Merge branch 'coder:main' into dotfiles-root
Phorcys
1 year ago
committed by
GitHub
commit
b9bec0fe99
@ -0,0 +1,42 @@
|
||||
name: Update README on Tag
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
tags:
|
||||
- 'v*'
|
||||
|
||||
jobs:
|
||||
update-readme:
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Get the latest tag
|
||||
id: get-latest-tag
|
||||
run: echo "TAG=$(git describe --tags --abbrev=0 | sed 's/^v//')" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Run update script
|
||||
run: ./update-version.sh
|
||||
|
||||
- name: Create Pull Request
|
||||
id: create-pr
|
||||
uses: peter-evans/create-pull-request@v5
|
||||
with:
|
||||
commit-message: 'chore: bump version to ${{ env.TAG }} in README.md files'
|
||||
title: 'chore: bump version to ${{ env.TAG }} in README.md files'
|
||||
body: 'This is an auto-generated PR to update README.md files of all modules with the new tag ${{ env.TAG }}'
|
||||
branch: 'update-readme-branch'
|
||||
base: 'main'
|
||||
env:
|
||||
TAG: ${{ steps.get-latest-tag.outputs.TAG }}
|
||||
|
||||
- name: Auto-approve
|
||||
uses: hmarr/auto-approve-action@v4
|
||||
if: github.ref == 'refs/heads/update-readme-branch'
|
||||
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 2.2 KiB After Width: | Height: | Size: 6.8 KiB |
@ -0,0 +1 @@
|
||||
<svg width="2270" height="2500" viewBox="0 0 256 282" xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="xMinYMin meet"><g fill="#8CC84B"><path d="M116.504 3.58c6.962-3.985 16.03-4.003 22.986 0 34.995 19.774 70.001 39.517 104.99 59.303 6.581 3.707 10.983 11.031 10.916 18.614v118.968c.049 7.897-4.788 15.396-11.731 19.019-34.88 19.665-69.742 39.354-104.616 59.019-7.106 4.063-16.356 3.75-23.24-.646-10.457-6.062-20.932-12.094-31.39-18.15-2.137-1.274-4.546-2.288-6.055-4.36 1.334-1.798 3.719-2.022 5.657-2.807 4.365-1.388 8.374-3.616 12.384-5.778 1.014-.694 2.252-.428 3.224.193 8.942 5.127 17.805 10.403 26.777 15.481 1.914 1.105 3.852-.362 5.488-1.274 34.228-19.345 68.498-38.617 102.72-57.968 1.268-.61 1.969-1.956 1.866-3.345.024-39.245.006-78.497.012-117.742.145-1.576-.767-3.025-2.192-3.67-34.759-19.575-69.5-39.18-104.253-58.76a3.621 3.621 0 0 0-4.094-.006C91.2 39.257 56.465 58.88 21.712 78.454c-1.42.646-2.373 2.071-2.204 3.653.006 39.245 0 78.497 0 117.748a3.329 3.329 0 0 0 1.89 3.303c9.274 5.259 18.56 10.481 27.84 15.722 5.228 2.814 11.647 4.486 17.407 2.33 5.083-1.823 8.646-7.01 8.549-12.407.048-39.016-.024-78.038.036-117.048-.127-1.732 1.516-3.163 3.2-3 4.456-.03 8.918-.06 13.374.012 1.86-.042 3.14 1.823 2.91 3.568-.018 39.263.048 78.527-.03 117.79.012 10.464-4.287 21.85-13.966 26.97-11.924 6.177-26.662 4.867-38.442-1.056-10.198-5.09-19.93-11.097-29.947-16.55C5.368 215.886.555 208.357.604 200.466V81.497c-.073-7.74 4.504-15.197 11.29-18.85C46.768 42.966 81.636 23.27 116.504 3.58z"/><path d="M146.928 85.99c15.21-.979 31.493-.58 45.18 6.913 10.597 5.742 16.472 17.793 16.659 29.566-.296 1.588-1.956 2.464-3.472 2.355-4.413-.006-8.827.06-13.24-.03-1.872.072-2.96-1.654-3.195-3.309-1.268-5.633-4.34-11.212-9.642-13.929-8.139-4.075-17.576-3.87-26.451-3.785-6.479.344-13.446.905-18.935 4.715-4.214 2.886-5.494 8.712-3.99 13.404 1.418 3.369 5.307 4.456 8.489 5.458 18.33 4.794 37.754 4.317 55.734 10.626 7.444 2.572 14.726 7.572 17.274 15.366 3.333 10.446 1.872 22.932-5.56 31.318-6.027 6.901-14.805 10.657-23.56 12.697-11.647 2.597-23.734 2.663-35.562 1.51-11.122-1.268-22.696-4.19-31.282-11.768-7.342-6.375-10.928-16.308-10.572-25.895.085-1.619 1.697-2.748 3.248-2.615 4.444-.036 8.888-.048 13.332.006 1.775-.127 3.091 1.407 3.182 3.08.82 5.367 2.837 11 7.517 14.182 9.032 5.827 20.365 5.428 30.707 5.591 8.568-.38 18.186-.495 25.178-6.158 3.689-3.23 4.782-8.634 3.785-13.283-1.08-3.925-5.186-5.754-8.712-6.95-18.095-5.724-37.736-3.647-55.656-10.12-7.275-2.571-14.31-7.432-17.105-14.906-3.9-10.578-2.113-23.662 6.098-31.765 8.006-8.06 19.563-11.164 30.551-12.275z"/></g></svg>
