Skip to content

Commit 3a59e4b

Browse files
author
Katie Horne
committed
Merge branch 'release-1.29' into docker
2 parents 0c7f595 + d9882b3 commit 3a59e4b

File tree

15 files changed

+282
-74
lines changed

15 files changed

+282
-74
lines changed

‎admin/access-control/manage.md

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ domain name for the OIDC token callback; use
2222
`https://coder.my-company.com/oidc/callback`.
2323

2424
Once you've registered a Coder application with your OIDC provider, you'll need
25-
to return to Coder and complete the setup process. Under **Admin** > **Manage** >
26-
**Authentication**, ensure that you've selected **OpenID Connect** as the
27-
authentication type. Then, provide the following parameters:
25+
to return to Coder and complete the setup process. Under **Admin** >
26+
**Manage** > **Authentication**, ensure that you've selected **OpenID Connect**
27+
as the authentication type. Then, provide the following parameters:
2828

2929
- **Client ID**: The client ID for the Coder application you registered with the
3030
OIDC provider
@@ -43,9 +43,9 @@ you:
4343
tokens from `https://<yourDomain>/api/v0/users/me/oidc-access-token`
4444
- **Additional Scopes:** Specify any scopes (beyond the default) that you would
4545
like Coder to request from the authentication provider. By default, Coder
46-
requests the scopes `openid`, `email`, and `profile`. Consult your
47-
authentication provider's documentation for information on which scopes they
48-
support.
46+
requests the scopes `openid`, `email`, and `profile`. Consult your
47+
authentication provider's documentation for information on which scopes they
48+
support.
4949
- **Disable built-in authentication:** Choose whether Coder removes the ability
5050
to log in with an email/password option when you've enabled OIDC
5151
authentication
@@ -62,9 +62,5 @@ To do so, navigate to **Manage** > **Admin** > **Authentication**. Then, toggle
6262
**Disable built-in authentication** to **On** and click **Save preferences**.
6363

6464
[Site managers](users/user-roles#site-manager-permissions) can still use
65-
built-in authentication. To view this option on the login page, add the
66-
following query parameter to the URL you use to access your Coder deployment:
67-
68-
```text
69-
/login?showAllAuthenticationTypes=1
70-
```
65+
built-in authentication. The **Admin Login** option will be visible on the login
66+
page if built-in authentication is disabled.

‎admin/workspace-management/cvms/management.md

Lines changed: 84 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,14 @@ a site manager must enable CVMs. To do so:
99
1. Go to **Manage > Admin > Infrastructure**.
1010
1. Toggle the **Enable Container-Based Virtual Machines** option to **Enable**.
1111

12-
## Cached CVMs
12+
This section also describes the customization features that Coder offers for
13+
CVMs:
14+
15+
![CVM Settings](../../../assets/admin/cvm-settings.png)
16+
17+
These settings will apply to workspaces **after** they have been rebuilt.
18+
19+
## Caching
1320

1421
> Cached CVMs are currently an **alpha** feature.
1522
@@ -18,7 +25,7 @@ To improve the startup time for CVM-based workspaces, you can enable caching.
1825
Cached CVMs require the `shiftfs` kernel to be present on the node. Some
1926
distributions (such as Ubuntu) include `shiftfs`. If you're unsure if `shiftfs`
2027
is present on your nodes, you can check by running `modinfo shiftfs`. If no
21-
output is returned, then you do not have `shiftfs` installed.
28+
output is returned, you do not have `shiftfs` installed.
2229

2330
If you don't want to install `shiftfs` yourself, you can have Coder install the
2431
module automatically for you. **It is important that you do not have secure boot
@@ -27,4 +34,78 @@ install `shiftfs` on your behalf.**
2734

