Skip to content

Commit 413928b

Browse files
johnstcnjohnstcn
authored
feat(helm/provisioner): add support for provisioner keys, add note re psk (#15122)
- Adds `provisionerDaemon.keySecretName` and `provisionerDaemon.keySecretKey` - Omitting `provisionerDaemon.pskSecretName` will now cause the PSK secret to no longer be created. - Adds a note in `NOTES.txt` regarding provisioner PSKs. - Adds validation that either `provisionerDaemon.keySecretName` or `provisionerDaemon.pskSecretName` is specified, and will fail the install in this case.
1 parent d18e830 commit 413928b

File tree

9 files changed

+361
-3
lines changed

9 files changed

+361
-3
lines changed

‎helm/provisioner/templates/NOTES.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{/*
2+
Deprecation notices:
3+
*/}}
4+
5+
{{- if .Values.provisionerDaemon.pskSecretName }}
6+
* Provisioner Daemon PSKs are no longer recommended for use with external
7+
provisioners. Consider migrating to scoped provisioner keys instead. For more
8+
information, see: https://coder.com/docs/admin/provisioners#authentication
9+
{{- end }}
10+
11+
Enjoy Coder! Please create an issue at https://github.com/coder/coder if you run
12+
into any problems! :)

‎helm/provisioner/templates/_coder.tpl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,23 @@ args:
3232
env:
3333
- name: CODER_PROMETHEUS_ADDRESS
3434
value: "0.0.0.0:2112"
35+
{{- if and (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName) }}
36+
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified." }}
37+
{{- end }}
38+
{{- if .Values.provisionerDaemon.pskSecretName }}
3539
- name: CODER_PROVISIONER_DAEMON_PSK
3640
valueFrom:
3741
secretKeyRef:
3842
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
3943
key: psk
44+
{{- end }}
45+
{{- if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
46+
- name: CODER_PROVISIONER_DAEMON_KEY
47+
valueFrom:
48+
secretKeyRef:
49+
name: {{ .Values.provisionerDaemon.keySecretName | quote }}
50+
key: {{ .Values.provisionerDaemon.keySecretKey | quote }}
51+
{{- end }}
4052
{{- if include "provisioner.tags" . }}
4153
- name: CODER_PROVISIONERD_TAGS
4254
value: {{ include "provisioner.tags" . }}

‎helm/provisioner/tests/chart_test.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,18 @@ var testCases = []testCase{
5252
name: "provisionerd_psk",
5353
expectedError: "",
5454
},
55+
{
56+
name: "provisionerd_key",
57+
expectedError: "",
58+
},
59+
{
60+
name: "provisionerd_psk_and_key",
61+
expectedError: "",
62+
},
63+
{
64+
name: "provisionerd_no_psk_or_key",
65+
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified.`,
66+
},
5567
{
5668
name: "extra_templates",
5769
expectedError: "",

‎helm/provisioner/tests/testdata/provisionerd_key.golden

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_KEY
111+
valueFrom:
112+
secretKeyRef:
113+
key: provisionerd-key
114+
name: coder-provisionerd-key
115+
- name: CODER_PROVISIONERD_TAGS
116+
value: clusterType=k8s,location=auh
117+
- name: CODER_URL
118+
value: http://coder.default.svc.cluster.local
119+
image: ghcr.io/coder/coder:latest
120+
imagePullPolicy: IfNotPresent
121+
lifecycle: {}
122+
name: coder
123+
ports: null
124+
resources: {}
125+
securityContext:
126+
allowPrivilegeEscalation: false
127+
readOnlyRootFilesystem: null
128+
runAsGroup: 1000
129+
runAsNonRoot: true
130+
runAsUser: 1000
131+
seccompProfile:
132+
type: RuntimeDefault
133+
volumeMounts: []
134+
restartPolicy: Always
135+
serviceAccountName: coder-provisioner
136+
terminationGracePeriodSeconds: 600
137+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_key.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"
8+
tags:
9+
location: auh
10+
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_no_psk_or_key.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: ""
7+
tags:
8+
location: auh
9+
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.golden

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_PSK
111+
valueFrom:
112+
secretKeyRef:
113+
key: psk
114+
name: coder-provisionerd-psk
115+
- name: CODER_PROVISIONER_DAEMON_KEY
116+
valueFrom:
117+
secretKeyRef:
118+
key: provisionerd-key
119+
name: coder-provisionerd-key
120+
- name: CODER_PROVISIONERD_TAGS
121+
value: clusterType=k8s,location=auh
122+
- name: CODER_URL
123+
value: http://coder.default.svc.cluster.local
124+
image: ghcr.io/coder/coder:latest
125+
imagePullPolicy: IfNotPresent
126+
lifecycle: {}
127+
name: coder
128+
ports: null
129+
resources: {}
130+
securityContext:
131+
allowPrivilegeEscalation: false
132+
readOnlyRootFilesystem: null
133+
runAsGroup: 1000
134+
runAsNonRoot: true
135+
runAsUser: 1000
136+
seccompProfile:
137+
type: RuntimeDefault
138+
volumeMounts: []
139+
restartPolicy: Always
140+
serviceAccountName: coder-provisioner
141+
terminationGracePeriodSeconds: 600
142+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: "coder-provisionerd-psk"
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"
8+
tags:
9+
location: auh
10+
clusterType: k8s

‎helm/provisioner/values.yaml

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -193,11 +193,25 @@ coder:
193193
# provisionerDaemon -- Provisioner Daemon configuration options
194194
provisionerDaemon:
195195
# provisionerDaemon.pskSecretName -- The name of the Kubernetes secret that contains the
196-
# Pre-Shared Key (PSK) to use to authenticate with Coder. The secret must be in the same namespace
197-
# as the Helm deployment, and contain an item called "psk" which contains the pre-shared key.
196+
# Pre-Shared Key (PSK) to use to authenticate with Coder. The secret must be
197+
# in the same namespace as the Helm deployment, and contain an item called
198+
# "psk" which contains the pre-shared key.
199+
# NOTE: We no longer recommend using PSKs. Please consider using provisioner
200+
# keys instead. They have a number of benefits, including the ability to
201+
# rotate them easily.
198202
pskSecretName: "coder-provisioner-psk"
199203

200-
# provisionerDaemon.tags -- Tags to filter provisioner jobs by
204+
# provisionerDaemon.keySecretName -- The name of the Kubernetes
205+
# secret that contains a provisioner key to use to authenticate with Coder.
206+
# See: https://coder.com/docs/admin/provisioners#authentication
207+
keySecretName: ""
208+
# provisionerDaemon.keySecretKey -- The key of the Kubernetes
209+
# secret specified in provisionerDaemon.keySecretName that contains
210+
# the provisioner key. Defaults to "key".
211+
keySecretKey: "key"
212+
213+
# provisionerDaemon.tags -- Tags to filter provisioner jobs by.
214+
# See: https://coder.com/docs/admin/provisioners#provisioner-tags
201215
tags:
202216
{}
203217
# location: usa

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy