Skip to content

Commit 5e76e56

Browse files
author
Katie Horne
authored
Merge branch 'release-1.25' into katiehorne/sc-17358
2 parents b767dbd + 58a9554 commit 5e76e56

File tree

18 files changed

+421
-113
lines changed

18 files changed

+421
-113
lines changed

‎admin/access-control/user-roles.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,20 @@ There are four roles available:
3939
</tbody>
4040
</table>
4141

42+
### Additive permissions
43+
44+
The following tables detail what permissions Coder grants to each of the four
45+
roles, but a summary of the roles are:
46+
47+
- All users are (or have the permissions of) a **member**
48+
- An **auditor** has the permissions of a member, plus the ability to work with
49+
audit logs
50+
- A **site manager** has the permissions of a member or an auditor, plus
51+
additional administrative rights
52+
- A **site admin** has the permissions of a member, auditor, and site manager,
53+
as well as additional admin rights (e.g., creating site managers, access to
54+
API keys)
55+
4256
### Site admin permissions
4357

4458
<table>

‎admin/registries/ecr.md

Lines changed: 117 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -6,41 +6,131 @@ description: Add a private Amazon ECR to Coder.
66
This article will show you how to add your private ECR to Coder. If you're using
77
a public ECR registry, you do not need to follow the steps below.
88

9-
Amazon requires users to [request temporary login credentials to access a
10-
private Elastic Container Registry (ECR)
11-
registry](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html).
12-
When interacting with ECR, Coder will request temporary credentials from the
13-
registry using the AWS credentials linked to the registry.
9+
Amazon requires users to
10+
[request temporary login credentials](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html)
11+
to access a private Elastic Container Registry (ECR) registry. When interacting
12+
with ECR, Coder will request temporary credentials from the registry using the
13+
AWS credentials linked to the registry.
1414

15-
## Step 1: Setting up your AWS credentials
15+
## Step 1: Setting up authentication for Coder
1616

17-
To access a private ECR registry, Coder needs AWS credentials (specifically your
18-
**access key ID** and **secret access key**) with authorization to access the
19-
provided registry. You can either use AWS credentials tied to your own AWS
20-
account *or* credentials tied to an IAM user specifically for Coder (we
21-
recommend the latter option).
17+
To access a private ECR registry, Coder needs to authenticate with AWS. Coder
18+
supports two methods of authentication with AWS ECR:
2219

23-
Note that you are not limited to providing one single set of AWS credentials.
24-
For example, you can use a set of credentials with access to all of your ECR
25-
repositories, or you can use individual sets of credentials, each with access to
26-
a single repository.
20+
- Static credentials
21+
- **Alpha:** IAM roles for service accounts
2722

28-
To provision AWS credentials for Coder:
23+
### Option A: Provision static credentials for Coder
2924

30-
1. **Optional:** [Create an IAM user for
31-
Coder](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html)
25+
You can use an **Access Key ID** and **Secret Access Key** tied to either your
26+
own AWS account _or_ credentials tied to a dedicated IAM user (we recommend the
27+
latter option).
28+
29+
> You are not limited to providing a single set of AWS credentials. For example,
30+
> you can use a set of credentials with access to all of your ECR repositories,
31+
> or you can use individual sets of credentials, each with access to a single
32+
> repository.
33+
34+
To provision static credentials for Coder:
35+
36+
1. **Optional:**
37+
[Create an IAM user for Coder](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html)
3238
to access ECR. You can either attach the AWS-managed policy
33-
`AmazonEC2ContainerRegistryReadOnly` to the user, or you can [create your
34-
own](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html).
39+
`AmazonEC2ContainerRegistryReadOnly` to the user, or you can
40+
[create your own](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html).
3541

36-
1. [Create an access
37-
key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
42+
1. [Create an access key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
3843
for the IAM user to be used with Coder (if one does not already exist).
3944

45+
### Option B: Link an AWS IAM role to the Coder Kubernetes service account (IRSA)
46+
47+
**Note:** This is currently an **alpha** feature.
48+
49+
Coder can use an
50+
[IAM role linked to Coder's Kubernetes service account](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/),
51+
though this is only supported when Coder is running in AWS EKS. This is because
52+
the
53+
[EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook/)
54+
is required to provision and inject the required token into the `coderd` pod.
55+
56+
> For more information on IAM Roles for Service Accounts (IRSA), please consult
57+
> the
58+
> [AWS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
59+
60+
To link an IAM role to Coder's Kubernetes service account:
61+
62+
1. Enable the feature under Manage > Admin > Infrastructure > ECR IAM Role
63+
Authentication.
64+
65+
1. Create an IAM OIDC Provider for your EKS cluster (if it does not already
66+
exist).
67+
68+
1. [Create the IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-service-account-iam-policy-and-role.html#create-service-account-iam-role)
69+
to be used by Coder, if it does not already exist.
70+
71+
**Note:** Ensure that you also create and attach a trust policy that permits
72+
the Coder service account the action `sts:AssumeRoleWithWebIdentity`. The
73+
trust policy will look similar to the following:
74+
75+
```json
76+
{
77+
"Version": "2012-10-17",
78+
"Statement": [
79+
{
80+
"Effect": "Allow",
81+
"Principal": {
82+
"Federated": "arn:aws:iam::${ACCT_ID}:oidc-provider/${OIDC_PROVIDER}"
83+
},
84+
"Action": "sts:AssumeRoleWithWebIdentity",
85+
"Condition": {
86+
"StringEquals": {
87+
"${OIDC_PROVIDER}:sub": "system:serviceaccount:${NAMESPACE}:${SERVICE_ACCOUNT}"
88+
}
89+
}
90+
}
91+
]
92+
}
93+
```
94+
95+
1. Annotate the Coder service account with the role ARN:
96+
97+
a) Add the following to your `values.yaml` for your Coder helm deployment:
98+
99+
```yaml
100+
coderd:
101+
...
102+
builtinProviderServiceAccount:
103+
...
104+
annotations:
105+
eks.amazonaws.com/role-arn: my-role-arn
106+
```
107+
108+
b) Update the Helm deployment:
109+
110+
```shell
111+
helm upgrade coder coder/coder --values values.yaml
112+
```
113+
114+
c) Verify that the Coder service account now has the correct annotation:
115+
116+
```shell
117+
kubectl get serviceaccount coder -o yaml | grep eks.amazonaws.com/role-arn
118+
eks.amazonaws.com/role-arn: my-role-arn
119+
```
120+
121+
1. Validate that pods created with the `coder` service account have permission
122+
to assume the role:
123+
124+
```shell
125+
kubectl run -it --rm awscli --image=amazon/aws-cli \
126+
--overrides='{"spec":{"serviceAccount":"coder"}}' \
127+
--command aws ecr describe-repositories
128+
```
129+
40130
## Step 2: Add your private ECR registry to Coder
41131

42-
You can add your private ECR registry at the same time that you [add your
43-
images](../../images/index.md). To import an image:
132+
You can add your private ECR registry at the same time that you
133+
[add your images](../../images/index.md). To import an image:
44134

45135
1. In Coder, go to **Images** and click on **Import Image** in the upper-right.
46136

@@ -51,7 +141,9 @@ images](../../images/index.md). To import an image:
51141
1. Provide a **registry name** and the **registry**.
52142

53143
1. Set the **registry kind** to **ECR** and provide your **Access Key ID** and
54-
**Secret Access Key**.
144+
**Secret Access Key**, if required. If you want to use IRSA instead of static
145+
credentials, to authenticate with ECR, leave **Access Key ID** and **Secret
146+
Access Key** blank.
55147

56148
1. Continue with the process of [adding your image](../../images/index.md).
57149

‎admin/workspace-management/self-contained-builds.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
title: "Self-contained workspace builds"
3+
description: Learn how to enable self-contained workspace builds.
4+
state: alpha
5+
---
6+
7+
By default the Coder workspace boot sequence occurs remotely -- Coder uploads
8+
assets (including the Coder agent, code-server, and JetBrains Projector) from
9+
`coderd` to a workspace.
10+
11+
However, Coder offers the option of using **self-contained workspace builds**.
12+
Enabling this option changes the Coder deployment so that workspaces control the
13+
boot sequence internally, with the workspace downloading assets from `coderd`.
14+
15+
> At this time, Coder does not support certificate injectioin with
16+
> self-contained workspace builds.
17+
18+
To enable self-contained workspace builds:
19+
20+
1. Log into Coder.
21+
1. Go to Manage > Admin.
22+
1. On the Infrastructure page, scroll down to **Workspace container runtime**.
23+
1. Under **Enable self-contained workspace builds**, flip the toggle to **On**.
24+
1. Click **Save workspaces**.
25+
26+
> Build errors are typically more verbose for remote builds than with
27+
> self-contained builds.

‎admin/workspace-providers/management.md

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,8 @@ At this point, you can:
6161
> `coder config-ssh`.
6262
6363
- Specify the Kubernetes `pod_tolerations`, `pod_node_selector`, and
64-
`service_account_annotations` for the workspaces deployed with this provider:
64+
`service_account_annotations`, and affinity for the workspaces deployed with
65+
this provider:
6566

6667
```json
6768
{
@@ -73,10 +74,35 @@ At this point, you can:
7374
}
7475
],
7576
"pod_node_selector": {},
76-
"service_account_annotations": {}
77+
"service_account_annotations": {},
78+
"affinity": {}
7779
}
7880
```
7981

82+
Configuring affinities allows you to control how workspaces are scheduled
83+
across nodes. Enabling affinities allows Coder to schedule workspaces across
84+
nodes, instead of being scheduled together onto a single node:
85+
86+
```json
87+
"affinity": {
88+
"podAffinity": {
89+
"preferredDuringSchedulingIgnoredDuringExecution": [
90+
{
91+
"weight": 1,
92+
"podAffinityTerm": {
93+
"labelSelector": {
94+
"matchLabels": {
95+
"com.coder.resource": "true"
96+
}
97+
},
98+
"topologyKey": "kubernetes.io/hostname"
99+
}
100+
}
101+
]
102+
}
103+
}
104+
```
105+
80106
Once you've made your changes, click **Update Provider** to save and continue.
81107

82108
## Delete a workspace provider

‎assets/workspaces/create-devurl.png

-47 KB
Loading

‎changelog/1.25.0.md

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
title: "1.25.0"
3+
description: "Released on 11/17/2021"
4+
---
5+
6+
> The final patch release of Kubernetes 1.19 was published on 28 October 2021.
7+
> As such, the _subsequent_ versions of Coder (v1.26 and later) will require the
8+
> use of Kubernetes 1.20 or later. See Coder's [version support policy] for more
9+
> information.
10+
11+
<!-- Turn off linting to avoid changing the link -->
12+
<!-- markdownlint-disable MD044 -->
13+
14+
[version support policy]:
15+
../setup/kubernetes/index.md#supported-kubernetes-versions
16+
17+
<!-- markdownlint-enable MD044 -->
18+
19+
### Breaking changes ❗
20+
21+
- web: updated dev URLs to use a double hyphen as the delimiter. Please update
22+
bookmarks accordingly.
23+
24+
### Features ✨
25+
26+
- EC2: added support for workspace providers deployed on EC2 instances.
27+
- Coder for Docker: added ability for macOS users with Docker Desktop to quickly
28+
deploy Coder.
29+
- web: added support for
30+
[IRSA authentication](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/)
31+
with AWS ECR. This can be enabled under **Manage > Admin > Infrastructure >
32+
ECR IAM Role Authentication**.
33+
- web: removed the workspace create interstitial page for selecting custom or
34+
templated workspaces and replaced with a drop-down button.
35+
- web: updated the **Create a Workspace** screen so that the **Advanced**
36+
section is collapsed by default.
37+
- web: added support for hyphens in usernames.
38+
- web: improved length validation on dev URL names to conform with hostname
39+
length limit.
40+
- web: improved support for high-availability deployments by allowing admins to
41+
control affinities, or how Coder schedules workspaces across nodes.
42+
- web: improved performance of the Coder UI.
43+
- cli: added ability to set auto-off times on a per-workspace basis.
44+
- infra: added the `CODER_ORGANIZATION_ID`environment variable.
45+
- infra: added ability to pass custom headers to workspace applications.
46+
- infra: added ability to check for non-200 status codes related to workspace
47+
applications.
48+
- infra: added
49+
[permissions for service account creation](https://github.com/cdr/enterprise-helm/blob/main/templates/rbac.yaml#L33)
50+
to the RBAC Helm charts.
51+
- infra: added functionality to create Kubernetes service accounts for
52+
workspaces when service account annotations are set for the workspace
53+
provider.
54+
- infra: added option to enable self-contained workspace builds, eliminating
55+
dependency on `kube exec`.
56+
- infra: updated to Next.js 12.
57+
- infra: updated JetBrains Projector to Agent v1.7 and Client v1.4.
58+
- infra: added logging for workspace applications.
59+
60+
### Bug fixes 🐛
61+
62+
- web: fixed audit log rendering issues.
63+
- web: fixed feedback form loading and rendering errors.
64+
- cli: fixed issue with user login overwriting configuration used by the Coder
65+
Agent.
66+
- cli: fixed issue with the web terminal not loading information correctly when
67+
running `--help`.
68+
- cli: added `tunnel` to the Coder CLI help listing.
69+
- infra: fixed issue with CVMs due to `shiftfs` failing to compile on kernel
70+
v5.11+.
71+
- infra: reverted Sysbox version due to memory corruption issues with Nix.
72+
- infra: fixed memory leak.
73+
- infra: fixed issue with `coder sync` not functioning properly.
74+
- infra: fixed issue with TLS certificates not properly updating at runtime.
75+
76+
### Security updates 🔐
77+
78+
- api: restricted ability to list all users and workspaces through the API to
79+
site managers and site admins.
80+
- api: removed ability to return OIDC IdP client secret using admin
81+
authentication API.
82+
- infra: implemented `update-crypto-policies` in images to ensure there's no use
83+
of insecure cryptography in images.
84+
85+
### Known issues 🔧
86+
87+
- web: the service banner (if enabled) reappears for all users, even if they've
88+
previously dismissed it.
89+
- web: using the web terminal in Coder can occasionally result in the connection
90+
being reset and needing to be restarted.
91+
- web: the **Switch workspace** drop-down menu shows a workspace's status as
92+
**Building** even though the build process is completed.

0 commit comments

Comments
 (0)