Enterprise Helm Save
Operate Coder v1 on Kubernetes
Project README
Coder Helm Chart
Coder moves developer workspaces to your cloud and centralizes their creation and management. Keep developers in flow with the power of the cloud and a superior developer experience.
The Coder Helm Chart is the best way to install and operate Coder on Kubernetes. It contains all the required components, and can scale to large deployments.
Getting Started
⚠️ Warning: This repository will not represent the latest Coder release. Reference our installation docs for instructions on a tagged release.
View our docs for detailed installation instructions.
Values
| Key | Type | Description | Default |
|---|---|---|---|
| certs | object | Certificate that will be mounted inside Coder services. | {"secret":{"key":"","name":""}} |
| certs.secret.key | string | Key pointing to a certificate in the secret. | "" |
| certs.secret.name | string | Name of the secret. | "" |
| coderd | object | Primary service responsible for all things Coder! | {"affinity":{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["coderd"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":1}]}},"alternateHostnames":[],"annotations":{},"builtinProviderServiceAccount":{"annotations":{},"labels":{},"migrate":true},"clientTLS":{"secretName":""},"devurlsHost":"","extraEnvs":[],"extraLabels":{},"image":"","imagePullSecret":"","liveness":{"failureThreshold":30,"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":3},"networkPolicy":{"enable":true},"oidc":{"enableRefresh":false,"redirectOptions":{}},"podSecurityContext":{"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}},"proxy":{"exempt":"cluster.local","http":"","https":""},"readiness":{"failureThreshold":15,"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":3},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1Gi"},"requests":{"cpu":"250m","memory":"512Mi"}},"reverseProxy":{"headers":[],"trustedOrigins":[]},"satellite":{"accessURL":"","enable":false,"primaryURL":""},"scim":{"authSecret":{"key":"secret","name":""},"enable":false},"securityContext":{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}},"serviceAnnotations":{},"serviceNodePorts":{"http":null,"https":null},"serviceSpec":{"externalTrafficPolicy":"Local","loadBalancerIP":"","loadBalancerSourceRanges":[],"type":"LoadBalancer"},"superAdmin":{"passwordSecret":{"key":"password","name":""}},"tls":{"devurlsHostSecretName":"","hostSecretName":""},"trustProxyIP":false,"workspaceServiceAccount":{"annotations":{},"labels":{}}} |
| coderd.affinity | object | Allows specifying an affinity rule for the coderd deployment. The default rule prefers to schedule coderd pods on different nodes, which is only applicable if coderd.replicas is greater than 1. |
{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/name","operator":"In","values":["coderd"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":1}]}} |
| coderd.alternateHostnames | list | A list of hostnames that coderd (including satellites) will allow for OIDC. If this list is not set, all OIDC traffic will go to the configured access URL in the admin settings on the dashboard (or the satellite's primary URL as configured by Helm). | [] |
| coderd.annotations | object | Apply annotations to the coderd deployment. https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ | {} |
| coderd.builtinProviderServiceAccount | object | Customize the built-in Kubernetes provider service account. | {"annotations":{},"labels":{},"migrate":true} |
| coderd.builtinProviderServiceAccount.annotations | object | A KV mapping of annotations. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ | {} |
| coderd.builtinProviderServiceAccount.labels | object | Add labels to the service account used for the built-in provider. | {} |
| coderd.builtinProviderServiceAccount.migrate | bool | Will migrate the built-in workspace provider using the coded environment. | true |
| coderd.clientTLS | object | Client-side TLS configuration for coderd. | {"secretName":""} |
| coderd.clientTLS.secretName | string | Secret containing a PEM encoded cert file. | "" |
| coderd.devurlsHost | string | Wildcard hostname to allow matching against custom-created dev URLs. Leaving as an empty string results in DevURLs being disabled. | "" |
| coderd.extraEnvs | list | Add additional environment variables to the coderd deployment containers. Overriding any environment variables that the Helm chart sets automatically is unsupported and will result in undefined behavior. You can find a list of the environment variables we set by default by inspecting the helm template files or by running kubectl describe against your existing coderd deployment. https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/ |
