Skip to content

Commit 859c96b

Browse files
Katie HornejohnstcnjawnsyEmyrkf0ssel
authored
Release 1.25.0 (coder#702)
* initial commit * chore(docs): document IRSA requirements for ECR (coder#703) * chore(docs): document IRSA requirements for ECR * fixup! chore(docs): document IRSA requirements for ECR * edit text * edit text * lint Co-authored-by: Katie Horne <katie@coder.com> * chore: add Kubernetes support notice to changelog (coder#704) Add a notice indicating that this is the final release of Coder that will support Kubernetes 1.19, in keeping with our version support policy and the Kubernetes upstream release schedule. Co-authored-by: Katie Horne <katie@coder.com> * update dev URL renaming * add upgrade guide * update env variables list * update workspace creation instructions * correct(docs): mark IRSA auth as alpha (coder#708) * correct(docs): label IRSA authentication as alpha * bump gh actions after changing pr base * fixup! correct(docs): label IRSA authentication as alpha * Update ecr.md Co-authored-by: Katie Horne <katie@coder.com> * update workspaces status check info * update changelog * add info re: self-contained builds * Add note re: bookmarks * add information re: affinities * update changelog * Update admin/workspace-management/self-contained-builds.md Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com> * add docker mention * chore: add EC2 docs (coder#699) * Update workspace provider admin docs for service account annotations and affinities * Add service account screenshot asset * Add note for requiring serviceaccount resource * lint * edit text * archive changelogs * chore: add Coder for Docker docs (coder#709) * add Docker link * reverse order of changelogs * update version * Add note about not supporting CVMs * Add affiity to changelog * Lint; edit text * lint * edit text Co-authored-by: Cian Johnston <cian@coder.com> Co-authored-by: Jonathan Yu <jonathan@coder.com> Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com> Co-authored-by: Garrett <garrett@coder.com> Co-authored-by: Garrett Delfosse <f0ssel@users.noreply.github.com>
1 parent 5c49d9c commit 859c96b

33 files changed

+704
-122
lines changed

‎admin/organizations/index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,8 @@ namespaces.
4141

4242
If you want to separate Coder workspaces by namespaces in a Kubernetes cluster,
4343
you can do so by
44-
[deploying a new workspace provider](../workspace-providers/deployment.md) to
45-
each additional namespace in the cluster. The workspace provider provisions
44+
[deploying a new workspace provider](../workspace-providers/deployment/index.md)
45+
to each additional namespace in the cluster. The workspace provider provisions
4646
workspaces to the namespace it has been deployed to, and you can control access
4747
to each workspace provider via an organization allowlist to replace the previous
4848
organization namespace behaviors.

‎admin/registries/ecr.md

Lines changed: 117 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -6,41 +6,131 @@ description: Add a private Amazon ECR to Coder.
66
This article will show you how to add your private ECR to Coder. If you're using
77
a public ECR registry, you do not need to follow the steps below.
88

9-
Amazon requires users to [request temporary login credentials to access a
10-
private Elastic Container Registry (ECR)
11-
registry](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html).
12-
When interacting with ECR, Coder will request temporary credentials from the
13-
registry using the AWS credentials linked to the registry.
9+
Amazon requires users to
10+
[request temporary login credentials](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html)
11+
to access a private Elastic Container Registry (ECR) registry. When interacting
12+
with ECR, Coder will request temporary credentials from the registry using the
13+
AWS credentials linked to the registry.
1414

15-
## Step 1: Setting up your AWS credentials
15+
## Step 1: Setting up authentication for Coder
1616

17-
To access a private ECR registry, Coder needs AWS credentials (specifically your
18-
**access key ID** and **secret access key**) with authorization to access the
19-
provided registry. You can either use AWS credentials tied to your own AWS
20-
account *or* credentials tied to an IAM user specifically for Coder (we
21-
recommend the latter option).
17+
To access a private ECR registry, Coder needs to authenticate with AWS. Coder
18+
supports two methods of authentication with AWS ECR:
2219

23-
Note that you are not limited to providing one single set of AWS credentials.
24-
For example, you can use a set of credentials with access to all of your ECR
25-
repositories, or you can use individual sets of credentials, each with access to
26-
a single repository.
20+
- Static credentials
21+
- **Alpha:** IAM roles for service accounts
2722

28-
To provision AWS credentials for Coder:
23+
### Option A: Provision static credentials for Coder
2924

30-
1. **Optional:** [Create an IAM user for
31-
Coder](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html)
25+
You can use an **Access Key ID** and **Secret Access Key** tied to either your
26+
own AWS account _or_ credentials tied to a dedicated IAM user (we recommend the
27+
latter option).
28+
29+
> You are not limited to providing a single set of AWS credentials. For example,
30+
> you can use a set of credentials with access to all of your ECR repositories,
31+
> or you can use individual sets of credentials, each with access to a single
32+
> repository.
33+
34+
To provision static credentials for Coder:
35+
36+
1. **Optional:**
37+
[Create an IAM user for Coder](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html)
3238
to access ECR. You can either attach the AWS-managed policy
33-
`AmazonEC2ContainerRegistryReadOnly` to the user, or you can [create your
34-
own](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html).
39+
`AmazonEC2ContainerRegistryReadOnly` to the user, or you can
40+
[create your own](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html).
3541

36-
1. [Create an access
37-
key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
42+
1. [Create an access key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
3843
for the IAM user to be used with Coder (if one does not already exist).
3944

45+
### Option B: Link an AWS IAM role to the Coder Kubernetes service account (IRSA)
46+
47+
**Note:** This is currently an **alpha** feature.
48+
49+
Coder can use an
50+
[IAM role linked to Coder's Kubernetes service account](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/),
51+
though this is only supported when Coder is running in AWS EKS. This is because
52+
the
53+
[EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook/)
54+
is required to provision and inject the required token into the `coderd` pod.
55+
56+
> For more information on IAM Roles for Service Accounts (IRSA), please consult
57+
> the
58+
> [AWS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
59+
60+
To link an IAM role to Coder's Kubernetes service account:
61+
62+
1. Enable the feature under Manage > Admin > Infrastructure > ECR IAM Role
63+
Authentication.
64+
65+
1. Create an IAM OIDC Provider for your EKS cluster (if it does not already
66+
exist).
67+
68+
1. [Create the IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-service-account-iam-policy-and-role.html#create-service-account-iam-role)
69+
to be used by Coder, if it does not already exist.
70+
71+
**Note:** Ensure that you also create and attach a trust policy that permits
72+
the Coder service account the action `sts:AssumeRoleWithWebIdentity`. The
73+
trust policy will look similar to the following:
74+
75+
```json
76+
{
77+
"Version": "2012-10-17",
78+
"Statement": [
79+
{
80+
"Effect": "Allow",
81+
"Principal": {
82+
"Federated": "arn:aws:iam::${ACCT_ID}:oidc-provider/${OIDC_PROVIDER}"
83+
},
84+
"Action": "sts:AssumeRoleWithWebIdentity",
85+
"Condition": {
86+
"StringEquals": {
87+
"${OIDC_PROVIDER}:sub": "system:serviceaccount:${NAMESPACE}:${SERVICE_ACCOUNT}"
88+
}
89+
}
90+
}
91+
]
92+
}
93+
```
94+
95+
1. Annotate the Coder service account with the role ARN:
96+
97+
a) Add the following to your `values.yaml` for your Coder helm deployment:
98+
99+
```yaml
100+
coderd:
101+
...
102+
builtinProviderServiceAccount:
103+
...
104+
annotations:
105+
eks.amazonaws.com/role-arn: my-role-arn
106+
```
107+
108+
b) Update the Helm deployment:
109+
110+
```shell
111+
helm upgrade coder coder/coder --values values.yaml
112+
```
113+
114+
c) Verify that the Coder service account now has the correct annotation:
115+
116+
```shell
117+
kubectl get serviceaccount coder -o yaml | grep eks.amazonaws.com/role-arn
118+
eks.amazonaws.com/role-arn: my-role-arn
119+
```
120+
121+
1. Validate that pods created with the `coder` service account have permission
122+
to assume the role:
123+
124+
```shell
125+
kubectl run -it --rm awscli --image=amazon/aws-cli \
126+
--overrides='{"spec":{"serviceAccount":"coder"}}' \
127+
--command aws ecr describe-repositories
128+
```
129+
40130
## Step 2: Add your private ECR registry to Coder
41131

42-
You can add your private ECR registry at the same time that you [add your
43-
images](../../images/index.md). To import an image:
132+
You can add your private ECR registry at the same time that you
133+
[add your images](../../images/index.md). To import an image:
44134

45135
1. In Coder, go to **Images** and click on **Import Image** in the upper-right.
46136

@@ -51,7 +141,9 @@ images](../../images/index.md). To import an image:
51141
1. Provide a **registry name** and the **registry**.
52142

53143
1. Set the **registry kind** to **ECR** and provide your **Access Key ID** and
54-
**Secret Access Key**.
144+
**Secret Access Key**, if required. If you want to use IRSA instead of static
145+
credentials, to authenticate with ECR, leave **Access Key ID** and **Secret
146+
Access Key** blank.
55147