|
||||
|
After Width: | Height: | Size: 2.5 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 174 KiB |
@ -1,43 +0,0 @@
|
||||
import { describe, expect, it } from "bun:test";
|
||||
import {
|
||||
executeScriptInContainer,
|
||||
runTerraformApply,
|
||||
runTerraformInit,
|
||||
testRequiredVariables,
|
||||
} from "../test";
|
||||
|
||||
describe("git-config", async () => {
|
||||
await runTerraformInit(import.meta.dir);
|
||||
|
||||
testRequiredVariables(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
|
||||
it("fails without git", async () => {
|
||||
const state = await runTerraformApply(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
const output = await executeScriptInContainer(state, "alpine");
|
||||
expect(output.exitCode).toBe(1);
|
||||
expect(output.stdout).toEqual([
|
||||
"\u001B[0;1mChecking git-config!",
|
||||
"Git is not installed!",
|
||||
]);
|
||||
});
|
||||
|
||||
it("runs with git", async () => {
|
||||
const state = await runTerraformApply(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
const output = await executeScriptInContainer(state, "alpine/git");
|
||||
expect(output.exitCode).toBe(0);
|
||||
expect(output.stdout).toEqual([
|
||||
"\u001B[0;1mChecking git-config!",
|
||||
"git-config: No user.email found, setting to ",
|
||||
"git-config: No user.name found, setting to default",
|
||||
"",
|
||||
"\u001B[0;1mgit-config: using email: ",
|
||||
"\u001B[0;1mgit-config: using username: default",
|
||||
]);
|
||||
});
|
||||
});
|
||||
@ -1,24 +0,0 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
BOLD='\033[0;1m'
|
||||
printf "$${BOLD}Checking git-config!\n"
|
||||
|
||||
# Check if git is installed
|
||||
command -v git > /dev/null 2>&1 || {
|
||||
echo "Git is not installed!"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Set git username and email if missing
|
||||
if [ -z $(git config --get user.email) ]; then
|
||||
printf "git-config: No user.email found, setting to ${GIT_EMAIL}\n"
|
||||
git config --global user.email "${GIT_EMAIL}"
|
||||
fi
|
||||
|
||||
if [ -z $(git config --get user.name) ]; then
|
||||
printf "git-config: No user.name found, setting to ${GIT_USERNAME}\n"
|
||||
git config --global user.name "${GIT_USERNAME}"
|
||||
fi
|
||||
|
||||
printf "\n$${BOLD}git-config: using email: $(git config --get user.email)\n"
|
||||
printf "$${BOLD}git-config: using username: $(git config --get user.name)\n\n"
|
||||
@ -0,0 +1,80 @@
|
||||
---
|
||||
display_name: "HCP Vault Secrets"
|
||||
description: "Fetch secrets from HCP Vault"
|
||||
icon: ../.icons/vault.svg
|
||||
maintainer_github: coder
|
||||
partner_github: hashicorp
|
||||
verified: true
|
||||
tags: [helper, integration, vault, hashicorp, hvs]
|
||||
---
|
||||
|
||||
# HCP Vault Secrets
|
||||
|
||||
This module lets you fetch all or selective secrets from a [HCP Vault Secrets](https://developer.hashicorp.com/hcp/docs/vault-secrets) app into your [Coder](https://coder.com) workspaces. It makes use of the [`hcp_vault_secrets_app`](https://registry.terraform.io/providers/hashicorp/hcp/latest/docs/data-sources/vault_secrets_app) data source from the [HCP provider](https://registry.terraform.io/providers/hashicorp/hcp/latest).
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.7"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
project_id = "aaa-bbb-ccc"
|
||||
}
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
To configure the HCP Vault Secrets module, follow these steps,
|
||||
|
||||
1. [Create secrets in HCP Vault Secrets](https://developer.hashicorp.com/vault/tutorials/hcp-vault-secrets-get-started/hcp-vault-secrets-create-secret)
|
||||
2. Create an HCP Service Principal from the HCP Vault Secrets app in the HCP console. This will give you the `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` that you need to authenticate with HCP Vault Secrets.
|
||||
|
||||
3. Set `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` variables on the coder provisioner (recommended) or supply them as input to the module.
|
||||
4. Set the `project_id`. This is the ID of the project where the HCP Vault Secrets app is running.
|
||||
|
||||
> See the [HCP Vault Secrets documentation](https://developer.hashicorp.com/hcp/docs/vault-secrets) for more information.
|
||||
|
||||
## Fetch All Secrets
|
||||
|
||||
To fetch all secrets from the HCP Vault Secrets app, skip the `secrets` input.
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.7"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
project_id = "aaa-bbb-ccc"
|
||||
}
|
||||
```
|
||||
|
||||
## Fetch Selective Secrets
|
||||
|
||||
To fetch selective secrets from the HCP Vault Secrets app, set the `secrets` input.
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.7"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
project_id = "aaa-bbb-ccc"
|
||||
secrets = ["MY_SECRET_1", "MY_SECRET_2"]
|
||||
}
|
||||
```
|
||||
|
||||
## Set Client ID and Client Secret as Inputs
|
||||
|
||||
Set `client_id` and `client_secret` as module inputs.
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.7"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
project_id = "aaa-bbb-ccc"
|
||||
client_id = "HCP_CLIENT_ID"
|
||||
client_secret = "HCP_CLIENT_SECRET"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,73 @@
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
coder = {
|
||||
source = "coder/coder"
|
||||
version = ">= 0.12.4"
|
||||
}
|
||||
hcp = {
|
||||
source = "hashicorp/hcp"
|
||||
version = ">= 0.82.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "hcp" {
|
||||
client_id = var.client_id
|
||||
client_secret = var.client_secret
|
||||
project_id = var.project_id
|
||||
}
|
||||
|
||||
provider "coder" {}
|
||||
|
||||
variable "agent_id" {
|
||||
type = string
|
||||
description = "The ID of a Coder agent."
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
type = string
|
||||
description = "The ID of the HCP project."
|
||||
}
|
||||
|
||||
variable "client_id" {
|
||||
type = string
|
||||
description = <<-EOF
|
||||
The client ID for the HCP Vault Secrets service principal. (Optional if HCP_CLIENT_ID is set as an environment variable.)
|
||||
EOF
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "client_secret" {
|
||||
type = string
|
||||
description = <<-EOF
|
||||
The client secret for the HCP Vault Secrets service principal. (Optional if HCP_CLIENT_SECRET is set as an environment variable.)
|
||||
EOF
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "app_name" {
|
||||
type = string
|
||||
description = "The name of the secrets app in HCP Vault Secrets"
|
||||
}
|
||||
|
||||
variable "secrets" {
|
||||
type = list(string)
|
||||
description = "The names of the secrets to retrieve from HCP Vault Secrets"
|
||||
default = null
|
||||
}
|
||||
|
||||
data "hcp_vault_secrets_app" "secrets" {
|
||||
app_name = var.app_name
|
||||
}
|
||||
|
||||
resource "coder_env" "hvs_secrets" {
|
||||
# https://support.hashicorp.com/hc/en-us/articles/4538432032787-Variable-has-a-sensitive-value-and-cannot-be-used-as-for-each-arguments
|
||||
for_each = var.secrets != null ? toset(var.secrets) : nonsensitive(toset(keys(data.hcp_vault_secrets_app.secrets.secrets)))
|
||||
agent_id = var.agent_id
|
||||
name = each.key
|
||||
value = data.hcp_vault_secrets_app.secrets.secrets[each.key]
|
||||
}
|
||||
@ -0,0 +1,58 @@
|
||||
---
|
||||
display_name: nodejs
|
||||
description: Install Node.js via nvm
|
||||
icon: ../.icons/node.svg
|
||||
maintainer_github: TheZoker
|
||||
verified: false
|
||||
tags: [helper]
|
||||
---
|
||||
|
||||
# nodejs
|
||||
|
||||
Automatically installs [Node.js](https://github.com/nodejs/node) via [nvm](https://github.com/nvm-sh/nvm). It can also install multiple versions of node and set a default version. If no options are specified, the latest version is installed.
