Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6781b0f

Browse files
johnstcnjohnstcn
authored
fix(helm/provisioner): prefer provisioner key if both psk and key are set (#15417)
Relates to #15416 This PR modifies the provisioner helm chart logic: - Previously, when both provisionerDaemon.keySecretName and provisionerDaemon.pskSecretName were both set, we would fail to install the chart. This required users to have an obnoxious workaround in place where setting provisionerDaemon.pskSecretName="" was required in order to use provisioner keys. We now check for pskSecretName being set to the default value when keySecretName is also specified, and switch to provisioner key authentication instead of PSK. The previous workaround is still supported. - We also had omitted to check for provisionerd.Tags being set along with provisionerDaemon.keySecretName. This would result in a crashlooping provisioner deployment, as setting both of these configuration options is not allowed. We now fast-fail the Helm deployment if we detect this scenario.
1 parent 71dc91e commit 6781b0f

12 files changed

+186
-24
lines changed

‎helm/provisioner/templates/_coder.tpl

+12-11
Original file line numberDiff line numberDiff line change
@@ -34,22 +34,23 @@ env:
3434
value: "0.0.0.0:2112"
3535
{{- if and (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName) }}
3636
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified." }}
37-
{{- else if and (.Values.provisionerDaemon.pskSecretName) (.Values.provisionerDaemon.keySecretName) }}
38-
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both." }}
39-
{{- end }}
40-
{{- if .Values.provisionerDaemon.pskSecretName }}
41-
- name: CODER_PROVISIONER_DAEMON_PSK
42-
valueFrom:
43-
secretKeyRef:
44-
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
45-
key: psk
46-
{{- end }}
47-
{{- if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
37+
{{- else if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
38+
{{- if and (not (empty .Values.provisionerDaemon.pskSecretName)) (ne .Values.provisionerDaemon.pskSecretName "coder-provisioner-psk") }}
39+
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both." }}
40+
{{- else if .Values.provisionerDaemon.tags }}
41+
{{ fail "provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName." }}
42+
{{- end }}
4843
- name: CODER_PROVISIONER_DAEMON_KEY
4944
valueFrom:
5045
secretKeyRef:
5146
name: {{ .Values.provisionerDaemon.keySecretName | quote }}
5247
key: {{ .Values.provisionerDaemon.keySecretKey | quote }}
48+
{{- else }}
49+
- name: CODER_PROVISIONER_DAEMON_PSK
50+
valueFrom:
51+
secretKeyRef:
52+
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
53+
key: psk
5354
{{- end }}
5455
{{- if include "provisioner.tags" . }}
5556
- name: CODER_PROVISIONERD_TAGS

‎helm/provisioner/tests/chart_test.go

+10
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,12 @@ var testCases = []testCase{
5656
name: "provisionerd_key",
5757
expectedError: "",
5858
},
59+
// Test explicitly for the workaround where setting provisionerDaemon.pskSecretName=""
60+
// was required to use provisioner keys.
61+
{
62+
name: "provisionerd_key_psk_empty_workaround",
63+
expectedError: "",
64+
},
5965
{
6066
name: "provisionerd_psk_and_key",
6167
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both.`,
@@ -64,6 +70,10 @@ var testCases = []testCase{
6470
name: "provisionerd_no_psk_or_key",
6571
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified.`,
6672
},
73+
{
74+
name: "provisionerd_key_tags",
75+
expectedError: `provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName.`,
76+
},
6777
{
6878
name: "extra_templates",
6979
expectedError: "",

‎helm/provisioner/tests/testdata/provisionerd_key.golden

-2
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,6 @@ spec:
112112
secretKeyRef:
113113
key: provisionerd-key
114114
name: coder-provisionerd-key
115-
- name: CODER_PROVISIONERD_TAGS
116-
value: clusterType=k8s,location=auh
117115
- name: CODER_URL
118116
value: http://coder.default.svc.cluster.local
119117
image: ghcr.io/coder/coder:latest

‎helm/provisioner/tests/testdata/provisionerd_key.yaml

-4
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,5 @@ coder:
22
image:
33
tag: latest
44
provisionerDaemon:
5-
pskSecretName: ""
65
keySecretName: "coder-provisionerd-key"
76
keySecretKey: "provisionerd-key"
8-
tags:
9-
location: auh
10-
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_key_psk_empty_workaround.golden

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
# Source: coder-provisioner/templates/coder.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
annotations: {}
7+
labels:
8+
app.kubernetes.io/instance: release-name
9+
app.kubernetes.io/managed-by: Helm
10+
app.kubernetes.io/name: coder-provisioner
11+
app.kubernetes.io/part-of: coder-provisioner
12+
app.kubernetes.io/version: 0.1.0
13+
helm.sh/chart: coder-provisioner-0.1.0
14+
name: coder-provisioner
15+
---
16+
# Source: coder-provisioner/templates/rbac.yaml
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: coder-provisioner-workspace-perms
21+
rules:
22+
- apiGroups: [""]
23+
resources: ["pods"]
24+
verbs:
25+
- create
26+
- delete
27+
- deletecollection
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- apiGroups: [""]
34+
resources: ["persistentvolumeclaims"]
35+
verbs:
36+
- create
37+
- delete
38+
- deletecollection
39+
- get
40+
- list
41+
- patch
42+
- update
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- deployments
48+
verbs:
49+
- create
50+
- delete
51+
- deletecollection
52+
- get
53+
- list
54+
- patch
55+
- update
56+
- watch
57+
---
58+
# Source: coder-provisioner/templates/rbac.yaml
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: "coder-provisioner"
63+
subjects:
64+
- kind: ServiceAccount
65+
name: "coder-provisioner"
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: Role
69+
name: coder-provisioner-workspace-perms
70+
---
71+
# Source: coder-provisioner/templates/coder.yaml
72+
apiVersion: apps/v1
73+
kind: Deployment
74+
metadata:
75+
annotations: {}
76+
labels:
77+
app.kubernetes.io/instance: release-name
78+
app.kubernetes.io/managed-by: Helm
79+
app.kubernetes.io/name: coder-provisioner
80+
app.kubernetes.io/part-of: coder-provisioner
81+
app.kubernetes.io/version: 0.1.0
82+
helm.sh/chart: coder-provisioner-0.1.0
83+
name: coder-provisioner
84+
spec:
85+
replicas: 1
86+
selector:
87+
matchLabels:
88+
app.kubernetes.io/instance: release-name
89+
app.kubernetes.io/name: coder-provisioner
90+
template:
91+
metadata:
92+
annotations: {}
93+
labels:
94+
app.kubernetes.io/instance: release-name
95+
app.kubernetes.io/managed-by: Helm
96+
app.kubernetes.io/name: coder-provisioner
97+
app.kubernetes.io/part-of: coder-provisioner
98+
app.kubernetes.io/version: 0.1.0
99+
helm.sh/chart: coder-provisioner-0.1.0
100+
spec:
101+
containers:
102+
- args:
103+
- provisionerd
104+
- start
105+
command:
106+
- /opt/coder
107+
env:
108+
- name: CODER_PROMETHEUS_ADDRESS
109+
value: 0.0.0.0:2112
110+
- name: CODER_PROVISIONER_DAEMON_KEY
111+
valueFrom:
112+
secretKeyRef:
113+
key: provisionerd-key
114+
name: coder-provisionerd-key
115+
- name: CODER_URL
116+
value: http://coder.default.svc.cluster.local
117+
image: ghcr.io/coder/coder:latest
118+
imagePullPolicy: IfNotPresent
119+
lifecycle: {}
120+
name: coder
121+
ports: null
122+
resources: {}
123+
securityContext:
124+
allowPrivilegeEscalation: false
125+
readOnlyRootFilesystem: null
126+
runAsGroup: 1000
127+
runAsNonRoot: true
128+
runAsUser: 1000
129+
seccompProfile:
130+
type: RuntimeDefault
131+
volumeMounts: []
132+
restartPolicy: Always
133+
serviceAccountName: coder-provisioner
134+
terminationGracePeriodSeconds: 600
135+
volumes: []

