mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
feat: add external provisioner daemon helm chart (#8939)
* Refactor helm to extract common templates to libcoder Signed-off-by: Spike Curtis <spike@coder.com> * Remove comment from libcoder Chart.yaml Signed-off-by: Spike Curtis <spike@coder.com> * Add provisioner helm chart * Fix prettier, linting, docs Signed-off-by: Spike Curtis <spike@coder.com> * Log at INFO when provisionerd connects to coderd Signed-off-by: Spike Curtis <spike@coder.com> * remove unnecessary exports in helm tests Signed-off-by: Spike Curtis <spike@coder.com> --------- Signed-off-by: Spike Curtis <spike@coder.com>
This commit is contained in:
Spike Curtis
@@ -0,0 +1,27 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
Makefile
|
||||
artifacthub-repo.yml
|
||||
|
||||
tests
|
||||
@@ -0,0 +1,6 @@
|
||||
dependencies:
|
||||
- name: libcoder
|
||||
repository: file://../libcoder
|
||||
version: 0.1.0
|
||||
digest: sha256:5c9a99109258073b590a9f98268490ef387fde24c0c7c7ade9c1a8c7ef5e6e10
|
||||
generated: "2023-08-08T07:27:19.677972411Z"
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: v2
|
||||
name: coder
|
||||
description: Remote development environments on your infrastructure
|
||||
home: https://github.com/coder/coder
|
||||
|
||||
# version and appVersion are injected at release and will always be shown as
|
||||
# 0.1.0 in the repository.
|
||||
#
|
||||
# If you're installing the Helm chart directly from git it will have this
|
||||
# version, which means the auto-generated image URI will be invalid. You can set
|
||||
# "coder.image.tag" to the desired tag manually.
|
||||
type: application
|
||||
version: "0.1.0"
|
||||
appVersion: "0.1.0"
|
||||
|
||||
# Coder has a hard requirement on Kubernetes 1.19, as this version introduced
|
||||
# the networking.k8s.io/v1 API.
|
||||
kubeVersion: ">= 1.19.0-0"
|
||||
|
||||
keywords:
|
||||
- coder
|
||||
- terraform
|
||||
sources:
|
||||
- https://github.com/coder/coder/tree/main/helm/coder
|
||||
icon: https://helm.coder.com/coder_logo_black.png
|
||||
maintainers:
|
||||
- name: Coder Technologies, Inc.
|
||||
email: support@coder.com
|
||||
url: https://coder.com/contact
|
||||
|
||||
dependencies:
|
||||
- name: libcoder
|
||||
version: 0.1.0
|
||||
repository: file://../libcoder
|
||||
@@ -0,0 +1,53 @@
|
||||
# Coder Helm Chart
|
||||
|
||||
This directory contains the Helm chart used to deploy Coder onto a Kubernetes
|
||||
cluster. It contains the minimum required components to run Coder on Kubernetes,
|
||||
and notably (compared to Coder Classic) does not include a database server.
|
||||
|
||||
## Getting Started
|
||||
|
||||
> **Warning**: The main branch in this repository does not represent the
|
||||
> latest release of Coder. Please reference our installation docs for
|
||||
> instructions on a tagged release.
|
||||
|
||||
View
|
||||
[our docs](https://coder.com/docs/coder-oss/latest/install/kubernetes)
|
||||
for detailed installation instructions.
|
||||
|
||||
## Values
|
||||
|
||||
Please refer to [values.yaml](values.yaml) for available Helm values and their
|
||||
defaults.
|
||||
|
||||
A good starting point for your values file is:
|
||||
|
||||
```yaml
|
||||
coder:
|
||||
# You can specify any environment variables you'd like to pass to Coder
|
||||
# here. Coder consumes environment variables listed in
|
||||
# `coder server --help`, and these environment variables are also passed
|
||||
# to the workspace provisioner (so you can consume them in your Terraform
|
||||
# templates for auth keys etc.).
|
||||
#
|
||||
# Please keep in mind that you should not set `CODER_ADDRESS`,
|
||||
# `CODER_TLS_ENABLE`, `CODER_TLS_CERT_FILE` or `CODER_TLS_KEY_FILE` as
|
||||
# they are already set by the Helm chart and will cause conflicts.
|
||||
env:
|
||||
- name: CODER_ACCESS_URL
|
||||
value: "https://coder.example.com"
|
||||
- name: CODER_PG_CONNECTION_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
# You'll need to create a secret called coder-db-url with your
|
||||
# Postgres connection URL like:
|
||||
# postgres://coder:password@postgres:5432/coder?sslmode=disable
|
||||
name: coder-db-url
|
||||
key: url
|
||||
|
||||
# This env enables the Prometheus metrics endpoint.
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: "0.0.0.0:2112"
|
||||
tls:
|
||||
secretNames:
|
||||
- my-tls-secret-name
|
||||
```
|
||||
Binary file not shown.
