Runners should set RunUntagged = false so that only jobs whose tags match the runner's tag list are dispatched. Allowing a runner to pick up untagged jobs lets any pipeline use it, defeating the workload-isolation strategy that tags are designed to enforce (e.g., separating production deployment runners from build runners). Reference: https://docs.gitlab.com/ee/ci/runners/configure_runners.html#use-tags-to-control-which-jobs-a-runner-can-run
1. In GitLab, navigate to the runner scope and locate the runner whose RunUntagged flag is true. 2. Click Edit and uncheck 'Run untagged jobs'. 3. Add explicit tags that describe the runner's permitted workloads (e.g., 'docker', 'production-deploy'). 4. Update job definitions in .gitlab-ci.yml to include matching tags via the 'tags:' keyword.
{
"target": "GLRunner",
"if": {
"allOf": [
{
"resource": "GLRunner",
"property": "RunUntagged",
"operator": "equals",
"value": false
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.2