Skip to content

Commit ec2f934

Browse files
nandajavarmaroboquat
nandajavarma
authored and
roboquat
committed
[installer] move workspaceImage out of experimental config
1 parent c582420 commit ec2f934

File tree

7 files changed

+144
-47
lines changed

7 files changed

+144
-47
lines changed

‎install/installer/pkg/components/server/configmap.go

+8-15
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,10 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
3737
license = licenseFilePath
3838
}
3939

40-
workspaceImage := ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, ""), workspace.DefaultWorkspaceImage, workspace.DefaultWorkspaceImageVersion)
41-
_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
42-
if cfg.WebApp != nil && cfg.WebApp.Server != nil && cfg.WebApp.Server.WorkspaceDefaults.WorkspaceImage != "" {
43-
workspaceImage = cfg.WebApp.Server.WorkspaceDefaults.WorkspaceImage
44-
}
45-
return nil
46-
})
40+
workspaceImage := ctx.Config.Workspace.WorkspaceImage
41+
if workspaceImage == "" {
42+
workspaceImage = ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, ""), workspace.DefaultWorkspaceImage, workspace.DefaultWorkspaceImageVersion)
43+
}
4744

4845
sessionSecret := "Important!Really-Change-This-Key!"
4946
_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
@@ -78,14 +75,10 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
7875
})
7976

8077
defaultBaseImageRegistryWhitelist := []string{}
81-
_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
82-
if cfg.WebApp != nil && cfg.WebApp.Server != nil {
83-
if cfg.WebApp.Server.DefaultBaseImageRegistryWhiteList != nil {
84-
defaultBaseImageRegistryWhitelist = cfg.WebApp.Server.DefaultBaseImageRegistryWhiteList
85-
}
86-
}
87-
return nil
88-
})
78+
allowList := ctx.Config.ContainerRegistry.PrivateBaseImageAllowList
79+
if len(allowList) > 0 {
80+
defaultBaseImageRegistryWhitelist = allowList
81+
}
8982

9083
chargebeeSecret := ""
9184
_ = ctx.WithExperimental(func(cfg *experimental.Config) error {

‎install/installer/pkg/components/server/configmap_test.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -53,17 +53,19 @@ func TestConfigMap(t *testing.T) {
5353
}
5454

5555
ctx, err := common.NewRenderContext(config.Config{
56+
Workspace: config.Workspace{
57+
WorkspaceImage: expectation.WorkspaceImage,
58+
},
59+
ContainerRegistry: config.ContainerRegistry{
60+
PrivateBaseImageAllowList: expectation.DefaultBaseImageRegistryWhiteList,
61+
},
5662
Experimental: &experimental.Config{
5763
WebApp: &experimental.WebAppConfig{
5864
Server: &experimental.ServerConfig{
5965
DisableDynamicAuthProviderLogin: expectation.DisableDynamicAuthProviderLogin,
6066
EnableLocalApp: pointer.Bool(expectation.EnableLocalApp),
6167
RunDbDeleter: pointer.Bool(expectation.RunDbDeleter),
6268
DisableWorkspaceGarbageCollection: expectation.DisableWorkspaceGarbageCollection,
63-
DefaultBaseImageRegistryWhiteList: expectation.DefaultBaseImageRegistryWhiteList,
64-
WorkspaceDefaults: experimental.WorkspaceDefaults{
65-
WorkspaceImage: expectation.WorkspaceImage,
66-
},
6769
OAuthServer: experimental.OAuthServer{
6870
JWTSecret: expectation.JWTSecret,
6971
},

‎install/installer/pkg/config/v1/config.go

+50-17
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ func (v version) Defaults(in interface{}) error {
5656
},
5757
}
5858
cfg.ContainerRegistry.InCluster = pointer.Bool(true)
59+
cfg.ContainerRegistry.PrivateBaseImageAllowList = []string{}
5960
cfg.Workspace.Resources.Requests = corev1.ResourceList{
6061
corev1.ResourceCPU: resource.MustParse("1000m"),
6162
corev1.ResourceMemory: resource.MustParse("2Gi"),
@@ -78,23 +79,52 @@ func (v version) CheckDeprecated(rawCfg interface{}) (map[string]interface{}, []
7879
conflicts := make([]string, 0)
7980
cfg := rawCfg.(*Config)
8081

