Skip to content

Commit a90c15f

Browse files
johnstcnjohnstcn
committed
chore(helm/provisioner): add documentation for deploying a separate provisioner
1 parent b871324 commit a90c15f

File tree

6 files changed

+353
-1
lines changed

6 files changed

+353
-1
lines changed

‎helm/provisioner/README.md

Lines changed: 110 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,114 @@ coder:
3232
value: "0.0.0.0:2112"
3333
replicaCount: 10
3434
provisionerDaemon:
35-
pskSecretName: "coder-provisioner-psk"
35+
keySecretName: "coder-provisionerd-key"
36+
keySecretKey: "provisionerd-key"
3637
```
38+
39+
## Specific Examples
40+
41+
Below are some common specific use-cases when deploying a Coder provisioner.
42+
43+
### Set Labels and Annotations
44+
45+
If you need to set deployment- or pod-level labels and annotations, set `coder.{annotations,labels}` or `coder.{podAnnotations,podLabels}`.
46+
47+
Example:
48+
```yaml
49+
coder:
50+
# ...
51+
annotations:
52+
com.coder/annotation/foo: bar
53+
com.coder/annotation/baz: qux
54+
labels:
55+
com.coder/label/foo: bar
56+
com.coder/label/baz: qux
57+
podAnnotations:
58+
com.coder/podAnnotation/foo: bar
59+
com.coder/podAnnotation/baz: qux
60+
podLabels:
61+
com.coder/podLabel/foo: bar
62+
com.coder/podLabel/baz: qux
63+
```
64+
65+
### Additional Templates
66+
67+
You can include extra Kubernetes manifests in `extraTemplates`.
68+
69+
The below example will also create a `ConfigMap` along with the Helm release:
70+
71+
```yaml
72+
coder:
73+
# ...
74+
provisionerDaemon:
75+
# ...
76+
extraTemplates:
77+
- |
78+
apiVersion: v1
79+
kind: ConfigMap
80+
metadata:
81+
name: some-config
82+
namespace: {{ .Release.Namespace }}
83+
data:
84+
key: some-value
85+
```
86+
87+
### Disable Service Account Creation
88+
89+
### Deploying multiple provisioners in the same namespace
90+
91+
To deploy multiple provisioners in the same namespace, set the following values explicitly to avoid conflicts:
92+
- `nameOverride`: controls the name of the provisioner deployment
93+
- `serviceAccount.name`: controls the name of the service account.
94+
95+
Note that `nameOverride` does not apply to `extraTemplates`, as illustrated below:
96+
97+
```yaml
98+
coder:
99+
# ...
100+
serviceAccount:
101+
name: other-coder-provisioner
102+
provisionerDaemon:
103+
# ...
104+
nameOverride: "other-coder-provisioner"
105+
extraTemplates:
106+
- |
107+
apiVersion: v1
108+
kind: ConfigMap
109+
metadata:
110+
name: some-other-config
111+
namespace: {{ .Release.Namespace }}
112+
data:
113+
key: some-other-value
114+
```
115+
116+
If you wish to deploy a second provisioner that references an existing service account, you can do so as follows:
117+
118+
- Set `coder.serviceAccount.disableCreate=true` to disable service account creation,
119+
- Set `coder.serviceAccount.workspacePerms=false` to disable creation of a role and role binding,
120+
- Set `coder.serviceAccount.nameOverride` to the name of an existing service account.
121+
122+
See below for a concrete example:
123+
```yaml
124+
coder:
125+
# ...
126+
serviceAccount:
127+
name: preexisting-service-account
128+
disableCreate: true
129+
workspacePerms: false
130+
provisionerDaemon:
131+
# ...
132+
nameOverride: "other-coder-provisioner"
133+
```
134+
135+
# Testing
136+
137+
The test suite for this chart lives in `./tests/chart_test.go`.
138+
139+
Each test case runs `helm template` against the corresponding `test_case.yaml`, and compares the output with that of the corresponding `test_case.golden` in `./tests/testdata`.
