mirror of https://github.com/coder/coder.git
feat: add support for custom permissions in Helm chart `rbac.yaml` file (#10590)
Co-authored-by: Dean Sheather <dean@deansheather.com> Co-authored-by: Atif Ali <atif@coder.com>
This commit is contained in:
parent
3530d39740
commit
7029ccfbdf
|
@ -0,0 +1 @@
|
||||||
|
charts/
|
|
@ -17,9 +17,11 @@ lint/helm: lint/helm/coder lint/helm/provisioner
|
||||||
.PHONY: lint/helm
|
.PHONY: lint/helm
|
||||||
|
|
||||||
lint/helm/coder:
|
lint/helm/coder:
|
||||||
|
helm dependency update --skip-refresh coder/
|
||||||
helm lint --strict --set coder.image.tag=v0.0.1 coder/
|
helm lint --strict --set coder.image.tag=v0.0.1 coder/
|
||||||
.PHONY: lint/helm/coder
|
.PHONY: lint/helm/coder
|
||||||
|
|
||||||
lint/helm/provisioner:
|
lint/helm/provisioner:
|
||||||
|
helm dependency update --skip-refresh provisioner/
|
||||||
helm lint --strict --set coder.image.tag=v0.0.1 provisioner/
|
helm lint --strict --set coder.image.tag=v0.0.1 provisioner/
|
||||||
.PHONY: lint/helm/provisioner
|
.PHONY: lint/helm/provisioner
|
||||||
|
|
Binary file not shown.
|
@ -84,6 +84,10 @@ var testCases = []testCase{
|
||||||
name: "prometheus",
|
name: "prometheus",
|
||||||
expectedError: "",
|
expectedError: "",
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
name: "sa_extra_rules",
|
||||||
|
expectedError: "",
|
||||||
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
type testCase struct {
|
type testCase struct {
|
||||||
|
@ -113,6 +117,9 @@ func TestRenderChart(t *testing.T) {
|
||||||
|
|
||||||
// Ensure that Helm is available in $PATH
|
// Ensure that Helm is available in $PATH
|
||||||
helmPath := lookupHelm(t)
|
helmPath := lookupHelm(t)
|
||||||
|
err := updateHelmDependencies(t, helmPath, "..")
|
||||||
|
require.NoError(t, err, "failed to build Helm dependencies")
|
||||||
|
|
||||||
for _, tc := range testCases {
|
for _, tc := range testCases {
|
||||||
tc := tc
|
tc := tc
|
||||||
t.Run(tc.name, func(t *testing.T) {
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
@ -154,6 +161,9 @@ func TestUpdateGoldenFiles(t *testing.T) {
|
||||||
}
|
}
|
||||||
|
|
||||||
helmPath := lookupHelm(t)
|
helmPath := lookupHelm(t)
|
||||||
|
err := updateHelmDependencies(t, helmPath, "..")
|
||||||
|
require.NoError(t, err, "failed to build Helm dependencies")
|
||||||
|
|
||||||
for _, tc := range testCases {
|
for _, tc := range testCases {
|
||||||
if tc.expectedError != "" {
|
if tc.expectedError != "" {
|
||||||
t.Logf("skipping test case %q with render error", tc.name)
|
t.Logf("skipping test case %q with render error", tc.name)
|
||||||
|
@ -175,6 +185,26 @@ func TestUpdateGoldenFiles(t *testing.T) {
|
||||||
t.Log("Golden files updated. Please review the changes and commit them.")
|
t.Log("Golden files updated. Please review the changes and commit them.")
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// updateHelmDependencies runs `helm dependency update .` on the given chartDir.
|
||||||
|
func updateHelmDependencies(t testing.TB, helmPath, chartDir string) error {
|
||||||
|
// Remove charts/ from chartDir if it exists.
|
||||||
|
err := os.RemoveAll(filepath.Join(chartDir, "charts"))
|
||||||
|
if err != nil {
|
||||||
|
return xerrors.Errorf("failed to remove charts/ directory: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Regenerate the chart dependencies.
|
||||||
|
cmd := exec.Command(helmPath, "dependency", "update", "--skip-refresh", ".")
|
||||||
|
cmd.Dir = chartDir
|
||||||
|
t.Logf("exec command: %v", cmd.Args)
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
if err != nil {
|
||||||
|
return xerrors.Errorf("failed to run `helm dependency build`: %w\noutput: %s", err, out)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
// runHelmTemplate runs helm template on the given chart with the given values and
|
// runHelmTemplate runs helm template on the given chart with the given values and
|
||||||
// returns the raw output.
|
// returns the raw output.
|
||||||
func runHelmTemplate(t testing.TB, helmPath, chartDir, valuesFilePath string) (string, error) {
|
func runHelmTemplate(t testing.TB, helmPath, chartDir, valuesFilePath string) (string, error) {
|
||||||
|
|
|
@ -0,0 +1,204 @@
|
||||||
|
---
|
||||||
|
# Source: coder/templates/coder.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: coder
|
||||||
|
app.kubernetes.io/part-of: coder
|
||||||
|
app.kubernetes.io/version: 0.1.0
|
||||||
|
helm.sh/chart: coder-0.1.0
|
||||||
|
name: coder
|
||||||
|
---
|
||||||
|
# Source: coder/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: coder-workspace-perms
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods"]
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["persistentvolumeclaims"]
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
# Source: coder/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: "coder"
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: "coder"
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: coder-workspace-perms
|
||||||
|
---
|
||||||
|
# Source: coder/templates/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: coder
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: coder-0.1.0
|
||||||
|
app.kubernetes.io/name: coder
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/part-of: coder
|
||||||
|
app.kubernetes.io/version: "0.1.0"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
annotations:
|
||||||
|
{}
|
||||||
|
spec:
|
||||||
|
type: LoadBalancer
|
||||||
|
sessionAffinity: None
|
||||||
|
ports:
|
||||||
|
- name: "http"
|
||||||
|
port: 80
|
||||||
|
targetPort: "http"
|
||||||
|
protocol: TCP
|
||||||
|
|
||||||
|
externalTrafficPolicy: "Cluster"
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: coder
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
---
|
||||||
|
# Source: coder/templates/coder.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: coder
|
||||||
|
app.kubernetes.io/part-of: coder
|
||||||
|
app.kubernetes.io/version: 0.1.0
|
||||||
|
helm.sh/chart: coder-0.1.0
|
||||||
|
name: coder
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: coder
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations: {}
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: coder
|
||||||
|
app.kubernetes.io/part-of: coder
|
||||||
|
app.kubernetes.io/version: 0.1.0
|
||||||
|
helm.sh/chart: coder-0.1.0
|
||||||
|
spec:
|
||||||
|
affinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: app.kubernetes.io/instance
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- coder
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- server
|
||||||
|
command:
|
||||||
|
- /opt/coder
|
||||||
|
env:
|
||||||
|
- name: CODER_HTTP_ADDRESS
|
||||||
|
value: 0.0.0.0:8080
|
||||||
|
- name: CODER_PROMETHEUS_ADDRESS
|
||||||
|
value: 0.0.0.0:2112
|
||||||
|
- name: CODER_ACCESS_URL
|
||||||
|
value: http://coder.default.svc.cluster.local
|
||||||
|
- name: KUBE_POD_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
- name: CODER_DERP_SERVER_RELAY_URL
|
||||||
|
value: http://$(KUBE_POD_IP):8080
|
||||||
|
image: ghcr.io/coder/coder:latest
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
lifecycle: {}
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: http
|
||||||
|
scheme: HTTP
|
||||||
|
name: coder
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: http
|
||||||
|
protocol: TCP
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: http
|
||||||
|
scheme: HTTP
|
||||||
|
resources: {}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
readOnlyRootFilesystem: null
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
volumeMounts: []
|
||||||
|
restartPolicy: Always
|
||||||
|
serviceAccountName: coder
|
||||||
|
terminationGracePeriodSeconds: 60
|
||||||
|
volumes: []
|
|
@ -0,0 +1,17 @@
|
||||||
|
coder:
|
||||||
|
image:
|
||||||
|
tag: latest
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
extraRules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["services"]
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
|
@ -91,9 +91,24 @@ coder:
|
||||||
# It is recommended to keep this on if you are using Kubernetes templates
|
# It is recommended to keep this on if you are using Kubernetes templates
|
||||||
# within Coder.
|
# within Coder.
|
||||||
workspacePerms: true
|
workspacePerms: true
|
||||||
# coder.serviceAccount.enableDeployments -- Provides the service account permission
|
# coder.serviceAccount.enableDeployments -- Provides the service account
|
||||||
# to manage Kubernetes deployments.
|
# permission to manage Kubernetes deployments. Depends on workspacePerms.
|
||||||
enableDeployments: true
|
enableDeployments: true
|
||||||
|
# coder.serviceAccount.extraRules -- Additional permissions added to the SA
|
||||||
|
# role. Depends on workspacePerms.
|
||||||
|
extraRules: []
|
||||||
|
# - apiGroups: [""]
|
||||||
|
# resources: ["services"]
|
||||||
|
# verbs:
|
||||||
|
# - create
|
||||||
|
# - delete
|
||||||
|
# - deletecollection
|
||||||
|
# - get
|
||||||
|
# - list
|
||||||
|
# - patch
|
||||||
|
# - update
|
||||||
|
# - watch
|
||||||
|
|
||||||
# coder.serviceAccount.annotations -- The Coder service account annotations.
|
# coder.serviceAccount.annotations -- The Coder service account annotations.
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# coder.serviceAccount.name -- The service account name
|
# coder.serviceAccount.name -- The service account name
|
||||||
|
|
|
@ -43,6 +43,9 @@ rules:
|
||||||
- update
|
- update
|
||||||
- watch
|
- watch
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.coder.serviceAccount.extraRules }}
|
||||||
|
{{ toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
---
|
---
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
kind: RoleBinding
|
kind: RoleBinding
|
||||||
|
|
Binary file not shown.
Loading…
Reference in New Issue