‎helm/provisioner/tests/testdata/provisionerd_key_psk_empty_workaround.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
pskSecretName: ""
6+
keySecretName: "coder-provisionerd-key"
7+
keySecretKey: "provisionerd-key"

‎helm/provisioner/tests/testdata/provisionerd_key_tags.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
coder:
2+
image:
3+
tag: latest
4+
provisionerDaemon:
5+
keySecretName: "coder-provisionerd-key"
6+
keySecretKey: "provisionerd-key"
7+
tags:
8+
location: auh
9+
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_no_psk_or_key.yaml

-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,3 @@ coder:
44
provisionerDaemon:
55
pskSecretName: ""
66
keySecretName: ""
7-
tags:
8-
location: auh
9-
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_psk.golden

+1-1
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ spec:
111111
valueFrom:
112112
secretKeyRef:
113113
key: psk
114-
name: coder-provisionerd-psk
114+
name: not-the-default-coder-provisioner-psk
115115
- name: CODER_PROVISIONERD_TAGS
116116
value: clusterType=k8s,location=auh
117117
- name: CODER_URL

‎helm/provisioner/tests/testdata/provisionerd_psk.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ coder:
22
image:
33
tag: latest
44
provisionerDaemon:
5-
pskSecretName: "coder-provisionerd-psk"
5+
pskSecretName: "not-the-default-coder-provisioner-psk"
66
tags:
77
location: auh
88
clusterType: k8s

‎helm/provisioner/tests/testdata/provisionerd_psk_and_key.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ coder:
22
image:
33
tag: latest
44
provisionerDaemon:
5-
pskSecretName: "coder-provisionerd-psk"
5+
pskSecretName: "not-the-default-coder-provisioner-psk"
66
keySecretName: "coder-provisionerd-key"
77
keySecretKey: "provisionerd-key"
88
tags:

‎helm/provisioner/values.yaml

+10-1
Original file line numberDiff line numberDiff line change
@@ -204,14 +204,23 @@ provisionerDaemon:
204204
# provisionerDaemon.keySecretName -- The name of the Kubernetes
205205
# secret that contains a provisioner key to use to authenticate with Coder.
206206
# See: https://coder.com/docs/admin/provisioners#authentication
207+
# NOTE: it is not permitted to specify both provisionerDaemon.keySecretName
208+
# and provisionerDaemon.pskSecretName. An exception is made for the purposes
209+
# of backwards-compatibility: if provisionerDaemon.pskSecretName is unchanged
210+
# from the default value and provisionerDaemon.keySecretName is set, then
211+
# provisionerDaemon.keySecretName and provisionerDaemon.keySecretKey will take
212+
# precedence over provisionerDaemon.pskSecretName.
207213
keySecretName: ""
208214
# provisionerDaemon.keySecretKey -- The key of the Kubernetes
209215
# secret specified in provisionerDaemon.keySecretName that contains
210216
# the provisioner key. Defaults to "key".
211217
keySecretKey: "key"
212218

213-
# provisionerDaemon.tags -- Tags to filter provisioner jobs by.
219+
# provisionerDaemon.tags -- If using a PSK, specify the set of provisioner
220+
# job tags for which this provisioner daemon is responsible.
214221
# See: https://coder.com/docs/admin/provisioners#provisioner-tags
222+
# NOTE: it is not permitted to specify both provisionerDaemon.tags and
223+
# provsionerDaemon.keySecretName.
215224
tags:
216225
{}
217226
# location: usa

0 commit comments

Comments
 (0)