Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

feat: add managed agent license limit checks#18937

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
deansheather wants to merge2 commits intomain
base:main
Choose a base branch
Loading
fromdean/ai-usage-enforcement-2
Open
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletioncli/server.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1101,7 +1101,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
autobuildTicker := time.NewTicker(vals.AutobuildPollInterval.Value())
defer autobuildTicker.Stop()
autobuildExecutor := autobuild.NewExecutor(
ctx, options.Database, options.Pubsub, coderAPI.FileCache, options.PrometheusRegistry, coderAPI.TemplateScheduleStore, &coderAPI.Auditor, coderAPI.AccessControlStore, logger, autobuildTicker.C, options.NotificationsEnqueuer, coderAPI.Experiments)
ctx, options.Database, options.Pubsub, coderAPI.FileCache, options.PrometheusRegistry, coderAPI.TemplateScheduleStore, &coderAPI.Auditor, coderAPI.AccessControlStore,coderAPI.BuildUsageChecker,logger, autobuildTicker.C, options.NotificationsEnqueuer, coderAPI.Experiments)
autobuildExecutor.Run()

jobReaperTicker := time.NewTicker(vals.JobReaperDetectorInterval.Value())
Expand Down
6 changes: 4 additions & 2 deletionscoderd/autobuild/lifecycle_executor.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,7 @@ type Executor struct {
templateScheduleStore *atomic.Pointer[schedule.TemplateScheduleStore]
accessControlStore *atomic.Pointer[dbauthz.AccessControlStore]
auditor *atomic.Pointer[audit.Auditor]
buildUsageChecker *atomic.Pointer[wsbuilder.UsageChecker]
log slog.Logger
tick <-chan time.Time
statsCh chan<- Stats
Expand All@@ -65,7 +66,7 @@ type Stats struct {
}

// New returns a new wsactions executor.
func NewExecutor(ctx context.Context, db database.Store, ps pubsub.Pubsub, fc *files.Cache, reg prometheus.Registerer, tss *atomic.Pointer[schedule.TemplateScheduleStore], auditor *atomic.Pointer[audit.Auditor], acs *atomic.Pointer[dbauthz.AccessControlStore], log slog.Logger, tick <-chan time.Time, enqueuer notifications.Enqueuer, exp codersdk.Experiments) *Executor {
func NewExecutor(ctx context.Context, db database.Store, ps pubsub.Pubsub, fc *files.Cache, reg prometheus.Registerer, tss *atomic.Pointer[schedule.TemplateScheduleStore], auditor *atomic.Pointer[audit.Auditor], acs *atomic.Pointer[dbauthz.AccessControlStore],buildUsageChecker *atomic.Pointer[wsbuilder.UsageChecker],log slog.Logger, tick <-chan time.Time, enqueuer notifications.Enqueuer, exp codersdk.Experiments) *Executor {
factory := promauto.With(reg)
le := &Executor{
//nolint:gocritic // Autostart has a limited set of permissions.
Expand All@@ -78,6 +79,7 @@ func NewExecutor(ctx context.Context, db database.Store, ps pubsub.Pubsub, fc *f
log: log.Named("autobuild"),
auditor: auditor,
accessControlStore: acs,
buildUsageChecker: buildUsageChecker,
notificationsEnqueuer: enqueuer,
reg: reg,
experiments: exp,
Expand DownExpand Up@@ -279,7 +281,7 @@ func (e *Executor) runOnce(t time.Time) Stats {
}

if nextTransition != "" {
builder := wsbuilder.New(ws, nextTransition).
builder := wsbuilder.New(ws, nextTransition, *e.buildUsageChecker.Load()).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This could panic; can you add some protection for it?

SetLastWorkspaceBuildInTx(&latestBuild).
SetLastWorkspaceBuildJobInTx(&latestJob).
Experiments(e.experiments).
Expand Down
12 changes: 12 additions & 0 deletionscoderd/coderd.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -21,6 +21,7 @@ import (

"github.com/coder/coder/v2/coderd/oauth2provider"
"github.com/coder/coder/v2/coderd/prebuilds"
"github.com/coder/coder/v2/coderd/wsbuilder"

"github.com/andybalholm/brotli"
"github.com/go-chi/chi/v5"
Expand DownExpand Up@@ -559,6 +560,13 @@ func New(options *Options) *API {
// bugs that may only occur when a key isn't precached in tests and the latency cost is minimal.
cryptokeys.StartRotator(ctx, options.Logger, options.Database)

// AGPL uses a no-op build usage checker as there are no license
// entitlements to enforce. This is swapped out in
// enterprise/coderd/coderd.go.
var buildUsageChecker atomic.Pointer[wsbuilder.UsageChecker]
var noopUsageChecker wsbuilder.UsageChecker = wsbuilder.NoopUsageChecker{}
buildUsageChecker.Store(&noopUsageChecker)

api := &API{
ctx: ctx,
cancel: cancel,
Expand All@@ -579,6 +587,7 @@ func New(options *Options) *API {
TemplateScheduleStore: options.TemplateScheduleStore,
UserQuietHoursScheduleStore: options.UserQuietHoursScheduleStore,
AccessControlStore: options.AccessControlStore,
BuildUsageChecker: &buildUsageChecker,
FileCache: files.New(options.PrometheusRegistry, options.Authorizer),
Experiments: experiments,
WebpushDispatcher: options.WebPushDispatcher,
Expand DownExpand Up@@ -1650,6 +1659,9 @@ type API struct {
FileCache *files.Cache
PrebuildsClaimer atomic.Pointer[prebuilds.Claimer]
PrebuildsReconciler atomic.Pointer[prebuilds.ReconciliationOrchestrator]
// BuildUsageChecker is a pointer as it's passed around to multiple
// components.
BuildUsageChecker *atomic.Pointer[wsbuilder.UsageChecker]

UpdatesProvider tailnet.WorkspaceUpdatesProvider

Expand Down
6 changes: 6 additions & 0 deletionscoderd/coderdtest/coderdtest.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -55,6 +55,7 @@ import (
"cdr.dev/slog/sloggers/slogtest"
"github.com/coder/coder/v2/archive"
"github.com/coder/coder/v2/coderd/files"
"github.com/coder/coder/v2/coderd/wsbuilder"
"github.com/coder/quartz"

"github.com/coder/coder/v2/coderd"
Expand DownExpand Up@@ -364,6 +365,10 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
}
connectionLogger.Store(&options.ConnectionLogger)

varbuildUsageChecker atomic.Pointer[wsbuilder.UsageChecker]
varnoopUsageChecker wsbuilder.UsageChecker= wsbuilder.NoopUsageChecker{}
buildUsageChecker.Store(&noopUsageChecker)

ctx,cancelFunc:=context.WithCancel(context.Background())
experiments:=coderd.ReadExperiments(*options.Logger,options.DeploymentValues.Experiments)
lifecycleExecutor:=autobuild.NewExecutor(
Expand All@@ -375,6 +380,7 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
&templateScheduleStore,
&auditor,
accessControlStore,
&buildUsageChecker,
*options.Logger,
options.AutobuildTicker,
options.NotificationsEnqueuer,
Expand Down
8 changes: 8 additions & 0 deletionscoderd/database/dbauthz/dbauthz.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2193,6 +2193,14 @@ func (q *querier) GetLogoURL(ctx context.Context) (string, error) {
return q.db.GetLogoURL(ctx)
}

func (q *querier) GetManagedAgentCount(ctx context.Context, arg database.GetManagedAgentCountParams) (int64, error) {
// Must be able to read all workspaces to check usage.
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace); err != nil {
return 0, err
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Please wrap err; could get confusing if there's an authz error on a seemingly unrelated resource.

}
return q.db.GetManagedAgentCount(ctx, arg)
}

func (q *querier) GetNotificationMessagesByStatus(ctx context.Context, arg database.GetNotificationMessagesByStatusParams) ([]database.NotificationMessage, error) {
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceNotificationMessage); err != nil {
return nil, err
Expand Down
18 changes: 12 additions & 6 deletionscoderd/database/dbauthz/dbauthz_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -17,20 +17,18 @@ import (
"golang.org/x/xerrors"

"cdr.dev/slog"

"github.com/coder/coder/v2/coderd/database/db2sdk"
"github.com/coder/coder/v2/coderd/notifications"
"github.com/coder/coder/v2/coderd/rbac/policy"
"github.com/coder/coder/v2/codersdk"

"github.com/coder/coder/v2/coderd/coderdtest"
"github.com/coder/coder/v2/coderd/database"
"github.com/coder/coder/v2/coderd/database/db2sdk"
"github.com/coder/coder/v2/coderd/database/dbauthz"
"github.com/coder/coder/v2/coderd/database/dbgen"
"github.com/coder/coder/v2/coderd/database/dbtestutil"
"github.com/coder/coder/v2/coderd/database/dbtime"
"github.com/coder/coder/v2/coderd/notifications"
"github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/coderd/rbac/policy"
"github.com/coder/coder/v2/coderd/util/slice"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/provisionersdk"
"github.com/coder/coder/v2/testutil"
)
Expand DownExpand Up@@ -904,6 +902,14 @@ func (s *MethodTestSuite) TestLicense() {
require.NoError(s.T(), err)
check.Args().Asserts().Returns("value")
}))
s.Run("GetManagedAgentCount", s.Subtest(func(db database.Store, check *expects) {
start := dbtime.Now()
end := start.Add(time.Hour)
check.Args(database.GetManagedAgentCountParams{
StartTime: start,
EndTime: end,
}).Asserts(rbac.ResourceWorkspace, policy.ActionRead).Returns(int64(0))
}))
}

func (s *MethodTestSuite) TestOrganization() {
Expand Down
7 changes: 7 additions & 0 deletionscoderd/database/dbmetrics/querymetrics.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more abouthow customized files appear on GitHub.

15 changes: 15 additions & 0 deletionscoderd/database/dbmock/dbmock.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more abouthow customized files appear on GitHub.

1 change: 1 addition & 0 deletionscoderd/database/querier.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more abouthow customized files appear on GitHub.

29 changes: 29 additions & 0 deletionscoderd/database/queries.sql.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more abouthow customized files appear on GitHub.

18 changes: 18 additions & 0 deletionscoderd/database/queries/licenses.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -35,3 +35,21 @@ DELETE
FROM licenses
WHERE id = $1
RETURNING id;

-- name: GetManagedAgentCount :one
-- This isn't strictly a license query, but it's related to license enforcement.
SELECT
COUNT(DISTINCT wb.id) AS count
FROM
workspace_builds AS wb
JOIN
provisioner_jobs AS pj
ON
wb.job_id = pj.id
WHERE
wb.transition = 'start'::workspace_transition
AND wb.has_ai_task = true
-- Exclude failed builds since they can't use AI managed agents anyway.
AND pj.job_status NOT IN ('canceled'::provisioner_job_status, 'failed'::provisioner_job_status)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Maybe it'll be more future-proof to whitelist instead of blacklist statuses...pending,running orsucceeded are the only states you care about, right? This currently ignores other statuses likecanceling,unknown, etc.

-- Jobs are counted when they are created.
AND wb.created_at BETWEEN @start_time::timestamptz AND @end_time::timestamptz;
2 changes: 1 addition & 1 deletioncoderd/workspacebuilds.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -335,7 +335,7 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
return
}

builder:=wsbuilder.New(workspace,database.WorkspaceTransition(createBuild.Transition)).
builder:=wsbuilder.New(workspace,database.WorkspaceTransition(createBuild.Transition),*api.BuildUsageChecker.Load()).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Can panic

Initiator(apiKey.UserID).
RichParameterValues(createBuild.RichParameterValues).
LogLevel(string(createBuild.LogLevel)).
Expand Down
2 changes: 1 addition & 1 deletioncoderd/workspaces.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -701,7 +701,7 @@ func createWorkspace(
return xerrors.Errorf("get workspace by ID: %w", err)
}

builder := wsbuilder.New(workspace, database.WorkspaceTransitionStart).
builder := wsbuilder.New(workspace, database.WorkspaceTransitionStart, *api.BuildUsageChecker.Load()).
Reason(database.BuildReasonInitiator).
Initiator(initiatorID).
ActiveVersion().
Expand Down
45 changes: 42 additions & 3 deletionscoderd/wsbuilder/wsbuilder.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -56,6 +56,7 @@ type Builder struct {
logLevelstring
deploymentValues*codersdk.DeploymentValues
experiments codersdk.Experiments
usageCheckerUsageChecker

richParameterValues []codersdk.WorkspaceBuildParameter
initiator uuid.UUID
Expand DownExpand Up@@ -89,7 +90,24 @@ type Builder struct {
verifyNoLegacyParametersOncebool
}

typeOptionfunc(Builder)Builder
typeUsageCheckerinterface {
CheckBuildUsage(ctx context.Context,store database.Store,templateVersion*database.TemplateVersion) (UsageCheckResponse,error)
}

typeUsageCheckResponsestruct {
Permittedbool
Messagestring
}

typeNoopUsageCheckerstruct{}

var_UsageChecker=NoopUsageChecker{}

func (NoopUsageChecker)CheckBuildUsage(_ context.Context,_ database.Store,_*database.TemplateVersion) (UsageCheckResponse,error) {
returnUsageCheckResponse{
Permitted:true,
},nil
}

// versionTarget expresses how to determine the template version for the build.
//
Expand DownExpand Up@@ -121,8 +139,8 @@ type stateTarget struct {
explicit*[]byte
}

funcNew(w database.Workspace,t database.WorkspaceTransition)Builder {
returnBuilder{workspace:w,trans:t}
funcNew(w database.Workspace,t database.WorkspaceTransition,ucUsageChecker)Builder {
returnBuilder{workspace:w,trans:t,usageChecker:uc}
}

// Methods that customize the build are public, have a struct receiver and return a new Builder.
Expand DownExpand Up@@ -321,6 +339,10 @@ func (b *Builder) buildTx(authFunc func(action policy.Action, object rbac.Object
iferr!=nil {
returnnil,nil,nil,err
}
err=b.checkUsage()
iferr!=nil {
returnnil,nil,nil,err
}
err=b.checkRunningBuild()
iferr!=nil {
returnnil,nil,nil,err
Expand DownExpand Up@@ -1247,6 +1269,23 @@ func (b *Builder) checkTemplateJobStatus() error {
returnnil
}

func (b*Builder)checkUsage()error {
templateVersion,err:=b.getTemplateVersion()
iferr!=nil {
returnBuildError{http.StatusInternalServerError,"failed to fetch template version",err}
}

resp,err:=b.usageChecker.CheckBuildUsage(b.ctx,b.store,templateVersion)
iferr!=nil {
returnBuildError{http.StatusInternalServerError,"failed to check build usage",err}
}
if!resp.Permitted {
returnBuildError{http.StatusForbidden,"Build is not permitted: "+resp.Message,nil}
Comment on lines +1280 to +1283
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Nit: capitalisation consistency

}

returnnil
}

func (b*Builder)checkRunningBuild()error {
job,err:=b.getLastBuildJob()
ifxerrors.Is(err,sql.ErrNoRows) {
Expand Down
Loading
Loading
[8]ページ先頭
©2009-2025 Movatter.jp