@@ -0,0 +1,6 @@
|
||||
{{/*
|
||||
Deprecation notices:
|
||||
*/}}
|
||||
|
||||
Enjoy Coder! Please create an issue at https://github.com/coder/coder if you run
|
||||
into any problems! :)
|
||||
@@ -0,0 +1,102 @@
|
||||
{{/*
|
||||
Service account to merge into the libcoder template
|
||||
*/}}
|
||||
{{- define "coder.serviceaccount" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Deployment to merge into the libcoder template
|
||||
*/}}
|
||||
{{- define "coder.deployment" -}}
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
-
|
||||
{{ include "libcoder.containerspec" (list . "coder.containerspec") | indent 8}}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
ContainerSpec for the Coder container of the Coder deployment
|
||||
*/}}
|
||||
{{- define "coder.containerspec" -}}
|
||||
args:
|
||||
{{- if .Values.coder.commandArgs }}
|
||||
{{- toYaml .Values.coder.commandArgs | nindent 12 }}
|
||||
{{- else }}
|
||||
{{- if .Values.coder.workspaceProxy }}
|
||||
- wsproxy
|
||||
{{- end }}
|
||||
- server
|
||||
{{- end }}
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: "0.0.0.0:8080"
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: "0.0.0.0:2112"
|
||||
{{- if .Values.provisionerDaemon.pskSecretName }}
|
||||
- name: CODER_PROVISIONER_DAEMON_PSK
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
|
||||
key: psk
|
||||
{{- end }}
|
||||
# Set the default access URL so a `helm apply` works by default.
|
||||
# See: https://github.com/coder/coder/issues/5024
|
||||
{{- $hasAccessURL := false }}
|
||||
{{- range .Values.coder.env }}
|
||||
{{- if eq .name "CODER_ACCESS_URL" }}
|
||||
{{- $hasAccessURL = true }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $hasAccessURL }}
|
||||
- name: CODER_ACCESS_URL
|
||||
value: {{ include "coder.defaultAccessURL" . | quote }}
|
||||
{{- end }}
|
||||
# Used for inter-pod communication with high-availability.
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: "http://$(KUBE_POD_IP):8080"
|
||||
{{- include "coder.tlsEnv" . }}
|
||||
{{- with .Values.coder.env }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: "http"
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
{{- if eq (include "coder.tlsEnabled" .) "true" }}
|
||||
- name: "https"
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- range .Values.coder.env }}
|
||||
{{- if eq .name "CODER_PROMETHEUS_ENABLE" }}
|
||||
{{/*
|
||||
This sadly has to be nested to avoid evaluating the second part
|
||||
of the condition too early and potentially getting type errors if
|
||||
the value is not a string (like a `valueFrom`). We do not support
|
||||
`valueFrom` for this env var specifically.
|
||||
*/}}
|
||||
{{- if eq .value "true" }}
|
||||
- name: "prometheus-http"
|
||||
containerPort: 2112
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: "http"
|
||||
scheme: "HTTP"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: "http"
|
||||
scheme: "HTTP"
|
||||
{{- end }}
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
{{ include "libcoder.serviceaccount" (list . "coder.serviceaccount") }}
|
||||
|
||||
---
|
||||
{{ include "libcoder.deployment" (list . "coder.deployment") }}
|
||||
@@ -0,0 +1,4 @@
|
||||
{{- range .Values.extraTemplates }}
|
||||
---
|
||||
{{ include "coder.renderTemplate" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,54 @@
|
||||
|
||||
{{- if .Values.coder.ingress.enable }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
{{- include "coder.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- toYaml .Values.coder.ingress.annotations | nindent 4 }}
|
||||
spec:
|
||||
{{- if .Values.coder.ingress.className }}
|
||||
{{/* If this is set to an empty string it fails validation on K8s */}}
|
||||
ingressClassName: {{ .Values.coder.ingress.className | quote }}
|
||||
{{- end }}
|
||||
|
||||
rules:
|
||||
- host: {{ .Values.coder.ingress.host | quote }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: coder
|
||||
port:
|
||||
name: "http"
|
||||
|
||||
{{- if .Values.coder.ingress.wildcardHost }}
|
||||
- host: {{ include "coder.ingressWildcardHost" . | quote }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: coder
|
||||
port:
|
||||
name: "http"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.coder.ingress.tls.enable }}
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ .Values.coder.ingress.host | quote }}
|
||||
secretName: {{ .Values.coder.ingress.tls.secretName | quote}}
|
||||
{{- if .Values.coder.ingress.tls.wildcardSecretName }}
|
||||
- hosts:
|
||||
- {{ include "coder.ingressWildcardHost" . | quote }}
|
||||
secretName: {{ .Values.coder.ingress.tls.wildcardSecretName | quote}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1 @@
|
||||
{{ include "libcoder.rbac.tpl" . }}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{- if .Values.coder.service.enable }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
{{- include "coder.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- toYaml .Values.coder.service.annotations | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.coder.service.type }}
|
||||
sessionAffinity: {{ .Values.coder.service.sessionAffinity }}
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
{{- if eq (include "coder.tlsEnabled" .) "true" }}
|
||||
- name: "https"
|
||||
port: 443
|
||||
targetPort: "https"
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if eq "LoadBalancer" .Values.coder.service.type }}
|
||||
{{- with .Values.coder.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.coder.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "coder.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,180 @@
|
||||
package tests // nolint: testpackage
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"flag"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
"golang.org/x/xerrors"
|
||||
|
||||
"github.com/coder/coder/testutil"
|
||||
)
|
||||
|
||||
// These tests run `helm template` with the values file specified in each test
|
||||
// and compare the output to the contents of the corresponding golden file.
|
||||
// All values and golden files are located in the `testdata` directory.
|
||||
// To update golden files, run `go test . -update`.
|
||||
|
||||
// updateGoldenFiles is a flag that can be set to update golden files.
|
||||
var updateGoldenFiles = flag.Bool("update", false, "Update golden files")
|
||||
|
||||
var testCases = []testCase{
|
||||
{
|
||||
name: "default_values",
|
||||
expectedError: "",
|
||||
},
|
||||
{
|
||||
name: "missing_values",
|
||||
expectedError: `You must specify the coder.image.tag value if you're installing the Helm chart directly from Git.`,
|
||||
},
|
||||
{
|
||||
name: "tls",
|
||||
expectedError: "",
|
||||
},
|
||||
{
|
||||
name: "sa",
|
||||
expectedError: "",
|
||||
},
|
||||
{
|
||||
name: "labels_annotations",
|
||||
expectedError: "",
|
||||
},
|
||||
{
|
||||
name: "workspace_proxy",
|
||||
expectedError: "",
|
||||
},
|
||||
{
|
||||
name: "command",
|
||||
expectedError: "",
|
||||
},
|
||||
{
|
||||
name: "command_args",
|
||||
expectedError: "",
|
||||
},
|
||||
{
|
||||
name: "provisionerd_psk",
|
||||
expectedError: "",
|
||||
},
|
||||
}
|
||||
|
||||
type testCase struct {
|
||||
name string // Name of the test case. This is used to control which values and golden file are used.
|
||||
expectedError string // Expected error from running `helm template`.
|
||||
}
|
||||
|
||||
func (tc testCase) valuesFilePath() string {
|
||||
return filepath.Join("./testdata", tc.name+".yaml")
|
||||
}
|
||||
|
||||
func (tc testCase) goldenFilePath() string {
|
||||
return filepath.Join("./testdata", tc.name+".golden")
|
||||
}
|
||||
|
||||
func TestRenderChart(t *testing.T) {
|
||||
t.Parallel()
|
||||
if *updateGoldenFiles {
|
||||
t.Skip("Golden files are being updated. Skipping test.")
|
||||
}
|
||||
if testutil.InCI() {
|
||||
switch runtime.GOOS {
|
||||
case "windows", "darwin":
|
||||
t.Skip("Skipping tests on Windows and macOS in CI")
|
||||
}
|
||||
}
|
||||
|
||||
// Ensure that Helm is available in $PATH
|
||||
helmPath := lookupHelm(t)
|
||||
for _, tc := range testCases {
|
||||
tc := tc
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
// Ensure that the values file exists.
|
||||
valuesFilePath := tc.valuesFilePath()
|
||||
if _, err := os.Stat(valuesFilePath); os.IsNotExist(err) {
|
||||
t.Fatalf("values file %q does not exist", valuesFilePath)
|
||||
}
|
||||
|
||||
// Run helm template with the values file.
|
||||
templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesFilePath)
|
||||
if tc.expectedError != "" {
|
||||
require.Error(t, err, "helm template should have failed")
|
||||
require.Contains(t, templateOutput, tc.expectedError, "helm template output should contain expected error")
|
||||
} else {
|
||||
require.NoError(t, err, "helm template should not have failed")
|
||||
require.NotEmpty(t, templateOutput, "helm template output should not be empty")
|
||||
goldenFilePath := tc.goldenFilePath()
|
||||
goldenBytes, err := os.ReadFile(goldenFilePath)
|
||||
require.NoError(t, err, "failed to read golden file %q", goldenFilePath)
|
||||
|
||||
// Remove carriage returns to make tests pass on Windows.
|
||||
goldenBytes = bytes.Replace(goldenBytes, []byte("\r"), []byte(""), -1)
|
||||
expected := string(goldenBytes)
|
||||
|
||||
require.NoError(t, err, "failed to load golden file %q")
|
||||
require.Equal(t, expected, templateOutput)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateGoldenFiles(t *testing.T) {
|
||||
t.Parallel()
|
||||
if !*updateGoldenFiles {
|
||||
t.Skip("Run with -update to update golden files")
|
||||
}
|
||||
|
||||
helmPath := lookupHelm(t)
|
||||
for _, tc := range testCases {
|
||||
if tc.expectedError != "" {
|
||||
t.Logf("skipping test case %q with render error", tc.name)
|
||||
continue
|
||||
}
|
||||
|
||||
valuesPath := tc.valuesFilePath()
|
||||
templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesPath)
|
||||
|
||||
require.NoError(t, err, "failed to run `helm template -f %q`", valuesPath)
|
||||
|
||||
goldenFilePath := tc.goldenFilePath()
|
||||
err = os.WriteFile(goldenFilePath, []byte(templateOutput), 0o644) // nolint:gosec
|
||||
require.NoError(t, err, "failed to write golden file %q", goldenFilePath)
|
||||
}
|
||||
t.Log("Golden files updated. Please review the changes and commit them.")
|
||||
}
|
||||
|
||||
// runHelmTemplate runs helm template on the given chart with the given values and
|
||||
// returns the raw output.
|
||||
func runHelmTemplate(t testing.TB, helmPath, chartDir, valuesFilePath string) (string, error) {
|
||||
// Ensure that valuesFilePath exists
|
||||
if _, err := os.Stat(valuesFilePath); err != nil {
|
||||
return "", xerrors.Errorf("values file %q does not exist: %w", valuesFilePath, err)
|
||||
}
|
||||
|
||||
cmd := exec.Command(helmPath, "template", chartDir, "-f", valuesFilePath, "--namespace", "default")
|
||||
t.Logf("exec command: %v", cmd.Args)
|
||||
out, err := cmd.CombinedOutput()
|
||||
return string(out), err
|
||||
}
|
||||
|
||||
// lookupHelm ensures that Helm is available in $PATH and returns the path to the
|
||||
// Helm executable.
|
||||
func lookupHelm(t testing.TB) string {
|
||||
helmPath, err := exec.LookPath("helm")
|
||||
if err != nil {
|
||||
t.Fatalf("helm not found in $PATH: %v", err)
|
||||
return ""
|
||||
}
|
||||
t.Logf("Using helm at %q", helmPath)
|
||||
return helmPath
|
||||
}
|
||||
|
||||
func TestMain(m *testing.M) {
|
||||
flag.Parse()
|
||||
os.Exit(m.Run())
|
||||
}
|
||||
+189
@@ -0,0 +1,189 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
command:
|
||||
- /opt/colin
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_ACCESS_URL
|
||||
value: http://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts: []
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes: []
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
coder:
|
||||
image:
|
||||
tag: latest
|
||||
command:
|
||||
- /opt/colin
|
||||
+190
@@ -0,0 +1,190 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- arg1
|
||||
- arg2
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_ACCESS_URL
|
||||
value: http://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts: []
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes: []
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
coder:
|
||||
image:
|
||||
tag: latest
|
||||
commandArgs:
|
||||
- arg1
|
||||
- arg2
|
||||
+189
@@ -0,0 +1,189 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_ACCESS_URL
|
||||
value: http://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts: []
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes: []
|
||||
@@ -0,0 +1,3 @@
|
||||
coder:
|
||||
image:
|
||||
tag: latest
|
||||
+197
@@ -0,0 +1,197 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
com.coder/annotation/baz: qux
|
||||
com.coder/annotation/foo: bar
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
com.coder/label/baz: qux
|
||||
com.coder/label/foo: bar
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
com.coder/podAnnotation/baz: qux
|
||||
com.coder/podAnnotation/foo: bar
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
com.coder/podLabel/baz: qux
|
||||
com.coder/podLabel/foo: bar
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_ACCESS_URL
|
||||
value: http://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts: []
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes: []
|
||||
@@ -0,0 +1,15 @@
|
||||
coder:
|
||||
image:
|
||||
tag: latest
|
||||
annotations:
|
||||
com.coder/annotation/foo: bar
|
||||
com.coder/annotation/baz: qux
|
||||
labels:
|
||||
com.coder/label/foo: bar
|
||||
com.coder/label/baz: qux
|
||||
podAnnotations:
|
||||
com.coder/podAnnotation/foo: bar
|
||||
com.coder/podAnnotation/baz: qux
|
||||
podLabels:
|
||||
com.coder/podLabel/foo: bar
|
||||
com.coder/podLabel/baz: qux
|
||||
+194
@@ -0,0 +1,194 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_PROVISIONER_DAEMON_PSK
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: psk
|
||||
name: coder-provisionerd-psk
|
||||
- name: CODER_ACCESS_URL
|
||||
value: http://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts: []
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes: []
|
||||
@@ -0,0 +1,5 @@
|
||||
coder:
|
||||
image:
|
||||
tag: latest
|
||||
provisionerDaemon:
|
||||
pskSecretName: "coder-provisionerd-psk"
|
||||
Vendored
+190
@@ -0,0 +1,190 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations:
|
||||
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/coder-service-account
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder-service-account
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-service-account-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder-service-account"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder-service-account"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-service-account-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_ACCESS_URL
|
||||
value: http://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts: []
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder-service-account
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes: []
|
||||
Vendored
+8
@@ -0,0 +1,8 @@
|
||||
coder:
|
||||
image:
|
||||
tag: latest
|
||||
serviceAccount:
|
||||
name: coder-service-account
|
||||
annotations:
|
||||
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/coder-service-account
|
||||
workspacePerms: true
|
||||
Vendored
+210
@@ -0,0 +1,210 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
- name: "https"
|
||||
port: 443
|
||||
targetPort: "https"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_ACCESS_URL
|
||||
value: https://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
- name: CODER_TLS_ENABLE
|
||||
value: "true"
|
||||
- name: CODER_TLS_ADDRESS
|
||||
value: 0.0.0.0:8443
|
||||
- name: CODER_TLS_CERT_FILE
|
||||
value: /etc/ssl/certs/coder/coder-tls/tls.crt
|
||||
- name: CODER_TLS_KEY_FILE
|
||||
value: /etc/ssl/certs/coder/coder-tls/tls.key
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /etc/ssl/certs/coder/coder-tls
|
||||
name: tls-coder-tls
|
||||
readOnly: true
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: tls-coder-tls
|
||||
secret:
|
||||
secretName: coder-tls
|
||||
Vendored
+6
@@ -0,0 +1,6 @@
|
||||
coder:
|
||||
image:
|
||||
tag: latest
|
||||
tls:
|
||||
secretNames:
|
||||
- coder-tls
|
||||
+197
@@ -0,0 +1,197 @@
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: coder-workspace-perms
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
# Source: coder/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "coder"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "coder"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: coder-workspace-perms
|
||||
---
|
||||
# Source: coder/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: coder
|
||||
labels:
|
||||
helm.sh/chart: coder-0.1.0
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: "0.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
{}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
sessionAffinity: ClientIP
|
||||
ports:
|
||||
- name: "http"
|
||||
port: 80
|
||||
targetPort: "http"
|
||||
protocol: TCP
|
||||
externalTrafficPolicy: "Cluster"
|
||||
selector:
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: coder/templates/coder.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
name: coder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: coder
|
||||
template:
|
||||
metadata:
|
||||
annotations: {}
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 0.1.0
|
||||
helm.sh/chart: coder-0.1.0
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- wsproxy
|
||||
- server
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_ACCESS_URL
|
||||
value: http://coder.default.svc.cluster.local
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
- name: CODER_PRIMARY_ACCESS_URL
|
||||
value: https://dev.coder.com
|
||||
- name: CODER_PROXY_SESSION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: token
|
||||
name: coder-workspace-proxy-session-token
|
||||
image: ghcr.io/coder/coder:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: null
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts: []
|
||||
restartPolicy: Always
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes: []
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
coder:
|
||||
workspaceProxy: true
|
||||
|
||||
image:
|
||||
tag: latest
|
||||
|
||||
env:
|
||||
- name: CODER_PRIMARY_ACCESS_URL
|
||||
value: "https://dev.coder.com"
|
||||
- name: CODER_PROXY_SESSION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: coder-workspace-proxy-session-token
|
||||
key: token
|
||||
@@ -0,0 +1,303 @@
|
||||
# coder -- Primary configuration for `coder server`.
|
||||
coder:
|
||||
# coder.env -- The environment variables to set for Coder. These can be used
|
||||
# to configure all aspects of `coder server`. Please see `coder server --help`
|
||||
# for information about what environment variables can be set.
|
||||
# Note: The following environment variables are set by default and cannot be
|
||||
# overridden:
|
||||
# - CODER_HTTP_ADDRESS: set to 0.0.0.0:8080 and cannot be changed.
|
||||
# - CODER_TLS_ADDRESS: set to 0.0.0.0:8443 if tls.secretName is not empty.
|
||||
# - CODER_TLS_ENABLE: set if tls.secretName is not empty.
|
||||
# - CODER_TLS_CERT_FILE: set if tls.secretName is not empty.
|
||||
# - CODER_TLS_KEY_FILE: set if tls.secretName is not empty.
|
||||
# - CODER_PROMETHEUS_ADDRESS: set to 0.0.0.0:2112 and cannot be changed.
|
||||
# Prometheus must still be enabled by setting CODER_PROMETHEUS_ENABLE.
|
||||
# - KUBE_POD_IP
|
||||
# - CODER_DERP_SERVER_RELAY_URL
|
||||
#
|
||||
# We will additionally set CODER_ACCESS_URL if unset to the cluster service
|
||||
# URL.
|
||||
env: []
|
||||
# - name: "CODER_ACCESS_URL"
|
||||
# value: "https://coder.example.com"
|
||||
|
||||
# coder.image -- The image to use for Coder.
|
||||
image:
|
||||
# coder.image.repo -- The repository of the image.
|
||||
repo: "ghcr.io/coder/coder"
|
||||
# coder.image.tag -- The tag of the image, defaults to {{.Chart.AppVersion}}
|
||||
# if not set. If you're using the chart directly from git, the default
|
||||
# app version will not work and you'll need to set this value. The helm
|
||||
# chart helpfully fails quickly in this case.
|
||||
tag: ""
|
||||
# coder.image.pullPolicy -- The pull policy to use for the image. See:
|
||||
# https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
|
||||
pullPolicy: IfNotPresent
|
||||
# coder.image.pullSecrets -- The secrets used for pulling the Coder image from
|
||||
# a private registry.
|
||||
pullSecrets: []
|
||||
# - name: "pull-secret"
|
||||
|
||||
# coder.initContainers -- Init containers for the deployment. See:
|
||||
# https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
|
||||
initContainers:
|
||||
[]
|
||||
# - name: init-container
|
||||
# image: busybox:1.28
|
||||
# command: ['sh', '-c', "sleep 2"]
|
||||
|
||||
# coder.annotations -- The Deployment annotations. See:
|
||||
# https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
annotations: {}
|
||||
|
||||
# coder.labels -- The Deployment labels. See:
|
||||
# https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
labels: {}
|
||||
|
||||
# coder.podAnnotations -- The Coder pod annotations. See:
|
||||
# https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
podAnnotations: {}
|
||||
|
||||
# coder.podLabels -- The Coder pod labels. See:
|
||||
# https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
podLabels: {}
|
||||
|
||||
# coder.serviceAccount -- Configuration for the automatically created service
|
||||
# account. Creation of the service account cannot be disabled.
|
||||
serviceAccount:
|
||||
# coder.serviceAccount.workspacePerms -- Whether or not to grant the coder
|
||||
# service account permissions to manage workspaces. This includes
|
||||
# permission to manage pods and persistent volume claims in the deployment
|
||||
# namespace.
|
||||
#
|
||||
# It is recommended to keep this on if you are using Kubernetes templates
|
||||
# within Coder.
|
||||
workspacePerms: true
|
||||
# coder.serviceAccount.enableDeployments -- Provides the service account permission
|
||||
# to manage Kubernetes deployments.
|
||||
enableDeployments: true
|
||||
# coder.serviceAccount.annotations -- The Coder service account annotations.
|
||||
annotations: {}
|
||||
# coder.serviceAccount.name -- The service account name
|
||||
name: coder
|
||||
|
||||
# coder.securityContext -- Fields related to the container's security
|
||||
# context (as opposed to the pod). Some fields are also present in the pod
|
||||
# security context, in which case these values will take precedence.
|
||||
securityContext:
|
||||
# coder.securityContext.runAsNonRoot -- Requires that the coder container
|
||||
# runs as an unprivileged user. If setting runAsUser to 0 (root), this
|
||||
# will need to be set to false.
|
||||
runAsNonRoot: true
|
||||
# coder.securityContext.runAsUser -- Sets the user id of the container.
|
||||
# For security reasons, we recommend using a non-root user.
|
||||
runAsUser: 1000
|
||||
# coder.securityContext.runAsGroup -- Sets the group id of the container.
|
||||
# For security reasons, we recommend using a non-root group.
|
||||
runAsGroup: 1000
|
||||
# coder.securityContext.readOnlyRootFilesystem -- Mounts the container's
|
||||
# root filesystem as read-only.
|
||||
readOnlyRootFilesystem: null
|
||||
# coder.securityContext.seccompProfile -- Sets the seccomp profile for
|
||||
# the coder container.
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
# coder.securityContext.allowPrivilegeEscalation -- Controls whether
|
||||
# the container can gain additional privileges, such as escalating to
|
||||
# root. It is recommended to leave this setting disabled in production.
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
# coder.volumes -- A list of extra volumes to add to the Coder pod.
|
||||
volumes: []
|
||||
# - name: "my-volume"
|
||||
# emptyDir: {}
|
||||
|
||||
# coder.volumeMounts -- A list of extra volume mounts to add to the Coder pod.
|
||||
volumeMounts: []
|
||||
# - name: "my-volume"
|
||||
# mountPath: "/mnt/my-volume"
|
||||
|
||||
# coder.tls -- The TLS configuration for Coder.
|
||||
tls:
|
||||
# coder.tls.secretNames -- A list of TLS server certificate secrets to mount
|
||||
# into the Coder pod. The secrets should exist in the same namespace as the
|
||||
# Helm deployment and should be of type "kubernetes.io/tls". The secrets
|
||||
# will be automatically mounted into the pod if specified, and the correct
|
||||
# "CODER_TLS_*" environment variables will be set for you.
|
||||
secretNames: []
|
||||
|
||||
# coder.replicaCount -- The number of Kubernetes deployment replicas. This
|
||||
# should only be increased if High Availability is enabled.
|
||||
#
|
||||
# This is an Enterprise feature. Contact sales@coder.com.
|
||||
replicaCount: 1
|
||||
|
||||
# coder.workspaceProxy -- Whether or not this deployment of Coder is a Coder
|
||||
# Workspace Proxy. Workspace Proxies reduce the latency between the user and
|
||||
# their workspace for web connections (workspace apps and web terminal) and
|
||||
# proxied connections from the CLI. Workspace Proxies are optional and only
|
||||
# recommended for geographically sparse teams.
|
||||
#
|
||||
# Make sure you set CODER_PRIMARY_ACCESS_URL and CODER_PROXY_SESSION_TOKEN in
|
||||
# the environment below. You can get a proxy token using the CLI:
|
||||
# coder wsproxy create \
|
||||
# --name "proxy-name" \
|
||||
# --display-name "Proxy Name" \
|
||||
# --icon "/emojis/xyz.png"
|
||||
#
|
||||
# This is an Enterprise feature. Contact sales@coder.com
|
||||
# Docs: https://coder.com/docs/v2/latest/admin/workspace-proxies
|
||||
workspaceProxy: false
|
||||
|
||||
# coder.lifecycle -- container lifecycle handlers for the Coder container, allowing
|
||||
# for lifecycle events such as postStart and preStop events
|
||||
# See: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
|
||||
lifecycle:
|
||||
{}
|
||||
# postStart:
|
||||
# exec:
|
||||
# command: ["/bin/sh", "-c", "echo postStart"]
|
||||
# preStop:
|
||||
# exec:
|
||||
# command: ["/bin/sh","-c","echo preStart"]
|
||||
|
||||
# coder.resources -- The resources to request for Coder. These are optional
|
||||
# and are not set by default.
|
||||
resources:
|
||||
{}
|
||||
# limits:
|
||||
# cpu: 2000m
|
||||
# memory: 4096Mi
|
||||
# requests:
|
||||
# cpu: 2000m
|
||||
# memory: 4096Mi
|
||||
|
||||
# coder.certs -- CA bundles to mount inside the Coder pod.
|
||||
certs:
|
||||
# coder.certs.secrets -- A list of CA bundle secrets to mount into the Coder
|
||||
# pod. The secrets should exist in the same namespace as the Helm
|
||||
# deployment.
|
||||
#
|
||||
# The given key in each secret is mounted at
|
||||
# `/etc/ssl/certs/{secret_name}.crt`.
|
||||
secrets:
|
||||
[]
|
||||
# - name: "my-ca-bundle"
|
||||
# key: "ca-bundle.crt"
|
||||
|
||||
# coder.affinity -- Allows specifying an affinity rule for the `coder` deployment.
|
||||
# The default rule prefers to schedule coder pods on different
|
||||
# nodes, which is only applicable if coder.replicaCount is greater than 1.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- "coder"
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
|
||||
# coder.tolerations -- Tolerations for tainted nodes.
|
||||
# See: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
tolerations:
|
||||
{}
|
||||
# - key: "key"
|
||||
# operator: "Equal"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule"
|
||||
|
||||
# coder.nodeSelector -- Node labels for constraining coder pods to nodes.
|
||||
# See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
|
||||
nodeSelector: {}
|
||||
# kubernetes.io/os: linux
|
||||
|
||||
# coder.service -- The Service object to expose for Coder.
|
||||
service:
|
||||
# coder.service.enable -- Whether to create the Service object.
|
||||
enable: true
|
||||
# coder.service.type -- The type of service to expose. See:
|
||||
# https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
|
||||
type: LoadBalancer
|
||||
# coder.service.sessionAffinity -- Must be set to ClientIP or None
|
||||
# AWS ELB does not support session stickiness based on ClientIP, so you must set this to None.
|
||||
# The error message you might see: "Unsupported load balancer affinity: ClientIP"
|
||||
# https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
|
||||
sessionAffinity: ClientIP
|
||||
# coder.service.externalTrafficPolicy -- The external traffic policy to use.
|
||||
# You may need to change this to "Local" to preserve the source IP address
|
||||
# in some situations.
|
||||
# https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
externalTrafficPolicy: Cluster
|
||||
# coder.service.loadBalancerIP -- The IP address of the LoadBalancer. If not
|
||||
# specified, a new IP will be generated each time the load balancer is
|
||||
# recreated. It is recommended to manually create a static IP address in
|
||||
# your cloud and specify it here in production to avoid accidental IP
|
||||
# address changes.
|
||||
loadBalancerIP: ""
|
||||
# coder.service.annotations -- The service annotations. See:
|
||||
# https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
annotations: {}
|
||||
|
||||
# coder.ingress -- The Ingress object to expose for Coder.
|
||||
ingress:
|
||||
# coder.ingress.enable -- Whether to create the Ingress object. If using an
|
||||
# Ingress, we recommend not specifying coder.tls.secretNames as the Ingress
|
||||
# will handle TLS termination.
|
||||
enable: false
|
||||
# coder.ingress.className -- The name of the Ingress class to use.
|
||||
className: ""
|
||||
# coder.ingress.host -- The hostname to match on.
|
||||
# Be sure to also set CODER_ACCESS_URL within coder.env[]
|
||||
host: ""
|
||||
# coder.ingress.wildcardHost -- The wildcard hostname to match on. Should be
|
||||
# in the form "*.example.com" or "*-suffix.example.com". If you are using a
|
||||
# suffix after the wildcard, the suffix will be stripped from the created
|
||||
# ingress to ensure that it is a legal ingress host. Optional if not using
|
||||
# applications over subdomains.
|
||||
# Be sure to also set CODER_WILDCARD_ACCESS_URL within coder.env[]
|
||||
wildcardHost: ""
|
||||
# coder.ingress.annotations -- The ingress annotations.
|
||||
annotations: {}
|
||||
# coder.ingress.tls -- The TLS configuration to use for the Ingress.
|
||||
tls:
|
||||
# coder.ingress.tls.enable -- Whether to enable TLS on the Ingress.
|
||||
enable: false
|
||||
# coder.ingress.tls.secretName -- The name of the TLS secret to use.
|
||||
secretName: ""
|
||||
# coder.ingress.tls.wildcardSecretName -- The name of the TLS secret to
|
||||
# use for the wildcard host.
|
||||
wildcardSecretName: ""
|
||||
|
||||
# coder.command -- The command to use when running the Coder container. Used
|
||||
# for customizing the location of the `coder` binary in your image.
|
||||
command:
|
||||
- /opt/coder
|
||||
|
||||
# coder.commandArgs -- Set arguments for the entrypoint command of the Coder pod.
|
||||
commandArgs: []
|
||||
|
||||
# provisionerDaemon -- Configuration for external provisioner daemons.
|
||||
#
|
||||
# This is an Enterprise feature. Contact sales@coder.com.
|
||||
provisionerDaemon:
|
||||
# provisionerDaemon.pskSecretName -- The name of the Kubernetes secret that contains the
|
||||
# Pre-Shared Key (PSK) to use to authenticate external provisioner daemons with Coder. The
|
||||
# secret must be in the same namespace as the Helm deployment, and contain an item called "psk"
|
||||
# which contains the pre-shared key.
|
||||
pskSecretName: ""
|
||||
|
||||
# extraTemplates -- Array of extra objects to deploy with the release. Strings
|
||||
# are evaluated as a template and can use template expansions and functions. All
|
||||
# other objects are used as yaml.
|
||||
extraTemplates:
|
||||
#- |
|
||||
# apiVersion: v1
|
||||
# kind: ConfigMap
|
||||
# metadata:
|
||||
# name: my-configmap
|
||||
# data:
|
||||
# key: {{ .Values.myCustomValue | quote }}
|
||||
Reference in New Issue
Block a user