Skip to content

Commit 0598aec

Browse files
bpmctjohnstcn
bpmct
and
johnstcn
authored
chore: add cherry-picks for Coder v2.17.1 (coder#15454)
Co-authored-by: Cian Johnston <cian@coder.com>
1 parent 5a6d23a commit 0598aec

14 files changed

+230
-76
lines changed

‎coderd/provisionerdserver/acquirer_test.go

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -523,8 +523,8 @@ func TestAcquirer_MatchTags(t *testing.T) {
523523
// Generate a table that can be copy-pasted into docs/admin/provisioners.md
524524
lines := []string{
525525
"\n",
526-
"| Provisioner Tags | Job Tags | Can Run Job? |",
527-
"|------------------|----------|--------------|",
526+
"| Provisioner Tags | Job Tags | Same Org | Can Run Job? |",
527+
"|------------------|----------|----------|--------------|",
528528
}
529529
// turn the JSON map into k=v for readability
530530
kvs := func(m map[string]string) string {
@@ -539,10 +539,14 @@ func TestAcquirer_MatchTags(t *testing.T) {
539539
}
540540
for _, tt := range testCases {
541541
acquire := "✅"
542+
sameOrg := "✅"
542543
if !tt.expectAcquire {
543544
acquire = "❌"
544545
}
545-
s := fmt.Sprintf("| %s | %s | %s |", kvs(tt.acquireJobTags), kvs(tt.provisionerJobTags), acquire)
546+
if tt.unmatchedOrg {
547+
sameOrg = "❌"
548+
}
549+
s := fmt.Sprintf("| %s | %s | %s | %s |", kvs(tt.acquireJobTags), kvs(tt.provisionerJobTags), sameOrg, acquire)
546550
lines = append(lines, s)
547551
}
548552
t.Logf("You can paste this into docs/admin/provisioners.md")

‎docs/admin/provisioners.md

Lines changed: 37 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -178,15 +178,17 @@ A provisioner can run a given build job if one of the below is true:
178178
1. If a job has any explicit tags, it can only run on a provisioner with those
179179
explicit tags (the provisioner could have additional tags).
180180

181-
The external provisioner in the above example can run build jobs with tags:
181+
The external provisioner in the above example can run build jobs in the same
182+
organization with tags:
182183

183184
- `environment=on_prem`
184185
- `datacenter=chicago`
185186
- `environment=on_prem datacenter=chicago`
186187

187188
However, it will not pick up any build jobs that do not have either of the
188189
`environment` or `datacenter` tags set. It will also not pick up any build jobs
189-
from templates with the tag `scope=user` set.
190+
from templates with the tag `scope=user` set, or build jobs from templates in
191+
different organizations.
190192

191193
> [!NOTE] If you only run tagged provisioners, you will need to specify a set of
192194
> tags that matches at least one provisioner for _all_ template import jobs and
@@ -198,34 +200,35 @@ from templates with the tag `scope=user` set.
198200

199201
This is illustrated in the below table:
200202

201-
| Provisioner Tags | Job Tags | Can Run Job? |
202-
| ----------------------------------------------------------------- | ---------------------------------------------------------------- | ------------ |
203-
| scope=organization owner= | scope=organization owner= | ✅ |
204-
| scope=organization owner= environment=on-prem | scope=organization owner= environment=on-prem | ✅ |
205-
| scope=organization owner= environment=on-prem datacenter=chicago | scope=organization owner= environment=on-prem | ✅ |
206-
| scope=organization owner= environment=on-prem datacenter=chicago | scope=organization owner= environment=on-prem datacenter=chicago | ✅ |
207-
| scope=user owner=aaa | scope=user owner=aaa | ✅ |
208-
| scope=user owner=aaa environment=on-prem | scope=user owner=aaa | ✅ |
209-
| scope=user owner=aaa environment=on-prem | scope=user owner=aaa environment=on-prem | ✅ |
210-
| scope=user owner=aaa environment=on-prem datacenter=chicago | scope=user owner=aaa environment=on-prem | ✅ |
211-
| scope=user owner=aaa environment=on-prem datacenter=chicago | scope=user owner=aaa environment=on-prem datacenter=chicago | ✅ |
212-
| scope=organization owner= | scope=organization owner= environment=on-prem | ❌ |
213-
| scope=organization owner= environment=on-prem | scope=organization owner= | ❌ |
214-
| scope=organization owner= environment=on-prem | scope=organization owner= environment=on-prem datacenter=chicago | ❌ |
215-
| scope=organization owner= environment=on-prem datacenter=new_york | scope=organization owner= environment=on-prem datacenter=chicago | ❌ |
216-
| scope=user owner=aaa | scope=organization owner= | ❌ |
217-
| scope=user owner=aaa | scope=user owner=bbb | ❌ |
218-
| scope=organization owner= | scope=user owner=aaa | ❌ |
219-
| scope=organization owner= | scope=user owner=aaa environment=on-prem | ❌ |
220-
| scope=user owner=aaa | scope=user owner=aaa environment=on-prem | ❌ |
221-
| scope=user owner=aaa environment=on-prem | scope=user owner=aaa environment=on-prem datacenter=chicago | ❌ |
222-
| scope=user owner=aaa environment=on-prem datacenter=chicago | scope=user owner=aaa environment=on-prem datacenter=new_york | ❌ |
203+
| Provisioner Tags | Job Tags | Same Org | Can Run Job? |
204+
| ----------------------------------------------------------------- | ---------------------------------------------------------------- | -------- | ------------ |
205+
| scope=organization owner= | scope=organization owner= | ✅ | ✅ |
206+
| scope=organization owner= environment=on-prem | scope=organization owner= environment=on-prem | ✅ | ✅ |
207+
| scope=organization owner= environment=on-prem datacenter=chicago | scope=organization owner= environment=on-prem | ✅ | ✅ |
208+
| scope=organization owner= environment=on-prem datacenter=chicago | scope=organization owner= environment=on-prem datacenter=chicago | ✅ | ✅ |
209+
| scope=user owner=aaa | scope=user owner=aaa | ✅ | ✅ |
210+
| scope=user owner=aaa environment=on-prem | scope=user owner=aaa | ✅ | ✅ |
211+
| scope=user owner=aaa environment=on-prem | scope=user owner=aaa environment=on-prem | ✅ | ✅ |
212+
| scope=user owner=aaa environment=on-prem datacenter=chicago | scope=user owner=aaa environment=on-prem | ✅ | ✅ |
213+
| scope=user owner=aaa environment=on-prem datacenter=chicago | scope=user owner=aaa environment=on-prem datacenter=chicago | ✅ | ✅ |
214+
| scope=organization owner= | scope=organization owner= environment=on-prem | ✅ | ❌ |
215+
| scope=organization owner= environment=on-prem | scope=organization owner= | ✅ | ❌ |
216+
| scope=organization owner= environment=on-prem | scope=organization owner= environment=on-prem datacenter=chicago | ✅ | ❌ |
217+
| scope=organization owner= environment=on-prem datacenter=new_york | scope=organization owner= environment=on-prem datacenter=chicago | ✅ | ❌ |
218+
| scope=user owner=aaa | scope=organization owner= | ✅ | ❌ |
219+
| scope=user owner=aaa | scope=user owner=bbb | ✅ | ❌ |
220+
| scope=organization owner= | scope=user owner=aaa | ✅ | ❌ |
221+
| scope=organization owner= | scope=user owner=aaa environment=on-prem | ✅ | ❌ |
222+
| scope=user owner=aaa | scope=user owner=aaa environment=on-prem | ✅ | ❌ |
223+
| scope=user owner=aaa environment=on-prem | scope=user owner=aaa environment=on-prem datacenter=chicago | ✅ | ❌ |
224+
| scope=user owner=aaa environment=on-prem datacenter=chicago | scope=user owner=aaa environment=on-prem datacenter=new_york | ✅ | ❌ |
225+
| scope=organization owner= environment=on-prem | scope=organization owner= environment=on-prem | ❌ | ❌ |
223226

224227
> **Note to maintainers:** to generate this table, run the following command and
225228
> copy the output:
226229
>
227230
> ```
228-
> go test -v -count=1 ./coderd/provisionerserver/ -test.run='^TestAcquirer_MatchTags/GenTable$'
231+
> go test -v -count=1 ./coderd/provisionerdserver/ -test.run='^TestAcquirer_MatchTags/GenTable$'
229232
> ```
230233

231234
## Types of provisioners
@@ -288,8 +291,7 @@ will use in concert with the Helm chart for deploying the Coder server.
288291
```sh
289292
coder provisioner keys create my-cool-key --org default
290293
# Optionally, you can specify tags for the provisioner key:
291-
# coder provisioner keys create my-cool-key --org default --tags location=auh kind=k8s
292-
```
294+
# coder provisioner keys create my-cool-key --org default --tag location=auh --tag kind=k8s
293295
294296
Successfully created provisioner key kubernetes-key! Save this authentication
295297
token, it will not be shown again.
@@ -300,25 +302,7 @@ will use in concert with the Helm chart for deploying the Coder server.
300302
1. Store the key in a kubernetes secret:
301303

302304
```sh
303-
kubectl create secret generic coder-provisioner-psk --from-literal=key1=`<key omitted>`
304-
```
305-
306-
1. Modify your Coder `values.yaml` to include
307-
308-
```yaml
309-
provisionerDaemon:
310-
keySecretName: "coder-provisioner-keys"
311-
keySecretKey: "key1"
312-
```
313-
314-
1. Redeploy Coder with the new `values.yaml` to roll out the PSK. You can omit
315-
`--version <your version>` to also upgrade Coder to the latest version.
316-
317-
```sh
318-
helm upgrade coder coder-v2/coder \
319-
--namespace coder \
320-
--version <your version> \
321-
--values values.yaml
305+
kubectl create secret generic coder-provisioner-psk --from-literal=my-cool-key=`<key omitted>`
322306
```
323307