[] |
| coderd.extraLabels | object | Allows specifying additional labels to pods in the coderd deployment (.spec.template.metadata.labels). |
{} |
| coderd.image | string | Injected by Coder during release. | "" |
| coderd.imagePullSecret | string | The secret used for pulling the coderd image from a private registry. | "" |
| coderd.liveness | object | Configure the liveness check for the coderd service. | {"failureThreshold":30,"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":3} |
| coderd.networkPolicy | object | Configure the network policy to apply to coderd. | {"enable":true} |
| coderd.networkPolicy.enable | bool | Manage a network policy for coderd using Helm. If false, no policies will be created for the Coder control plane. | true |
| coderd.podSecurityContext | object | Fields related to the pod's security context (as opposed to the container). Some fields are also present in the container security context, which will take precedence over these values. | {"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}} |
| coderd.podSecurityContext.runAsGroup | int | Sets the group id of the pod. For security reasons, we recommend using a non-root group. | 1000 |
| coderd.podSecurityContext.runAsNonRoot | bool | Requires that containers in the pod run as an unprivileged user. If setting runAsUser to 0 (root), this will need to be set to false. | true |
| coderd.podSecurityContext.runAsUser | int | Sets the user id of the pod. For security reasons, we recommend using a non-root user. | 1000 |
| coderd.podSecurityContext.seccompProfile | object | Sets the seccomp profile for the pod. If set, the container security context setting will take precedence over this value. | {"type":"RuntimeDefault"} |
| coderd.proxy | object | Whether Coder should initiate outbound connections using a proxy. | {"exempt":"cluster.local","http":"","https":""} |
| coderd.proxy.exempt | string | Bypass the configured proxy rules for this comma-delimited list of hosts or prefixes. This corresponds to the no_proxy environment variable. | "cluster.local" |
| coderd.proxy.http | string | Proxy to use for HTTP connections. If unset, coderd will initiate HTTP connections directly. This corresponds to the http_proxy environment variable. | "" |
| coderd.proxy.https | string | Proxy to use for HTTPS connections. If this is not set, coderd will use the HTTP proxy (if set), otherwise it will initiate HTTPS connections directly. This corresponds to the https_proxy environment variable. | "" |
| coderd.readiness | object | Configure the readiness check for the coderd service. | {"failureThreshold":15,"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":3} |
| coderd.replicas | int | The number of Kubernetes Pod replicas. Consider increasing replicas as you add more nodes and more users are accessing Coder. | 1 |
| coderd.resources | object | Kubernetes resource specification for coderd pods. To unset a value, set it to "". To unset all values, set resources to nil. Consider increasing resources as more users are accessing Coder. | {"limits":{"cpu":"1000m","memory":"1Gi"},"requests":{"cpu":"250m","memory":"512Mi"}} |
| coderd.reverseProxy | object | Whether Coder should trust proxy headers for inbound connections, important for ensuring correct IP addresses when an Ingress Controller, service mesh, or other Layer 7 reverse proxy are deployed in front of Coder. | {"headers":[],"trustedOrigins":[]} |
| coderd.reverseProxy.headers | list | A list of trusted headers. | [] |
| coderd.reverseProxy.trustedOrigins | list | A list of IPv4 or IPv6 subnets to consider trusted, specified in CIDR format. If hosts are part of a matching network, the configured headers will be trusted; otherwise, coderd will rely on the connecting client IP address. | [] |
| coderd.satellite | object | Deploy a satellite to geodistribute access to workspaces for lower latency. | {"accessURL":"","enable":false,"primaryURL":""} |
| coderd.satellite.accessURL | string | URL of the satellite that clients will connect to. e.g. https://sydney.coder.myorg.com | "" |
| coderd.satellite.enable | bool | Run coderd as a satellite pointing to a primary deployment. Satellite enable low-latency access to workspaces all over the world. Read more: https://coder.com/docs/coder/latest/admin/satellites | false |
