opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore(docs): update docs for correct use of shell and console and enforce linewidth (#9245)

Browse Source
This commit is contained in:
Muhammad Atif Ali
2023-08-23 12:27:57 +03:00
committed by GitHub
parent ed2b1236c0
commit d37f6d80f7
96 changed files with 2838 additions and 1457 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/install/openshift.md
+53 -48
View File
@@ -2,10 +2,11 @@
Before proceeding, please ensure that you have an OpenShift cluster running K8s
1.19+ (OpenShift 4.7+) and have Helm 3.5+ installed. In addition, you'll need to
install the OpenShift CLI (`oc`) to authenticate to your cluster and create OpenShift
resources.
install the OpenShift CLI (`oc`) to authenticate to your cluster and create
OpenShift resources.
You'll also want to install the [latest version of Coder](https://github.com/coder/coder/releases/latest)
You'll also want to install the
[latest version of Coder](https://github.com/coder/coder/releases/latest)
locally in order to log in and manage templates.
## Install Coder with OpenShift
@@ -26,11 +27,12 @@ oc new-project coder
### 2. Configure SecurityContext values
Depending upon your configured Security Context Constraints (SCC), you'll need to modify
some or all of the following `securityContext` values from the default values:
Depending upon your configured Security Context Constraints (SCC), you'll need
to modify some or all of the following `securityContext` values from the default
values:
The below values are modified from Coder defaults and allow the Coder deployment to run
under the SCC `restricted-v2`.
The below values are modified from Coder defaults and allow the Coder deployment
to run under the SCC `restricted-v2`.
> Note: `readOnlyRootFilesystem: true` is not technically required under
> `restricted-v2`, but is often mandated in OpenShift environments.
@@ -45,8 +47,8 @@ coder:
seccompProfile: RuntimeDefault # Unchanged from default
```
- For `runAsUser` / `runAsGroup`, you can retrieve the correct values for project UID and project GID with the following
command:
- For `runAsUser` / `runAsGroup`, you can retrieve the correct values for
project UID and project GID with the following command:
```console
oc get project coder -o json | jq -r '.metadata.annotations'
@@ -56,12 +58,12 @@ coder:
}
```
Alternatively, you can set these values to `null` to allow OpenShift to automatically select
the correct value for the project.
Alternatively, you can set these values to `null` to allow OpenShift to
automatically select the correct value for the project.
- For `readOnlyRootFilesystem`, consult the SCC under which Coder needs to run.
In the below example, the `restricted-v2` SCC does not require a read-only root filesystem,
while `restricted-custom` does:
In the below example, the `restricted-v2` SCC does not require a read-only
root filesystem, while `restricted-custom` does:
```console
oc get scc -o wide
@@ -70,34 +72,34 @@ coder:
restricted-v2 false ["NET_BIND_SERVICE"] MustRunAs MustRunAsRange MustRunAs RunAsAny <no value> false ["configMap","downwardAPI","emptyDir","ephemeral","persistentVolumeClaim","projected","secret"]
```
If you are unsure, we recommend setting `readOnlyRootFilesystem` to `true` in an OpenShift
environment.
If you are unsure, we recommend setting `readOnlyRootFilesystem` to `true` in
an OpenShift environment.
- For `seccompProfile`: in some environments, you may need to set this to `null` to allow OpenShift
to pick its preferred value.
- For `seccompProfile`: in some environments, you may need to set this to `null`
to allow OpenShift to pick its preferred value.
### 3. Configure the Coder service, connection URLs, and cache values
To establish a connection to PostgreSQL, set the `CODER_PG_CONNECTION_URL` value.
[See our Helm documentation](./kubernetes.md) on configuring the PostgreSQL connection
URL as a secret. Additionally, if accessing Coder over a hostname, set the `CODER_ACCESS_URL`
value.
To establish a connection to PostgreSQL, set the `CODER_PG_CONNECTION_URL`
value. [See our Helm documentation](./kubernetes.md) on configuring the
PostgreSQL connection URL as a secret. Additionally, if accessing Coder over a
hostname, set the `CODER_ACCESS_URL` value.
By default, Coder creates the cache directory in `/home/coder/.cache`. Given the
OpenShift-provided UID and `readOnlyRootFS` security context constraint, the Coder
container does not have permission to write to this directory.
OpenShift-provided UID and `readOnlyRootFS` security context constraint, the
Coder container does not have permission to write to this directory.
