Introduction
There are times when a Self-Hosted runner resource class token needs to be rotated either for best security practices or if it has been unintentionally exposed in plain text when working with a CircleCI Support engineer on a support request.
Prerequisites
An existing running installation of a Self-Hosted Runner Resource Class on either a Linux, macOS, or Windows environment
A current installation of the CircleCI CLI on your machine
Instructions
Navigate to your terminal, and confirm that the CircleCI CLI is installed by running
circleci versionGet a list of tokens for your resource class
Run
circleci runner token list <resource-class name>
Example:
$ circleci runner token list runner-rc/support-demo +--------------------------------------+----------+----------------------+ | ID | NICKNAME | CREATED AT | +--------------------------------------+----------+----------------------+ | 350a1717-5c96-4964-9cf4-228a3298d0d1 | | 2022-05-09T16:20:45Z | +--------------------------------------+----------+----------------------+
Create a new token
circleci runner token create <resource-class-name> "<nickname>"
Example:
circleci runner token create runner-rc/support-demo "NEW"
This will return an
auth_tokenvalue that will be used in the next step
If applicable, you can delete the old token using the identifier
IDRun
circleci runner token delete "<token identifier>"
Example:
circleci runner token delete "350a1717-5c96-4964-9cf4-228a3298d0d1"
Update your
circleci-runner-config.yaml.yamlwith the new token by updating theauth_tokenfield with the new value from the response in Step 4 above and save this file.
Please note: The default location of this file will depend on the OS that this runner is hosted on.Linux:
/etc/circleci-runner/circleci-runner-config.yamlmacOS:
$HOME/Library/Preferences/com.circleci.runner/config.yamlWindows:
C:\Program Files\CircleCI\runner-agent-config.yaml
Restart the Runner Service
Linux:
sudo systemctl start circleci-runner
macOS:
launchctl bootstrap gui/$(id -u) $HOME/Library/LaunchAgents/com.circleci.runner.plist
launchctl enable gui/$(id -u)/com.circleci.runner
launchctl kickstart -k gui/$(id -u)/com.circleci.runner
Windows:
Uninstalling CircleCI self-hosted runners will prepare the system for installation again.
Download the
Uninstall-CircleCIRunner.ps1script from GitHub to an easily accessible location.Open PowerShell as an administrator and navigate to the directory where you placed the script file.
Run the following in your PowerShell:
./Uninstall-CircleCIRunner.ps1