2835
> GPUs are not supported with cached CVMs at this time.
2936
30-
![Cached CVMs](../../../assets/admin/cached-cvms.png)
37+
## Self-contained workspace builds
38+
39+
> Self-contained workspace builds are currently an **alpha** feature.
40+
41+
By default, Coder initializes workspaces by running commands inside the
42+
container. Workspaces, however, control the initialization sequence instead when
43+
you enable [self-contained workspace builds]. This enables cluster operations
44+
that restrict command execution inside containers using the Kubernetes API, such
45+
as the `kubectl exec` command.
46+
47+
[self-contained workspace builds]: ../self-contained-builds.md
48+
49+
## Workspace process logging
50+
51+
> Workspace process logging is currently an **alpha** feature.
52+
53+
[Workspace process logging] enables auditing of commands executed inside the
54+
workspace container.
55+
56+
[workspace process logging]: ../process-logging.md
57+
58+
## TUN device
59+
60+
> TUN devices currently an **alpha** feature.
61+
62+
Coder allows the creation of custom network interfaces using the Linux TUN
63+
device. When using the **Enable TUN device** setting, Coder workspaces will have
64+
a `/dev/net/tun` device mounted into the workspace at build time. VPN usage
65+
often requires a TUN device.
66+
67+
Users may need root (or `sudo`) access within their workspace to use the TUN
68+
device and start a VPN client.
69+
70+
> At this time, Coder does not support TUN devices for non-Kubernetes workspace
71+
> types, such as EC2 or Docker.
72+
>
73+
> If you're working with EC2 workspaces, we recommend enabling privileged mode
74+
> in the workspace provider settings, which will allow users to create their own
75+
> TUN device.
76+
77+
We've tested this feature using the [Tailscale](https://tailscale.com/) VPN
78+
within Coder. Remember that you may have to change your VPN settings to keep any
79+
persistent files (such as configuration/identity) files in your home volume, as
80+
any data outside the home volume is cleared when the workspace is rebuilt.
81+
82+
## FUSE device
83+
84+
> FUSE devices are currently an **alpha** feature.
85+
86+
Coder allows the creation of custom filesystems using the Linux FUSE userspace
87+
filesystem device. By enabling the **Enable FUSE device** setting, Coder
88+
workspaces will have a `/dev/fuse` device mounted into the workspace at build
89+
time. These devices are often used to mount specialized filesystems, such as
90+
Google Cloud Storage buckets, to your workspace.
91+
92+
Users may need root (or `sudo`) access within their workspace to use the FUSE
93+
device and start a FUSE filesystem.
94+
95+
> At this time, Coder does not support FUSE devices for non-Kubernetes workspace
96+
> types, such as EC2 or Docker.
97+
>
98+
> If you're working with EC2 workspaces, we recommend enabling privileged mode
99+
> in the workspace provider settings, which will allow users to create their own
100+
> FUSE device.
101+
102+
For example, you can mount a directory from a remote SSH server using `sshfs`:
103+
104+
```console
105+
mkdir /tmp/mnt
106+
sshfs user@host:/ /tmp/mnt
107+
```
108+
109+
Then, in a second terminal, run `ls /tmp/mnt` to list the files from the remote
110+
host. You should also be able to see a `fuse.sshfs` entry in the output from the
111+
`mount` command.

‎admin/workspace-management/tun-device.md

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎assets/admin/cached-cvms.png

-186 KB
Binary file not shown.

‎assets/admin/cvm-settings.png

133 KB
Loading

‎assets/admin/tun.png

-17.9 KB
Binary file not shown.