81-
if cfg.Experimental != nil && cfg.Experimental.WebApp != nil && cfg.Experimental.WebApp.ProxyConfig != nil && cfg.Experimental.WebApp.ProxyConfig.ServiceType != nil {
82-
warnings["experimental.webapp.proxy.serviceType"] = *cfg.Experimental.WebApp.ProxyConfig.ServiceType
83-
84-
if cfg.Components != nil && cfg.Components.Proxy != nil && cfg.Components.Proxy.Service != nil && cfg.Components.Proxy.Service.ServiceType != nil {
85-
conflicts = append(conflicts, "Cannot set proxy service type in both components and experimental")
86-
} else {
87-
// Promote the experimental value to the components
88-
if cfg.Components == nil {
89-
cfg.Components = &Components{}
82+
if cfg.Experimental != nil && cfg.Experimental.WebApp != nil {
83+
// service type of proxy is now configurable from main config
84+
if cfg.Experimental.WebApp.ProxyConfig != nil && cfg.Experimental.WebApp.ProxyConfig.ServiceType != nil {
85+
warnings["experimental.webapp.proxy.serviceType"] = *cfg.Experimental.WebApp.ProxyConfig.ServiceType
86+
87+
if cfg.Components != nil && cfg.Components.Proxy != nil && cfg.Components.Proxy.Service != nil && cfg.Components.Proxy.Service.ServiceType != nil {
88+
conflicts = append(conflicts, "Cannot set proxy service type in both components and experimental")
89+
} else {
90+
// Promote the experimental value to the components
91+
if cfg.Components == nil {
92+
cfg.Components = &Components{}
93+
}
94+
if cfg.Components.Proxy == nil {
95+
cfg.Components.Proxy = &ProxyComponent{}
96+
}
97+
if cfg.Components.Proxy.Service == nil {
98+
cfg.Components.Proxy.Service = &ComponentTypeService{}
99+
}
100+
cfg.Components.Proxy.Service.ServiceType = cfg.Experimental.WebApp.ProxyConfig.ServiceType
90101
}
91-
if cfg.Components.Proxy == nil {
92-
cfg.Components.Proxy = &ProxyComponent{}
102+
}
103+
104+
// default workspace base image is now configurable from main config
105+
if cfg.Experimental.WebApp.Server != nil {
106+
107+
workspaceImage := cfg.Experimental.WebApp.Server.WorkspaceDefaults.WorkspaceImage
108+
if workspaceImage != "" {
109+
warnings["experimental.webapp.server.workspaceDefaults.workspaceImage"] = workspaceImage
110+
111+
if cfg.Workspace.WorkspaceImage != "" {
112+
conflicts = append(conflicts, "Cannot set default workspace image in both workspaces and experimental")
113+
} else {
114+
cfg.Workspace.WorkspaceImage = workspaceImage
115+
}
93116
}
94-
if cfg.Components.Proxy.Service == nil {
95-
cfg.Components.Proxy.Service = &ComponentTypeService{}
117+
118+
registryAllowList := cfg.Experimental.WebApp.Server.DefaultBaseImageRegistryWhiteList
119+
if registryAllowList != nil {
120+
warnings["experimental.webapp.server.defaultBaseImageRegistryWhitelist"] = registryAllowList
121+
122+
if len(cfg.ContainerRegistry.PrivateBaseImageAllowList) > 0 {
123+
conflicts = append(conflicts, "Cannot set allow list for private base image in both containerRegistry and experimental")
124+
} else {
125+
cfg.ContainerRegistry.PrivateBaseImageAllowList = registryAllowList
126+
}
96127
}
97-
cfg.Components.Proxy.Service.ServiceType = cfg.Experimental.WebApp.ProxyConfig.ServiceType
98128
}
99129
}
100130

@@ -235,9 +265,10 @@ const (
235265
)
236266

237267
type ContainerRegistry struct {
238-
InCluster *bool `json:"inCluster,omitempty" validate:"required"`
239-
External *ContainerRegistryExternal `json:"external,omitempty" validate:"required_if=InCluster false"`
240-
S3Storage *S3Storage `json:"s3storage,omitempty"`
268+
InCluster *bool `json:"inCluster,omitempty" validate:"required"`
269+
External *ContainerRegistryExternal `json:"external,omitempty" validate:"required_if=InCluster false"`
270+
S3Storage *S3Storage `json:"s3storage,omitempty"`
271+
PrivateBaseImageAllowList []string `json:"privateBaseImageAllowList"`
241272
}
242273

243274
type ContainerRegistryExternal struct {
@@ -320,6 +351,8 @@ type Workspace struct {
320351

321352
// TimeoutAfterClose is the time a workspace timed out after it has been closed (“closed” means that it does not get a heartbeat from an IDE anymore)
322353
TimeoutAfterClose *util.Duration `json:"timeoutAfterClose,omitempty"`
354+
355+
WorkspaceImage string `json:"workspaceImage,omitempty"`
323356
}
324357

325358
type OpenVSX struct {

‎install/installer/pkg/config/v1/config.md

+73-7
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Config defines the v1 version structure of the gitpod config file
99
|`kind`|string|N| `Meta`, `Workspace`, `Full` ||
1010
|`domain`|string|Y| | The domain to deploy to|
1111
|`metadata.region`|string|Y| | Location for your objectStorage provider|
12+
|`metadata.shortname`|string|N| | InstallationShortname establishes the "identity" of the (application) cluster.|
1213
|`repository`|string|Y| ||
1314
|`observability.logLevel`|string|N| `trace`, `debug`, `info`, `warning`, `error`, `fatal`, `panic` |Taken from github.com/gitpod-io/gitpod/components/gitpod-protocol/src/util/logging.ts|
1415
|`observability.tracing.endpoint`|string|N| ||
@@ -25,18 +26,27 @@ Config defines the v1 version structure of the gitpod config file
2526
|`objectStorage.s3.endpoint`|string|Y| ||
2627
|`objectStorage.s3.credentials.kind`|string|N| `secret` ||
2728
|`objectStorage.s3.credentials.name`|string|Y| ||
29+
|`objectStorage.s3.bucket`|string|N| | BucketName sets the name of an existing bucket to enable the "single bucket mode" If no name is configured, the old "one bucket per user" behaviour kicks in.|
2830
|`objectStorage.cloudStorage.serviceAccount.kind`|string|N| `secret` ||
2931
|`objectStorage.cloudStorage.serviceAccount.name`|string|Y| ||
3032
|`objectStorage.cloudStorage.project`|string|Y| ||
3133
|`objectStorage.azure.credentials.kind`|string|N| `secret` ||
3234
|`objectStorage.azure.credentials.name`|string|Y| ||
35+
|`objectStorage.maximumBackupCount`|int|N| ||
36+
|`objectStorage.blobQuota`|int64|N| ||
37+
|`objectStorage.resources.requests`||Y| | todo(sje): add custom validation to corev1.ResourceList|
38+
|`objectStorage.resources.limits`||N| ||
39+
|`objectStorage.resources.dynamicLimits`||N| ||
3340
|`containerRegistry.inCluster`|bool|Y| ||
3441
|`containerRegistry.external.url`|string|Y| ||
3542
|`containerRegistry.external.certificate.kind`|string|N| `secret` ||
3643
|`containerRegistry.external.certificate.name`|string|Y| ||
3744
|`containerRegistry.s3storage.bucket`|string|Y| ||
45+
|`containerRegistry.s3storage.region`|string|Y| ||
46+
|`containerRegistry.s3storage.endpoint`|string|Y| ||
3847
|`containerRegistry.s3storage.certificate.kind`|string|N| `secret` ||
3948
|`containerRegistry.s3storage.certificate.name`|string|Y| ||
49+
|`containerRegistry.privateBaseImageAllowList[ ]`|[]string|N| ||
4050
|`certificate.kind`|string|N| `secret` ||
4151
|`certificate.name`|string|Y| ||
4252
|`imagePullSecrets[ ].kind`|string|N| `secret` ||
@@ -49,14 +59,16 @@ Config defines the v1 version structure of the gitpod config file
4959
|`workspace.resources.dynamicLimits`||N| ||
5060
|`workspace.templates.default`||N| ||
5161
|`workspace.templates.prebuild`||N| ||
52-
|`workspace.templates.ghost`||N| ||
5362
|`workspace.templates.imagebuild`||N| ||
5463
|`workspace.templates.regular`||N| ||
55-
|`workspace.templates.probe`||N| ||
64+
|`workspace.pvc.size`||Y| | Size is a size of persistent volume claim to use|
65+
|`workspace.pvc.storageClass`|string|N| | StorageClass is a storage class of persistent volume claim to use|
66+
|`workspace.pvc.snapshotClass`|string|N| | SnapshotClass is a snapshot class name that is used to create volume snapshot|
5667
|`workspace.maxLifetime`||Y| | MaxLifetime is the maximum time a workspace is allowed to run. After that, the workspace times out despite activity|
5768
|`workspace.timeoutDefault`||N| | TimeoutDefault is the default timeout of a regular workspace|
5869
|`workspace.timeoutExtended`||N| | TimeoutExtended is the workspace timeout that a user can extend to for one workspace|
5970
|`workspace.timeoutAfterClose`||N| | TimeoutAfterClose is the time a workspace timed out after it has been closed (“closed” means that it does not get a heartbeat from an IDE anymore)|
71+
|`workspace.workspaceImage`|string|N| ||
6072
|`openVSX.url`|string|N| ||
6173
|`authProviders[ ].kind`|string|N| `secret` ||
6274
|`authProviders[ ].name`|string|Y| ||
@@ -67,6 +79,11 @@ Config defines the v1 version structure of the gitpod config file
6779
|`sshGatewayHostKey.kind`|string|N| `secret` ||
6880
|`sshGatewayHostKey.name`|string|Y| ||
6981
|`disableDefinitelyGp`|bool|N| ||
82+
|`customCACert.kind`|string|N| `secret` ||
83+
|`customCACert.name`|string|Y| ||
84+
|`dropImageRepo`|bool|N| ||
85+
|`customization`||N| ||
86+
|`components.proxy.service.serviceType`||N| ||
7087
|`apiVersion`|string|Y| |API version of the Gitpod config defintion. `v1` in this version of Config|
7188

7289

@@ -80,9 +97,58 @@ Additional config parameters that are in experimental state
8097
|`experimental.workspace.tracing.samplerType`|string|N| `const`, `probabilistic`, `rateLimiting`, `remote` |Values taken from https://github.com/jaegertracing/jaeger-client-go/blob/967f9c36f0fa5a2617c9a0993b03f9a3279fadc8/config/config.go#L71|
8198
|`experimental.workspace.tracing.samplerParam`|float64|N| ||
8299
|`experimental.workspace.stage`|string|N| ||
83-
|`experimental.workspace.stage`|string|N| ||
100+
|`experimental.workspace.schedulerName`|string|N| ||
101+
|`experimental.workspace.hostURL`|string|N| ||
102+
|`experimental.workspace.workspaceClusterHost`|string|N| ||
103+
|`experimental.workspace.workspaceURLTemplate`|string|N| ||
104+
|`experimental.workspace.workspacePortURLTemplate`|string|N| ||
105+
|`experimental.workspace.workspacePortURLTemplate`|string|N| ||
106+
|`experimental.workspace.ioLimits`||N| ||
107+
|`experimental.workspace.procLimit`|int64|N| ||
108+
|`experimental.workspace.wsManagerRateLimits`||N| ||
84109
|`experimental.workspace.registryFacade`||N| ||
85-
|`experimental.webapp`|WebAppConfig|N| ||
86-
|`experimental.ide`|IDEConfig|N| ||
87-
88-
110+
|`experimental.workspace.wsDaemon`||N| ||
111+
|`experimental.workspace.classes`||N| ||
112+
|`experimental.workspace.wsProxy`||N| ||
113+
|`experimental.webapp.publicApi.enabled`|bool|N| ||
114+
|`experimental.webapp.server.workspaceDefaults.workspaceImage`|string|N| | @deprecated use workspace.workspaceImage instead|
115+
|`experimental.webapp.server.oauthServer.jwtSecret`|string|N| ||
116+
|`experimental.webapp.server.session.secret`|string|N| ||
117+
|`experimental.webapp.server.githubApp.appId`|int32|N| ||
118+
|`experimental.webapp.server.githubApp.authProviderId`|string|N| ||
119+
|`experimental.webapp.server.githubApp.baseUrl`|string|N| ||
120+
|`experimental.webapp.server.githubApp.certPath`|string|N| ||
121+
|`experimental.webapp.server.githubApp.enabled`|bool|N| ||
122+
|`experimental.webapp.server.githubApp.logLevel`|string|N| ||
123+
|`experimental.webapp.server.githubApp.marketplaceName`|string|N| ||
124+
|`experimental.webapp.server.githubApp.webhookSecret`|string|N| ||
125+
|`experimental.webapp.server.githubApp.certSecretName`|string|N| ||
126+
|`experimental.webapp.server.chargebeeSecret`|string|N| ||
127+
|`experimental.webapp.server.stripeSecret`|string|N| ||
128+
|`experimental.webapp.server.stripeConfig`|string|N| ||
129+
|`experimental.webapp.server.disableDynamicAuthProviderLogin`|bool|N| ||
130+
|`experimental.webapp.server.enableLocalApp`|bool|N| ||
131+
|`experimental.webapp.server.runDbDeleter`|bool|N| ||
132+
|`experimental.webapp.server.defaultBaseImageRegistryWhitelist[ ]`|[]string|N| | @deprecated use containerRegistry.privateBaseImageAllowList instead|
133+
|`experimental.webapp.server.disableWorkspaceGarbageCollection`|bool|N| ||
134+
|`experimental.webapp.server.blockedRepositories[ ].urlRegExp`|string|N| ||
135+
|`experimental.webapp.server.blockedRepositories[ ].blockUser`|bool|N| ||
136+
|`experimental.webapp.proxy.staticIP`|string|N| ||
137+
|`experimental.webapp.proxy.serviceAnnotations`||N| ||
138+
|`experimental.webapp.proxy.serviceType`||N| | @deprecated use components.proxy.service.serviceType instead|
139+
|`experimental.webapp.wsManagerBridge.skipSelf`|bool|N| ||
140+
|`experimental.webapp.tracing.samplerType`|string|N| `const`, `probabilistic`, `rateLimiting`, `remote` |Values taken from https://github.com/jaegertracing/jaeger-client-go/blob/967f9c36f0fa5a2617c9a0993b03f9a3279fadc8/config/config.go#L71|
141+
|`experimental.webapp.tracing.samplerParam`|float64|N| ||
142+
|`experimental.webapp.usePodAntiAffinity`|bool|N| ||
143+
|`experimental.webapp.disableMigration`|bool|N| ||
144+
|`experimental.webapp.usage.enabled`|bool|N| ||
145+
|`experimental.webapp.usage.schedule`|string|N| ||
146+
|`experimental.webapp.usage.creditsPerMinuteByWorkspaceClass`||N| ||
147+
|`experimental.webapp.configcatKey`|string|N| ||
148+
|`experimental.ide.resolveLatest`|bool|N| | Disable resolution of latest images and use bundled latest versions instead|
149+
|`experimental.ide.ideProxy.serviceAnnotations`||N| ||
150+
|`experimental.ide.openvsxProxy.serviceAnnotations`||N| ||
151+
|`experimental.common.podConfig`||N| ||
152+
|`experimental.common.staticMessagebusPassword`|string|N| ||
153+
|`experimental.telemetry.data`||N| ||
154+
|`experimental.agentSmith`||N| ||

‎install/installer/pkg/config/v1/experimental/experimental.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,7 @@ type WebAppConfig struct {
147147
}
148148

149149
type WorkspaceDefaults struct {
150+
// @deprecated use workspace.workspaceImage instead
150151
WorkspaceImage string `json:"workspaceImage"`
151152
}
152153

@@ -185,8 +186,10 @@ type ServerConfig struct {
185186
DisableDynamicAuthProviderLogin bool `json:"disableDynamicAuthProviderLogin"`
186187
EnableLocalApp *bool `json:"enableLocalApp"`
187188
RunDbDeleter *bool `json:"runDbDeleter"`
188-
DefaultBaseImageRegistryWhiteList []string `json:"defaultBaseImageRegistryWhitelist"`
189189
DisableWorkspaceGarbageCollection bool `json:"disableWorkspaceGarbageCollection"`
190+
191+
// @deprecated use containerRegistry.privateBaseImageAllowList instead
192+
DefaultBaseImageRegistryWhiteList []string `json:"defaultBaseImageRegistryWhitelist"`
190193
}
191194

192195
type ProxyConfig struct {

‎install/kots/manifests/gitpod-installation-status.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ spec:
3030
containers:
3131
- name: installation-status
3232
# This will normally be the release tag
33-
image: "eu.gcr.io/gitpod-core-dev/build/installer:sje-installer-post-process.6"
33+
image: "eu.gcr.io/gitpod-core-dev/build/installer:nvn-fix-11408.15"
3434
command:
3535
- /bin/sh
3636
- -c

‎install/kots/manifests/gitpod-installer-job.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ spec:
2828
containers:
2929
- name: installer
3030
# This will normally be the release tag
31-
image: "eu.gcr.io/gitpod-core-dev/build/installer:sje-installer-post-process.6"
31+
image: "eu.gcr.io/gitpod-core-dev/build/installer:nvn-fix-11408.15"
3232
volumeMounts:
3333
- mountPath: /config-patch
3434
name: config-patch
@@ -156,7 +156,7 @@ spec:
156156
echo "{{repl LocalRegistryImagePullSecret }}" | base64 -d > /tmp/kotsregistry.json
157157
158158
# Add the registries to the server allowlist
159-
yq e -i ".experimental.webApp.server.defaultBaseImageRegistryWhitelist += $(cat /tmp/kotsregistry.json | jq '.auths' | jq -rc 'keys')" "${CONFIG_FILE}"
159+
yq e -i ".containerRegistry.privateBaseImageAllowList += $(cat /tmp/kotsregistry.json | jq '.auths' | jq -rc 'keys')" "${CONFIG_FILE}"
160160
161161
if [ '{{repl ConfigOptionEquals "reg_incluster" "0" }}' = "true" ];
162162
then

0 commit comments

Comments
 (0)