To fix this, you can mount a temporary volume in the pod and set
the `CODER_CACHE_DIRECTORY` environment variable to that location.
In the below example, we mount this under `/tmp` and set the cache location to
`/tmp/coder`. This enables Coder to run with `readOnlyRootFilesystem: true`.
To fix this, you can mount a temporary volume in the pod and set the
`CODER_CACHE_DIRECTORY` environment variable to that location. In the below
example, we mount this under `/tmp` and set the cache location to `/tmp/coder`.
This enables Coder to run with `readOnlyRootFilesystem: true`.
> Note: Depending on the number of templates and provisioners you use, you may
> need to increase the size of the volume, as the `coder` pod will be automatically
> restarted when this volume fills up.
> need to increase the size of the volume, as the `coder` pod will be
> automatically restarted when this volume fills up.
Additionally, create the Coder service as a `ClusterIP`. In the next step,
you will create an OpenShift route that points to the service HTTP target port.
Additionally, create the Coder service as a `ClusterIP`. In the next step, you
will create an OpenShift route that points to the service HTTP target port.
```yaml
coder:
@@ -128,8 +130,8 @@ coder:
readOnly: false
```
> Note: OpenShift provides a Developer Catalog offering you can use to
> install PostgreSQL into your cluster.
> Note: OpenShift provides a Developer Catalog offering you can use to install
> PostgreSQL into your cluster.
### 4. Create the OpenShift route
@@ -165,8 +167,8 @@ oc apply -f route.yaml
### 5. Install Coder
You can now install Coder using the values you've set from the above steps. To do
so, run the series of `helm` commands below:
You can now install Coder using the values you've set from the above steps. To
do so, run the series of `helm` commands below:
```console
helm repo add coder-v2 https://helm.coder.com/v2
@@ -176,8 +178,8 @@ helm install coder coder-v2/coder \
--values values.yaml
```
> Note: If the Helm installation fails with a Kubernetes RBAC error, check the permissions
> of your OpenShift user using the `oc auth can-i` command.
> Note: If the Helm installation fails with a Kubernetes RBAC error, check the
> permissions of your OpenShift user using the `oc auth can-i` command.
>
> The below permissions are the minimum required:
>
@@ -212,9 +214,9 @@ helm install coder coder-v2/coder \
### 6. Create an OpenShift-compatible image
While the deployment is spinning up, we will need to create some images that
are compatible with OpenShift. These images can then be run without modifying
the Security Context Constraints (SCCs) in OpenShift.
While the deployment is spinning up, we will need to create some images that are
compatible with OpenShift. These images can then be run without modifying the
Security Context Constraints (SCCs) in OpenShift.
1. Determine the UID range for the project:
@@ -230,15 +232,18 @@ the Security Context Constraints (SCCs) in OpenShift.
}
```
Note the `uid-range` and `supplemental-groups`. In this case, the project `coder`
has been allocated 10,000 UIDs and GIDs, both starting at `1000680000`.
Note the `uid-range` and `supplemental-groups`. In this case, the project
`coder` has been allocated 10,000 UIDs and GIDs, both starting at
`1000680000`.
In this example, we will pick both UID and GID `1000680000`.
1. Create a `BuildConfig` referencing the source image you want to customize.
This will automatically kick off a `Build` that will remain pending until step 3.
This will automatically kick off a `Build` that will remain pending until
step 3.
> For more information, please consult the [OpenShift Documentation](https://docs.openshift.com/container-platform/4.12/cicd/builds/understanding-buildconfigs.html).
> For more information, please consult the
> [OpenShift Documentation](https://docs.openshift.com/container-platform/4.12/cicd/builds/understanding-buildconfigs.html).
```console
oc create -f - <<EOF
@@ -289,8 +294,8 @@ the Security Context Constraints (SCCs) in OpenShift.
oc create imagestream enterprise-base
```
The `Build` created in the previous step should now begin.
Once completed, you should see output similar to the following:
The `Build` created in the previous step should now begin. Once completed,
you should see output similar to the following:
```console
oc get imagestreamtag
@@ -310,8 +315,8 @@ cd ./openshift-k8s
Edit `main.tf` and update the following fields of the Kubernetes pod resource:
- `spec.security_context`: remove this field.
- `spec.container.image`: update this field to the newly built image hosted
on the OpenShift image registry from the previous step.
- `spec.container.image`: update this field to the newly built image hosted on
the OpenShift image registry from the previous step.
- `spec.container.security_context`: remove this field.
Finally, create the template: