also, crd2pulumi helps 🙂 https://github.com/pulumi/crd2pulumi

sure, code is here:

new CustomResource(
      'runner-pool',
      {
        apiVersion: '<http://garo.tietoevry.com/v1alpha1|garo.tietoevry.com/v1alpha1>',
        kind: 'GithubActionRunner',
        metadata: {
          name: 'runner-pool',
          namespace: 'github-actions-runner-operator',
        },
        spec: {
          minRunners: config.minRunners,
          maxRunners: config.maxRunners,
          organization: 'jugo-io',
          reconciliationPeriod: '1m',
          tokenRef: {
            key: 'GH_TOKEN',
            name: 'actions-runner',
          },
          podTemplateSpec: {
            metadata: {
              annotations: { '<http://prometheus.io/scrape|prometheus.io/scrape>': 'false', '<http://prometheus.io/port|prometheus.io/port>': '3903' },
            },
            spec: {
              affinity: {
                podAntiAffinity: {
                  preferredDuringSchedulingIgnoredDuringExecution: [
                    {
                      weight: 100,
                      podAffinityTerm: {
                        topologyKey: '<http://kubernetes.io/hostname|kubernetes.io/hostname>',
                        labelSelector: {
                          matchExpressions: [
                            {
                              key: '<http://garo.tietoevry.com/pool|garo.tietoevry.com/pool>',
                              operator: 'In',
                              values: ['runner-pool'],
                            },
                          ],
                        },
                      },
                    },
                  ],
                },
              },

              containers: [
                {
                  name: 'runner',
                  env: [
                    {
                      name: 'RUNNER_DEBUG',
                      value: 'true',
                    },
                    {
                      name: 'DOCKER_TLS_CERTDIR',
                      value: '/certs',
                    },
                    {
                      name: 'DOCKER_HOST',
                      value: '<tcp://localhost:2376>',
                    },
                    {
                      name: 'DOCKER_TLS_VERIFY',
                      value: '1',
                    },
                    {
                      name: 'DOCKER_CERT_PATH',
                      value: '/certs/client',
                    },
                    {
                      name: 'GH_ORG',
                      value: 'jugo-io',
                    },
                  ],
                  envFrom: [
                    {
                      secretRef: {
                        name: 'runner-pool-regtoken',
                      },
                    },
                  ],
                  image: '<http://quay.io/evryfs/github-actions-runner:master|quay.io/evryfs/github-actions-runner:master>',
                  imagePullPolicy: 'IfNotPresent',
                  resources: {},
                  volumeMounts: [
                    {
                      mountPath: '/certs',
                      name: 'docker-certs',
                    },
                    {
                      mountPath: '/home/runner/_diag',
                      name: 'runner-diag',
                    },
                    {
                      mountPath: '/home/runner/_work',
                      name: 'runner-work',
                    },
                  ],
                },
                {
                  name: 'docker',
                  env: [
                    {
                      name: 'DOCKER_TLS_CERTDIR',
                      value: '/certs',
                    },
                  ],
                  image: 'docker:stable-dind',
                  imagePullPolicy: 'Always',
                  args: ['--mtu=1430'],
                  resources: {},
                  securityContext: {
                    privileged: true,
                  },
                  volumeMounts: [
                    {
                      mountPath: '/var/lib/docker',
                      name: 'docker-storage',
                    },
                    {
                      mountPath: '/certs',
                      name: 'docker-certs',
                    },
                    {
                      mountPath: '/home/runner/_work',
                      name: 'runner-work',
                    },
                  ],
                },
                {
                  name: 'exporter',
                  image: '<http://quay.io/evryfs/github-actions-runner-metrics:v0.0.3|quay.io/evryfs/github-actions-runner-metrics:v0.0.3>',
                  ports: [
                    {
                      containerPort: 3903,
                      protocol: 'TCP',
                    },
                  ],
                  volumeMounts: [
                    {
                      name: 'runner-diag',
                      mountPath: '/_diag',
                      readOnly: true,
                    },
                  ],
                },
              ],
              volumes: [
                {
                  emptyDir: {},
                  name: 'runner-work',
                },
                {
                  emptyDir: {},
                  name: 'runner-diag',
                },
                {
                  emptyDir: {},
                  name: 'mvn-repo',
                },
                {
                  emptyDir: {},
                  name: 'docker-storage',
                },
                {
                  emptyDir: {},
                  name: 'docker-certs',
                },
              ],
            },
          },
        },
      },
      { dependsOn: [operator], provider },
    );

ill have to dig in to where thats coming from

im going to try applying it manually again and seeing if i get the same issues

ive been looking in the issues for the operator im using and they seem to imply it could be secret related, but the secret is correct and the token has relevant perms... ill keep digging anyway, just wanted to make sure i definitely had the right resource type, cheers