feat: add provisioner chart to release and docs (#9050)

* Add provisioner chart to release and docs Signed-off-by: Spike Curtis <spike@coder.com> * Update docs/admin/provisioners.md Co-authored-by: Muhammad Atif Ali <atif@coder.com> * Prettier Signed-off-by: Spike Curtis <spike@coder.com> * spell out PSK first time per section Co-authored-by: Cian Johnston <cian@coder.com> --------- Signed-off-by: Spike Curtis <spike@coder.com> Co-authored-by: Muhammad Atif Ali <atif@coder.com> Co-authored-by: Cian Johnston <cian@coder.com>
2026-09-24 15:04:27 +08:00 · 2023-08-16 16:26:38 +04:00
parent 6fd9975aed
commit ff9252c706
7 changed files with 139 additions and 33 deletions
@@ -10,22 +10,23 @@ By default, the Coder server runs [built-in provisioner daemons](../cli/server.m

 - **Reduce server load**: External provisioners reduce load and build queue times from the Coder server. See [Scaling Coder](./scale.md#concurrent-workspace-builds) for more details.

-> External provisioners are in an [alpha state](../contributing/feature-stages.md#alpha-features) and the behavior is subject to change. Use [GitHub issues](https://github.com/coder/coder) to leave feedback.
-
-## Running external provisioners
-
 Each provisioner can run a single [concurrent workspace build](./scale.md#concurrent-workspace-builds). For example, running 30 provisioner containers will allow 30 users to start workspaces at the same time.

 Provisioners are started with the [coder provisionerd start](../cli/provisionerd_start.md) command.

-### Authentication
+## Authentication

-The provisioner server must authenticate with your Coder deployment. There are two authentication methods:
+The provisioner daemon must authenticate with your Coder deployment.

- PSK: Set a [provisioner daemon PSK](../cli/server#--provisioner-daemon-psk) on the Coder server and start the provisioner with `coder provisionerd start --psk <your-psk>`
- User token: [Authenticate](../cli.md#--token) the Coder CLI as a user with the Template Admin or Owner role.
+Set a [provisioner daemon pre-shared key (PSK)](../cli/server.md#--provisioner-daemon-psk) on the Coder server and start the provisioner with
+`coder provisionerd start --psk <your-psk>`. If you are [installing with Helm](../install/kubernetes#install-coder-with-helm),
+see the [Helm example](#example-running-an-external-provisioner-with-helm) below.

-### Types of provisioners
+> Coder still supports authenticating the provisioner daemon with a [token](../cli.md#--token) from a user with the
+> Template Admin or Owner role. This method is deprecated in favor of the PSK, which only has permission to access
+> provisioner daemon APIs. We recommend migrating to the PSK as soon as practical.
+
+## Types of provisioners

 - **Generic provisioners** can pick up any build job from templates without provisioner tags.

@@ -65,7 +66,68 @@ The provisioner server must authenticate with your Coder deployment. There are t
    --provisioner-tag scope=user
  ```

-### Example: Running an external provisioner on a VM
+## Example: Running an external provisioner with Helm
+
+Coder provides a Helm chart for running external provisioner daemons, which you will use in concert with the Helm chart
+for deploying the Coder server.
+
+1. Create a long, random pre-shared key (PSK) and store it in a Kubernetes secret
+
+   ```shell
+   kubectl create secret generic coder-provisioner-psk --from-literal=psk=`head /dev/urandom | tr -dc A-Za-z0-9 | head -c 26`
+   ```
+
+1. Modify your Coder `values.yaml` to include
+
+   ```yaml
+   provisionerDaemon:
+     pskSecretName: "coder-provisioner-psk"
+   ```
+
+1. Redeploy Coder with the new `values.yaml` to roll out the PSK. You can omit `--version <your version>` to also upgrade
+   Coder to the latest version.
+
+   ```shell
+   helm upgrade coder coder-v2/coder \
+       --namespace coder \
+       --version <your version> \
+       --values values.yaml
+   ```
+
+1. Create a `provisioner-values.yaml` file for the provisioner daemons Helm chart. For example
+
+   ```yaml
+   coder:
+     env:
+       - name: CODER_URL
+         value: "https://coder.example.com"
+     replicaCount: 10
+   provisionerDaemon:
+     pskSecretName: "coder-provisioner-psk"
+     tags:
+       location: auh
+       kind: k8s
+   ```
+
+   This example creates a deployment of 10 provisioner daemons (for 10 concurrent builds) with the listed tags. For
+   generic provisioners, remove the tags.
+
+   > Refer to the [values.yaml](https://github.com/coder/coder/blob/main/helm/provisioner/values.yaml) file for the
+   > coder-provisioner chart for information on what values can be specified.
+
+1. Install the provisioner daemon chart
+
+   ```shell
+   helm install coder-provisioner coder-v2/coder-provisioner \
+       --namespace coder \
+       --version <your version> \
+       --values provisioner-values.yaml
+   ```
+
+   You can verify that your provisioner daemons have successfully connected to Coderd by looking for a log with message
+   `provisionerd successfully connected to coderd` from each Pod.
+
+## Example: Running an external provisioner on a VM

 ```sh
 curl -L https://coder.com/install.sh | sh
@@ -74,7 +136,7 @@ export CODER_SESSION_TOKEN=your_token
 coder provisionerd start
 ```

-### Example: Running an external provisioner via Docker
+## Example: Running an external provisioner via Docker

 ```sh
 docker run --rm -it \