140+
If `expectedError` is not empty for that specific test case, no corresponding `.golden` file is required.
141+
142+
To add a new test case:
143+
- Create an appropriately named `.yaml` file in `testdata/` along with a corresponding `.golden` file, if required.
144+
- Add the test case to the array in `chart_test.go`, setting `name` to the name of the files you added previously (without the extension). If appropriate, set `expectedError`.
145+
- Run the tests and ensure that no regressions in existing test cases occur: `go test ./tests`.

‎helm/provisioner/tests/chart_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,14 @@ var testCases = []testCase{
8282
name: "sa_disabled",
8383
expectedError: "",
8484
},
85+
{
86+
name: "name_override",
87+
expectedError: "",
88+
},
89+
{
90+
name: "name_override_existing_sa",
91+
expectedError: "",
92+
},
8593
}
8694

8795
type testCase struct {

‎helm/provisioner/tests/testdata/name_override.golden

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: other-coder-provisioner
11+
app.kubernetes.io/part-of: other-coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: other-coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/extra-templates.yaml
17+
apiVersion: v1
18+
kind: ConfigMap
19+
metadata:
20+
name: some-config
21+
namespace: default
22+
data:
23+
key: some-value
24+
---
25+
# Source: coder-provisioner/templates/rbac.yaml
26+
apiVersion: rbac.authorization.k8s.io/v1
27+
kind: Role
28+
metadata:
29+
name: other-coder-provisioner-workspace-perms
30+
rules:
31+
- apiGroups: [""]
32+
resources: ["pods"]
33+
verbs:
34+
- create
35+
- delete
36+
- deletecollection
37+
- get
38+
- list
39+
- patch
40+
- update
41+
- watch
42+
- apiGroups: [""]
43+
resources: ["persistentvolumeclaims"]
44+
verbs:
45+
- create
46+
- delete
47+
- deletecollection
48+
- get
49+
- list
50+
- patch
51+
- update
52+
- watch
53+
- apiGroups:
54+
- apps
55+
resources:
56+
- deployments
57+
verbs:
58+
- create
59+
- delete
60+
- deletecollection
61+
- get
62+
- list
63+
- patch
64+
- update
65+
- watch
66+
---
67+
# Source: coder-provisioner/templates/rbac.yaml
68+
apiVersion: rbac.authorization.k8s.io/v1
69+
kind: RoleBinding
70+
metadata:
71+
name: "other-coder-provisioner"
72+
subjects:
73+
- kind: ServiceAccount
74+
name: "other-coder-provisioner"
75+
roleRef:
76+
apiGroup: rbac.authorization.k8s.io
77+
kind: Role
78+
name: other-coder-provisioner-workspace-perms
79+
---
80+
# Source: coder-provisioner/templates/coder.yaml
81+
apiVersion: apps/v1
82+
kind: Deployment
83+
metadata:
84+
annotations: {}
85+
labels:
86+
app.kubernetes.io/instance: release-name
87+
app.kubernetes.io/managed-by: Helm
88+
app.kubernetes.io/name: other-coder-provisioner
89+
app.kubernetes.io/part-of: other-coder-provisioner
90+
app.kubernetes.io/version: 0.1.0
91+
helm.sh/chart: coder-provisioner-0.1.0
92+
name: other-coder-provisioner
93+
spec:
94+
replicas: 1
95+
selector:
96+
matchLabels:
97+
app.kubernetes.io/instance: release-name
98+
app.kubernetes.io/name: other-coder-provisioner
99+
template:
100+
metadata:
101+
annotations: {}
102+
labels:
103+
app.kubernetes.io/instance: release-name
104+
app.kubernetes.io/managed-by: Helm
105+
app.kubernetes.io/name: other-coder-provisioner
106+
app.kubernetes.io/part-of: other-coder-provisioner
107+
app.kubernetes.io/version: 0.1.0
108+
helm.sh/chart: coder-provisioner-0.1.0
109+
spec:
110+
containers:
111+
- args:
112+
- provisionerd
113+
- start
114+
command:
115+
- /opt/coder
116+
env:
117+
- name: CODER_PROMETHEUS_ADDRESS
118+
value: 0.0.0.0:2112
119+
- name: CODER_PROVISIONER_DAEMON_PSK
120+
valueFrom:
121+
secretKeyRef:
122+
key: psk
123+
name: coder-provisioner-psk
124+
- name: CODER_URL
125+
value: http://coder.default.svc.cluster.local
126+
image: ghcr.io/coder/coder:latest
127+
imagePullPolicy: IfNotPresent
128+
lifecycle: {}
129+
name: coder
130+
ports: null
131+
resources: {}
132+
securityContext:
133+
allowPrivilegeEscalation: false
134+
readOnlyRootFilesystem: null
135+
runAsGroup: 1000
136+
runAsNonRoot: true
137+
runAsUser: 1000
138+
seccompProfile:
139+
type: RuntimeDefault
140+
volumeMounts: []
141+
restartPolicy: Always
142+
serviceAccountName: other-coder-provisioner
143+
terminationGracePeriodSeconds: 600
144+
volumes: []

‎helm/provisioner/tests/testdata/name_override.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
coder:
2+
image:
3+
tag: latest
4+
serviceAccount:
5+
name: other-coder-provisioner
6+
nameOverride: "other-coder-provisioner"
7+
# Note that extraTemplates does not respect nameOverride.
8+
extraTemplates:
9+
- |
10+
apiVersion: v1
11+
kind: ConfigMap
12+
metadata:
13+
name: some-config
14+
namespace: {{ .Release.Namespace }}
15+
data:
16+
key: some-value

‎helm/provisioner/tests/testdata/name_override_existing_sa.golden

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
---
4+
apiVersion: apps/v1
5+
kind: Deployment
6+
metadata:
7+
annotations: {}
8+
labels:
9+
app.kubernetes.io/instance: release-name
10+
app.kubernetes.io/managed-by: Helm
11+
app.kubernetes.io/name: other-coder-provisioner
12+
app.kubernetes.io/part-of: other-coder-provisioner
13+
app.kubernetes.io/version: 0.1.0
14+
helm.sh/chart: coder-provisioner-0.1.0
15+
name: other-coder-provisioner
16+
spec:
17+
replicas: 1
18+
selector:
19+
matchLabels:
20+
app.kubernetes.io/instance: release-name
21+
app.kubernetes.io/name: other-coder-provisioner
22+
template:
23+
metadata:
24+
annotations: {}
25+
labels:
26+
app.kubernetes.io/instance: release-name
27+
app.kubernetes.io/managed-by: Helm
28+
app.kubernetes.io/name: other-coder-provisioner
29+
app.kubernetes.io/part-of: other-coder-provisioner
30+
app.kubernetes.io/version: 0.1.0
31+
helm.sh/chart: coder-provisioner-0.1.0
32+
spec:
33+
containers:
34+
- args:
35+
- provisionerd
36+
- start
37+
command:
38+
- /opt/coder
39+
env:
40+
- name: CODER_PROMETHEUS_ADDRESS
41+
value: 0.0.0.0:2112
42+
- name: CODER_PROVISIONER_DAEMON_PSK
43+
valueFrom:
44+
secretKeyRef:
45+
key: psk
46+
name: coder-provisioner-psk
47+
- name: CODER_URL
48+
value: http://coder.default.svc.cluster.local
49+
image: ghcr.io/coder/coder:latest
50+
imagePullPolicy: IfNotPresent
51+
lifecycle: {}
52+
name: coder
53+
ports: null
54+
resources: {}
55+
securityContext:
56+
allowPrivilegeEscalation: false
57+
readOnlyRootFilesystem: null
58+
runAsGroup: 1000
59+
runAsNonRoot: true
60+
runAsUser: 1000
61+
seccompProfile:
62+
type: RuntimeDefault
63+
volumeMounts: []
64+
restartPolicy: Always
65+
serviceAccountName: existing-coder-provisioner-serviceaccount
66+
terminationGracePeriodSeconds: 600
67+
volumes: []

‎helm/provisioner/tests/testdata/name_override_existing_sa.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
coder:
2+
image:
3+
tag: latest
4+
serviceAccount:
5+
name: "existing-coder-provisioner-serviceaccount"
6+
disableCreate: true
7+
workspacePerms: false
8+
nameOverride: "other-coder-provisioner"

0 commit comments

Comments
 (0)