Skip to content

Commit e6f3186

Browse files
johnstcnjohnstcn
committed
continue to support pskSecretName="" workaround
1 parent 9b8cda7 commit e6f3186

File tree

4 files changed

+149
-1
lines changed

4 files changed

+149
-1
lines changed

‎helm/provisioner/templates/_coder.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ env:
3535
{{- if and (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName) }}
3636
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified." }}
3737
{{- else if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
38-
{{- if ne .Values.provisionerDaemon.pskSecretName "coder-provisioner-psk" }}
38+
{{- if and (not (empty .Values.provisionerDaemon.pskSecretName)) (ne .Values.provisionerDaemon.pskSecretName "coder-provisioner-psk") }}
3939
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both." }}
4040
{{- else if .Values.provisionerDaemon.tags }}
4141
{{ fail "provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName." }}

‎helm/provisioner/tests/chart_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,12 @@ var testCases = []testCase{
5656
name: "provisionerd_key",
5757
expectedError: "",
5858
},
59+
// Test explicitly for the workaround where setting provisionerDaemon.pskSecretName=""
60+
// was required to use provisioner keys.
61+
{
62+
name: "provisionerd_key_psk_empty_workaround",
63+
expectedError: "",
64+
},
5965
{
6066
name: "provisionerd_psk_and_key",
6167
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both.`,

‎helm/provisioner/tests/testdata/provisionerd_key_psk_empty_workaround.golden

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_KEY
111+
valueFrom:
112+
secretKeyRef:
113+
key: provisionerd-key
114+
name: coder-provisionerd-key
115+
- name: CODER_URL
116+
value: http://coder.default.svc.cluster.local
117+
image: ghcr.io/coder/coder:latest
118+
imagePullPolicy: IfNotPresent
119+
lifecycle: {}
120+
name: coder
121+
ports: null
122+
resources: {}
123+
securityContext:
124+
allowPrivilegeEscalation: false
125+
readOnlyRootFilesystem: null
126+
runAsGroup: 1000
127+
runAsNonRoot: true
128+
runAsUser: 1000
129+
seccompProfile:
130+
type: RuntimeDefault
131+
volumeMounts: []
132+
restartPolicy: Always
133+
serviceAccountName: coder-provisioner
134+
terminationGracePeriodSeconds: 600
135+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_key_psk_empty_workaround.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"

0 commit comments

Comments
 (0)