Skip to content

Commit 4098a8c

Browse files
matifalimatifali
committed
add integration guides
1 parent cf13803 commit 4098a8c

File tree

22 files changed

+548
-62
lines changed

22 files changed

+548
-62
lines changed

‎docs/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ and whatever else Terraform lets you dream up.
4040
4141
## IDE Support
4242
43-
You can use any Web IDE ([code-server](https://github.com/coder/code-server), [projector](https://github.com/JetBrains/projector-server), [Jupyter](https://jupyter.org/), etc.), [JetBrains Gateway](https://www.jetbrains.com/remote-development/gateway/), [VS Code Remote](https://code.visualstudio.com/docs/remote/ssh-tutorial) or even a file sync such as [mutagen](https://mutagen.io/).
43+
You can use any Web IDE ([code-server](https://github.com/coder/code-server), [projector](https://github.com/JetBrains/projector-server), [Jupyter](https://jupyter.org/), etc.), [JetBrains Gateway](https://www.JetBrains.com/remote-development/gateway/), [VS Code Remote](https://code.visualstudio.com/docs/remote/ssh-tutorial) or even a file sync such as [mutagen](https://mutagen.io/).
4444
4545
<p align="center">
4646
<img src="./images/ide-icons.svg" height=72>

‎docs/admin/integrations/artifactory-integration.md

+176
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
# JFrog Artifactory Integration
2+
3+
<div>
4+
<a href="https://github.com/matifali" style="text-decoration: none; color: inherit;">
5+
<span style="vertical-align:middle;">M Atif Ali</span>
6+
<img src="https://github.com/matifali.png" width="24px" height="24px" style="vertical-align:middle; margin: 0px;"/>
7+
</a>
8+
</div>
9+
January 24, 2024
10+
11+
---
12+
13+
Use Coder and JFrog Artifactory together to secure your development environments
14+
without disturbing your developers' existing workflows.
15+
16+
This guide will demonstrate how to use JFrog Artifactory as a package registry
17+
within a workspace.
18+
19+
## Requirements
20+
21+
- A JFrog Artifactory instance
22+
- 1:1 mapping of users in Coder to users in Artifactory by email address or
23+
username
24+
- Repositories configured in Artifactory for each package manager you want to
25+
use
26+
27+
## Provisioner Authentication
28+
29+
The most straight-forward way to authenticate your template with Artifactory is
30+
by using our official Coder [modules](https://registry.coder.com). We publish
31+
two type of modules that automate the JFrog Artifactory and Coder integration.
32+
33+
1. [JFrog-OAuth](https://registry.coder.com/modules/jfrog-oauth)
34+
2. [JFrog-Token](https://registry.coder.com/modules/jfrog-token)
35+
36+
### JFrog-OAuth
37+
38+
This module is usable by JFrog self-hosted (on-premises) Artifactory as it
39+
requires configuring a custom integration. This integration benefits from
40+
Coder's [external-auth](https://coder.com/docs/v2/latest/admin/external-auth)
41+
feature and allows each user to authenticate with Artifactory using an OAuth
42+
flow and issues user-scoped tokens to each user.
43+
44+
To set this up, follow these steps:
45+
46+
1. Modify your Helm chart `values.yaml` for JFrog Artifactory to add,
47+
48+
```yaml
49+
artifactory:
50+
enabled: true
51+
frontend:
52+
extraEnvironmentVariables:
53+
- name: JF_FRONTEND_FEATURETOGGLER_ACCESSINTEGRATION
54+
value: "true"
55+
access:
56+
accessConfig:
57+
integrations-enabled: true
58+
integration-templates:
59+
- id: "1"
60+
name: "CODER"
61+
redirect-uri: "https://CODER_URL/external-auth/jfrog/callback"
62+
scope: "applied-permissions/user"
63+
```
64+
65+
> Note Replace `CODER_URL` with your Coder deployment URL, e.g.,
66+
> <coder.example.com>
67+
68+
2. Create a new Application Integration by going to
69+
<https://JFROG_URL/ui/admin/configuration/integrations/new> and select the
70+
Application Type as the integration you created in step 1.
71+
72+
![JFrog Platform new integration](../images/guides/artifactory-integration/jfrog-oauth-app.png)
73+
74+
3. Add a new
75+
[external authentication](https://coder.com/docs/v2/latest/admin/external-auth)