56148
1. Continue with the process of [adding your image](../../images/index.md).
57149

‎admin/workspace-management/self-contained-builds.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
title: "Self-contained workspace builds"
3+
description: Learn how to enable self-contained workspace builds.
4+
state: alpha
5+
---
6+
7+
By default the Coder workspace boot sequence occurs remotely -- Coder uploads
8+
assets (including the Coder agent, code-server, and JetBrains Projector) from
9+
`coderd` to a workspace.
10+
11+
However, Coder offers the option of using **self-contained workspace builds**.
12+
Enabling this option changes the Coder deployment so that workspaces control the
13+
boot sequence internally, with the workspace downloading assets from `coderd`.
14+
15+
> At this time, Coder does not support certificate injectioin with
16+
> self-contained workspace builds.
17+
18+
To enable self-contained workspace builds:
19+
20+
1. Log into Coder.
21+
1. Go to Manage > Admin.
22+
1. On the Infrastructure page, scroll down to **Workspace container runtime**.
23+
1. Under **Enable self-contained workspace builds**, flip the toggle to **On**.
24+
1. Click **Save workspaces**.
25+
26+
> Build errors are typically more verbose for remote builds than with
27+
> self-contained builds.

‎admin/workspace-providers/deployment/ec2.md

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
---
2+
title: EC2
3+
description: Learn how to deploy a workspace provider to an EC2 cluster.
4+
state: alpha
5+
---
6+
7+
This article walks you through the process of deploying a workspace provider to
8+
an EC2 instance.
9+
10+
The use of EC2 providers is currently an **alpha** feature. Before using, please
11+
enable this feature under **Feature Preview**:
12+
13+
1. Log into Coder as a site manager or site admin.
14+
1. In the top-right, click on your avatar and select **Feature Preview**.
15+
1. Select **Amazon EC2 (Docker) providers** and click **Enable**.
16+
17+
## Prerequisites
18+
19+
You must have an
20+
[**AWS access key ID** and **secret access key**](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys).
21+
22+
We recommend having the [AWS CLI](https://aws.amazon.com/cli/) installed and
23+
configured as well.
24+
25+
### IAM permissions
26+
27+
To manage EC2 providers for your Coder deployment, create an IAM policy and
28+
attach it to the IAM identity (e.g., role) that will be managing your resources
29+
(be sure to update or remove `aws:RequestedRegion` accordingly):
30+
31+
```json
32+
{
33+
"Version": "2012-10-17",
34+
"Statement": [
35+
{
36+
"Effect": "Deny",
37+
"Action": "ec2:*",
38+
"Resource": "*",
39+
"Condition": {
40+
"StringNotEquals": {
41+
"aws:RequestedRegion": "us-east-1"
42+
}
43+
}
44+
},
45+
{
46+
"Effect": "Allow",
47+
"Action": [
48+
"ec2:DescribeAccountAttributes",
49+
"ec2:DescribeSubnets",
50+
"ec2:CreateSecurityGroup",
51+
"ec2:DescribeSecurityGroups",
52+
"ec2:AuthorizeSecurityGroupIngress",
53+
"ec2:DeleteSecurityGroup",
54+
"ec2:ImportKeyPair",
55+
"ec2:DescribeKeyPairs",
56+
"ec2:CreateVolume",
57+
"ec2:DescribeVolumes",
58+
"ec2:AttachVolume",
59+
"ec2:DeleteVolume",
60+
"ec2:RunInstances",
61+
"ec2:DescribeInstances",
62+
"ec2:DescribeInstanceStatus",
63+
"ec2:TerminateInstances",
64+
"ec2:DescribeInstanceTypes",
65+
"ec2:CreateTags"
66+
],
67+
"Resource": "*"
68+
}
69+
]
70+
}
71+
```
72+
73+
## 1. Select the workspace provider type to create
74+
75+
1. Log into Coder as a site manager, and go to **Manage** > **Workspace
76+
providers**.
77+
78+
1. In the top-right next to **Create Kubernetes Provider**, click on the **down
79+
arrow** and select **Create Amazon EC2 Provider**.
80+
81+
1. Provide a **name** to identify the provider.
82+
83+
## 2. Configure the connection to AWS
84+
85+
Provide the requested configuration details to connect Coder to your AWS
86+
account:
87+
88+
- **Access key ID**: the AWS access key associated with your account
89+
- **Secret access key**: the AWS secret access key associated with your account
90+
- **AWS region ID**: select the AWS region where the EC2 instances should be
91+
created
92+
- **AWS availability zone**: the AWS availability zone associated with the
93+
region where the EC2 instances are created
94+
95+
## 3. Provide networking information (optional)
96+
97+
Provide the following networking options if desired:
98+
99+
- VPC ID: Optional. The VPC network to which instances should be attached. If
100+
you leave this field empty, Coder uses the default VPC ID in the specified
101+
region for your EC2 instances
102+
- Subnet ID: Optional. The
103+
[ID of the subnet](https://docs.aws.amazon.com/managedservices/latest/userguide/find-subnet.html)
104+
associated with your VPC and availability zone. If you leave this field empty,
105+
Coder uses the default subnet associated with the VPC in your region and
106+
availability zone.
107+
108+
## 4. Provide AMI configuration information
109+
110+
Specify the Amazon Machine Image configuration you want to be used when
111+
launching workspaces:
112+
113+
- **Privileged mode**: Optional. check this box if you would like the workspace
114+
container to have read/write access to the EC2 instance's host filesystem
115+
116+
> Privileged mode may pose a security risk to your organization. We recommend
117+
> enabling this feature only if users need full access to the host (e.g., kernel
118+
> driver development or running Docker-in-Docker).
119+
120+
- **AMI ID**: the Amazon machine image ID to be used when creating the EC2
121+
instances; the machine image used must contain and start a Docker daemon. If
122+
blank, Coder defaults to an image that meets the requirements. If you selected
123+
a supported AWS region, this will auto-populate with a supported AMI (though
124+
you are welcome to change it)
125+
- **Instance types**: Optional. The EC2 instance types that users can provision
126+
using the workspace provider. Provide each instance type on a separate line;
127+
wildcard characters are allowed
128+
- **AMI SSH username**: the SSH login username used by Coder to connect to EC2
129+
instances. Must be set if you provide a custom AMI ID (this value may be
130+
auto-populated depending on the AMI you choose))
131+
- **Root volume size**: the storage capacity to be reserved for the copy of the
132+
AMI
133+
- **Docker volume size**: the storage capacity used for the Docker daemon
134+
directory; stores the workspace image and any ephemeral data outside of the
135+
home directory
136+
137+
## 5. Enable external connections (optional)
138+
139+
Toggle **external connect** on if you would like to enable SSH connections to
140+
your workspaces via the Coder CLI.
141+
142+
## 6. Create the provider
143+
144+
Click **Create provider** to proceed.

