Skip to content

Commit ddbfc3e

Browse files
f0sself0ssel
committed
coderd
1 parent ece56e8 commit ddbfc3e

File tree

5 files changed

+577
-8
lines changed

5 files changed

+577
-8
lines changed

‎scaletest/terraform/new/k8s_certmanager.tf

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
locals {
2+
cert_manager_namespace = "cert-manager"
3+
cert_manager_helm_repo = "https://charts.jetstack.io"
4+
cert_manager_helm_chart = "cert-manager"
5+
cert_manager_release_name = "cert-manager"
6+
cert_manager_chart_version = "1.12.2"
7+
cloudflare_issuer_private_key_secret_name = "cloudflare-issuer-private-key"
8+
}
9+
10+
resource "kubernetes_secret" "cloudflare-api-key" {
11+
metadata {
12+
name = "cloudflare-api-key-secret"
13+
namespace = local.cert_manager_namespace
14+
}
15+
data = {
16+
api-token = var.cloudflare_api_token
17+
}
18+
}
19+
20+
resource "kubernetes_namespace" "cert-manager-namespace" {
21+
metadata {
22+
name = local.cert_manager_namespace
23+
}
24+
}
25+
26+
resource "helm_release" "cert-manager" {
27+
repository = local.cert_manager_helm_repo
28+
chart = local.cert_manager_helm_chart
29+
name = local.cert_manager_release_name
30+
namespace = kubernetes_namespace.cert-manager-namespace.metadata.0.name
31+
values = [<<EOF
32+
installCRDs: true
33+
EOF
34+
]
35+
}
36+
37+
resource "kubectl_manifest" "cloudflare-cluster-issuer" {
38+
depends_on = [ helm_release.cert-manager ]
39+
yaml_body = <<YAML
40+
apiVersion: cert-manager.io/v1
41+
kind: ClusterIssuer
42+
metadata:
43+
name: cloudflare-issuer
44+
spec:
45+
acme:
46+
email: ${var.cloudflare_email}
47+
server: https://acme-staging-v02.api.letsencrypt.org/directory
48+
privateKeySecretRef:
49+
name: ${local.cloudflare_issuer_private_key_secret_name}
50+
solvers:
51+
- dns01:
52+
cloudflare:
53+
apiTokenSecretRef:
54+
name: ${kubernetes_secret.cloudflare-api-key.metadata.0.name}
55+
key: api-token
56+
YAML
57+
}

