Skip to content

Commit 19fc1a2

Browse files
EdwardAngertEdwardAngert
committed
Merge remote-tracking branch 'origin/main' into update-upgrade-config-links
2 parents 3716a96 + fed70bd commit 19fc1a2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+2833
-337
lines changed

‎.github/workflows/ci.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ jobs:
9090
- "coderd/**"
9191
- "enterprise/**"
9292
- "examples/*"
93+
- "helm/**"
9394
- "provisioner/**"
9495
- "provisionerd/**"
9596
- "provisionersdk/**"
@@ -970,7 +971,7 @@ jobs:
970971
uses: google-github-actions/setup-gcloud@f0990588f1e5b5af6827153b93673613abdc6ec7 # v2.1.1
971972

972973
- name: Set up Flux CLI
973-
uses: fluxcd/flux2/action@9b3958825a314eb79495c6993ef397ddbf87f32f # v2.2.1
974+
uses: fluxcd/flux2/action@5350425cdcd5fa015337e09fa502153c0275bd4b # v2.4.0
974975
with:
975976
# Keep this and the github action up to date with the version of flux installed in dogfood cluster
976977
version: "2.2.1"

‎.github/workflows/scorecard.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,6 @@ jobs:
4747

4848
# Upload the results to GitHub's code scanning dashboard.
4949
- name: "Upload to code-scanning"
50-
uses: github/codeql-action/upload-sarif@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
50+
uses: github/codeql-action/upload-sarif@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
5151
with:
5252
sarif_file: results.sarif

‎.github/workflows/security.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
uses: ./.github/actions/setup-go
3838

3939
- name: Initialize CodeQL
40-
uses: github/codeql-action/init@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
40+
uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
4141
with:
4242
languages: go, javascript
4343

@@ -47,7 +47,7 @@ jobs:
4747
rm Makefile
4848
4949
- name: Perform CodeQL Analysis
50-
uses: github/codeql-action/analyze@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
50+
uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
5151

5252
- name: Send Slack notification on failure
5353
if: ${{ failure() }}
@@ -124,15 +124,15 @@ jobs:
124124
echo "image=$(cat "$image_job")" >> $GITHUB_OUTPUT
125125
126126
- name: Run Trivy vulnerability scanner
127-
uses: aquasecurity/trivy-action@5681af892cd0f4997658e2bacc62bd0a894cf564
127+
uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2
128128
with:
129129
image-ref: ${{ steps.build.outputs.image }}
130130
format: sarif
131131
output: trivy-results.sarif
132132
severity: "CRITICAL,HIGH"
133133

134134
- name: Upload Trivy scan results to GitHub Security tab
135-
uses: github/codeql-action/upload-sarif@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
135+
uses: github/codeql-action/upload-sarif@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
136136
with:
137137
sarif_file: trivy-results.sarif
138138
category: "Trivy"
@@ -147,7 +147,7 @@ jobs:
147147
# Prisma cloud scan runs last because it fails the entire job if it
148148
# detects vulnerabilities. :|
149149
- name: Run Prisma Cloud image scan
150-
uses: PaloAltoNetworks/prisma-cloud-scan@1f38c94d789ff9b01a4e80070b442294ebd3e362 # v1.4.0
150+
uses: PaloAltoNetworks/prisma-cloud-scan@124b48d8325c23f58a35da0f1b4d9a6b54301d05 # v1.6.7
151151
with:
152152
pcc_console_url: ${{ secrets.PRISMA_CLOUD_URL }}
153153
pcc_user: ${{ secrets.PRISMA_CLOUD_ACCESS_KEY }}

‎coderd/tailnet.go

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -91,13 +91,15 @@ func NewServerTailnet(
9191
})
9292
}
9393

94-
derpMapUpdaterClosed := make(chan struct{})
94+
bgRoutines := &sync.WaitGroup{}
9595
originalDerpMap := derpMapFn()
9696
// it's important to set the DERPRegionDialer above _before_ we set the DERP map so that if
9797
// there is an embedded relay, we use the local in-memory dialer.
9898
conn.SetDERPMap(originalDerpMap)
99+
bgRoutines.Add(1)
99100
go func() {
100-
defer close(derpMapUpdaterClosed)
101+
defer bgRoutines.Done()
102+
defer logger.Debug(ctx, "polling DERPMap exited")
101103

102104
ticker := time.NewTicker(5 * time.Second)
103105
defer ticker.Stop()
@@ -120,7 +122,7 @@ func NewServerTailnet(
120122
tn := &ServerTailnet{
121123
ctx: serverCtx,
122124
cancel: cancel,
123-
derpMapUpdaterClosed: derpMapUpdaterClosed,
125+
bgRoutines: bgRoutines,
124126
logger: logger,
125127
tracer: traceProvider.Tracer(tracing.TracerName),
126128
conn: conn,
@@ -170,8 +172,15 @@ func NewServerTailnet(
170172
// registering the callback also triggers send of the initial node
171173
tn.coordinatee.SetNodeCallback(tn.nodeCallback)
172174

173-
go tn.watchAgentUpdates()
174-
go tn.expireOldAgents()
175+
tn.bgRoutines.Add(2)
176+
go func() {
177+
defer tn.bgRoutines.Done()
178+
tn.watchAgentUpdates()
179+
}()
180+
go func() {
181+
defer tn.bgRoutines.Done()
182+
tn.expireOldAgents()
183+
}()
175184
return tn, nil
176185
}
177186

@@ -204,6 +213,7 @@ func (s *ServerTailnet) Collect(metrics chan<- prometheus.Metric) {
204213
}
205214

206215
func (s *ServerTailnet) expireOldAgents() {
216+
defer s.logger.Debug(s.ctx, "stopped expiring old agents")
207217
const (
208218
tick = 5 * time.Minute
209219
cutoff = 30 * time.Minute
@@ -255,6 +265,7 @@ func (s *ServerTailnet) doExpireOldAgents(cutoff time.Duration) {
255265
}
256266

257267
func (s *ServerTailnet) watchAgentUpdates() {
268+
defer s.logger.Debug(s.ctx, "stopped watching agent updates")
258269
for {
259270
conn := s.getAgentConn()
260271
resp, ok := conn.NextUpdate(s.ctx)
@@ -317,9 +328,9 @@ func (s *ServerTailnet) reinitCoordinator() {
317328
}
318329

319330
type ServerTailnet struct {
320-
ctx context.Context
321-
cancel func()
322-
derpMapUpdaterClosed chan struct{}
331+
ctx context.Context
332+
cancel func()
333+
bgRoutines *sync.WaitGroup
323334

324335
logger slog.Logger
325336
tracer trace.Tracer
@@ -532,10 +543,12 @@ func (c *netConnCloser) Close() error {
532543
}
533544

534545
func (s *ServerTailnet) Close() error {
546+
s.logger.Info(s.ctx, "closing server tailnet")
547+
defer s.logger.Debug(s.ctx, "server tailnet close complete")
535548
s.cancel()
536549
_ = s.conn.Close()
537550
s.transport.CloseIdleConnections()
538-
<-s.derpMapUpdaterClosed
551+
s.bgRoutines.Wait()
539552
return nil
540553
}
541554

‎docs/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,3 +143,4 @@ or [the v2 migration guide and FAQ](https://coder.com/docs/v1/guides/v2-faq).
143143

144144
- Learn about [Templates](./admin/templates/index.md)
145145
- [Install Coder](./install/index.md)
146+
- Follow the [Quickstart guide](./tutorials/quickstart.md) to try Coder out for yourself.

