Skip to content

Commit 32d4bd7

Browse files
johnstcnjohnstcn
committed
feat(helm/provisioner): add support for provisioner keys, add note re psk
1 parent 5ebc748 commit 32d4bd7

8 files changed

+345
-3
lines changed

‎helm/provisioner/templates/NOTES.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{/*
2+
Deprecation notices:
3+
*/}}
4+
5+
{{- if .Values.provisionerDaemon.pskSecretName }}
6+
Note: Provisioner Daemon PSKs are no longer recommended for use with external
7+
provisioners. Consider migrating to scoped provisioner keys instead. For more
8+
information, see: https://coder.com/docs/admin/provisioners#authentication
9+
{{- end }}
10+
11+
Enjoy Coder! Please create an issue at https://github.com/coder/coder if you run
12+
into any problems! :)

‎helm/provisioner/templates/_coder.tpl

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,20 @@ args:
3232
env:
3333
- name: CODER_PROMETHEUS_ADDRESS
3434
value: "0.0.0.0:2112"
35+
{{- if .Values.provisionerDaemon.pskSecretName }}
3536
- name: CODER_PROVISIONER_DAEMON_PSK
3637
valueFrom:
3738
secretKeyRef:
3839
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
3940
key: psk
41+
{{- end }}
42+
{{- if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
43+
- name: CODER_PROVISIONER_DAEMON_KEY
44+
valueFrom:
45+
secretKeyRef:
46+
name: {{ .Values.provisionerDaemon.keySecretName | quote }}
47+
key: {{ .Values.provisionerDaemon.keySecretKey | quote }}
48+
{{- end }}
4049
{{- if include "provisioner.tags" . }}
4150
- name: CODER_PROVISIONERD_TAGS
4251
value: {{ include "provisioner.tags" . }}

‎helm/provisioner/tests/chart_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,14 @@ var testCases = []testCase{
5252
name: "provisionerd_psk",
5353
expectedError: "",
5454
},
55+
{
56+
name: "provisionerd_key",
57+
expectedError: "",
58+
},
59+
{
60+
name: "provisionerd_psk_and_key",
61+
expectedError: "",
62+
},
5563
{
5664
name: "extra_templates",
5765
expectedError: "",

‎helm/provisioner/tests/testdata/provisionerd_key.golden

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_KEY
111+
valueFrom:
112+
secretKeyRef:
113+
key: provisionerd-key
114+
name: coder-provisionerd-key
115+
- name: CODER_PROVISIONERD_TAGS
116+
value: clusterType=k8s,location=auh
117+
- name: CODER_URL
118+
value: http://coder.default.svc.cluster.local
119+
image: ghcr.io/coder/coder:latest
120+
imagePullPolicy: IfNotPresent
121+
lifecycle: {}
122+
name: coder
123+
ports: null
124+
resources: {}
125+
securityContext:
126+
allowPrivilegeEscalation: false
127+
readOnlyRootFilesystem: null
128+
runAsGroup: 1000
129+
runAsNonRoot: true
130+
runAsUser: 1000
131+
seccompProfile:
132+
type: RuntimeDefault
133+
volumeMounts: []
134+
restartPolicy: Always
135+
serviceAccountName: coder-provisioner
136+
terminationGracePeriodSeconds: 600
137+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_key.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"
8+
tags:
9+
location: auh
10+
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.golden

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_PSK
111+
valueFrom:
112+
secretKeyRef:
113+
key: psk
114+
name: coder-provisionerd-psk
115+
- name: CODER_PROVISIONER_DAEMON_KEY
116+
valueFrom:
117+
secretKeyRef:
118+
key: provisionerd-key
119+
name: coder-provisionerd-key
120+
- name: CODER_PROVISIONERD_TAGS
121+
value: clusterType=k8s,location=auh
122+
- name: CODER_URL
123+
value: http://coder.default.svc.cluster.local
124+
image: ghcr.io/coder/coder:latest
125+
imagePullPolicy: IfNotPresent
126+
lifecycle: {}
127+
name: coder
128+
ports: null
129+
resources: {}
130+
securityContext:
131+
allowPrivilegeEscalation: false
132+
readOnlyRootFilesystem: null
133+
runAsGroup: 1000
134+
runAsNonRoot: true
135+
runAsUser: 1000
136+
seccompProfile:
137+
type: RuntimeDefault
138+
volumeMounts: []
139+
restartPolicy: Always
140+
serviceAccountName: coder-provisioner
141+
terminationGracePeriodSeconds: 600
142+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: "coder-provisionerd-psk"
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"
8+
tags:
9+
location: auh
10+
clusterType: k8s

‎helm/provisioner/values.yaml

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -192,12 +192,26 @@ coder:
192192

193193
# provisionerDaemon -- Provisioner Daemon configuration options
194194
provisionerDaemon:
195-
# provisionerDaemon.pskSecretName -- The name of the Kubernetes secret that contains the
195+
# provisionerDaemon.pskSecretName -- (deprecated) The name of the Kubernetes secret that contains the
196196
# Pre-Shared Key (PSK) to use to authenticate with Coder. The secret must be in the same namespace
197-
# as the Helm deployment, and contain an item called "psk" which contains the pre-shared key.
197+
# as the Helm deployment, and contain an item called "psk" which contains the
198+
# pre-shared key.
199+
# WARNING: this field is deprecated and will be removed in a future release.
200+
# Please use provisionerDaemon.keySecretName instead and generate a
201+
# provisioner key instead of a PSK.
198202
pskSecretName: "coder-provisioner-psk"
199203

200-
# provisionerDaemon.tags -- Tags to filter provisioner jobs by
204+
# provisionerDaemon.keySecretName -- The name of the Kubernetes
205+
# secret that contains a provisioner key to use to authenticate with Coder.
206+
# See: https://coder.com/docs/admin/provisioners#authentication
207+
keySecretName: ""
208+
# provisionerDaemon.keySecretKey -- The key of the Kubernetes
209+
# secret specified in provisionerDaemon.keySecretName that contains
210+
# the provisioner key. Defaults to "key".
211+
keySecretKey: "key"
212+
213+
# provisionerDaemon.tags -- Tags to filter provisioner jobs by.
214+
# See: https://coder.com/docs/admin/provisioners#provisioner-tags
201215
tags:
202216
{}
203217
# location: usa

0 commit comments

Comments
 (0)