‎scaletest/terraform/new/k8s_coder.tf

Lines changed: 280 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,280 @@
1+
data "google_client_config" "default" {}
2+
3+
locals {
4+
coder_url = "https://${var.name}-${var.deployments[0].name}-scaletest.${var.cloudflare_domain}"
5+
coder_admin_email = "admin@coder.com"
6+
coder_admin_user = "coder"
7+
coder_helm_repo = "https://helm.coder.com/v2"
8+
coder_helm_chart = "coder"
9+
coder_namespace = "coder-${var.name}"
10+
coder_release_name = var.name
11+
provisionerd_helm_chart = "coder-provisioner"
12+
provisionerd_release_name = "${var.name}-provisionerd"
13+
dnsNames = regex("https?://([^/]+)", local.coder_url)
14+
}
15+
16+
resource "kubernetes_namespace" "coder_namespace" {
17+
metadata {
18+
name = local.coder_namespace
19+
}
20+
lifecycle {
21+
ignore_changes = [timeouts, wait_for_default_service_account]
22+
}
23+
}
24+
25+
resource "random_password" "provisionerd_psk" {
26+
length = 26
27+
}
28+
29+
resource "kubernetes_secret" "coder-db" {
30+
type = "Opaque"
31+
metadata {
32+
name = "coder-db-url"
33+
namespace = kubernetes_namespace.coder_namespace.metadata.0.name
34+
}
35+
data = {
36+
url = local.coder_db_url
37+
}
38+
lifecycle {
39+
ignore_changes = [timeouts, wait_for_service_account_token]
40+
}
41+
}
42+
43+
resource "kubernetes_secret" "provisionerd_psk" {
44+
type = "Opaque"
45+
metadata {
46+
name = "coder-provisioner-psk"
47+
namespace = kubernetes_namespace.coder_namespace.metadata.0.name
48+
}
49+
data = {
50+
psk = random_password.provisionerd_psk.result
51+
}
52+
lifecycle {
53+
ignore_changes = [timeouts, wait_for_service_account_token]
54+
}
55+
}
56+
57+
# OIDC secret needs to be manually provisioned for now.
58+
data "kubernetes_secret" "coder_oidc" {
59+
metadata {
60+
namespace = kubernetes_namespace.coder_namespace.metadata.0.name
61+
name = "coder-oidc"
62+
}
63+
}
64+
65+
resource "kubectl_manifest" "coder_certificate" {
66+
depends_on = [ helm_release.cert-manager ]
67+
yaml_body = <<YAML
68+
apiVersion: cert-manager.io/v1
69+
kind: Certificate
70+
metadata:
71+
name: ${var.name}
72+
namespace: ${kubernetes_namespace.coder_namespace.metadata.0.name}
73+
spec:
74+
secretName: ${var.name}-tls
75+
dnsNames:
76+
- ${local.dnsNames.0}
77+
issuerRef:
78+
name: cloudflare-issuer
79+
kind: ClusterIssuer
80+
YAML
81+
}
82+
83+
data "kubernetes_secret" "coder_tls" {
84+
metadata {
85+
namespace = kubernetes_namespace.coder_namespace.metadata.0.name
86+
name = "${var.name}-tls"
87+
}
88+
depends_on = [kubectl_manifest.coder_certificate]
89+
}
90+
91+
resource "helm_release" "coder-chart" {
92+
repository = local.coder_helm_repo
93+
chart = local.coder_helm_chart
94+
name = local.coder_release_name
95+
version = var.coder_chart_version
96+
namespace = kubernetes_namespace.coder_namespace.metadata.0.name
97+
values = [<<EOF
98+
coder:
99+
affinity:
100+
nodeAffinity:
101+
requiredDuringSchedulingIgnoredDuringExecution:
102+
nodeSelectorTerms:
103+
- matchExpressions:
104+
- key: "cloud.google.com/gke-nodepool"
105+
operator: "In"
106+
values: ["${google_container_node_pool.node_pool[0].name}"]
107+
podAntiAffinity:
108+
preferredDuringSchedulingIgnoredDuringExecution:
109+
- weight: 1
110+
podAffinityTerm:
111+
topologyKey: "kubernetes.io/hostname"
112+
labelSelector:
113+
matchExpressions:
114+
- key: "app.kubernetes.io/instance"
115+
operator: "In"
116+
values: ["${local.coder_release_name}"]
117+
env:
118+
- name: "CODER_ACCESS_URL"
119+
value: "${local.coder_url}"
120+
- name: "CODER_CACHE_DIRECTORY"
121+
value: "/tmp/coder"
122+
- name: "CODER_TELEMETRY_ENABLE"
123+
value: "false"
124+
- name: "CODER_LOGGING_HUMAN"
125+
value: "/dev/null"
126+
- name: "CODER_LOGGING_STACKDRIVER"
127+
value: "/dev/stderr"
128+
- name: "CODER_PG_CONNECTION_URL"
129+
valueFrom:
130+
secretKeyRef:
131+
name: "${kubernetes_secret.coder-db.metadata.0.name}"
132+
key: url
133+
- name: "CODER_PPROF_ENABLE"
134+
value: "true"
135+
- name: "CODER_PROMETHEUS_ENABLE"
136+
value: "true"
137+
- name: "CODER_PROMETHEUS_COLLECT_AGENT_STATS"
138+
value: "true"
139+
- name: "CODER_PROMETHEUS_COLLECT_DB_METRICS"
140+
value: "true"
141+
- name: "CODER_VERBOSE"
142+
value: "true"
143+
- name: "CODER_EXPERIMENTS"
144+
value: "${var.coder_experiments}"
145+
- name: "CODER_DANGEROUS_DISABLE_RATE_LIMITS"
146+
value: "true"
147+
# Disabling built-in provisioner daemons
148+
- name: "CODER_PROVISIONER_DAEMONS"
149+
value: "0"
150+
- name: CODER_PROVISIONER_DAEMON_PSK
151+
valueFrom:
152+
secretKeyRef:
153+
key: psk
154+
name: "${kubernetes_secret.provisionerd_psk.metadata.0.name}"
155+
# Enable OIDC
156+
# - name: "CODER_OIDC_ISSUER_URL"
157+
# valueFrom:
158+
# secretKeyRef:
159+
# key: issuer-url
160+
# name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
161+
# - name: "CODER_OIDC_EMAIL_DOMAIN"
162+
# valueFrom:
163+
# secretKeyRef:
164+
# key: email-domain
165+
# name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
166+
# - name: "CODER_OIDC_CLIENT_ID"
167+
# valueFrom:
168+
# secretKeyRef:
169+
# key: client-id
170+
# name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
171+
# - name: "CODER_OIDC_CLIENT_SECRET"
172+
# valueFrom:
173+
# secretKeyRef:
174+
# key: client-secret
175+
# name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
176+
# Send OTEL traces to the cluster-local collector to sample 10%
177+
- name: "OTEL_EXPORTER_OTLP_ENDPOINT"
178+
value: "http://otel-collector.${kubernetes_namespace.coder_namespace.metadata.0.name}.svc.cluster.local:4317"
179+
- name: "OTEL_TRACES_SAMPLER"
180+
value: parentbased_traceidratio
181+
- name: "OTEL_TRACES_SAMPLER_ARG"
182+
value: "0.1"
183+
image:
184+
repo: ${var.coder_image_repo}
185+
tag: ${var.coder_image_tag}
186+
replicaCount: "${var.coder_replicas}"
187+
resources:
188+
requests:
189+
cpu: "${var.coder_cpu_request}"
190+
memory: "${var.coder_mem_request}"
191+
limits:
192+
cpu: "${var.coder_cpu_limit}"
193+
memory: "${var.coder_mem_limit}"
194+
securityContext:
195+
readOnlyRootFilesystem: true
196+
service:
197+
enable: true
198+
sessionAffinity: None
199+
loadBalancerIP: "${google_compute_address.coder[0].address}"
200+
volumeMounts:
201+
- mountPath: "/tmp"
202+
name: cache
203+
readOnly: false
204+
volumes:
205+
- emptyDir:
206+
sizeLimit: 1024Mi
207+
name: cache
208+
EOF
209+
]
210+
}
211+
212+
resource "helm_release" "provisionerd-chart" {
213+
repository = local.coder_helm_repo
214+
chart = local.provisionerd_helm_chart
215+
name = local.provisionerd_release_name
216+
version = var.provisionerd_chart_version
217+
namespace = kubernetes_namespace.coder_namespace.metadata.0.name
218+
values = [<<EOF
219+
coder:
220+
affinity:
221+
nodeAffinity:
222+
requiredDuringSchedulingIgnoredDuringExecution:
223+
nodeSelectorTerms:
224+
- matchExpressions:
225+
- key: "cloud.google.com/gke-nodepool"
226+
operator: "In"
227+
values: ["${google_container_node_pool.node_pool[0].name}"]
228+
podAntiAffinity:
229+
preferredDuringSchedulingIgnoredDuringExecution:
230+
- weight: 1
231+
podAffinityTerm:
232+
topologyKey: "kubernetes.io/hostname"
233+
labelSelector:
234+
matchExpressions:
235+
- key: "app.kubernetes.io/instance"
236+
operator: "In"
237+
values: ["${local.coder_release_name}"]
238+
env:
239+
- name: "CODER_URL"
240+
value: "${local.coder_url}"
241+
- name: "CODER_VERBOSE"
242+
value: "true"
243+
- name: "CODER_CONFIG_DIR"
244+
value: "/tmp/config"
245+
- name: "CODER_CACHE_DIRECTORY"
246+
value: "/tmp/coder"
247+
- name: "CODER_TELEMETRY_ENABLE"
248+
value: "false"
249+
- name: "CODER_LOGGING_HUMAN"
250+
value: "/dev/null"
251+
- name: "CODER_LOGGING_STACKDRIVER"
252+
value: "/dev/stderr"
253+
- name: "CODER_PROMETHEUS_ENABLE"
254+
value: "true"
255+
- name: "CODER_PROVISIONERD_TAGS"
256+
value: "scope=organization"
257+
image:
258+
repo: ${var.provisionerd_image_repo}
259+
tag: ${var.provisionerd_image_tag}
260+
replicaCount: "${var.provisionerd_replicas}"
261+
resources:
262+
requests:
263+
cpu: "${var.provisionerd_cpu_request}"
264+
memory: "${var.provisionerd_mem_request}"
265+
limits:
266+
cpu: "${var.provisionerd_cpu_limit}"
267+
memory: "${var.provisionerd_mem_limit}"
268+
securityContext:
269+
readOnlyRootFilesystem: true
270+
volumeMounts:
271+
- mountPath: "/tmp"
272+
name: cache
273+
readOnly: false
274+
volumes:
275+
- emptyDir:
276+
sizeLimit: 1024Mi
277+
name: cache
278+
EOF
279+
]
280+
}

0 commit comments

Comments
 (0)