Skip to content

Commit 45dc2eb

Browse files
paolomainardipaolomainardi
committed
Close all the remainings tasks
1 parent ceb759d commit 45dc2eb

File tree

5 files changed

+107
-27
lines changed

5 files changed

+107
-27
lines changed

‎deployment/chart/README.md

Lines changed: 19 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -49,29 +49,36 @@ The following table lists the configurable parameters of the code-server chart a
4949
| Parameter | Description | Default |
5050
| --------------------------------- | ------------------------------------------ | --------------------------------------------------------- |
5151
| `image.registry` | Code-server image registry | `docker.io` |
52-
| `image.repository` | Code-server Image name | `codercom/code-server` |
52+
| `image.repository` | Code-server Image name | `codercom/code-server` |
5353
| `image.tag` | Code-server Image tag | `{TAG_NAME}` |
5454
| `image.pullPolicy` | Code-server image pull policy | `IfNotPresent` |
5555
| `nameOverride` | String to partially override code-server.fullname template with a string (will prepend the release name) | `nil` |
56-
| `fullnameOverride` | String to fully override code-server.fullname template with a string |
57-
| `hostnameOverride` | String to fully override code-server container hostname |
58-
| `service.type` | Kubernetes Service type | `NodePort` |
59-
| `service.port` | Service HTTP port | `8443` |
56+
| `fullnameOverride` | String to fully override code-server.fullname template with a string |
57+
| `hostnameOverride` | String to fully override code-server container hostname |
58+
| `service.type` | Kubernetes Service type | `NodePort` |
59+
| `service.port` | Service HTTP port | `8443` |
6060
| `ingress.enabled` | Enable ingress controller resource | `false` |
61-
| `ingress.hosts[0].name` | Hostname to your code-server installation | `code-server.local` |
61+
| `ingress.hosts[0].name` | Hostname to your code-server installation | `code-server.local` |
6262
| `ingress.hosts[0].path` | Path within the url structure | `/` |
6363
| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` |
6464
| `ingress.hosts[0].certManager` | Add annotations for cert-manager | `false` |
65-
| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `code-server.local-tls-secret` |
65+
| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `code-server.local-tls-secret` |
6666
| `ingress.hosts[0].annotations` | Annotations for this host's ingress record | `[]` |
6767
| `ingress.secrets[0].name` | TLS Secret Name | `nil` |
6868
| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` |
69-
| `ingress.secrets[0].key` | TLS Secret Key | `nil` |
70-
| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` |
69+
| `ingress.secrets[0].key` | TLS Secret Key | `nil` |
70+
| `extraArgs` | Additional code-server container arguments | `{}` |
71+
| `extraVars` | Optional environment variables for code-server | `{}` |
72+
| `volumePermissions.enabled` | Enable volume permissions init container | `true` |
73+
| `volumePermissions.securityContext.runAsUser` | User ID for the init container | `0` |
74+
| `securityContext.enabled` | Enable security context | `true` |
75+
| `securityContext.fsGroup` | Group ID for the container | `1000` |
76+
| `securityContext.runAsUser` | User ID for the container | `1000` |
77+
| `resources` | CPU/Memory resource requests/limits | `{}` |
7178
| `persistence.enabled` | Enable persistence using PVC | `true` |
72-
| `persistence.storageClass` | PVC Storage Class for code-server volume | `nil` (uses alpha storage class annotation) |
73-
| `persistence.accessMode` | PVC Access Mode for code-server volume | `ReadWriteOnce` |
74-
| `persistence.size` | PVC Storage Request for code-server volume | `8Gi`
79+
| `persistence.storageClass` | PVC Storage Class for code-server volume | `nil` |
80+
| `persistence.accessMode` | PVC Access Mode for code-server volume | `ReadWriteOnce` |
81+
| `persistence.size` | PVC Storage Request for code-server volume | `8Gi` |
7582

7683
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
7784

@@ -91,6 +98,4 @@ $ helm install --name my-release -f values.yaml deployment/chart
9198

9299
> **Tip**: You can use the default [values.yaml](values.yaml)
93100
94-
## Image
95101

96-
The `image` parameter allows specifying which image will be pulled for the chart.