|
||||
|
||||
```tf
|
||||
module "nodejs" {
|
||||
source = "registry.coder.com/modules/nodejs/coder"
|
||||
version = "1.0.10"
|
||||
agent_id = coder_agent.example.id
|
||||
}
|
||||
```
|
||||
|
||||
### Install multiple versions
|
||||
|
||||
This installs multiple versions of Node.js:
|
||||
|
||||
```tf
|
||||
module "nodejs" {
|
||||
source = "registry.coder.com/modules/nodejs/coder"
|
||||
version = "1.0.10"
|
||||
agent_id = coder_agent.example.id
|
||||
node_versions = [
|
||||
"18",
|
||||
"20",
|
||||
"node"
|
||||
]
|
||||
default_node_version = "20"
|
||||
}
|
||||
```
|
||||
|
||||
### Full example
|
||||
|
||||
A example with all available options:
|
||||
|
||||
```tf
|
||||
module "nodejs" {
|
||||
source = "registry.coder.com/modules/nodejs/coder"
|
||||
version = "1.0.10"
|
||||
agent_id = coder_agent.example.id
|
||||
nvm_version = "v0.39.7"
|
||||
nvm_install_prefix = "/opt/nvm"
|
||||
node_versions = [
|
||||
"16",
|
||||
"18",
|
||||
"node"
|
||||
]
|
||||
default_node_version = "16"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,12 @@
|
||||
import { describe, expect, it } from "bun:test";
|
||||
import { runTerraformInit, testRequiredVariables } from "../test";
|
||||
|
||||
describe("nodejs", async () => {
|
||||
await runTerraformInit(import.meta.dir);
|
||||
|
||||
testRequiredVariables(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
|
||||
// More tests depend on shebang refactors
|
||||
});
|
||||
@ -0,0 +1,52 @@
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
coder = {
|
||||
source = "coder/coder"
|
||||
version = ">= 0.12"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
variable "agent_id" {
|
||||
type = string
|
||||
description = "The ID of a Coder agent."
|
||||
}
|
||||
|
||||
variable "nvm_version" {
|
||||
type = string
|
||||
description = "The version of nvm to install."
|
||||
default = "master"
|
||||
}
|
||||
|
||||
variable "nvm_install_prefix" {
|
||||
type = string
|
||||
description = "The prefix to install nvm to (relative to $HOME)."
|
||||
default = ".nvm"
|
||||
}
|
||||
|
||||
variable "node_versions" {
|
||||
type = list(string)
|
||||
description = "A list of Node.js versions to install."
|
||||
default = ["node"]
|
||||
}
|
||||
|
||||
variable "default_node_version" {
|
||||
type = string
|
||||
description = "The default Node.js version"
|
||||
default = "node"
|
||||
}
|
||||
|
||||
resource "coder_script" "nodejs" {
|
||||
agent_id = var.agent_id
|
||||
display_name = "Node.js:"
|
||||
script = templatefile("${path.module}/run.sh", {
|
||||
NVM_VERSION : var.nvm_version,
|
||||
INSTALL_PREFIX : var.nvm_install_prefix,
|
||||
NODE_VERSIONS : join(",", var.node_versions),
|
||||
DEFAULT : var.default_node_version,
|
||||
})
|
||||
run_on_start = true
|
||||
start_blocks_login = true
|
||||
}
|
||||
@ -0,0 +1,51 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
NVM_VERSION='${NVM_VERSION}'
|
||||
NODE_VERSIONS='${NODE_VERSIONS}'
|
||||
INSTALL_PREFIX='${INSTALL_PREFIX}'
|
||||
DEFAULT='${DEFAULT}'
|
||||
BOLD='\033[0;1m'
|
||||
CODE='\033[36;40;1m'
|
||||
RESET='\033[0m'
|
||||
|
||||
printf "$${BOLD}Installing nvm!$${RESET}\n"
|
||||
|
||||
export NVM_DIR="$HOME/$${INSTALL_PREFIX}/nvm"
|
||||
mkdir -p "$NVM_DIR"
|
||||
|
||||
script="$(curl -sS -o- "https://raw.githubusercontent.com/nvm-sh/nvm/$${NVM_VERSION}/install.sh" 2>&1)"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed to download nvm installation script: $script"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
output="$(bash <<< "$script" 2>&1)"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed to install nvm: $output"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
printf "🥳 nvm has been installed\n\n"
|
||||
|
||||
# Set up nvm for the rest of the script.
|
||||
[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
|
||||
|
||||
# Install each node version...
|
||||
IFS=',' read -r -a VERSIONLIST <<< "$${NODE_VERSIONS}"
|
||||
for version in "$${VERSIONLIST[@]}"; do
|
||||
if [ -z "$version" ]; then
|
||||
continue
|
||||
fi
|
||||
printf "🛠️ Installing node version $${CODE}$version$${RESET}...\n"
|
||||
output=$(nvm install "$version" 2>&1)
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed to install version: $version: $output"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
# Set default if provided
|
||||
if [ -n "$${DEFAULT}" ]; then
|
||||
printf "🛠️ Setting default node version $${CODE}$DEFAULT$${RESET}...\n"
|
||||
output=$(nvm alias default $DEFAULT 2>&1)
|
||||
fi
|
||||
@ -0,0 +1,29 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Function to run terraform init and validate in a directory
|
||||
run_terraform() {
|
||||
local dir="$1"
|
||||
echo "Running terraform init and validate in $dir"
|
||||
pushd "$dir"
|
||||
terraform init -upgrade
|
||||
terraform validate
|
||||
popd
|
||||
}
|
||||
|
||||
# Main script
|
||||
main() {
|
||||
# Get the directory of the script
|
||||
script_dir=$(dirname "$(readlink -f "$0")")
|
||||
|
||||
# Get all subdirectories in the repository
|
||||
subdirs=$(find "$script_dir" -mindepth 1 -maxdepth 1 -type d -not -name ".*" | sort)
|
||||
|
||||
for dir in $subdirs; do
|
||||
run_terraform "$dir"
|
||||
done
|
||||
}
|
||||
|
||||
# Run the main script
|
||||
main
|
||||
@ -0,0 +1,29 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# This script updates the version number in the README.md files of all modules
|
||||
# to the latest tag in the repository. It is intended to be run from the root
|
||||
# of the repository or by using the `bun update-version` command.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
current_tag=$(git describe --tags --abbrev=0)
|
||||
previous_tag=$(git describe --tags --abbrev=0 $current_tag^)
|
||||
mapfile -t changed_dirs < <(git diff --name-only "$previous_tag"..."$current_tag" -- ':!**/README.md' ':!**/*.test.ts' | xargs dirname | grep -v '^\.' | sort -u)
|
||||
|
||||
LATEST_TAG=$(git describe --abbrev=0 --tags | sed 's/^v//') || exit $?
|
||||
|
||||
for dir in "${changed_dirs[@]}"; do
|
||||
if [[ -f "$dir/README.md" ]]; then
|
||||
echo "Bumping version in $dir/README.md"
|
||||
file="$dir/README.md"
|
||||
tmpfile=$(mktemp /tmp/tempfile.XXXXXX)
|
||||
awk -v tag="$LATEST_TAG" '{
|
||||
if ($1 == "version" && $2 == "=") {
|
||||
sub(/"[^"]*"/, "\"" tag "\"")
|
||||
print
|
||||
} else {
|
||||
print
|
||||
}
|
||||
}' "$file" > "$tmpfile" && mv "$tmpfile" "$file"
|
||||
fi
|
||||
done
|
||||
@ -0,0 +1,11 @@
|
||||
import { describe } from "bun:test";
|
||||
import { runTerraformInit, testRequiredVariables } from "../test";
|
||||
|
||||
describe("vault-github", async () => {
|
||||
await runTerraformInit(import.meta.dir);
|
||||
|
||||
testRequiredVariables(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
vault_addr: "foo",
|
||||
});
|
||||
});
|
||||
@ -0,0 +1,83 @@
|
||||
---
|
||||
display_name: Hashicorp Vault Integration (Token)
|
||||
description: Authenticates with Vault using Token
|
||||
icon: ../.icons/vault.svg
|
||||
maintainer_github: coder
|
||||
partner_github: hashicorp
|
||||
verified: true
|
||||
tags: [helper, integration, vault, token]
|
||||
---
|
||||
|
||||
# Hashicorp Vault Integration (Token)
|
||||
|
||||
This module lets you authenticate with [Hashicorp Vault](https://www.vaultproject.io/) in your Coder workspaces using a [Vault token](https://developer.hashicorp.com/vault/docs/auth/token).
|
||||
|
||||
```tf
|
||||
variable "vault_token" {
|
||||
type = string
|
||||
description = "The Vault token to use for authentication."
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/vault-token/coder"
|
||||
version = "1.0.7"
|
||||
agent_id = coder_agent.example.id
|
||||
vault_token = var.token
|
||||
vault_addr = "https://vault.example.com"
|
||||
}
|
||||
```
|
||||
|
||||
Then you can use the Vault CLI in your workspaces to fetch secrets from Vault:
|
||||
|
||||
```shell
|
||||
vault kv get -namespace=coder -mount=secrets coder
|
||||
```
|
||||
|
||||
or using the Vault API:
|
||||
|
||||
```shell
|
||||
curl -H "X-Vault-Token: ${VAULT_TOKEN}" -X GET "${VAULT_ADDR}/v1/coder/secrets/data/coder"
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
To configure the Vault module, you must create a Vault token with the the required permissions and configure the module with the token and Vault address.
|
||||
|
||||
1. Create a vault policy with read access to the secret mount you need your developers to access.
|
||||
```shell
|
||||
vault policy write read-coder-secrets - <<EOF
|
||||
path "coder/data/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "coder/metadata/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
EOF
|
||||
```
|
||||
2. Create a token using this policy.
|
||||
```shell
|
||||
vault token create -policy="read-coder-secrets"
|
||||
```
|
||||
3. Copy the generated token and use in your template.
|
||||
|
||||
## Examples
|
||||
|
||||
### Configure Vault integration and install a specific version of the Vault CLI
|
||||
|
||||
```tf
|
||||
variable "vault_token" {
|
||||
type = string
|
||||
description = "The Vault token to use for authentication."
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/vault-token/coder"
|
||||
version = "1.0.7"
|
||||
agent_id = coder_agent.example.id
|
||||
vault_addr = "https://vault.example.com"
|
||||
vault_token = var.token
|
||||
vault_cli_version = "1.15.0"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,12 @@
|
||||
import { describe } from "bun:test";
|
||||
import { runTerraformInit, testRequiredVariables } from "../test";
|
||||
|
||||
describe("vault-token", async () => {
|
||||
await runTerraformInit(import.meta.dir);
|
||||
|
||||
testRequiredVariables(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
vault_addr: "foo",
|
||||
vault_token: "foo",
|
||||
});
|
||||
});
|
||||
@ -0,0 +1,62 @@
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
coder = {
|
||||
source = "coder/coder"
|
||||
version = ">= 0.12.4"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Add required variables for your modules and remove any unneeded variables
|
||||
variable "agent_id" {
|
||||
type = string
|
||||
description = "The ID of a Coder agent."
|
||||
}
|
||||
|
||||
variable "vault_addr" {
|
||||
type = string
|
||||
description = "The address of the Vault server."
|
||||
}
|
||||
|
||||
variable "vault_token" {
|
||||
type = string
|
||||
description = "The Vault token to use for authentication."
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "vault_cli_version" {
|
||||
type = string
|
||||
description = "The version of Vault to install."
|
||||
default = "latest"
|
||||
validation {
|
||||
condition = can(regex("^(latest|[0-9]+\\.[0-9]+\\.[0-9]+)$", var.vault_cli_version))
|
||||
error_message = "Vault version must be in the format 0.0.0 or latest"
|
||||
}
|
||||
}
|
||||
|
||||
data "coder_workspace" "me" {}
|
||||
|
||||
resource "coder_script" "vault" {
|
||||
agent_id = var.agent_id
|
||||
display_name = "Vault (Token)"
|
||||
icon = "/icon/vault.svg"
|
||||
script = templatefile("${path.module}/run.sh", {
|
||||
INSTALL_VERSION : var.vault_cli_version,
|
||||
})
|
||||
run_on_start = true
|
||||
start_blocks_login = true
|
||||
}
|
||||
|
||||
resource "coder_env" "vault_addr" {
|
||||
agent_id = var.agent_id
|
||||
name = "VAULT_ADDR"
|
||||
value = var.vault_addr
|
||||
}
|
||||
|
||||
resource "coder_env" "vault_token" {
|
||||
agent_id = var.agent_id
|
||||
name = "VAULT_TOKEN"
|
||||
value = var.vault_token
|
||||
}
|
||||
@ -0,0 +1,103 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Convert all templated variables to shell variables
|
||||
INSTALL_VERSION=${INSTALL_VERSION}
|
||||
|
||||
fetch() {
|
||||
dest="$1"
|
||||
url="$2"
|
||||
if command -v curl > /dev/null 2>&1; then
|
||||
curl -sSL --fail "$${url}" -o "$${dest}"
|
||||
elif command -v wget > /dev/null 2>&1; then
|
||||
wget -O "$${dest}" "$${url}"
|
||||
elif command -v busybox > /dev/null 2>&1; then
|
||||
busybox wget -O "$${dest}" "$${url}"
|
||||
else
|
||||
printf "curl, wget, or busybox is not installed. Please install curl or wget in your image.\n"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
unzip_safe() {
|
||||
if command -v unzip > /dev/null 2>&1; then
|
||||
command unzip "$@"
|
||||
elif command -v busybox > /dev/null 2>&1; then
|
||||
busybox unzip "$@"
|
||||
else
|
||||
printf "unzip or busybox is not installed. Please install unzip in your image.\n"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
install() {
|
||||
# Get the architecture of the system
|
||||
ARCH=$(uname -m)
|
||||
if [ "$${ARCH}" = "x86_64" ]; then
|
||||
ARCH="amd64"
|
||||
elif [ "$${ARCH}" = "aarch64" ]; then
|
||||
ARCH="arm64"
|
||||
else
|
||||
printf "Unsupported architecture: $${ARCH}\n"
|
||||
return 1
|
||||
fi
|
||||
# Fetch the latest version of Vault if INSTALL_VERSION is 'latest'
|
||||
if [ "$${INSTALL_VERSION}" = "latest" ]; then
|
||||
LATEST_VERSION=$(curl -s https://releases.hashicorp.com/vault/ | grep -v 'rc' | grep -oE 'vault/[0-9]+\.[0-9]+\.[0-9]+' | sed 's/vault\///' | sort -V | tail -n 1)
|
||||
printf "Latest version of Vault is %s.\n\n" "$${LATEST_VERSION}"
|
||||
if [ -z "$${LATEST_VERSION}" ]; then
|
||||
printf "Failed to determine the latest Vault version.\n"
|
||||
return 1
|
||||
fi
|
||||
INSTALL_VERSION=$${LATEST_VERSION}
|
||||
fi
|
||||
|
||||
# Check if the vault CLI is installed and has the correct version
|
||||
installation_needed=1
|
||||
if command -v vault > /dev/null 2>&1; then
|
||||
CURRENT_VERSION=$(vault version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
|
||||
if [ "$${CURRENT_VERSION}" = "$${INSTALL_VERSION}" ]; then
|
||||
printf "Vault version %s is already installed and up-to-date.\n\n" "$${CURRENT_VERSION}"
|
||||
installation_needed=0
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ $${installation_needed} -eq 1 ]; then
|
||||
# Download and install Vault
|
||||
if [ -z "$${CURRENT_VERSION}" ]; then
|
||||
printf "Installing Vault CLI ...\n\n"
|
||||
else
|
||||
printf "Upgrading Vault CLI from version %s to %s ...\n\n" "$${CURRENT_VERSION}" "${INSTALL_VERSION}"
|
||||
fi
|
||||
fetch vault.zip "https://releases.hashicorp.com/vault/$${INSTALL_VERSION}/vault_$${INSTALL_VERSION}_linux_amd64.zip"
|
||||
if [ $? -ne 0 ]; then
|
||||
printf "Failed to download Vault.\n"
|
||||
return 1
|
||||
fi
|
||||
if ! unzip_safe vault.zip; then
|
||||
printf "Failed to unzip Vault.\n"
|
||||
return 1
|
||||
fi
|
||||
rm vault.zip
|
||||
if sudo mv vault /usr/local/bin/vault 2> /dev/null; then
|
||||
printf "Vault installed successfully!\n\n"
|
||||
else
|
||||
mkdir -p ~/.local/bin
|
||||
if ! mv vault ~/.local/bin/vault; then
|
||||
printf "Failed to move Vault to local bin.\n"
|
||||
return 1
|
||||
fi
|
||||
printf "Please add ~/.local/bin to your PATH to use vault CLI.\n"
|
||||
fi
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
TMP=$(mktemp -d)
|
||||
if ! (
|
||||
cd "$TMP"
|
||||
install
|
||||
); then
|
||||
echo "Failed to install Vault CLI."
|
||||
exit 1
|
||||
fi
|
||||
rm -rf "$TMP"
|
||||
@ -1,63 +0,0 @@
|
||||
import { describe, expect, it } from "bun:test";
|
||||
import {
|
||||
executeScriptInContainer,
|
||||
runTerraformApply,
|
||||
runTerraformInit,
|
||||
} from "../test";
|
||||
|
||||
describe("vscode-web", async () => {
|
||||
await runTerraformInit(import.meta.dir);
|
||||
|
||||
// replaces testRequiredVariables due to license variable
|
||||
// may add a testRequiredVariablesWithLicense function later
|
||||
it("missing agent_id", async () => {
|
||||
try {
|
||||
await runTerraformApply(import.meta.dir, {
|
||||
accept_license: "true",
|
||||
});
|
||||
} catch (ex) {
|
||||
expect(ex.message).toContain('input variable "agent_id" is not set');
|
||||
}
|
||||
});
|
||||
|
||||
it("invalid license_agreement", async () => {
|
||||
try {
|
||||
await runTerraformApply(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
} catch (ex) {
|
||||
expect(ex.message).toContain(
|
||||
"You must accept the VS Code license agreement by setting accept_license=true",
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
it("fails without curl", async () => {
|
||||
const state = await runTerraformApply(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
accept_license: "true",
|
||||
});
|
||||
const output = await executeScriptInContainer(state, "alpine");
|
||||
expect(output.exitCode).toBe(1);
|
||||
expect(output.stdout).toEqual([
|
||||
"\u001b[0;1mInstalling vscode-cli!",
|
||||
"Failed to install vscode-cli:", // TODO: manually test error log
|
||||
]);
|
||||
});
|
||||
|
||||
it("runs with curl", async () => {
|
||||
const state = await runTerraformApply(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
accept_license: "true",
|
||||
});
|
||||
const output = await executeScriptInContainer(state, "alpine/curl");
|
||||
expect(output.exitCode).toBe(0);
|
||||
expect(output.stdout).toEqual([
|
||||
"\u001b[0;1mInstalling vscode-cli!",
|
||||
"🥳 vscode-cli has been installed.",
|
||||
"",
|
||||
"👷 Running /tmp/vscode-cli/bin/code serve-web --port 13338 --without-connection-token --accept-server-license-terms in the background...",
|
||||
"Check logs at /tmp/vscode-web.log!",
|
||||
]);
|
||||
});
|
||||
});
|
||||
@ -1,21 +1,56 @@
|
||||
#!/usr/bin/env sh
|
||||
#!/usr/bin/env bash
|
||||
|
||||
BOLD='\033[0;1m'
|
||||
EXTENSIONS=("${EXTENSIONS}")
|
||||
|
||||
# Create install directory if it doesn't exist
|
||||
mkdir -p ${INSTALL_DIR}
|
||||
# Create install prefix
|
||||
mkdir -p ${INSTALL_PREFIX}
|
||||
|
||||
printf "$${BOLD}Installing vscode-cli!\n"
|
||||
printf "$${BOLD}Installing Microsoft Visual Studio Code Server!\n"
|
||||
|
||||
# Download and extract code-cli tarball
|
||||
output=$(curl -Lk 'https://code.visualstudio.com/sha/download?build=stable&os=cli-alpine-x64' --output vscode_cli.tar.gz && tar -xf vscode_cli.tar.gz -C ${INSTALL_DIR} && rm vscode_cli.tar.gz)
|
||||
# Download and extract vscode-server
|
||||
ARCH=$(uname -m)
|
||||
case "$ARCH" in
|
||||
x86_64) ARCH="x64" ;;
|
||||
aarch64) ARCH="arm64" ;;
|
||||
*)
|
||||
echo "Unsupported architecture"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
HASH=$(curl -fsSL https://update.code.visualstudio.com/api/commits/stable/server-linux-$ARCH-web | cut -d '"' -f 2)
|
||||
output=$(curl -fsSL https://vscode.download.prss.microsoft.com/dbazure/download/stable/$HASH/vscode-server-linux-$ARCH-web.tar.gz | tar -xz -C ${INSTALL_PREFIX} --strip-components 1)
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed to install Microsoft Visual Studio Code Server: $output"
|
||||
exit 1
|
||||
fi
|
||||
printf "$${BOLD}Microsoft Visual Studio Code Server has been installed.\n"
|
||||
|
||||
VSCODE_SERVER="${INSTALL_PREFIX}/bin/code-server"
|
||||
|
||||
# Install each extension...
|
||||
IFS=',' read -r -a EXTENSIONLIST <<< "$${EXTENSIONS}"
|
||||
for extension in "$${EXTENSIONLIST[@]}"; do
|
||||
if [ -z "$extension" ]; then
|
||||
continue
|
||||
fi
|
||||
printf "🧩 Installing extension $${CODE}$extension$${RESET}...\n"
|
||||
output=$($VSCODE_SERVER --install-extension "$extension" --force)
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed to install vscode-cli: $output"
|
||||
echo "Failed to install extension: $extension: $output"
|
||||
exit 1
|
||||
fi
|
||||
printf "🥳 vscode-cli has been installed.\n\n"
|
||||
done
|
||||
|
||||
# Check if the settings file exists...
|
||||
if [ ! -f ~/.vscode-server/data/Machine/settings.json ]; then
|
||||
echo "⚙️ Creating settings file..."
|
||||
mkdir -p ~/.vscode-server/data/Machine
|
||||
echo "${SETTINGS}" > ~/.vscode-server/data/Machine/settings.json
|
||||
fi
|
||||
|
||||
echo "👷 Running ${INSTALL_DIR}/bin/code serve-web --port ${PORT} --without-connection-token --accept-server-license-terms in the background..."
|
||||
echo "👷 Running ${INSTALL_PREFIX}/bin/code-server serve-local --port ${PORT} --host 127.0.0.1 --accept-server-license-terms serve-local --without-connection-token --telemetry-level ${TELEMETRY_LEVEL} in the background..."
|
||||
echo "Check logs at ${LOG_PATH}!"
|
||||
${INSTALL_DIR}/code serve-web --port ${PORT} --without-connection-token --accept-server-license-terms > ${LOG_PATH} 2>&1 &
|
||||
"${INSTALL_PREFIX}/bin/code-server" serve-local --port "${PORT}" --host 127.0.0.1 --accept-server-license-terms serve-local --without-connection-token --telemetry-level "${TELEMETRY_LEVEL}" > "${LOG_PATH}" 2>&1 &
|
||||
|
||||
Loading…
Reference in New Issue