mirror of
https://github.com/coder/coder.git
synced 2026-06-02 20:48:20 +00:00
Cian Johnston
6781b0fc87
Relates to https://github.com/coder/coder/pull/15416 This PR modifies the provisioner helm chart logic: - Previously, when both provisionerDaemon.keySecretName and provisionerDaemon.pskSecretName were both set, we would fail to install the chart. This required users to have an obnoxious workaround in place where setting provisionerDaemon.pskSecretName="" was required in order to use provisioner keys. We now check for pskSecretName being set to the default value when keySecretName is also specified, and switch to provisioner key authentication instead of PSK. The previous workaround is still supported. - We also had omitted to check for provisionerd.Tags being set along with provisionerDaemon.keySecretName. This would result in a crashlooping provisioner deployment, as setting both of these configuration options is not allowed. We now fast-fail the Helm deployment if we detect this scenario.
138 lines
3.3 KiB
Plaintext
138 lines
3.3 KiB
Plaintext
---
|
|
# Source: coder-provisioner/templates/coder.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
annotations: {}
|
|
labels:
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: coder-provisioner
|
|
app.kubernetes.io/part-of: coder-provisioner
|
|
app.kubernetes.io/version: 0.1.0
|
|
helm.sh/chart: coder-provisioner-0.1.0
|
|
name: coder-provisioner
|
|
---
|
|
# Source: coder-provisioner/templates/rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: coder-provisioner-workspace-perms
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims"]
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
---
|
|
# Source: coder-provisioner/templates/rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: "coder-provisioner"
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: "coder-provisioner"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: coder-provisioner-workspace-perms
|
|
---
|
|
# Source: coder-provisioner/templates/coder.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations: {}
|
|
labels:
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: coder-provisioner
|
|
app.kubernetes.io/part-of: coder-provisioner
|
|
app.kubernetes.io/version: 0.1.0
|
|
helm.sh/chart: coder-provisioner-0.1.0
|
|
name: coder-provisioner
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/name: coder-provisioner
|
|
template:
|
|
metadata:
|
|
annotations: {}
|
|
labels:
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: coder-provisioner
|
|
app.kubernetes.io/part-of: coder-provisioner
|
|
app.kubernetes.io/version: 0.1.0
|
|
helm.sh/chart: coder-provisioner-0.1.0
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- provisionerd
|
|
- start
|
|
command:
|
|
- /opt/coder
|
|
env:
|
|
- name: CODER_PROMETHEUS_ADDRESS
|
|
value: 0.0.0.0:2112
|
|
- name: CODER_PROVISIONER_DAEMON_PSK
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: psk
|
|
name: not-the-default-coder-provisioner-psk
|
|
- name: CODER_PROVISIONERD_TAGS
|
|
value: clusterType=k8s,location=auh
|
|
- name: CODER_URL
|
|
value: http://coder.default.svc.cluster.local
|
|
image: ghcr.io/coder/coder:latest
|
|
imagePullPolicy: IfNotPresent
|
|
lifecycle: {}
|
|
name: coder
|
|
ports: null
|
|
resources: {}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: null
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts: []
|
|
restartPolicy: Always
|
|
serviceAccountName: coder-provisioner
|
|
terminationGracePeriodSeconds: 600
|
|
volumes: []
|