Skip to content

Commit 306fdd8

Browse files
spikecurtisspikecurtis
committed
WIP external provisioner chart
Signed-off-by: Spike Curtis <spike@coder.com>
1 parent 175e776 commit 306fdd8

27 files changed

+1894
-12
lines changed

‎helm/coder/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ keywords:
2121
- coder
2222
- terraform
2323
sources:
24-
- https://github.com/coder/coder/tree/main/helm
24+
- https://github.com/coder/coder/tree/main/helm/coder
2525
icon: https://helm.coder.com/coder_logo_black.png
2626
maintainers:
2727
- name: Coder Technologies, Inc.

‎helm/coder/templates/coder.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,13 @@ env:
3030
value: "0.0.0.0:8080"
3131
- name: CODER_PROMETHEUS_ADDRESS
3232
value: "0.0.0.0:2112"
33+
{{- if .Values.coder.provisionerDaemonPSKSecretName }}
34+
- name: CODER_PROVISIONER_DAEMON_PSK
35+
valueFrom:
36+
secretKeyRef:
37+
name: {{ .Values.coder.provisionerDaemonPSKSecretName | quote }}
38+
key: psk
39+
{{- end }}
3340
# Set the default access URL so a `helm apply` works by default.
3441
# See: https://github.com/coder/coder/issues/5024
3542
{{- $hasAccessURL := false }}

‎helm/coder/tests/chart_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,10 @@ var TestCases = []TestCase{
5656
name: "command_args",
5757
expectedError: "",
5858
},
59+
{
60+
name: "provisionerd_psk",
61+
expectedError: "",
62+
},
5963
}
6064

6165
type TestCase struct {

‎helm/coder/tests/testdata/provisionerd_psk.golden

+194
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
# Source: coder/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder
11+
app.kubernetes.io/part-of: coder
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-0.1.0
14+
name: coder
15+
---
16+
# Source: coder/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-workspace-perms
70+
---
71+
# Source: coder/templates/service.yaml
72+
apiVersion: v1
73+
kind: Service
74+
metadata:
75+
name: coder
76+
labels:
77+
helm.sh/chart: coder-0.1.0
78+
app.kubernetes.io/name: coder
79+
app.kubernetes.io/instance: release-name
80+
app.kubernetes.io/part-of: coder
81+
app.kubernetes.io/version: "0.1.0"
82+
app.kubernetes.io/managed-by: Helm
83+
annotations:
84+
{}
85+
spec:
86+
type: LoadBalancer
87+
sessionAffinity: ClientIP
88+
ports:
89+
- name: "http"
90+
port: 80
91+
targetPort: "http"
92+
protocol: TCP
93+
externalTrafficPolicy: "Cluster"
94+
selector:
95+
app.kubernetes.io/name: coder
96+
app.kubernetes.io/instance: release-name
97+
---
98+
# Source: coder/templates/coder.yaml
99+
apiVersion: apps/v1
100+
kind: Deployment
101+
metadata:
102+
annotations: {}
103+
labels:
104+
app.kubernetes.io/instance: release-name
105+
app.kubernetes.io/managed-by: Helm
106+
app.kubernetes.io/name: coder
107+
app.kubernetes.io/part-of: coder
108+
app.kubernetes.io/version: 0.1.0
109+
helm.sh/chart: coder-0.1.0
110+
name: coder
111+
spec:
112+
replicas: 1
113+
selector:
114+
matchLabels:
115+
app.kubernetes.io/instance: release-name
116+
app.kubernetes.io/name: coder
117+
template:
118+
metadata:
119+
annotations: {}
120+
labels:
121+
app.kubernetes.io/instance: release-name
122+
app.kubernetes.io/managed-by: Helm
123+
app.kubernetes.io/name: coder
124+
app.kubernetes.io/part-of: coder
125+
app.kubernetes.io/version: 0.1.0
126+
helm.sh/chart: coder-0.1.0
127+
spec:
128+
affinity:
129+
podAntiAffinity:
130+
preferredDuringSchedulingIgnoredDuringExecution:
131+
- podAffinityTerm:
132+
labelSelector:
133+
matchExpressions:
134+
- key: app.kubernetes.io/instance
135+
operator: In
136+
values:
137+
- coder
138+
topologyKey: kubernetes.io/hostname
139+
weight: 1
140+
containers:
141+
- args:
142+
- server
143+
command:
144+
- /opt/coder
145+
env:
146+
- name: CODER_HTTP_ADDRESS
147+
value: 0.0.0.0:8080
148+
- name: CODER_PROMETHEUS_ADDRESS
149+
value: 0.0.0.0:2112
150+
- name: CODER_PROVISIONER_DAEMON_PSK
151+
valueFrom:
152+
secretKeyRef:
153+
key: psk
154+
name: coder-provisionerd-psk
155+
- name: CODER_ACCESS_URL
156+
value: http://coder.default.svc.cluster.local
157+
- name: KUBE_POD_IP
158+
valueFrom:
159+
fieldRef:
160+
fieldPath: status.podIP
161+
- name: CODER_DERP_SERVER_RELAY_URL
162+
value: http://$(KUBE_POD_IP):8080
163+
image: ghcr.io/coder/coder:latest
164+
imagePullPolicy: IfNotPresent
165+
lifecycle: {}
166+
livenessProbe:
167+
httpGet:
168+
path: /healthz
169+
port: http
170+
scheme: HTTP
171+
name: coder
172+
ports:
173+
- containerPort: 8080
174+
name: http
175+
protocol: TCP
176+
readinessProbe:
177+
httpGet:
178+
path: /healthz
179+
port: http
180+
scheme: HTTP
181+
resources: {}
182+
securityContext:
183+
allowPrivilegeEscalation: false
184+
readOnlyRootFilesystem: null
185+
runAsGroup: 1000
186+
runAsNonRoot: true
187+
runAsUser: 1000
188+
seccompProfile:
189+
type: RuntimeDefault
190+
volumeMounts: []
191+
restartPolicy: Always
192+
serviceAccountName: coder
193+
terminationGracePeriodSeconds: 60
194+
volumes: []

‎helm/coder/tests/testdata/provisionerd_psk.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemonPSKSecretName: "coder-provisionerd-psk"

‎helm/coder/values.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,14 @@ coder:
280280
# coder.commandArgs -- Set arguments for the entrypoint command of the Coder pod.
281281
commandArgs: []
282282

283+
# coder.provisionerDaemonPSKSecretName -- The name of the Kubernetes secret that contains the
284+
# Pre-Shared Key (PSK) to use to authenticate external provisioner daemons with Coder. The
285+
# secret must be in the same namespace as the Helm deployment, and contain an item called "psk"
286+
# which contains the pre-shared key.
287+
#
288+
# This is an Enterprise feature. Contact sales@coder.com.
289+
provisionerDaemonPSKSecretName: ""
290+
283291
# extraTemplates -- Array of extra objects to deploy with the release. Strings
284292
# are evaluated as a template and can use template expansions and functions. All
285293
# other objects are used as yaml.

‎helm/libcoder/templates/_helpers.tpl

+17-9
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,15 @@ Coder Docker image URI
4949
Coder TLS enabled.
5050
*/}}
5151
{{- define "coder.tlsEnabled" -}}
52-
{{- if .Values.coder.tls.secretNames -}}
53-
true
54-
{{- else -}}
55-
false
56-
{{- end -}}
52+
{{- if hasKey .Values.coder "tls" -}}
53+
{{- if .Values.coder.tls.secretNames -}}
54+
true
55+
{{- else -}}
56+
false
57+
{{- end -}}
58+
{{- else -}}
59+
false
60+
{{- end -}}
5761
{{- end }}
5862

5963
{{/*
@@ -88,11 +92,13 @@ http
8892
Coder volume definitions.
8993
*/}}
9094
{{- define "coder.volumeList" }}
91-
{{ range $secretName := .Values.coder.tls.secretNames -}}
95+
{{- if hasKey .Values.coder "tls" -}}
96+
{{ range $secretName := .Values.coder.tls.secretNames -}}
9297
- name: "tls-{{ $secretName }}"
9398
secret:
9499
secretName: {{ $secretName | quote }}
95-
{{ end -}}
100+
{{ end -}}
101+
{{- end }}
96102
{{ range $secret := .Values.coder.certs.secrets -}}
97103
- name: "ca-cert-{{ $secret.name }}"
98104
secret:
@@ -119,11 +125,13 @@ volumes: []
119125
Coder volume mounts.
120126
*/}}
121127
{{- define "coder.volumeMountList" }}
122-
{{ range $secretName := .Values.coder.tls.secretNames -}}
128+
{{- if hasKey .Values.coder "tls" -}}
129+
{{ range $secretName := .Values.coder.tls.secretNames -}}
123130
- name: "tls-{{ $secretName }}"
124131
mountPath: "/etc/ssl/certs/coder/{{ $secretName }}"
125132
readOnly: true
126-
{{ end -}}
133+
{{ end -}}
134+
{{- end }}
127135
{{ range $secret := .Values.coder.certs.secrets -}}
128136
- name: "ca-cert-{{ $secret.name }}"
129137
mountPath: "/etc/ssl/certs/{{ $secret.name }}.crt"

‎helm/libcoder/templates/_rbac.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
apiVersion: rbac.authorization.k8s.io/v1
55
kind: Role
66
metadata:
7-
name: coder-workspace-perms
7+
name: {{ .Values.coder.serviceAccount.name }}-workspace-perms
88
rules:
99
- apiGroups: [""]
1010
resources: ["pods"]
@@ -54,6 +54,6 @@ subjects:
5454
roleRef:
5555
apiGroup: rbac.authorization.k8s.io
5656
kind: Role
57-
name: coder-workspace-perms
57+
name: {{ .Values.coder.serviceAccount.name }}-workspace-perms
5858
{{- end }}
5959
{{- end -}}

‎helm/provisioner/Chart.yaml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: v2
2+
name: coder-provisioner
3+
description: "External provisioner daemon for Coder. This is an Enterprise feature; contact sales@coder.com."
4+
home: https://github.com/coder/coder
5+
6+
# version and appVersion are injected at release and will always be shown as
7+
# 0.1.0 in the repository.
8+
#
9+
# If you're installing the Helm chart directly from git it will have this
10+
# version, which means the auto-generated image URI will be invalid. You can set
11+
# "coder.image.tag" to the desired tag manually.
12+
type: application
13+
version: "0.1.0"
14+
appVersion: "0.1.0"
15+
16+
# Coder has a hard requirement on Kubernetes 1.19, as this version introduced
17+
# the networking.k8s.io/v1 API.
18+
kubeVersion: ">= 1.19.0-0"
19+
20+
keywords:
21+
- coder
22+
- terraform
23+
sources:
24+
- https://github.com/coder/coder/tree/main/helm/provisioner
25+
icon: https://helm.coder.com/coder_logo_black.png
26+
maintainers:
27+
- name: Coder Technologies, Inc.
28+
email: support@coder.com
29+
url: https://coder.com/contact
30+
31+
dependencies:
32+
- name: libcoder
33+
version: 0.1.0
34+
repository: file://../libcoder

‎helm/provisioner/charts/libcoder-0.1.0.tgz

2.92 KB
Binary file not shown.

0 commit comments

Comments
 (0)