mirror of
https://github.com/coder/coder.git
synced 2026-06-03 21:18:24 +00:00
Michael Suchacz
e5707a13d6
> This PR was authored by Mux on behalf of Mike. ## Summary Adds support for multiple peer root workspace agents sharing the same `auth_instance_id`, so AWS, Azure, and GCP instance-identity auth can issue the correct session token for a selected agent instead of assuming a single root agent per instance. ## Problem When a Terraform template attaches two or more `coder_agent` resources (with `auth = "aws-instance-identity"`) to a single compute instance, every agent shares the same cloud instance ID. The existing singular lookup picks whichever agent was created most recently, silently ignoring the others. ## Solution Introduce an optional pre-auth agent selector (`CODER_AGENT_NAME`) and make the server-side lookup ambiguity-aware. **Database layer:** - `GetWorkspaceAgentsByInstanceID` (`:many`): returns all matching root agents for an instance ID. - `GetWorkspaceAgentByInstanceIDAndName` (`:one`): returns the named root agent for disambiguation. **SDK and CLI:** - `agent_name` field added to AWS, Azure, and GCP request structs (`omitempty` for backward compatibility). - `CODER_AGENT_NAME` env var and `--agent-name` flag wired into the agent bootstrap before instance-identity auth runs. **Server handler (`handleAuthInstanceID`):** - When `agent_name` is present: direct lookup by (instance ID, name). - When absent: legacy lookup, then resource-scoped ambiguity check. Returns 409 with available agent names if multiple root agents match. - Whitespace-only names are trimmed and treated as unspecified. - Sub-agents remain excluded (`parent_id IS NULL` filter). **Verification template:** - `examples/templates/aws-multi-agent/` provisions one EC2 instance with two agents (`main` and `dev`), both using instance-identity auth with `CODER_AGENT_NAME` set in the cloud-init user data. ## Backward compatibility Existing single-agent deployments work unchanged. The `agent_name` field is optional with `omitempty`, and the unnamed path preserves today's behavior when only one root agent matches.
99 lines
4.1 KiB
Plaintext
99 lines
4.1 KiB
Plaintext
coder v0.0.0-devel
|
|
|
|
USAGE:
|
|
coder agent [flags]
|
|
|
|
Starts the Coder workspace agent.
|
|
|
|
OPTIONS:
|
|
--auth string, $CODER_AGENT_AUTH (default: token)
|
|
Specify the authentication type to use for the agent.
|
|
|
|
--agent-name string, $CODER_AGENT_NAME
|
|
The name of the agent to authenticate as (only applicable for instance
|
|
identity).
|
|
|
|
--agent-token string, $CODER_AGENT_TOKEN
|
|
An agent authentication token.
|
|
|
|
--agent-token-file string, $CODER_AGENT_TOKEN_FILE
|
|
A file containing an agent authentication token.
|
|
|
|
--agent-url url, $CODER_AGENT_URL
|
|
URL for an agent to access your deployment.
|
|
|
|
--log-human string, $CODER_AGENT_LOGGING_HUMAN (default: /dev/stderr)
|
|
Output human-readable logs to a given file.
|
|
|
|
--log-json string, $CODER_AGENT_LOGGING_JSON
|
|
Output JSON logs to a given file.
|
|
|
|
--log-stackdriver string, $CODER_AGENT_LOGGING_STACKDRIVER
|
|
Output Stackdriver compatible logs to a given file.
|
|
|
|
--agent-header string-array, $CODER_AGENT_HEADER
|
|
Additional HTTP headers added to all requests. Provide as key=value.
|
|
Can be specified multiple times.
|
|
|
|
--agent-header-command string, $CODER_AGENT_HEADER_COMMAND
|
|
An external command that outputs additional HTTP headers added to all
|
|
requests. The command must output each header as `key=value` on its
|
|
own line.
|
|
|
|
--block-file-transfer bool, $CODER_AGENT_BLOCK_FILE_TRANSFER (default: false)
|
|
Block file transfer using known applications: nc,rsync,scp,sftp.
|
|
|
|
--block-local-port-forwarding bool, $CODER_AGENT_BLOCK_LOCAL_PORT_FORWARDING (default: false)
|
|
Block local port forwarding through the SSH server (ssh -L).
|
|
|
|
--block-reverse-port-forwarding bool, $CODER_AGENT_BLOCK_REVERSE_PORT_FORWARDING (default: false)
|
|
Block reverse port forwarding through the SSH server (ssh -R).
|
|
|
|
--boundary-log-proxy-socket-path string, $CODER_AGENT_BOUNDARY_LOG_PROXY_SOCKET_PATH (default: /tmp/boundary-audit.sock)
|
|
The path for the boundary log proxy server Unix socket. Boundary
|
|
should write audit logs to this socket.
|
|
|
|
--debug-address string, $CODER_AGENT_DEBUG_ADDRESS (default: 127.0.0.1:2113)
|
|
The bind address to serve a debug HTTP server.
|
|
|
|
--devcontainers-discovery-autostart-enable bool, $CODER_AGENT_DEVCONTAINERS_DISCOVERY_AUTOSTART_ENABLE (default: false)
|
|
Allow the agent to autostart devcontainer projects it discovers based
|
|
on their configuration.
|
|
|
|
--devcontainers-enable bool, $CODER_AGENT_DEVCONTAINERS_ENABLE (default: true)
|
|
Allow the agent to automatically detect running devcontainers.
|
|
|
|
--devcontainers-project-discovery-enable bool, $CODER_AGENT_DEVCONTAINERS_PROJECT_DISCOVERY_ENABLE (default: true)
|
|
Allow the agent to search the filesystem for devcontainer projects.
|
|
|
|
--log-dir string, $CODER_AGENT_LOG_DIR (default: /tmp)
|
|
Specify the location for the agent log files.
|
|
|
|
--no-reap bool
|
|
Do not start a process reaper.
|
|
|
|
--pprof-address string, $CODER_AGENT_PPROF_ADDRESS (default: 127.0.0.1:6060)
|
|
The address to serve pprof.
|
|
|
|
--prometheus-address string, $CODER_AGENT_PROMETHEUS_ADDRESS (default: 127.0.0.1:2112)
|
|
The bind address to serve Prometheus metrics.
|
|
|
|
--script-data-dir string, $CODER_AGENT_SCRIPT_DATA_DIR (default: /tmp)
|
|
Specify the location for storing script data.
|
|
|
|
--socket-path string, $CODER_AGENT_SOCKET_PATH
|
|
Specify the path for the agent socket.
|
|
|
|
--socket-server-enabled bool, $CODER_AGENT_SOCKET_SERVER_ENABLED (default: true)
|
|
Enable the agent socket server.
|
|
|
|
--ssh-max-timeout duration, $CODER_AGENT_SSH_MAX_TIMEOUT (default: 72h)
|
|
Specify the max timeout for a SSH connection, it is advisable to set
|
|
it to a minimum of 60s, but no more than 72h.
|
|
|
|
--tailnet-listen-port int, $CODER_AGENT_TAILNET_LISTEN_PORT (default: 0)
|
|
Specify a static port for Tailscale to use for listening.
|
|
|
|
———
|
|
Run `coder --help` for a list of global options.
|