enterprises/<your_enterprise>\"The docs sometimes lag behind the UI, but users have had success using a classic PAT that includes the manage_runners:enterprise scope.
From GitHub discussion on Stack Overflow:
\n\n\n“I generated Personal Access Token (classic) with permission manage_runners:enterprise and all good. ARC was able to connect to enterprise.”
\n
So:
\n- \n
- Create your PAT as a classic token, not a fine-grained token. \n
- Ensure Resource owner is indeed the enterprise account (given that's how the classic PAT behaves). \n
- Include at least the
manage_runners:enterprisescope. \n
If you're using fine-grained tokens, they currently don’t support that enterprise runner management scope, and indeed, you’ve noted that you can't change the resource owner anyway.
","upvoteCount":1,"url":"https://github.com/orgs/community/discussions/171574#discussioncomment-14312435"}}}adding ARC runner at enterprise level to GHEC, 404 #171574
-
Why are you starting this discussion?Error What GitHub Actions topic or product is this about?ARC (Actions Runner Controller) Discussion DetailsI am trying to setup ARC auto scale with on prem host and k8s cluster. I have followed their instructions, but they do not mention any examples or details for adding runners at enterprise level, only giving examples for org level, however they say enterprise is possible. I am authenticating with a PAT generated by the enterprise admin account, this has permissions RW on actions and RW on Administration. The Docs for this part mention permissions scopes that don't seem to exist anymore. for example, the word "enterprise" does not appear on this page. I am using a PAT because the docs say that Github Apps do not work for enterprise level. 
I have tried making the PAT in the accounts both of the Enterprise Admin and the Enterprise Owner, same result. Both times the resource owner is that user, as the enterprise itself does not appear. The runner set listener does not appear in k8s. These are the logs from the controller: I have tested hitting this endpoint with curl, and it also gives back the 404. However, If I change the PAT to be incorrect, then it gives 401. So it seems the PAT is ok, but I suspect perhaps it does not have the right permissions. But with the docs not aligning to what I can see in the UI, I don't know which permissions to give it. Any help would be greatly appreciated. |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 6 replies
-
|
First off, let's talk about that URL in your logs. It's trying to call home to So, the fix for this is thankfully straightforward. We just need to gently guide the controller to the correct address. You'll want to add one specific line to your spec:
githubConfigUrl: https://<domain>.ghe.com/ Now, while we're at it, let's just double-check that PAT. You were right to suspect the permissions, the documentation can sometimes feel like it's playing catch-up. The administration scope is perfect for organization-level access, but for the enterprise level, it's best to create a token that is explicitly owned by the enterprise account itself, not your user. When you create a new fine-grained token, just ensure the Resource owner is set to your enterprise, and it has those read and write permissions for both Administration and Actions. I have a strong feeling that correcting the URL will get you most of the way there. Once you make that update, everything should start falling into place. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, thanks for the response the As for the PAT, can you be more specific? I have 3 accounts, one is the Enterprise Admin that is not tied to any IDP. second is the Enterprise Owner that is an IDP user with admin permissions. Thirdly is my personal account, also on the IDP. I have tried with the first two, and both have the same result. Also, on both the Enterprise Owner and Enterprise Admin, it is not possible to change the Resource owner to anything other than that user. |
Beta Was this translation helpful? Give feedback.
This comment was marked as spam.
This comment was marked as spam.
-
|
Sorry for the delay, @alext-extracellular The You encountered this error because ARC is strict about what githubConfigUrl should point to:
Based on the docs and community feedback, valid examples include:
In your case, since you're targeting enterprise-level runners, your not Next step: Update your Helm manifest or githubConfigUrl: "https://github.com/enterprises/<your_enterprise>"Or in your Helm command: --set githubConfigUrl="https://github.com/enterprises/<your_enterprise>"The docs sometimes lag behind the UI, but users have had success using a classic PAT that includes the From GitHub discussion on Stack Overflow:
So:
If you're using fine-grained tokens, they currently don’t support that enterprise runner management scope, and indeed, you’ve noted that you can't change the resource owner anyway. |
Beta Was this translation helpful? Give feedback.
-
|
The URL is correct, I am using github enterprise cloud, with enterprise managed users, with data residency in the EU. That is the correct url where I log in to. 
|
Beta Was this translation helpful? Give feedback.
-
|
Glad to hear it's working, happy I could help. |
Beta Was this translation helpful? Give feedback.
-
|
A related question. Is app based authentication already supported in this scenario? I'm trying to register my runner scale set in my enterprise and I'm facing the following problem: {"severity":"error","ts":"2025-12-09T14:52:57Z","logger":"AutoscalingRunnerSet","message":"Failed to get runner scale set from Actions service","version":"0.13.0","autoscalingrunnerset":{"name":"kubernetes-runner","namespace":"infra-gha-runners"},"runnerGroupId":"1","runn
erScaleSetName":"kubernetes-runner","error":"failed to create new actions service request: failed to issue update token if needed: failed to get runner registration token on refresh: github api error: StatusCode 403, RequestID \"D67C:1EB96E:38D50EA:34556F3:693837C9\": {\"
message\":\"Resource not accessible by integration\",\"documentation_url\":\"https://docs.github.com/rest/actions/self-hosted-runners#create-a-registration-token-for-an-enterprise\",\"status\":\"403\"}","stacktrace":"github.com/actions/actions-runner-controller/controller
s/actions%2egithub%2ecom.(*AutoscalingRunnerSetReconciler).createRunnerScaleSet\n\tgithub.com/actions/actions-runner-controller/controllers/actions.github.com/autoscalingrunnerset_controller.go:419\ngithub.com/actions/actions-runner-controller/controllers/actions%2egithub
%2ecom.(*AutoscalingRunnerSetReconciler).Reconcile\n\tgithub.com/actions/actions-runner-controller/controllers/actions.github.com/autoscalingrunnerset_controller.go:187\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\tsigs.k8s.io/con
[email protected]/pkg/internal/controller/controller.go:216\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\tsigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:461\nsigs.k8s.io/controller-runtim
e/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\tsigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:421\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1\n\tsigs.k8s.io/controller-runtime@
v0.22.3/pkg/internal/controller/controller.go:296"}The 403 error gives me a hint that my application does not have the correct scope. However, when I look in the permission config for my app I cannot see any permissions related to runners on the enterprise level... |
Beta Was this translation helpful? Give feedback.
-
|
@steinwelberg don't quote me on it, but I don't think app-based is supported for this, just from what I remember from their docs |
Beta Was this translation helpful? Give feedback.
-
|
I figured so much ;-). Too bad indeed that not all auth methods have the same level of support. |
Beta Was this translation helpful? Give feedback.
Sorry for the delay, @alext-extracellular
The
githubConfigUrlneeds to be the correct target endpoint.You encountered this error because ARC is strict about what githubConfigUrl should point to:
It must correspond to the actual GitHub resource, a repository, organization, or enterprise, that the runners will be attached to
The Controller then infers the correct API endpoint (including adding
/api/...) for calls like fetching registration tokensBased on the docs and community feedback, valid examples include:
https://github.com/<your_enterprise>/<your_org>/<repo>(per-repo)https://github.com/<your_enterprise>/<your_org>(organization)https://github.com/enterprises/<your_enterpri…