| coderd.satellite.primaryURL | string | URL of the primary Coder deployment. Must be accessible from the satellite and clients. eg. https://coder.myorg.com | "" |
| coderd.scim.authSecret.key | string | The key of the secret that contains the SCIM auth header. | "secret" |
| coderd.scim.authSecret.name | string | Name of a secret that should be used to determine the auth header used for the SCIM server. The secret should be contained in the field secret, or the manually specified one. |
"" |
| coderd.scim.enable | bool | Enable SCIM support in coderd. SCIM allows you to automatically provision/deprovision users. If true, authSecret.name must be set. | false |
| coderd.securityContext | object | Fields related to the container's security context (as opposed to the pod). Some fields are also present in the pod security context, in which case these values will take precedence. | {"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}} |
| coderd.securityContext.allowPrivilegeEscalation | bool | Controls whether the container can gain additional privileges, such as escalating to root. It is recommended to leave this setting disabled in production. | false |
| coderd.securityContext.readOnlyRootFilesystem | bool | Mounts the container's root filesystem as read-only. It is recommended to leave this setting enabled in production. This will override the same setting in the pod | true |
| coderd.securityContext.runAsGroup | int | Sets the group id of the pod. For security reasons, we recommend using a non-root group. | 1000 |
| coderd.securityContext.runAsNonRoot | bool | Requires that the coderd and migrations containers run as an unprivileged user. If setting runAsUser to 0 (root), this will need to be set to false. | true |
| coderd.securityContext.runAsUser | int | Sets the user id of the pod. For security reasons, we recommend using a non-root user. | 1000 |
| coderd.securityContext.seccompProfile | object | Sets the seccomp profile for the migration and runtime containers. | {"type":"RuntimeDefault"} |
| coderd.serviceAnnotations | object | Apply annotations to the coderd service. https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ | {} |
| coderd.serviceNodePorts | object | Allows manually setting static node ports for the coderd service. This is only helpful if static ports are required, and usually should be left alone. By default these are dynamically chosen. | {"http":null,"https":null} |
| coderd.serviceNodePorts.http | string | Sets a static 'coderd' service non-TLS nodePort. This should usually be omitted. | nil |
| coderd.serviceNodePorts.https | string | Sets a static 'coderd' service TLS nodePort This should usually be omitted. | nil |
| coderd.serviceSpec | object | Specification to inject for the coderd service. See: https://kubernetes.io/docs/concepts/services-networking/service/ | {"externalTrafficPolicy":"Local","loadBalancerIP":"","loadBalancerSourceRanges":[],"type":"LoadBalancer"} |
| coderd.serviceSpec.externalTrafficPolicy | string | Set the traffic policy for the service. See: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip | "Local" |
| coderd.serviceSpec.loadBalancerIP | string | Set the IP address of the coderd service. | "" |
| coderd.serviceSpec.loadBalancerSourceRanges | list | Traffic through the LoadBalancer will be restricted to the specified client IPs. This field will be ignored if the cloud provider does not support this feature. | [] |
| coderd.serviceSpec.type | string | Set the type of Service. See: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types | "LoadBalancer" |
| coderd.superAdmin.passwordSecret.key | string | The key of the secret that contains the super admin password. | "password" |
| coderd.superAdmin.passwordSecret.name | string | Name of a secret that should be used to determine the password for the super admin account. The password should be contained in the field password, or the manually specified one. |
"" |
| coderd.tls | object | TLS configuration for coderd. These options will override dashboard configuration. | {"devurlsHostSecretName":"","hostSecretName":""} |
| coderd.tls.devurlsHostSecretName | string | The secret to use for DevURL TLS. | "" |
| coderd.tls.hostSecretName | string | The secret to use for TLS. | "" |
| coderd.trustProxyIP | bool | Configures Coder to accept X-Real-IP and X-Forwarded-For headers from any origin. This option is deprecated and will be removed in a future release. Use the coderd.reverseProxy setting instead, which supports configuring an allowlist of trusted origins. | false |
| coderd.workspaceServiceAccount | object | Customize the default service account used for workspaces. | {"annotations":{},"labels":{}} |
| coderd.workspaceServiceAccount.annotations | object | A KV mapping of annotations. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ | {} |
| coderd.workspaceServiceAccount.labels | object | Add labels to the service account used for workspaces. | {} |
| envbox | object | Required for running Docker inside containers. See requirements: https://coder.com/docs/coder/latest/admin/workspace-management/cvms | {"image":""} |
| envbox.image | string | Injected by Coder during release. | "" |
| ingress | object | Configure an Ingress to route traffic to Coder services. | {"annotations":{"nginx.ingress.kubernetes.io/proxy-body-size":"0"},"className":"","enable":false,"host":"","tls":{"enable":false}} |
| ingress.annotations | object | Additional annotations to add to the Ingress object. The behavior is typically dependent on the Ingress Controller implementation, and useful for managing features like TLS termination. | {"nginx.ingress.kubernetes.io/proxy-body-size":"0"} |
| ingress.className | string | The ingressClassName to set on the Ingress. | "" |
| ingress.enable | bool | A boolean controlling whether to create an Ingress. | false |
| ingress.host | string | The hostname to proxy to the Coder installation. The cluster Ingress Controller typically uses server name indication or the HTTP Host header to route traffic. The dev URLs hostname is specified in coderd.devurlsHost. | "" |
| ingress.tls | object | Configures TLS settings for the Ingress. TLS certificates are specified in coderd.tls.hostSecretName and coderd.tls.devurlsHostSecretName. | {"enable":false} |
| ingress.tls.enable | bool | Determines whether the Ingress handles TLS. | false |
| logging | object | Configures the logging format and output of Coder. | {"human":"/dev/stderr","json":"","splunk":{"channel":"","token":"","url":""},"stackdriver":"","verbose":true} |
| logging.human | string | Location to send logs that are formatted for readability. Set to an empty string to disable. | "/dev/stderr" |
| logging.json | string | Location to send logs that are formatted as JSON. Set to an empty string to disable. | "" |
| logging.splunk | object | Coder can send logs directly to Splunk in addition to file-based output. | {"channel":"","token":"","url":""} |
| logging.splunk.token | string | Splunk HEC collector token. | "" |
| logging.splunk.url | string | Splunk HEC collector endpoint. | "" |
| logging.stackdriver | string | Location to send logs that are formatted for Google Stackdriver. Set to an empty string to disable. | "" |
| logging.verbose | bool | Toggles coderd debug logging. | true |
| metrics | object | Configure various metrics to gain observability into Coder. | {"amplitudeKey":""} |
| metrics.amplitudeKey | string | Enables telemetry pushing to Amplitude. Amplitude records how users interact with Coder, which is used to improve the product. No events store any personal information. Amplitude can be found here: https://amplitude.com/ Keep empty to disable. | "" |
| postgres.connector | string | Option for configuring database connector type. valid values are: - "postgres" -- default connector - "awsiamrds" -- uses AWS IAM account in environment to authenticate using IAM to connect to an RDS instance. | "postgres" |
| postgres.database | string | Name of the database that Coder will use. You must create this database first. | "" |
| postgres.default | object | Configure a built-in PostgreSQL deployment. | {"annotations":{},"enable":true,"image":"","networkPolicy":{"enable":true},"resources":{"limits":{"cpu":"250m","memory":"1Gi"},"requests":{"cpu":"250m","memory":"1Gi","storage":"10Gi"}},"storageClassName":""} |
| postgres.default.annotations | object | Apply annotations to the default postgres service. https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ | {} |
| postgres.default.enable | bool | Deploys a PostgreSQL instance. We recommend using an external PostgreSQL instance in production. If true, all other values are ignored. | true |
| postgres.default.image | string | Injected by Coder during release. | "" |
| postgres.default.networkPolicy | object | Configure the network policy to apply to the built-in PostgreSQL deployment. | {"enable":true} |
| postgres.default.networkPolicy.enable | bool | Manage a network policy for PostgreSQL using Helm. If false, no policies will be created for the built-in database. | true |
| postgres.default.resources | object | Kubernetes resource specification for the PostgreSQL pod. To unset a value, set it to "". To unset all values, set resources to nil. | {"limits":{"cpu":"250m","memory":"1Gi"},"requests":{"cpu":"250m","memory":"1Gi","storage":"10Gi"}} |
| postgres.default.resources.requests.storage | string | Specifies the size of the volume claim for persisting the database. | "10Gi" |
| postgres.default.storageClassName | string | Set the storageClass to store the database. | "" |
| postgres.host | string | Host of the external PostgreSQL instance. | "" |
| postgres.noPasswordEnv | bool | If enabled, passwordSecret will be specified as a volumeMount and the env DB_PASSWORD_PATH will be set instead to point to that location. The default behaviour is to set the environment variable DB_PASSWORD to the value of the postgres password secret. |
false |
| postgres.passwordSecret | string | Name of an existing secret in the current namespace with the password of the PostgreSQL instance. The password must be contained in the secret field password. This should be set to an empty string if the database does not require a password to connect. |
"" |
| postgres.port | string | Port of the external PostgreSQL instance. | "" |
| postgres.searchPath | string | Optional. Schema for coder tables in the external PostgresSQL instance. This changes the 'search_path' client configuration option (https://www.postgresql.org/docs/current/runtime-config-client.html). By default, the 'public' schema will be used. | "" |
| postgres.ssl | object | Options for configuring the SSL cert, key, and root cert when connecting to Postgres. | {"certSecret":{"key":"","name":""},"keySecret":{"key":"","name":""},"rootCertSecret":{"key":"","name":""}} |
| postgres.ssl.certSecret | object | Secret containing a PEM encoded cert file. | {"key":"","name":""} |
| postgres.ssl.certSecret.key | string | Key pointing to a certificate in the secret. | "" |
| postgres.ssl.certSecret.name | string | Name of the secret. | "" |
| postgres.ssl.keySecret | object | Secret containing a PEM encoded key file. | {"key":"","name":""} |
| postgres.ssl.keySecret.key | string | Key pointing to a certificate in the secret. | "" |
| postgres.ssl.keySecret.name | string | Name of the secret. | "" |
| postgres.ssl.rootCertSecret | object | Secret containing a PEM encoded root cert file. | {"key":"","name":""} |
| postgres.ssl.rootCertSecret.key | string | Key pointing to a certificate in the secret. | "" |
| postgres.ssl.rootCertSecret.name | string | Name of the secret. | "" |
| postgres.sslMode | string | Provides variable levels of protection for the PostgreSQL connection. For acceptable values, see: https://www.postgresql.org/docs/11/libpq-ssl.html | "require" |
| postgres.user | string | User of the external PostgreSQL instance. | "" |
| services | object | Kubernetes Service configuration that applies to Coder services. | {"annotations":{},"clusterDomainSuffix":".svc.cluster.local","nodeSelector":{"kubernetes.io/arch":"amd64","kubernetes.io/os":"linux"},"tolerations":[],"type":"ClusterIP"} |
| services.annotations | object | A KV mapping of annotations. See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ DEPRECATED -- Please use the annotations value for each object. | {} |
| services.clusterDomainSuffix | string | Custom domain suffix for DNS resolution in your cluster. See: https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/ | ".svc.cluster.local" |
| services.nodeSelector | object | See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector | {"kubernetes.io/arch":"amd64","kubernetes.io/os":"linux"} |
| services.tolerations | list | Each element is a toleration object. See: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ | [] |
| services.type | string | See the following for configurable types: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types | "ClusterIP" |
Contributing
Thanks for considering a contribution to this Chart! Please see CONTRIBUTING.md for our conventions and practices.
Support
If you experience issues, have feedback, or want to ask a question, open an issue or pull request in this repository. Feel free to contact us instead.
Copyright and License
Copyright (C) 2020-2022 Coder Technologies Inc.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.
Open Source Agenda is not affiliated with "Enterprise Helm" Project. README Source: coder/enterprise-helm
Stars
44
Open Issues
12
Last Commit
3 months ago
Repository
License
Tags
Open Source Agenda Badge
