8000 fix(helm/provisioner): prefer provisioner key if both psk and key are set by johnstcn · Pull Request #15417 · coder/coder · GitHub
[go: up one dir, main page]
Skip to content

fix(helm/provisioner): prefer provisioner key if both psk and key are set #15417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 7, 2024
Merged

fix(helm/provisioner): prefer provisioner key if both psk and key are set #15417

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5661c62
fix(helm/provisioner): prefer provisioner key if both psk and key are…
johnstcn Nov 6, 2024
112c46a
IMPORTANT DISTINCTION
johnstcn Nov 6, 2024
58aafcc
adjust logic to only override if pskSecretName is the default value
johnstcn Nov 7, 2024
9b8cda7
fixup! adjust logic to only override if pskSecretName is the default …
johnstcn Nov 7, 2024
e6f3186
continue to support pskSecretName="" workaround
johnstcn Nov 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
adjust logic to only override if pskSecretName is the default value
  • Loading branch information
@johnstcn
johnstcn committed Nov 7, 2024
commit 58aafcc287b8242aa6a9613e7ac02282682fff64
5 changes: 5 additions & 0 deletions helm/provisioner/templates/_coder.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,11 @@ env:
{{- if and (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName) }}
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified." }}
{{- else if and .Values.provisionerDaemon.keySecretName .Values.provisionerDaemon.keySecretKey }}
{{- if ne .Values.provisionerDaemon.pskSecretName "coder-provisioner-psk" }}
{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both." }}
{{- else if .Values.provisionerDaemon.tags }}
{{ fail "provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName." }}
{{- end }}
- name: CODER_PROVISIONER_DAEMON_KEY
valueFrom:
secretKeyRef:
Expand Down
6 changes: 5 additions & 1 deletion helm/provisioner/tests/chart_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,12 +58,16 @@ var testCases = []testCase{
},
{
name: "provisionerd_psk_and_key",
expectedError: ``,
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both.`,
},
{
name: "provisionerd_no_psk_or_key",
expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified.`,
},
{
name: "provisionerd_key_tags",
expectedError: `provisionerDaemon.tags may not be specified with provisionerDaemon.keySecretName.`,
},
{
name: "extra_templates",
expectedError: "",
Expand Down
2 changes: 0 additions & 2 deletions helm/provisioner/tests/testdata/provisionerd_key.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,8 +112,6 @@ spec:
secretKeyRef:
key: provisionerd-key
name: coder-provisionerd-key
- name: CODER_PROVISIONERD_TAGS
value: clusterType=k8s,location=auh
- name: CODER_URL
value: http://coder.default.svc.cluster.local
image: ghcr.io/coder/coder:latest
Expand Down
3 changes: 0 additions & 3 deletions helm/provisioner/tests/testdata/provisionerd_key.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,3 @@ coder:
provisionerDaemon:
keySecretName: "coder-provisionerd-key"
keySecretKey: "provisionerd-key"
tags:
location: auh
clusterType: k8s
9 changes: 9 additions & 0 deletions helm/provisioner/tests/testdata/provisionerd_key_tags.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
coder:
image:
tag: latest
provisionerDaemon:
keySecretName: "coder-provisionerd-key"
keySecretKey: "provisionerd-key"
tags:
location: auh
clusterType: k8s
3 changes: 0 additions & 3 deletions helm/provisioner/tests/testdata/provisionerd_no_psk_or_key.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,3 @@ coder:
provisionerDaemon:
pskSecretName: ""
keySecretName: ""
tags:
location: auh
clusterType: k8s
137 changes: 0 additions & 137 deletions helm/provisioner/tests/testdata/provisionerd_psk_and_key.golden
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion helm/provisioner/tests/testdata/provisionerd_psk_and_key.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ coder:
image:
tag: latest
provisionerDaemon:
pskSecretName: "coder-provisionerd-psk"
pskSecretName: "not-the-default-coder-provisioner-psk"
keySecretName: "coder-provisionerd-key"
keySecretKey: "provisionerd-key"
tags:
Expand Down
14 changes: 10 additions & 4 deletions helm/provisioner/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,17 +204,23 @@ provisionerDaemon:
# provisionerDaemon.keySecretName -- The name of the Kubernetes
# secret that contains a provisioner key to use to authenticate with Coder.
# See: https://coder.com/docs/admin/provisioners#authentication
# NOTE: if keySecretName and pskSecretName are both set, keySecretName will
# take precedence, as Coder provisioners will refuse to start if both a PSK
# and key are set.
# NOTE: it is not permitted to specify both provisionerDaemon.keySecretName
# and provisionerDaemon.pskSecretName. An exception is made for the purposes
# of backwards-compatibility: if provisionerDaemon.pskSecretName is unchanged
# from the default value and provisionerDaemon.keySecretName is set, then
# provisionerDaemon.keySecretName and provisionerDaemon.keySecretKey will take
# precedence over provisionerDaemon.pskSecretName.
keySecretName: ""
# provisionerDaemon.keySecretKey -- The key of the Kubernetes
# secret specified in provisionerDaemon.keySecretName that contains
# the provisioner key. Defaults to "key".
keySecretKey: "key"

# provisionerDaemon.tags -- Tags to filter provisioner jobs by.
# provisionerDaemon.tags -- If using a PSK, specify the set of provisioner
# job tags for which this provisioner daemon is responsible.
# See: https://coder.com/docs/admin/provisioners#provisioner-tags
# NOTE: it is not permitted to specify both provisionerDaemon.tags and
# provsionerDaemon.keySecretName.
tags:
{}
# location: usa
Expand Down
0