‎changelog/1.29.0.md

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
title: "1.29.0"
3+
description: "Released on 03/23/2022"
4+
---
5+
6+
### Breaking changes ❗
7+
8+
There are no breaking changes in 1.29.0.
9+
10+
### Features ✨
11+
12+
- web: added admin login form that appears when OIDC login is enabled and
13+
built-in authentication is disabled.
14+
- C4D: added support for SSH to Docker workspace providers.
15+
- C4D: added support for access URLs other than `localhost`.
16+
- cli: added ability to
17+
[create workspace providers via CLI](../guides/admin/wp-cli.md).
18+
- infra: added support for AWS’ IAM Roles for Service Accounts (IRSA) to
19+
CVM-enabled workspaces.
20+
- infra: added support for
21+
[FUSE devices in CVM-enabled workspaces](../admin/workspace-management/cvms/management.md#fuse-device).
22+
- infra: updated code-server version to `4.1.0` (features VS Code `1.63.0`).
23+
- infra: updated Kubernetes libraries to `1.21`.
24+
- api: added ability for users to set preferred ICE protocol (e.g., `TURN` or
25+
`STUN`).
26+
27+
### Bug fixes 🐛
28+
29+
- web: fixed issue where usernames in dev URLs were case-sensitive.
30+
- web: fixed issue where resource quota changes were audit logged incorrectly.
31+
- web: fixed issue where deleting a workspace caused a “Failed to fetch
32+
applications!” error.
33+
- web: fixed issue where the Dashboard showed a “workspace available”
34+
notification even though the build failed.
35+
- web: fixed issue with the Create/Edit a Workspace form not displaying errors
36+
if users provided non-unique workspace names.
37+
- web: fixed issue with code copy buttons in the UI.
38+
- web: fixed issue where users aren’t logged out correctly after changing the
39+
password.
40+
- C4D: fixed issue with Docker workspace provider form throwing “Failed to
41+
create/update workspace provider!” errors.
42+
- C4D: fixed “Resource Load Unknown” errors that occurred during the workspace
43+
build process.
44+
- infra: fixed issue where the API call issued by Coder while loading the
45+
workspaces page returns the image and information on all workspaces using that
46+
image, leading to degraded performance.
47+
- infra: fixed issue with workspace build jobs scheduled multiple times.
48+
- infra: fixed memory leak when a client connects to a workspace.
49+
- infra: fixed issue where dev URL access settings weren’t enforced after
50+
changes made by site managers.
51+
- infra: fixed issue regarding mTLS not working with Git providers and Docker
52+
registries.
53+
- infra: fixed issue with `coderd` intermittently crashing.
54+
- infra: fixed issue with satellites unable to build workspaces when the
55+
self-contained workspace feature was enabled.
56+
57+
### Security updates 🔐
58+
59+
infra: upgraded from Go boring 1.17.5b7 to 1.17.8b7 to fix CVEs.
60+
61+
### Known issues 🔧
62+
63+
- web: the service banner (if enabled) reappears for all users, even if they've
64+
previously dismissed it.
65+
- web: using the web terminal in Coder can occasionally result in the connection
66+
being reset and needing to be restarted.
67+
- web: the **Switch workspace** drop-down menu shows a workspace's status as
68+
**Building** even though the build process is completed.
69+
- web: users installing v1.24 (or later) into an air-gapped environment cannot
70+
upload their license when prompted.

‎changelog/index.md

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: "Changelog"
33
description:
4-
"Coder releases annotated with breaking changes, new features and fixes."
4+
"Coder releases annotated with breaking changes, new features, and fixes."
55
icon:
66
"<svg viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\">\n<path
77
d=\"M14 2H6c-1.1 0-1.99.9-1.99 2L4 20c0 1.1.89 2 1.99 2H18c1.1 0 2-.9
@@ -10,15 +10,18 @@ icon:
1010

1111
## Release schedule
1212

13-
[Coder release calendar (iCal file)](https://coder.com/release-calendar.ical)
13+
[Coder release calendar (iCal file)](https://calendar.google.com/calendar/ical/c_sdmrh87t5voc4u5rrjvktcrpko%40group.calendar.google.com/public/basic.ics)
1414

15-
- Release _candidates_ begin appearing on the **second Wednesday** of each month
16-
(Coder may create multiple release candidates prior to the actual release)
15+
- We typically issue release _candidates_ on the **third Wednesday** of each
16+
month, though this is subject to change. Check the
17+
[release calendar](https://calendar.google.com/calendar/ical/c_sdmrh87t5voc4u5rrjvktcrpko%40group.calendar.google.com/public/basic.ics)
18+
for up-to-date information (Coder may create multiple release candidates prior
19+
to the actual release)
1720
- We do not provide documentation for release candidates, and you should not
1821
use them unless you've been instructed to do so by Coder. You can identify
1922
release candidates by the presence of `-rc` in the version number (e.g.,
2023
`1.16.0-rc.1`).
21-
- Releases are available on the **third Wednesday** of each month
24+
- Releases are available a week after we issue a release candidate
2225
- _Patch_ releases become available as needed
2326

