Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1acfd2a

Browse files
johnstcnbpmct
authored andcommitted
fix(helm/provisioner): prefer provisioner key if both psk and key are set (#15417)
Relates to#15416This PR modifies the provisioner helm chart logic:- Previously, when both provisionerDaemon.keySecretName and provisionerDaemon.pskSecretName were both set, we would fail to install the chart. This required users to have an obnoxious workaround in place where setting provisionerDaemon.pskSecretName="" was required in order to use provisioner keys. We now check for pskSecretName being set to the default value when keySecretName is also specified, and switch to provisioner key authentication instead of PSK. The previous workaround is still supported.- We also had omitted to check for provisionerd.Tags being set along with provisionerDaemon.keySecretName. This would result in a crashlooping provisioner deployment, as setting both of these configuration options is not allowed. We now fast-fail the Helm deployment if we detect this scenario.(cherry picked from commit6781b0f)
1 parent5a6d23a commit1acfd2a

12 files changed

+186
-24
lines changed

‎helm/provisioner/templates/_coder.tpl

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,22 +34,23 @@ env:
3434
value: "0.0.0.0:2112"
3535
{{-ifand (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName)}}
3636
{{ fail"Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified."}}
37-
{{-elseifand (.Values.provisionerDaemon.pskSecretName) (.Values.provisionerDaemon.keySecretName)}}
38-
{{ fail"Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both."}}
39-
{{- end}}
40-
{{-if .Values.provisionerDaemon.pskSecretName}}
41-
- name: CODER_PROVISIONER_DAEMON_PSK
42-
valueFrom:
43-
secretKeyRef:
44-
name:{{ .Values.provisionerDaemon.pskSecretName | quote}}
45-
key: psk
46-
{{- end}}
47-
{{-ifand .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey}}
37+
{{-elseifand .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey}}
38+
{{-ifand (not (empty .Values.provisionerDaemon.pskSecretName)) (ne .Values.provisionerDaemon.pskSecretName"coder-provisioner-psk")}}
39+
{{ fail"Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both."}}
40+
{{-elseif .Values.provisionerDaemon.tags}}
41+
{{ fail"provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName."}}
42+
{{- end}}
4843
- name: CODER_PROVISIONER_DAEMON_KEY
4944
valueFrom:
5045
secretKeyRef:
5146
name:{{ .Values.provisionerDaemon.keySecretName | quote}}
5247
key:{{ .Values.provisionerDaemon.keySecretKey | quote}}
48+
{{-else}}
49+
- name: CODER_PROVISIONER_DAEMON_PSK
50+
valueFrom:
51+
secretKeyRef:
52+
name:{{ .Values.provisionerDaemon.pskSecretName | quote}}
53+
key: psk
5354
{{- end}}
5455
{{-ifinclude"provisioner.tags" .}}
5556
- name: CODER_PROVISIONERD_TAGS

‎helm/provisioner/tests/chart_test.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,12 @@ var testCases = []testCase{
5656
name:"provisionerd_key",
5757
expectedError:"",
5858
},
59+
// Test explicitly for the workaround where setting provisionerDaemon.pskSecretName=""
60+
// was required to use provisioner keys.
61+
{
62+
name:"provisionerd_key_psk_empty_workaround",
63+
expectedError:"",
64+
},
5965
{
6066
name:"provisionerd_psk_and_key",
6167
expectedError:`Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both.`,
@@ -64,6 +70,10 @@ var testCases = []testCase{
6470
name:"provisionerd_no_psk_or_key",
6571
expectedError:`Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified.`,
6672
},
73+
{
74+
name:"provisionerd_key_tags",
75+
expectedError:`provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName.`,
76+
},
6777
{
6878
name:"extra_templates",
6979
expectedError:"",

‎helm/provisioner/tests/testdata/provisionerd_key.golden

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,6 @@ spec:
112112
secretKeyRef:
113113
key: provisionerd-key
114114
name: coder-provisionerd-key
115-
- name: CODER_PROVISIONERD_TAGS
116-
value: clusterType=k8s,location=auh
117115
- name: CODER_URL
118116
value: http://coder.default.svc.cluster.local
119117
image: ghcr.io/coder/coder:latest

‎helm/provisioner/tests/testdata/provisionerd_key.yaml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,5 @@ coder:
22
image:
33
tag:latest
44
provisionerDaemon:
5-
pskSecretName:""
65
keySecretName:"coder-provisionerd-key"
76
keySecretKey:"provisionerd-key"
8-
tags:
9-
location:auh
10-
clusterType:k8s
Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_KEY
111+
valueFrom:
112+
secretKeyRef:
113+
key: provisionerd-key
114+
name: coder-provisionerd-key
115+
- name: CODER_URL
116+
value: http://coder.default.svc.cluster.local
117+
image: ghcr.io/coder/coder:latest
118+
imagePullPolicy: IfNotPresent
119+
lifecycle: {}
120+
name: coder
121+
ports: null
122+
resources: {}
123+
securityContext:
124+
allowPrivilegeEscalation: false
125+
readOnlyRootFilesystem: null
126+
runAsGroup: 1000
127+
runAsNonRoot: true
128+
runAsUser: 1000
129+
seccompProfile:
130+
type: RuntimeDefault
131+
volumeMounts: []
132+
restartPolicy: Always
133+
serviceAccountName: coder-provisioner
134+
terminationGracePeriodSeconds: 600
135+
volumes: []
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
coder:
2+
image:
3+
tag:latest
4+
provisionerDaemon:
5+
pskSecretName:""
6+
keySecretName:"coder-provisionerd-key"
7+
keySecretKey:"provisionerd-key"
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
coder:
2+
image:
3+
tag:latest
4+
provisionerDaemon:
5+
keySecretName:"coder-provisionerd-key"
6+
keySecretKey:"provisionerd-key"
7+
tags:
8+
location:auh
9+
clusterType:k8s

‎helm/provisioner/tests/testdata/provisionerd_no_psk_or_key.yaml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,3 @@ coder:
44
provisionerDaemon:
55
pskSecretName:""
66
keySecretName:""
7-
tags:
8-
location:auh
9-
clusterType:k8s

‎helm/provisioner/tests/testdata/provisionerd_psk.golden

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ spec:
111111
valueFrom:
112112
secretKeyRef:
113113
key: psk
114-
name: coder-provisionerd-psk
114+
name:not-the-default-coder-provisioner-psk
115115
- name: CODER_PROVISIONERD_TAGS
116116
value: clusterType=k8s,location=auh
117117
- name: CODER_URL

‎helm/provisioner/tests/testdata/provisionerd_psk.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ coder:
22
image:
33
tag:latest
44
provisionerDaemon:
5-
pskSecretName:"coder-provisionerd-psk"
5+
pskSecretName:"not-the-default-coder-provisioner-psk"
66
tags:
77
location:auh
88
clusterType:k8s

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ coder:
22
image:
33
tag:latest
44
provisionerDaemon:
5-
pskSecretName:"coder-provisionerd-psk"
5+
pskSecretName:"not-the-default-coder-provisioner-psk"
66
keySecretName:"coder-provisionerd-key"
77
keySecretKey:"provisionerd-key"
88
tags:

‎helm/provisioner/values.yaml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,14 +204,23 @@ provisionerDaemon:
204204
# provisionerDaemon.keySecretName -- The name of the Kubernetes
205205
# secret that contains a provisioner key to use to authenticate with Coder.
206206
# See: https://coder.com/docs/admin/provisioners#authentication
207+
# NOTE: it is not permitted to specify both provisionerDaemon.keySecretName
208+
# and provisionerDaemon.pskSecretName. An exception is made for the purposes
209+
# of backwards-compatibility: if provisionerDaemon.pskSecretName is unchanged
210+
# from the default value and provisionerDaemon.keySecretName is set, then
211+
# provisionerDaemon.keySecretName and provisionerDaemon.keySecretKey will take
212+
# precedence over provisionerDaemon.pskSecretName.
207213
keySecretName:""
208214
# provisionerDaemon.keySecretKey -- The key of the Kubernetes
209215
# secret specified in provisionerDaemon.keySecretName that contains
210216
# the provisioner key. Defaults to "key".
211217
keySecretKey:"key"
212218

213-
# provisionerDaemon.tags -- Tags to filter provisioner jobs by.
219+
# provisionerDaemon.tags -- If using a PSK, specify the set of provisioner
220+
# job tags for which this provisioner daemon is responsible.
214221
# See: https://coder.com/docs/admin/provisioners#provisioner-tags
222+
# NOTE: it is not permitted to specify both provisionerDaemon.tags and
223+
# provsionerDaemon.keySecretName.
215224
tags:
216225
{}
217226
# location: usa

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp