server-deployment.yaml

# Copyright (c) 2020 Gitpod GmbH. All rights reserved.
# Licensed under the MIT License. See License-MIT.txt in the project root for license information.

{{ define "ws-manager-list" -}}
{{- $ := .root -}}
{{- $comp := .comp -}}
{{- if (and $comp.wsmanSkipSelf (eq (len $comp.wsman) 0)) -}}
manager: []
{{- else }}
manager:
{{- if not $comp.wsmanSkipSelf }}
- name: "{{ template "gitpod.installation.shortname" . }}"
  url: "dns:///ws-manager:8080"
  state: "available"
  maxScore: 100
  score: 50
  govern: true
  tls:
    ca: /ws-manager-client-tls-certs/ca.crt
    crt: /ws-manager-client-tls-certs/tls.crt
    key: /ws-manager-client-tls-certs/tls.key
{{- end }}
{{- range $_, $wsman := $comp.wsman }}
{{ "- " -}}
{{ $wsman | toYaml | indent 2 | trim }}
  tls:
    ca: /ws-manager-client-tls-certs/ca.crt
    crt: /ws-manager-client-tls-certs/tls.crt
    key: /ws-manager-client-tls-certs/tls.key
{{- end }}
{{- end -}}
{{- end -}}

{{ define "rate-limiter-config" -}}
groups:
  inWorkspaceUserAction:
    points: 10
    durationsSec: 2
functions:
  openPort:
    group: inWorkspaceUserAction
  closePort:
    group: inWorkspaceUserAction
  controlAdmission:
    group: inWorkspaceUserAction
  shareSnapshot:
    group: inWorkspaceUserAction
{{- end -}}

{{ $comp := .Values.components.server -}}
{{- $this := dict "root" . "gp" $.Values "comp" $comp -}}
{{- $thisWorkspace := dict "root" . "comp" .Values.components.workspace -}}
{{- if not $comp.disabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: server
  labels:
    app: {{ template "gitpod.fullname" . }}
    component: server
    kind: deployment
    stage: {{ .Values.installation.stage }}
spec:
  selector:
    matchLabels:
      app: {{ template "gitpod.fullname" . }}
      component: server
      kind: pod
      stage: {{ .Values.installation.stage }}
  replicas: {{ $comp.replicas | default 1 }}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      name: server
      labels:
        app: {{ template "gitpod.fullname" . }}
        component: server
        kind: pod
        stage: {{ .Values.installation.stage }}
    spec:
{{ include "gitpod.pod.affinity" $this | indent 6 }}
      serviceAccountName: server
      enableServiceLinks: false
      initContainers:
{{ include "gitpod.msgbusWaiter.container" $this | indent 6 }}
{{ include "gitpod.databaseWaiter.container" $this | indent 6 }}
      containers:
      - name: server
        image: {{ template "gitpod.comp.imageFull" $this }}
{{ include "gitpod.container.resources" $this | indent 8 }}
{{ include "gitpod.container.ports" $this | indent 8 }}
        securityContext:
          privileged: false
          runAsUser: 31001
        volumeMounts:
        - mountPath: /ws-manager-client-tls-certs
          name: ws-manager-client-tls-certs
          readOnly: true
{{- if $comp.github.app }}
        - name: github-app-cert-secret
          mountPath: "/github-app-cert"
          readOnly: true
{{- end }}
{{- if $comp.serverContainer.volumeMounts }}
{{ toYaml $comp.serverContainer.volumeMounts | indent 8 }}
{{- end }}
{{ include "gitpod.container.defaultEnv" $this | indent 8 }}
{{ include "gitpod.container.dbEnv" $this | indent 8 }}
{{ include "gitpod.container.tracingEnv" $this | indent 8 }}
{{ include "gitpod.container.analyticsEnv" $this | indent 8 }}
{{ include "gitpod.container.messagebusEnv" $this | indent 8 }}
        - name: RATE_LIMITER_CONFIG
          value: {{ (include "rate-limiter-config" $this) | fromYaml | toJson | quote }}
        - name: GITPOD_LICENSE
          value: "{{ .Values.license }}"
{{- if $comp.github.app }}
        - name: GITPOD_GITHUB_APP_ENABLED
          value: "{{ $comp.github.app.enabled | default "false" }}"
        - name: GITPOD_GITHUB_APP_ID
          value: "{{ $comp.github.app.appId }}"
        - name: GITPOD_GITHUB_APP_WEBHOOK_SECRET
          value: "{{ $comp.github.app.webhookSecret }}"
        - name: GITPOD_GITHUB_APP_AUTH_PROVIDER_ID
          value: "{{ $comp.github.app.authProviderId }}"
{{- if $comp.github.app.githubHost }}
        - name: GHE_HOST
          value: "{{ $comp.github.app.githubHost }}"
{{- end }}
        - name: GITPOD_GITHUB_APP_CERT_PATH
          value: "/github-app-cert/cert"
        - name: GITPOD_GITHUB_APP_MKT_NAME
          value: "{{ $comp.github.app.marketPlaceName }}"
{{- end }}
        - name: GITPOD_DEFINITELY_GP_DISABLED
          value: "{{ $comp.definitelyGpDisabled | default "false" }}"
        - name: NODE_ENV
          value: "{{ .Values.installation.stage }}"
        - name: SERVER_VERSION
          value: "{{ template "gitpod.comp.version" $this }}"
        - name: SHLVL
          value: "1"
        - name: THEIA_PORT
          value: "{{ .Values.components.workspace.ports.http.containerPort | toString }}"
        - name: THEIA_IMAGE_REPO
          value: "{{ template "gitpod.comp.imageRepo" (dict "root" . "gp" $.Values "comp" .Values.components.workspace.theiaImage) }}"
        - name: CODE_IMAGE_REPO
          value: "{{ template "gitpod.comp.imageRepo" (dict "root" . "gp" $.Values "comp" .Values.components.workspace.codeImage) }}"
        - name: EXPERIMENTAL_FEATURE_FLAGS
          value: {{ .Values.previewFeatureFlags | toJson | quote }}
        - name: WORKSPACE_DEFAULT_IMAGE
          value: "{{ template "gitpod.comp.imageFull" (dict "root" . "gp" $.Values "comp" .Values.components.workspace.defaultImage) }}"
        - name: IDE_IMAGE_ALIASES
          value: {{ (dict "code" (include "gitpod.comp.imageFull" (dict "root" . "gp" $.Values "comp" .Values.components.workspace.codeImage))) | toJson | quote }}
    {{- if $comp.blockNewUsers }}
        - name: BLOCK_NEW_USERS
          value: {{ $comp.blockNewUsers | quote }}
        - name: BLOCK_NEW_USERS_PASSLIST
          value: {{ $comp.blockNewUsersPasslist | toJson | quote }}
    {{- end }}
    {{- if $comp.makeNewUsersAdmin }}
        - name: MAKE_NEW_USERS_ADMIN
          value: {{ $comp.makeNewUsersAdmin | quote }}
    {{- end }}
    {{- if $comp.enableLocalApp }}
        - name: ENABLE_LOCAL_APP
          value: "true"
    {{- end }}
    {{- if $comp.enableOAuthServer }}
        - name: ENABLE_OAUTH_SERVER
          value: "true"
    {{- end }}
    {{- if $comp.portAccessForUsersOnly }}
        - name: PORT_ACCESS_FOR_USERS_ONLY
          value: "true"
    {{- end }}
    {{- if $comp.sessionMaxAgeMs }}
        - name: SESSION_MAX_AGE_MS
          value: {{ $comp.sessionMaxAgeMs | quote }}
    {{- end }}
        - name: SESSION_SECRET
          value: {{ $comp.sessionSecret | quote }}
    {{- if .Values.components.workspace.localTheia }}
        - name: LOCAL_THEIA
          value: "true"
    {{- end }}
    {{- if $comp.theiaPluginsBucketName }}
        - name: THEIA_PLUGINS_BUCKET_NAME_OVERRIDE
          value: {{ $comp.theiaPluginsBucketName }}
    {{- end }}
    {{- if .Values.devBranch }}
        - name: DEV_BRANCH
          value: "{{ .Values.devBranch }}"
    {{- end }}
        - name: WSMAN_CFG_MANAGERS
          value: {{ index (include "ws-manager-list" $this | fromYaml) "manager" | default list | toJson | b64enc | quote }}
        - name: GITPOD_BASEIMG_REGISTRY_WHITELIST
          value: {{ $comp.defaultBaseImageRegistryWhitelist | toJson | quote }}
        - name: GITPOD_DEFAULT_FEATURE_FLAGS
          value: {{ $comp.defaultFeatureFlags | toJson | quote }}
    {{- if $comp.incrementalPrebuilds.repositoryPasslist }}
        - name: INCREMENTAL_PREBUILDS_REPO_PASSLIST
          value: {{ $comp.incrementalPrebuilds.repositoryPasslist | toJson | quote }}
    {{- end }}
    {{- if $comp.incrementalPrebuilds.commitHistory }}
        - name: INCREMENTAL_PREBUILDS_COMMIT_HISTORY
          value: {{ $comp.incrementalPrebuilds.commitHistory | quote }}
    {{- end }}
        - name: AUTH_PROVIDERS_CONFIG
          valueFrom:
            configMapKeyRef:
              name: auth-providers-config
              key: auth-providers.json
        - name: BRANDING_CONFIG
          value: {{ .Values.branding | toJson | quote }}
    {{- if $comp.runDbDeleter }}
        - name: RUN_DB_DELETER
          value: {{ $comp.runDbDeleter | quote }}
    {{- end }}
        - name: SERVER_PROXY_APIKEY
          valueFrom:
            secretKeyRef:
              name: server-proxy-apikey
              key: apikey
        - name: GITPOD_GARBAGE_COLLECTION_DISABLED
          value: {{ $comp.garbageCollection.disabled | default "false" | quote }}
        - name: OAUTH_SERVER_JWT_SECRET
          value: {{ (randAlphaNum 20) | quote }}
{{- if $comp.serverContainer.env }}
{{ toYaml $comp.serverContainer.env | indent 8 }}
{{- end }}
{{ include "gitpod.kube-rbac-proxy" $this | indent 6 }}
      volumes:
      - name: ws-manager-client-tls-certs
        secret:
          secretName: {{ .Values.components.wsManager.tls.client.secretName }}
{{- if $comp.github.app }}
      - name: github-app-cert-secret
        secret:
          secretName: {{ $comp.github.app.appCert }}
{{- end }}
{{- if $comp.volumes }}
{{ toYaml $comp.volumes | indent 6 }}
{{- end }}
{{ toYaml .Values.defaults | indent 6 }}
{{ end }}