2427
## Changelogs

‎guides/admin/wp-cli.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: Workspace provider provisioning via CLI
3+
description: Learn how to provision a workspace provider using the Coder CLI.
4+
---
5+
6+
1. Install and authenticate the Coder CLI.
7+
8+
1. Run the following to provision a new **Kubernetes** workspace provider (be
9+
sure to replace the placeholders as necessary):
10+
11+
```console
12+
coder providers create kubernetes [name] --namespace=[namespace] --cluster-address=[clusterAddress]
13+
```
14+
15+
<!-- markdownlint-disable -->
16+
17+
| **Parameter** | **Description** |
18+
| ----------------- | ------------------------------------------------------------------------------ |
19+
| `name` | The name for the workspace provider you'd like provisioned |
20+
| `namespace` | The namespace in which to provision workspaces. |
21+
| `cluster-address` | The address of the Kubernetes control plane; find using `kubectl cluster-info` |
22+
23+
<!-- markdownlint-restore -->
24+
25+
Example usage:
26+
27+
```console
28+
coder providers create kubernetes my-provider --namespace=my-namespace --cluster-address=https://255.255.255.255`
29+
```
30+
31+
To create a new **EC2** workspace provider:
32+
33+
```console
34+
coder providers create ec2 [name] --access-key-id=[access-key-id] --secret-access-key=[secret-access-key]
35+
```
36+
37+
<!-- markdownlint-disable -->
38+
39+
| **Parameter** | **Description** |
40+
| ------------------- | ---------------------------------------------------------- |
41+
| `name` | The name for the workspace provider you'd like provisioned |
42+
| `access-key-id` | The AWS access key associated with your account. |
43+
| `secret-access-key` | The AWS region where the EC2 instances should be created. |
44+
45+
<!-- markdownlint-restore -->
46+
47+
```console
48+
coder providers create ec2 my-provider --access-key-id=AKIAIOSFODNN7EXAMPLE --secret-access-key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
49+
```
50+
51+
1. Once you've provisioned the workspace provider, deploy it to your
52+
[Kubernetes](../../admin/workspace-providers/deployment/kubernetes.md) or
53+
[EC2](../../admin/workspace-providers/deployment/ec2.md) cluster.
54+
55+
Ensure that you're connected to the cluster you're deploying to, and run the
56+
provided `helm upgrade` command; it should look something like the following,
57+
but with the placeholders filled with values appropriate to your deployment:
58+
59+
helm upgrade coder-workspace-provider coder/workspace-provider \
60+
--version=<version> \
61+
--atomic \
62+
--install \
63+
--force \
64+
--set envproxy.token=<token> \
65+
--set envproxy.accessURL=<envproxyAccessURL> \
66+
--set ingress.host=<ingressHostName> \
67+
--set envproxy.clusterAddress=<clusterAddress> \
68+
--set cemanager.accessURL=<cemanagerAccessUrl>
69+
70+
> WARNING: The 'envproxy.token' is a secret value that authenticates the
71+
> workspace provider; make sure that you don't share this token or make it
72+
> public.
73+
74+
You can set
75+
[additional values of the Helm Chart](https://github.com/cdr/enterprise-helm/blob/workspace-providers-envproxy-only/README.md)
76+
to customize the deployment further.

‎manifest.json

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{
22
"versions": [
3+
"v1.29",
34
"v1.28",
45
"v1.27",
56
"v1.26",
@@ -321,9 +322,6 @@
321322
{
322323
"path": "./admin/workspace-management/ssh-access.md"
323324
},
324-
{
325-
"path": "./admin/workspace-management/tun-device.md"
326-
},
327325
{
328326
"path": "./admin/workspace-management/process-logging.md"
329327
}
@@ -431,6 +429,9 @@
431429
},
432430
{
433431
"path": "./guides/admin/usage-monitoring.md"
432+
},
433+
{
434+
"path": "./guides/admin/wp-cli.md"
434435
}
435436
]
436437
},
@@ -552,6 +553,9 @@
552553
{
553554
"path": "./changelog/index.md",
554555
"children": [
556+
{
557+
"path": "./changelog/1.29.0.md"
558+
},
555559
{
556560
"path": "./changelog/1.28.0.md",
557561
"children": [

0 commit comments

Comments
 (0)