ARC (legacy) cert-manager webhook error in CI

The legacy actions-runner-controller (RunnerDeployment based) depends on cert-manager to serve its admission webhook certificate. If cert-manager is absent, applying Runner resources fails on the webhook.

What this error means

Applying a RunnerDeployment on legacy ARC fails with a webhook error such as "no endpoints available for service actions-runner-controller-webhook" or a failed certificate.

Terminal

Error from server (InternalError): error when creating "runner.yaml":
Internal error occurred: failed calling webhook
"mutate.runnerdeployment.actions.summerwind.dev": failed to call webhook:
no endpoints available for service "actions-runner-controller-webhook"

Common causes

cert-manager is not installed

Legacy ARC uses cert-manager to issue the webhook certificate; without it the webhook has no valid cert and no endpoints.

Using legacy ARC when the scale set model is intended

The current gha-runner-scale-set model does not require cert-manager; hitting this error can mean an outdated install path.

How to fix it

Install cert-manager for legacy ARC

Install cert-manager and wait for its pods to be ready.
Reinstall or restart the legacy ARC controller.
Re-apply the RunnerDeployment once the webhook has endpoints.

Terminal

kubectl apply -f \
  https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

Move to the gha-runner-scale-set model

The current ARC charts do not need cert-manager. Migrating removes this dependency entirely.

How to prevent it

Install cert-manager before legacy ARC, or use the scale set charts.
Prefer the current gha-runner-scale-set model for new clusters.
Verify webhook endpoints exist before applying runner resources.