76+
to Coder by setting these env variables,
77+
78+
```env
79+
# JFrog Artifactory External Auth
80+
CODER_EXTERNAL_AUTH_1_ID="jfrog"
81+
CODER_EXTERNAL_AUTH_1_TYPE="jfrog"
82+
CODER_EXTERNAL_AUTH_1_CLIENT_ID="YYYYYYYYYYYYYYY"
83+
CODER_EXTERNAL_AUTH_1_CLIENT_SECRET="XXXXXXXXXXXXXXXXXXX"
84+
CODER_EXTERNAL_AUTH_1_DISPLAY_NAME="JFrog Artifactory"
85+
CODER_EXTERNAL_AUTH_1_DISPLAY_ICON="/icon/jfrog.svg"
86+
CODER_EXTERNAL_AUTH_1_AUTH_URL="https://JFROG_URL/ui/authorization"
87+
CODER_EXTERNAL_AUTH_1_SCOPES="applied-permissions/user"
88+
```
89+
90+
> Note Replace `JFROG_URL` with your JFrog Artifactory base URL, e.g.,
91+
> <example.jfrog.io>
92+
93+
4. Create or edit a Coder template and use the
94+
[JFrog-OAuth](https://registry.coder.com/modules/jfrog-oauth) module to
95+
configure the integration.
96+
97+
```hcl
98+
module "jfrog" {
99+
source = "registry.coder.com/modules/jfrog-oauth/coder"
100+
version = "1.0.0"
101+
agent_id = coder_agent.example.id
102+
jfrog_url = "https://jfrog.example.com"
103+
configure_code_server = true # this depends on the code-server
104+
username_field = "username" # If you are using GitHub to login to both Coder and Artifactory, use username_field = "username"
105+
package_managers = {
106+
"npm": "npm",
107+
"go": "go",
108+
"pypi": "pypi"
109+
}
110+
}
111+
```
112+
113+
### JFrog-Token
114+
115+
This module makes use of the
116+
[Artifactory terraform provider](https://registry.terraform.io/providers/jfrog/artifactory/latest/docs)
117+
and an admin-scoped token to create user-scoped tokens for each user by matching
118+
their Coder email or username with Artifactory. This can be used for both SaaS
119+
and self-hosted(on-premises) Artifactory instances.
120+
121+
To set this up, follow these steps:
122+
123+
1. Get a JFrog access token from your Artifactory instance. The token must be an
124+
[admin token](https://registry.terraform.io/providers/jfrog/artifactory/latest/docs#access-token)
125+
with scope `applied-permissions/admin`.
126+
2. Create or edit a Coder template and use the
127+
[JFrog-Token](https://registry.coder.com/modules/jfrog-token) module to
128+
configure the integration and pass the admin token. It is recommended to
129+
store the token in a sensitive terraform variable to prevent it from being
130+
displayed in plain text in the terraform state.
131+
132+
```hcl
133+
variable "artifactory_access_token" {
134+
type = string
135+
sensitive = true
136+
}
137+
138+
module "jfrog" {
139+
source = "registry.coder.com/modules/jfrog-token/coder"
140+
version = "1.0.0"
141+
agent_id = coder_agent.example.id
142+
jfrog_url = "https://example.jfrog.io"
143+
configure_code_server = true # this depends on the code-server
144+
artifactory_access_token = var.artifactory_access_token
145+
package_managers = {
146+
"npm": "npm",
147+
"go": "go",
148+
"pypi": "pypi"
149+
}
150+
}
151+
```
152+
153+
<blockquote class="info">
154+
The admin-level access token is used to provision user tokens and is never exposed to
155+
developers or stored in workspaces.
156+
</blockquote>
157+
158+
If you do not want to use the official modules, you can check example template
159+
that uses Docker as the underlying compute
160+
[here](https://github.com/coder/coder/tree/main/examples/jfrog/docker). The same
161+
concepts apply to all compute types.
162+
163+
## Offline Deployments
164+
165+
See the [offline deployments](../templates/modules.md#offline-installations)
166+
section for instructions on how to use coder-modules in an offline environment
167+
with Artifactory.
168+
169+
## More reading
170+
171+
- See the full example template
172+
[here](https://github.com/coder/coder/tree/main/examples/jfrog/docker).
173+
- To serve extensions from your own VS Code Marketplace, check out
174+
[code-marketplace](https://github.com/coder/code-marketplace#artifactory-storage).
175+
- To store templates in Artifactory, check out our
176+
[Artifactory modules](../templates/modules.md#artifactory) docs.