‎admin/workspace-providers/deployment/index.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
title: Deployment
3+
description: Learn how to deploy a workspace provider to a cluster.
4+
---
5+
6+
<children></children>

‎admin/workspace-providers/deployment.md renamed to ‎admin/workspace-providers/deployment/kubernetes.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
2-
title: Workspace provider deployment
3-
description: Learn how to deploy a workspace provider.
2+
title: Kubernetes
3+
description: Learn how to deploy a workspace provider to a Kubernetes cluster.
44
---
55

66
This article walks you through the process of deploying a workspace provider to
77
a Kubernetes cluster. If you do not have one, you can use our
8-
[cluster guides](../../setup/kubernetes/index.md) to create one compatible with
9-
Coder.
8+
[cluster guides](../../../setup/kubernetes/index.md) to create one compatible
9+
with Coder.
1010

1111
## Dependencies
1212

@@ -56,7 +56,7 @@ Install the following dependencies if you haven't already:
5656
name: coder
5757
rules:
5858
- apiGroups: ["", "apps", "networking.k8s.io"] # "" indicates the core API group
59-
resources: ["persistentvolumeclaims", "pods", "deployments", "services", "secrets", "pods/exec","pods/log", "events", "networkpolicies"]
59+
resources: ["persistentvolumeclaims", "pods", "deployments", "services", "secrets", "pods/exec","pods/log", "events", "networkpolicies", "serviceaccounts"]
6060
verbs: ["create", "get", "list", "watch", "update", "patch", "delete", "deletecollection"]
6161
- apiGroups: ["metrics.k8s.io", "storage.k8s.io"]
6262
resources: ["pods", "storageclasses"]

‎admin/workspace-providers/index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ create workspaces.
3030

3131
Remote workspace providers can lower developers' latency by locating their
3232
workspaces closer to them geographically or can be used for workload isolation
33-
purposes. See [Deploying a workspace provider](deployment.md) to learn how to
34-
expand your Coder deployment to additional Kubernetes clusters.
33+
purposes. See [Deploying a workspace provider](deployment/index.md) to learn how
34+
to expand your Coder deployment to additional Kubernetes clusters.
3535

3636
### Organization allowlists
3737

0 commit comments

Comments
 (0)