‎docs/admin/networking/workspace-proxies.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,6 @@ connecting with their workspace over SSH, a workspace app, port forwarding, etc.
1313
Dashboard connections and API calls (e.g. the workspaces list) are not served
1414
over workspace proxies.
1515

16-
![ProxyDiagram](../../images/admin/networking/workspace-proxies/proxydiagram.png)
17-
1816
# Deploy a workspace proxy
1917

2018
Each workspace proxy should be a unique instance. At no point should 2 workspace
@@ -56,12 +54,13 @@ Deploying the workspace proxy will also register the proxy with coderd and make
5654
the workspace proxy usable. If the proxy deployment is successful,
5755
`coder wsproxy ls` will show an `ok` status code:
5856

59-
```
57+
```shell
6058
$ coder wsproxy ls
6159
NAME URL STATUS STATUS
62-
brazil-saopaulo https://brazil.example.com ok
63-
europe-frankfurt https://europe.example.com ok
64-
sydney https://sydney.example.com ok
60+
primary https://dev.coder.com ok
61+
brazil-saopaulo https://brazil.example.com ok
62+
europe-frankfurt https://europe.example.com ok
63+
sydney https://sydney.example.com ok
6564
```
6665

6766
Other Status codes:

‎docs/admin/provisioners.md

Lines changed: 54 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -41,36 +41,40 @@ The provisioner daemon must authenticate with your Coder deployment.
4141
## Scoped Key (Recommended)
4242

4343
We recommend creating finely-scoped keys for provisioners. Keys are scoped to an
44-
organization.
44+
organization, and optionally to a specific set of tags.
4545

46-
```sh
47-
coder provisioner keys create my-key \
48-
--org default
46+
1. Use `coder provisioner` to create the key:
4947

50-
Successfully created provisioner key my-key! Save this authentication token, it will not be shown again.
48+
- To create a key for an organization that will match untagged jobs:
5149

52-
<key omitted>
53-
```
50+
```sh
51+
coder provisioner keys create my-key \
52+
--org default
5453

55-
Or, restrict the provisioner to jobs with specific tags
54+
Successfully created provisioner key my-key! Save this authentication token, it will not be shown again.
5655

57-
```sh
58-
coder provisioner keys create kubernetes-key \
59-
--org default \
60-
--tag environment=kubernetes
56+
<key omitted>
57+
```
6158

62-
Successfully created provisioner key kubernetes-key! Save this authentication token, it will not be shown again.
59+
- To restrict the provisioner to jobs with specific tags:
6360

64-
<key omitted>
65-
```
61+
```sh
62+
coder provisioner keys create kubernetes-key \
63+
--org default \
64+
--tag environment=kubernetes
6665
67-
To start the provisioner:
66+
Successfully created provisioner key kubernetes-key! Save this authentication token, it will not be shown again.
6867
69-
```sh
70-
export CODER_URL=https://<your-coder-url>
71-
export CODER_PROVISIONER_DAEMON_KEY=<key>
72-
coder provisioner start
73-
```
68+
<key omitted>
69+
```
70+
71+
1. Start the provisioner with the specified key:
72+
73+
```sh
74+
export CODER_URL=https://<your-coder-url>
75+
export CODER_PROVISIONER_DAEMON_KEY=<key>
76+
coder provisioner start
77+
```
7478

7579
Keep reading to see instructions for running provisioners on
7680
Kubernetes/Docker/etc.
@@ -98,11 +102,15 @@ Note: Any user can start [user-scoped provisioners](#user-scoped-provisioners),
98102
but this will also require a template on your deployment with the corresponding
99103
tags.
100104

101-
## Global PSK
105+
## Global PSK (Not Recommended)
106+
107+
> Global pre-shared keys (PSK) make it difficult to rotate keys or isolate
108+
> provisioners.
109+
>
110+
> We do not recommend using global PSK.
102111

103-
A deployment-wide PSK can be used to authenticate any provisioner. We do not
104-
recommend this approach anymore, as it makes key rotation or isolating
105-
provisioners far more difficult. To use a global PSK, set a
112+
A deployment-wide PSK can be used to authenticate any provisioner. To use a
113+
global PSK, set a
106114
[provisioner daemon pre-shared key (PSK)](../reference/cli/server.md#--provisioner-daemon-psk)
107115
on the Coder server.
108116

@@ -275,18 +283,32 @@ coder templates push on-prem \
275283
Coder provides a Helm chart for running external provisioner daemons, which you
276284
will use in concert with the Helm chart for deploying the Coder server.
277285

278-
1. Create a long, random pre-shared key (PSK) and store it in a Kubernetes
279-
secret
286+
1. Create a provisioner key:
287+
288+
```sh
289+
coder provisioner keys create my-cool-key --org default
290+
# Optionally, you can specify tags for the provisioner key:
291+
# coder provisioner keys create my-cool-key --org default --tags location=auh kind=k8s
292+
```
293+
294+
Successfully created provisioner key kubernetes-key! Save this authentication
295+
token, it will not be shown again.
296+
297+
<key omitted>
298+
```
299+
300+
1. Store the key in a kubernetes secret:
280301
281302
```sh
282-
kubectl create secret generic coder-provisioner-psk --from-literal=psk=`head /dev/urandom | base64 | tr -dc A-Za-z0-9 | head -c 26`
303+
kubectl create secret generic coder-provisioner-psk --from-literal=key1=`<key omitted>`
283304
```
284305
285306
1. Modify your Coder `values.yaml` to include
286307
287308
```yaml
288309
provisionerDaemon:
289-
pskSecretName: "coder-provisioner-psk"
310+
keySecretName: "coder-provisioner-keys"
311+
keySecretKey: "key1"
290312
```
291313
292314
1. Redeploy Coder with the new `values.yaml` to roll out the PSK. You can omit
@@ -300,7 +322,7 @@ will use in concert with the Helm chart for deploying the Coder server.
300322
```
301323
302324
1. Create a `provisioner-values.yaml` file for the provisioner daemons Helm
303-
chart. For example
325+
chart. For example:
304326
305327
```yaml
306328
coder:
@@ -309,10 +331,8 @@ will use in concert with the Helm chart for deploying the Coder server.
309331
value: "https://coder.example.com"
310332
replicaCount: 10
311333
provisionerDaemon:
312-
pskSecretName: "coder-provisioner-psk"
313-
tags:
314-
location: auh
315-
kind: k8s
334+
keySecretName: "coder-provisioner-keys"
335+
keySecretKey: "key1"
316336
```
317337
318338
This example creates a deployment of 10 provisioner daemons (for 10

‎docs/admin/templates/managing-templates/index.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Working with templates
22

3-
You create and edit Coder templates as [Terraform](../../../start/coder-tour.md)
4-
configuration files (`.tf`) and any supporting files, like a README or
5-
configuration files for other services.
3+
You create and edit Coder templates as
4+
[Terraform](../../../tutorials/quickstart.md) configuration files (`.tf`) and
5+
any supporting files, like a README or configuration files for other services.
66

77
## Who creates templates?
88

‎docs/images/admin/networking/workspace-proxies/proxydiagram.png

-159 KB
Binary file not shown.

‎docs/images/screenshots/create-template.png

80.1 KB
Loading

‎docs/images/screenshots/welcome-create-admin-user.png

46.7 KB
Loading

‎docs/images/screenshots/workspace-running-with-topbar.png

57.6 KB
Loading

‎docs/install/index.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,5 +64,5 @@ coder login https://coder.example.com
6464

6565
## Next steps
6666

67-
- [Set up your first deployment](../start/coder-tour.md)
67+
- [Set up your first deployment](../tutorials/quickstart.md)
6868
- [Expose your control plane to other users](../admin/setup/index.md)

‎docs/manifest.json

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@
88
"icon_path": "./images/icons/home.svg",
99
"children": [
1010
{
11-
"title": "Tour Coder",
12-
"description": "Tour Coder by creating a deployment with Docker",
13-
"path": "./start/coder-tour.md"
11+
"title": "Coder quickstart",
12+
"description": "Try it out for yourself",
13+
"path": "./tutorials/quickstart.md"
1414
},
1515
{
1616
"title": "Screenshots",
@@ -634,6 +634,11 @@
634634
"path": "./tutorials/index.md",
635635
"icon_path": "./images/icons/generic.svg",
636636
"children": [
637+
{
638+
"title": "Get started with Coder",
639+
"description": "Learn how to install and run Coder quickly",
640+
"path": "./tutorials/quickstart.md"
641+
},
637642
{
638643
"title": "Write a Template from Scratch",
639644
"description": "Learn how to author Coder templates",

0 commit comments

Comments
 (0)