‎docs/admin/integrations/island-integration.md

+163
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
# Island Browser Integration
2+
3+
<div>
4+
<a href="https://github.com/ericpaulsen" style="text-decoration: none; color: inherit;">
5+
<span style="vertical-align:middle;">Eric Paulsen</span>
6+
<img src="https://github.com/ericpaulsen.png" width="24px" height="24px" style="vertical-align:middle; margin: 0px;"/>
7+
</a>
8+
</div>
9+
April 24, 2024
10+
11+
---
12+
13+
[Island](https://www.island.io/) is an enterprise-grade browser, offering a
14+
Chromium-based experience similar to popular web browsers like Chrome and Edge.
15+
It includes built-in security features for corporate applications and data,
16+
aiming to bridge the gap between consumer-focused browsers and the security
17+
needs of the enterprise.
18+
19+
Coder natively integrates with Island's feature set, which include data loss
20+
protection (DLP), application awareness, browser session recording, and single
21+
sign-on (SSO). This guide intends to document these feature categories and how
22+
they apply to your Coder deployment.
23+
24+
## General Configuration
25+
26+
### Create an Application Group for Coder
27+
28+
We recommend creating an Application Group specific to Coder in the Island
29+
Management console. This Application Group object will be referenced when
30+
creating browser policies.
31+
32+
[See the Island documentation for creating an Application Group](https://documentation.island.io/docs/create-and-configure-an-application-group-object).
33+
34+
## Advanced Data Loss Protection
35+
36+
Integrate Island's advanced data loss prevention (DLP) capabilities with Coder's
37+
cloud development environment (CDE), enabling you to control the “last mile”
38+
between developers’ CDE and their local devices, ensuring that sensitive IP
39+
remains in your centralized environment.
40+
41+
### Block cut, copy, paste, printing, screen share
42+
43+
1. [Create a Data Sandbox Profile](https://documentation.island.io/docs/create-and-configure-a-data-sandbox-profile)
44+
45+
1. Configure the following actions to allow/block (based on your security
46+
requirements):
47+
48+
- Screenshot and Screen Share
49+
- Printing
50+
- Save Page
51+
- Clipboard Limitations
52+
53+
1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general)
54+
to apply the Data Sandbox Profile
55+
56+
1. Define the Coder Application group as the Destination Object
57+
58+
1. Define the Data Sandbox Profile as the Action in the Last Mile Protection
59+
section
60+
61+
### Conditionally allow copy on Coder's CLI authentication page
62+
63+
1. [Create a URL Object](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general)
64+
with the following configuration:
65+
66+
- **Include**
67+
- **URL type**: Wildcard
68+
- **URL address**: `coder.example.com/cli-auth`
69+
- **Casing**: Insensitive
70+
71+
1. [Create a Data Sandbox Profile](https://documentation.island.io/docs/create-and-configure-a-data-sandbox-profile)
72+
73+
1. Configure action to allow copy/paste
74+
75+
1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general)
76+
to apply the Data Sandbox Profile
77+
78+
1. Define the URL Object you created as the Destination Object
79+
80+
1. Define the Data Sandbox Profile as the Action in the Last Mile Protection
81+
section
82+
83+
### Prevent file upload/download from the browser
84+
85+
1. Create a Protection Profiles for both upload/download
86+
87+
- [Upload documentation](https://documentation.island.io/docs/create-and-configure-an-upload-protection-profile)
88+
- [Download documentation](https://documentation.island.io/v1/docs/en/create-and-configure-a-download-protection-profile)
89+
90+
1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general)
91+
to apply the Protection Profiles
92+
93+
1. Define the Coder Application group as the Destination Object
94+
95+
1. Define the applicable Protection Profile as the Action in the Data Protection
96+
section
97+
98+
### Scan files for sensitive data
99+