324308
1. Create a `provisioner-values.yaml` file for the provisioner daemons Helm
@@ -331,13 +315,17 @@ will use in concert with the Helm chart for deploying the Coder server.
331315
value: "https://coder.example.com"
332316
replicaCount: 10
333317
provisionerDaemon:
318+
# NOTE: in older versions of the Helm chart (2.17.0 and below), it is required to set this to an empty string.
319+
pskSecretName: ""
334320
keySecretName: "coder-provisioner-keys"
335-
keySecretKey: "key1"
321+
keySecretKey: "my-cool-key"
336322
```
337323

338324
This example creates a deployment of 10 provisioner daemons (for 10
339-
concurrent builds) with the listed tags. For generic provisioners, remove the
340-
tags.
325+
concurrent builds) authenticating using the above key. The daemons will
326+
authenticate using the provisioner key created in the previous step and
327+
acquire jobs matching the tags specified when the provisioner key was
328+
created. The set of tags is inferred automatically from the provisioner key.
341329

342330
> Refer to the
343331
> [values.yaml](https://github.com/coder/coder/blob/main/helm/provisioner/values.yaml)

‎helm/provisioner/templates/_coder.tpl

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,22 +34,23 @@ env:
3434
value: "0.0.0.0:2112"
3535
{{- if and (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName) }}
3636
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified." }}
37-
{{- else if and (.Values.provisionerDaemon.pskSecretName) (.Values.provisionerDaemon.keySecretName) }}
38-
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both." }}
39-
{{- end }}
40-
{{- if .Values.provisionerDaemon.pskSecretName }}
41-
- name: CODER_PROVISIONER_DAEMON_PSK
42-
valueFrom:
43-
secretKeyRef:
44-
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
45-
key: psk
46-
{{- end }}
47-
{{- if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
37+
{{- else if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
38+
{{- if and (not (empty .Values.provisionerDaemon.pskSecretName)) (ne .Values.provisionerDaemon.pskSecretName "coder-provisioner-psk") }}
39+
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both." }}
40+
{{- else if .Values.provisionerDaemon.tags }}
41+
{{ fail "provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName." }}
42+
{{- end }}
4843
- name: CODER_PROVISIONER_DAEMON_KEY
4944
valueFrom:
5045
secretKeyRef:
5146
name: {{ .Values.provisionerDaemon.keySecretName | quote }}
5247
key: {{ .Values.provisionerDaemon.keySecretKey | quote }}
48+
{{- else }}
49+
- name: CODER_PROVISIONER_DAEMON_PSK
50+
valueFrom:
51+
secretKeyRef:
52+
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
53+
key: psk
5354
{{- end }}
5455
{{- if include "provisioner.tags" . }}
5556
- name: CODER_PROVISIONERD_TAGS

‎helm/provisioner/tests/chart_test.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,12 @@ var testCases = []testCase{
5656
name: "provisionerd_key",
5757
expectedError: "",
5858
},
59+
// Test explicitly for the workaround where setting provisionerDaemon.pskSecretName=""
60+
// was required to use provisioner keys.
61+
{
62+
name: "provisionerd_key_psk_empty_workaround",
63+
expectedError: "",
64+
},
5965
{
6066
name: "provisionerd_psk_and_key",
6167
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both.`,
@@ -64,6 +70,10 @@ var testCases = []testCase{
6470
name: "provisionerd_no_psk_or_key",
6571
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified.`,
6672
},
73+
{
74+
name: "provisionerd_key_tags",
75+
expectedError: `provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName.`,
76+
},
6777
{
6878
name: "extra_templates",
6979
expectedError: "",

‎helm/provisioner/tests/testdata/provisionerd_key.golden

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,6 @@ spec:
112112
secretKeyRef:
113113
key: provisionerd-key
114114
name: coder-provisionerd-key
115-
- name: CODER_PROVISIONERD_TAGS
116-
value: clusterType=k8s,location=auh
117115
- name: CODER_URL
118116
value: http://coder.default.svc.cluster.local
119117
image: ghcr.io/coder/coder:latest

‎helm/provisioner/tests/testdata/provisionerd_key.yaml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,5 @@ coder:
22
image:
33
tag: latest
44
provisionerDaemon:
5-
pskSecretName: ""
65
keySecretName: "coder-provisionerd-key"
76
keySecretKey: "provisionerd-key"
8-
tags:
9-
location: auh
10-
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_key_psk_empty_workaround.golden

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_KEY
111+
valueFrom:
112+
secretKeyRef:
113+
key: provisionerd-key
114+
name: coder-provisionerd-key
115+
- name: CODER_URL
116+
value: http://coder.default.svc.cluster.local
117+
image: ghcr.io/coder/coder:latest
118+
imagePullPolicy: IfNotPresent
119+
lifecycle: {}
120+
name: coder
121+
ports: null
122+
resources: {}
123+
securityContext:
124+
allowPrivilegeEscalation: false
125+
readOnlyRootFilesystem: null
126+
runAsGroup: 1000
127+
runAsNonRoot: true
128+
runAsUser: 1000
129+
seccompProfile:
130+
type: RuntimeDefault
131+
volumeMounts: []
132+
restartPolicy: Always
133+
serviceAccountName: coder-provisioner
134+
terminationGracePeriodSeconds: 600
135+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_key_psk_empty_workaround.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"

‎helm/provisioner/tests/testdata/provisionerd_key_tags.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
keySecretName: "coder-provisionerd-key"
6+
keySecretKey: "provisionerd-key"
7+
tags:
8+
location: auh
9+
clusterType: k8s

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy