How to secure GARM and the GARM configurator

Use this guide to apply the charm-level security recommendations before using GARM for production workloads. It covers TLS-protected ingress, metrics access, remote-shell settings, Juju secrets, and trusted script configuration.

What you’ll need

  • A deployed garm application and at least one integrated garm-configurator application.

  • Permission to change Juju application configuration.

  • A deployment ingress that can provide HTTPS for externally reachable GARM traffic.

  • Juju secret values for the GitHub App and OpenStack credentials.

This guide covers charm settings and assumptions. Follow the platform’s Canonical documentation for ingress, Juju access control, PostgreSQL, and OpenStack hardening.

Protect the GARM endpoint

GARM listens on port 8080 for its API and metrics. The workload does not terminate TLS. Expose it through a TLS-terminating ingress and restrict the backend and metrics paths to their intended clients.

Do not treat the unauthenticated metrics endpoint as an administrative API. Restrict it to the monitoring system.

Disable the remote shell unless required

The configurator declares enable-shell enabled by default. Disable it when interactive runner sessions are not required:

juju config garm-configurator enable-shell=false

Verify the applied value:

juju config garm-configurator enable-shell

The command should report false. If the remote shell is required, use a TLS-protected GARM agent path and restrict GARM administrator access.

Protect credentials

Use Juju secrets for the GitHub App private key and OpenStack password.

The get-credentials action returns the GARM administrator password. Run it only when needed and treat its output as secret material:

juju run garm/0 get-credentials

For the complete first-deployment secret flow, see the deployment tutorial.

Review trusted script settings

The GARM configurator passes two operator-supplied bash scripts to each runner:

  • pre-install-scripts: a script that runs on the runner VM before the runner is installed.

  • pre-job-script: a script appended to the runner pre-job script, so it runs before each job. If it exits with a non-zero code, the job fails and the workflow steps do not run.

Both are trusted shell code. Review every value before you apply it.

Set a pre-job script:

juju config garm-configurator pre-job-script="echo 'runner prepared'"

Clear the options when they are no longer needed:

juju config garm-configurator pre-install-scripts="" pre-job-script=""

Verify the charm state

Check that the charms have the expected status after changing security settings:

juju status

A failed or blocked status requires resolving the reported configuration or relation problem before relying on the deployment.

Read more