mirror of
https://github.com/coder/coder.git
synced 2026-06-04 21:48:22 +00:00
Michael Suchacz
e5707a13d6
> This PR was authored by Mux on behalf of Mike. ## Summary Adds support for multiple peer root workspace agents sharing the same `auth_instance_id`, so AWS, Azure, and GCP instance-identity auth can issue the correct session token for a selected agent instead of assuming a single root agent per instance. ## Problem When a Terraform template attaches two or more `coder_agent` resources (with `auth = "aws-instance-identity"`) to a single compute instance, every agent shares the same cloud instance ID. The existing singular lookup picks whichever agent was created most recently, silently ignoring the others. ## Solution Introduce an optional pre-auth agent selector (`CODER_AGENT_NAME`) and make the server-side lookup ambiguity-aware. **Database layer:** - `GetWorkspaceAgentsByInstanceID` (`:many`): returns all matching root agents for an instance ID. - `GetWorkspaceAgentByInstanceIDAndName` (`:one`): returns the named root agent for disambiguation. **SDK and CLI:** - `agent_name` field added to AWS, Azure, and GCP request structs (`omitempty` for backward compatibility). - `CODER_AGENT_NAME` env var and `--agent-name` flag wired into the agent bootstrap before instance-identity auth runs. **Server handler (`handleAuthInstanceID`):** - When `agent_name` is present: direct lookup by (instance ID, name). - When absent: legacy lookup, then resource-scoped ambiguity check. Returns 409 with available agent names if multiple root agents match. - Whitespace-only names are trimmed and treated as unspecified. - Sub-agents remain excluded (`parent_id IS NULL` filter). **Verification template:** - `examples/templates/aws-multi-agent/` provisions one EC2 instance with two agents (`main` and `dev`), both using instance-identity auth with `CODER_AGENT_NAME` set in the cloud-init user data. ## Backward compatibility Existing single-agent deployments work unchanged. The `agent_name` field is optional with `omitempty`, and the unnamed path preserves today's behavior when only one root agent matches.
19 lines
524 B
Plaintext
19 lines
524 B
Plaintext
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# Create the user if it doesn't exist.
|
|
if ! id -u "${linux_user}" >/dev/null 2>&1; then
|
|
useradd -m -s /bin/bash "${linux_user}"
|
|
fi
|
|
|
|
# Start main agent with disambiguation name.
|
|
CODER_AGENT_NAME=main sudo -u '${linux_user}' sh -c '${main_init_script}' \
|
|
>/tmp/coder-agent-main.log 2>&1 &
|
|
|
|
# Start dev agent with disambiguation name.
|
|
CODER_AGENT_NAME=dev sudo -u '${linux_user}' sh -c '${dev_init_script}' \
|
|
>/tmp/coder-agent-dev.log 2>&1 &
|
|
|
|
# Wait for both agent processes to start.
|
|
wait
|