‎deployment/chart/templates/NOTES.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,7 @@
1919
echo "Visit http://127.0.0.1:8080 to use your application"
2020
kubectl port-forward $POD_NAME 8080:80
2121
{{- end }}
22+
23+
Administrator credentials:
24+
25+
Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "code-server.fullname" . }} -o jsonpath="{.data.password}" | base64 --decode)

‎deployment/chart/templates/deployment.yaml

Lines changed: 39 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,24 +24,51 @@ spec:
2424
{{- if .Values.hostnameOverride }}
2525
hostname: {{ .Values.hostnameOverride }}
2626
{{- end }}
27+
{{- if .Values.securityContext.enabled }}
28+
securityContext:
29+
fsGroup: {{ .Values.securityContext.fsGroup }}
30+
{{- end }}
31+
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
2732
initContainers:
28-
- name: permissions
29-
image: busybox:latest
30-
imagePullPolicy: IfNotPresent
31-
command: ["/bin/sh"]
32-
args: ["-c", "chown -R 1000:1000 /home/coder"]
33-
volumeMounts:
34-
- name: data
35-
mountPath: /home/coder
33+
- name: init-chmod-data
34+
image: busybox:latest
35+
imagePullPolicy: IfNotPresent
36+
command:
37+
- sh
38+
- -c
39+
- |
40+
chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} /home/coder
41+
securityContext:
42+
runAsUser: {{ .Values.volumePermissions.securityContext.runAsUser }}
43+
volumeMounts:
44+
- name: data
45+
mountPath: /home/coder
46+
{{- end }}
3647
containers:
3748
- name: {{ .Chart.Name }}
3849
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
3950
imagePullPolicy: {{ .Values.image.pullPolicy }}
40-
args: ["--allow-http", "--no-auth"]
51+
{{- if .Values.securityContext.enabled }}
4152
securityContext:
42-
runAsUser: 1000
43-
runAsGroup: 1000
44-
fsGroup: 1000
53+
runAsUser: {{ .Values.securityContext.runAsUser }}
54+
{{- end }}
55+
env:
56+
- name: PASSWORD
57+
valueFrom:
58+
secretKeyRef:
59+
{{- if .Values.existingSecret }}
60+
name: {{ .Values.existingSecret }}
61+
{{- else }}
62+
name: {{ template "code-server.fullname" . }}
63+
{{- end }}
64+
key: password
65+
{{- if .Values.extraVars }}
66+
{{ toYaml .Values.extraVars | indent 12 }}
67+
{{- end }}
68+
{{- if .Values.extraArgs }}
69+
args:
70+
{{ toYaml .Values.extraArgs | indent 12 }}
71+
{{- end }}
4572
volumeMounts:
4673
- name: data
4774
mountPath: /home/coder/project

‎deployment/chart/templates/secrets.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: {{ include "code-server.fullname" . }}
5+
labels:
6+
app.kubernetes.io/name: {{ include "code-server.name" . }}
7+
helm.sh/chart: {{ include "code-server.chart" . }}
8+
app.kubernetes.io/instance: {{ .Release.Name }}
9+
app.kubernetes.io/managed-by: {{ .Release.Service }}
10+
type: Opaque
11+
data:
12+
{{ if .Values.password }}
13+
password: "{{ .Values.password | b64enc }}"
14+
{{ else }}
15+
password: "{{ randAlphaNum 24 | b64enc }}"
16+
{{ end }}

‎deployment/chart/values.yaml

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,35 @@ ingress:
3030
# hosts:
3131
# - code-server.example.loc
3232

33-
resources:
33+
# Optional additional arguments
34+
extraArgs: []
35+
# - --allow-http
36+
# - --no-auth
37+
38+
# Optional additional environment variables
39+
extraVars: []
40+
# - name: DISABLE_TELEMETRY
41+
# value: true
42+
43+
##
44+
## Init containers parameters:
45+
## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup
46+
##
47+
volumePermissions:
48+
enabled: true
49+
## Init container Security Context
50+
securityContext:
51+
runAsUser: 0
52+
53+
## Pod Security Context
54+
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
55+
##
56+
securityContext:
57+
enabled: true
58+
fsGroup: 1000
59+
runAsUser: 1000
60+
61+
resources: {}
3462
# We usually recommend not to specify default resources and to leave this as a conscious
3563
# choice for the user. This also increases chances charts run on environments with little
3664
# resources, such as Minikube. If you do want to specify resources, uncomment the following

0 commit comments

Comments
 (0)