100+
1. [Create a Data Loss Prevention scanner](https://documentation.island.io/docs/create-a-data-loss-prevention-scanner)
101+
102+
1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general)
103+
to apply the DLP Scanner
104+
105+
1. Define the Coder Application group as the Destination Object
106+
107+
1. Define the DLP Scanner as the Action in the Data Protection section
108+
109+
## Application Awareness and Boundaries
110+
111+
Ensure that Coder is only accessed through the Island browser, guaranteeing that
112+
your browser-level DLP policies are always enforced, and developers can’t
113+
sidestep such policies simply by using another browser.
114+
115+
### Configure browser enforcement, conditional access policies
116+
117+
1. Create a conditional access policy for your configured identity provider.
118+
119+
> Note: the configured IdP must be the same for both Coder and Island
120+
121+
- [Azure Active Directory/Entra ID](https://documentation.island.io/docs/configure-browser-enforcement-for-island-with-azure-ad#create-and-apply-a-conditional-access-policy)
122+
- [Okta](https://documentation.island.io/docs/configure-browser-enforcement-for-island-with-okta)
123+
- [Google](https://documentation.island.io/docs/configure-browser-enforcement-for-island-with-google-enterprise)
124+
125+
## Browser Activity Logging
126+
127+
Govern and audit in-browser terminal and IDE sessions using Island, such as
128+
screenshots, mouse clicks, and keystrokes.
129+
130+
### Activity Logging Module
131+
132+
1. [Create an Activity Logging Profile](https://documentation.island.io/docs/create-and-configure-an-activity-logging-profile)
133+
134+
Supported browser events include:
135+
136+
- Web Navigation
137+
- File Download
138+
- File Upload
139+
- Clipboard/Drag & Drop
140+
- Print
141+
- Save As
142+
- Screenshots
143+
- Mouse Clicks
144+
- Keystrokes
145+
146+
1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general)
147+
to apply the Activity Logging Profile
148+
149+
1. Define the Coder Application group as the Destination Object
150+
151+
1. Define the Activity Logging Profile as the Action in the Security &
152+
Visibility section
153+
154+
## Identity-aware logins (SSO)
155+
156+
Integrate Island's identity management system with Coder's authentication
157+
mechanisms to enable identity-aware logins.
158+
159+
### Configure single sign-on (SSO) seamless authentication between Coder and Island
160+
161+
Configure the same identity provider (IdP) for both your Island and Coder
162+
deployment. Upon initial login to the Island browser, the user's session token
163+
will automatically be passed to Coder and authenticate their Coder session.

‎docs/admin/integrations/prometheus.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ spec:
108108
| `coderd_agentstats_connection_count` | gauge | The number of established connections by agent | `agent_name` `username` `workspace_name` |
109109
| `coderd_agentstats_connection_median_latency_seconds` | gauge | The median agent connection latency | `agent_name` `username` `workspace_name` |
110110
| `coderd_agentstats_rx_bytes` | gauge | Agent Rx bytes | `agent_name` `username` `workspace_name` |
111-
| `coderd_agentstats_session_count_jetbrains` | gauge | The number of session established by JetBrains | `agent_name` `username` `workspace_name` |
111+
| `coderd_agentstats_session_count_JetBrains` | gauge | The number of session established by JetBrains | `agent_name` `username` `workspace_name` |
112112
| `coderd_agentstats_session_count_reconnecting_pty` | gauge | The number of session established by reconnecting PTY | `agent_name` `username` `workspace_name` |
113113
| `coderd_agentstats_session_count_ssh` | gauge | The number of session established by SSH | `agent_name` `username` `workspace_name` |
114114
| `coderd_agentstats_session_count_vscode` | gauge | The number of session established by VSCode | `agent_name` `username` `workspace_name` |

0 commit comments

Comments
 (0)