Skip to content

Commit 413928b

Browse files
johnstcnjohnstcn
authored
feat(helm/provisioner): add support for provisioner keys, add note re psk (coder#15122)
- Adds `provisionerDaemon.keySecretName` and `provisionerDaemon.keySecretKey` - Omitting `provisionerDaemon.pskSecretName` will now cause the PSK secret to no longer be created. - Adds a note in `NOTES.txt` regarding provisioner PSKs. - Adds validation that either `provisionerDaemon.keySecretName` or `provisionerDaemon.pskSecretName` is specified, and will fail the install in this case.
1 parent d18e830 commit 413928b

9 files changed

+361
-3
lines changed

‎helm/provisioner/templates/NOTES.txt

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{/*
2+
Deprecation notices:
3+
*/}}
4+
5+
{{- if .Values.provisionerDaemon.pskSecretName }}
6+
* Provisioner Daemon PSKs are no longer recommended for use with external
7+
provisioners. Consider migrating to scoped provisioner keys instead. For more
8+
information, see: https://coder.com/docs/admin/provisioners#authentication
9+
{{- end }}
10+
11+
Enjoy Coder! Please create an issue at https://github.com/coder/coder if you run
12+
into any problems! :)

‎helm/provisioner/templates/_coder.tpl

+12
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,23 @@ args:
3232
env:
3333
- name: CODER_PROMETHEUS_ADDRESS
3434
value: "0.0.0.0:2112"
35+
{{- if and (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName) }}
36+
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified." }}
37+
{{- end }}
38+
{{- if .Values.provisionerDaemon.pskSecretName }}
3539
- name: CODER_PROVISIONER_DAEMON_PSK
3640
valueFrom:
3741
secretKeyRef:
3842
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
3943
key: psk
44+
{{- end }}
45+
{{- if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
46+
- name: CODER_PROVISIONER_DAEMON_KEY
47+
valueFrom:
48+
secretKeyRef:
49+
name: {{ .Values.provisionerDaemon.keySecretName | quote }}
50+
key: {{ .Values.provisionerDaemon.keySecretKey | quote }}
51+
{{- end }}
4052
{{- if include "provisioner.tags" . }}
4153
- name: CODER_PROVISIONERD_TAGS
4254
value: {{ include "provisioner.tags" . }}

‎helm/provisioner/tests/chart_test.go

+12
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,18 @@ var testCases = []testCase{
5252
name: "provisionerd_psk",
5353
expectedError: "",
5454
},
55+
{
56+
name: "provisionerd_key",
57+
expectedError: "",
58+
},
59+
{
60+
name: "provisionerd_psk_and_key",
61+
expectedError: "",
62+
},
63+
{
64+
name: "provisionerd_no_psk_or_key",
65+
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified.`,
66+
},
5567
{
5668
name: "extra_templates",
5769
expectedError: "",

‎helm/provisioner/tests/testdata/provisionerd_key.golden

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_KEY
111+
valueFrom:
112+
secretKeyRef:
113+
key: provisionerd-key
114+
name: coder-provisionerd-key
115+
- name: CODER_PROVISIONERD_TAGS
116+
value: clusterType=k8s,location=auh
117+
- name: CODER_URL
118+
value: http://coder.default.svc.cluster.local
119+
image: ghcr.io/coder/coder:latest
120+
imagePullPolicy: IfNotPresent
121+
lifecycle: {}
122+
name: coder
123+
ports: null
124+
resources: {}
125+
securityContext:
126+
allowPrivilegeEscalation: false
127+
readOnlyRootFilesystem: null
128+
runAsGroup: 1000
129+
runAsNonRoot: true
130+
runAsUser: 1000
131+
seccompProfile:
132+
type: RuntimeDefault
133+
volumeMounts: []
134+
restartPolicy: Always
135+
serviceAccountName: coder-provisioner
136+
terminationGracePeriodSeconds: 600
137+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_key.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"
8+
tags:
9+
location: auh
10+
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_no_psk_or_key.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: ""
7+
tags:
8+
location: auh
9+
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.golden

+142
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_PSK
111+
valueFrom:
112+
secretKeyRef:
113+
key: psk
114+
name: coder-provisionerd-psk
115+
- name: CODER_PROVISIONER_DAEMON_KEY
116+
valueFrom:
117+
secretKeyRef:
118+
key: provisionerd-key
119+
name: coder-provisionerd-key
120+
- name: CODER_PROVISIONERD_TAGS
121+
value: clusterType=k8s,location=auh
122+
- name: CODER_URL
123+
value: http://coder.default.svc.cluster.local
124+
image: ghcr.io/coder/coder:latest
125+
imagePullPolicy: IfNotPresent
126+
lifecycle: {}
127+
name: coder
128+
ports: null
129+
resources: {}
130+
securityContext:
131+
allowPrivilegeEscalation: false
132+
readOnlyRootFilesystem: null
133+
runAsGroup: 1000
134+
runAsNonRoot: true
135+
runAsUser: 1000
136+
seccompProfile:
137+
type: RuntimeDefault
138+
volumeMounts: []
139+
restartPolicy: Always
140+
serviceAccountName: coder-provisioner
141+
terminationGracePeriodSeconds: 600
142+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: "coder-provisionerd-psk"
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"
8+
tags:
9+
location: auh
10+
clusterType: k8s

‎helm/provisioner/values.yaml

+17-3
Original file line numberDiff line numberDiff line change
@@ -193,11 +193,25 @@ coder:
193193
# provisionerDaemon -- Provisioner Daemon configuration options
194194
provisionerDaemon:
195195
# provisionerDaemon.pskSecretName -- The name of the Kubernetes secret that contains the
196-
# Pre-Shared Key (PSK) to use to authenticate with Coder. The secret must be in the same namespace
197-
# as the Helm deployment, and contain an item called "psk" which contains the pre-shared key.
196+
# Pre-Shared Key (PSK) to use to authenticate with Coder. The secret must be
197+
# in the same namespace as the Helm deployment, and contain an item called
198+
# "psk" which contains the pre-shared key.
199+
# NOTE: We no longer recommend using PSKs. Please consider using provisioner
200+
# keys instead. They have a number of benefits, including the ability to
201+
# rotate them easily.
198202
pskSecretName: "coder-provisioner-psk"
199203

200-
# provisionerDaemon.tags -- Tags to filter provisioner jobs by
204+
# provisionerDaemon.keySecretName -- The name of the Kubernetes
205+
# secret that contains a provisioner key to use to authenticate with Coder.
206+
# See: https://coder.com/docs/admin/provisioners#authentication
207+
keySecretName: ""
208+
# provisionerDaemon.keySecretKey -- The key of the Kubernetes
209+
# secret specified in provisionerDaemon.keySecretName that contains
210+
# the provisioner key. Defaults to "key".
211+
keySecretKey: "key"
212+
213+
# provisionerDaemon.tags -- Tags to filter provisioner jobs by.
214+
# See: https://coder.com/docs/admin/provisioners#provisioner-tags
201215
tags:
202216
{}
203217
# location: usa

0 commit comments

Comments
 (0)