Skip to content

Commit cf3fce7

Browse files
patrick-codetogethernmorenor
patrick-codetogether
and
nmorenor
authored
Release (#90)
* Change collab helm chart to use private registry image * Changes for docker compose. (#85) * Rename hq to intel * Allow user to provide their own hqproperties secret (#86) * allow users to provide their own hqproperties secret for improved security over sensitive information * PR feedback. cleaner value structure and using an explicit hqpropertiessecret.enabled value to toggle whether the secret is read --------- Co-authored-by: Ignacio Moreno <nmorenor@gmail.com> Co-authored-by: Ignacio Moreno <ignacio@codetogether.com>
1 parent c5e0295 commit cf3fce7

10 files changed

Lines changed: 105 additions & 36 deletions

File tree

‎charts/collab/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: codetogether-collab
33
description: CodeTogether Collab
44

55
type: application
6-
version: 1.2.1
6+
version: 1.2.2
77
appVersion: "2025.1.0"
88

99
icon: https://www.codetogether.com/wp-content/uploads/2020/02/codetogether-circle-128.png

‎charts/collab/values.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,7 @@ nameOverride: ""
1111
fullnameOverride: ""
1212

1313
image:
14-
# By default use DockerHub repository.
15-
repository: codetogether/codetogether-collab
16-
# Uncomment to use CodeTogether private Docker registry.
17-
# repository: hub.edge.codetogether.com/releases/codetogether
14+
repository: hub.edge.codetogether.com/releases/codetogether-collab
1815
pullPolicy: Always
1916
# Overrides the image tag whose default is the chart appVersion.
2017
tag: "latest"

‎charts/intel/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: codetogether-intel
33
description: CodeTogether Intel provides advanced project insights for developers
44

55
type: application
6-
version: 1.2.1
6+
version: 1.2.2
77
appVersion: "2025.1.0"
88

99
icon: https://www.codetogether.com/wp-content/uploads/2020/02/codetogether-circle-128.png

‎charts/intel/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ The following table lists configurable parameters of the CodeTogether Intel char
3131
| `imageCredentials.password` | Docker registry password | `my-customer-password` |
3232
| `imageCredentials.email` | Docker registry email | `unused` |
3333
| `codetogether.url` | Full URL for the CodeTogether Intel server | `https://<server-fqdn>` |
34+
| `hqpropertiessecret.enabled` | (Optional) If true, the value in hqpropertiessecret.ref will be used in place of the hqproperties values | `false` |
35+
| `hqpropertiessecret.ref` | (Optional) Name of a Kubernetes secret containing the hqproperties secret. If provided, will override the other values in the hqproperties section | `kubernetes-secret-name` |
3436
| `hqproperties.hq.sso.client.id` | Client ID for Single Sign-On (SSO) | `CLIENTID.apps.googleusercontent.com` |
3537
| `hqproperties.hq.sso.client.secret` | Client Secret for Single Sign-On (SSO) | `CLIENTSECRET` |
3638
| `hqproperties.hq.sso.client.issuer.url` | Issuer URL for Single Sign-On (SSO) | `https://accounts.google.com` |
@@ -51,7 +53,6 @@ The following table lists configurable parameters of the CodeTogether Intel char
5153
| `java.customCacerts.enabled` | Enables mounting a custom Java trust store (cacerts) | `false` |
5254
| `java.customCacerts.cacertsSecretName` | Name of the Kubernetes secret containing the `cacerts` file | `custom-java-cacerts` |
5355
| `java.customCacerts.trustStorePasswordKey` | (Optional) Key inside the Kubernetes secret containing the trust store password | `trustStorePassword` |
54-
| `cassandra.passwordSecret` | (Optional) Name of a Kubernetes secret containing the Cassandra database password. | |
5556
| `ingress.enabled` | Enables ingress controller resource | `true` |
5657
| `ingress.annotations` | Annotations for ingress | `{}` |
5758
| `ingress.tls.secretName` | TLS secret name for ingress | `codetogether-intel-tls` |

‎charts/intel/templates/deployment.yaml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,13 @@ spec:
107107
volumes:
108108
- name: properties-volume
109109
secret:
110-
secretName: {{ if .Values.fullnameOverride }}{{ .Values.fullnameOverride }}-hqproperties{{ else }}hqproperties{{ end }}
110+
secretName: {{- if .Values.hqpropertiessecret.enabled }}
111+
{{- .Values.hqpropertiessecret.ref }}
112+
{{- else if .Values.fullnameOverride }}
113+
{{- printf "%s-hqproperties" .Values.fullnameOverride }}
114+
{{- else }}
115+
{{- "hqproperties" }}
116+
{{- end }}
111117
{{- if .Values.java.customCacerts.enabled }}
112118
- name: java-cacerts
113119
secret:

‎charts/intel/templates/secret-properties.yaml‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,12 @@
1+
{{- if not .Values.hqpropertiessecret.enabled }}
12
apiVersion: v1
23
kind: Secret
34
metadata:
45
name: {{ if .Values.fullnameOverride }}{{ .Values.fullnameOverride }}-hqproperties{{ else }}hqproperties{{ end }}
56
type: Opaque
67
stringData:
78
cthq.properties: |-
8-
{{- $cassandraPassword := "" }}
9-
{{- if and (hasKey .Values "cassandra") (hasKey .Values.cassandra "passwordSecret") .Values.cassandra.passwordSecret (lookup "v1" "Secret" .Release.Namespace .Values.cassandra.passwordSecret) }}
10-
{{- $cassandraPassword := (lookup "v1" "Secret" .Release.Namespace .Values.cassandra.passwordSecret).data.cassandraPassword | b64dec }}
11-
{{- end }}
129
{{- range $key, $value := .Values.hqproperties }}
13-
{{- if and (eq $key "hq.cassandra.db.password") $cassandraPassword }}
14-
{{ $key }}={{ $cassandraPassword }}
15-
{{- else }}
16-
{{ $key }}={{ $value }}
17-
{{- end }}
18-
{{- end }}
10+
{{ $key }}={{ $value }}
11+
{{- end }}
12+
{{- end }}

‎charts/intel/values.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,10 @@ hqproperties:
5959
# default datacenter name is 'datacenter1'
6060
# hq.cassandra.db.localdatacenter: datacenter1
6161

62-
# Optional property, if provided the value from the secret will be used as the cassandra DB password
63-
# This will overwrite the value in the hqproperties hq.cassandra.db.password
64-
# The secret must have a key named 'cassandraPassword'
65-
cassandra:
66-
passwordSecret: ""
62+
# Optional properties, if enabled is true, the values in the secret will be used as the hqproperties secret
63+
hqpropertiessecret:
64+
enabled: false
65+
ref: "intel-test-hqproperties-arbitrary"
6766

6867
java:
6968
customCacerts:

‎compose/codetogether.nginx‎

Lines changed: 43 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,43 @@
1+
server {
2+
listen 443 ssl http2;
3+
server_name <collab-server-fqdn>;
4+
proxy_buffer_size 128k;
5+
proxy_buffers 4 256k;
6+
ssl_certificate <path-to-ssl-bundle.crt>;
7+
ssl_certificate_key <path-to-ssl.key>;
8+
ssl_dhparam <path-to-dhparam.pem>;
9+
ssl_prefer_server_ciphers on;
10+
ssl_protocols TLSv1.2;
11+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
12+
location / {
13+
# Similar proxy logic for headers
14+
set $realIP $remote_addr;
15+
set $forwardTo $proxy_add_x_forwarded_for;
16+
set $reqHost $http_host;
17+
client_max_body_size 32M;
18+
if ($http_x_real_ip != '') {
19+
set $realIP $http_x_real_ip;
20+
}
21+
if ($http_x_forwarded_for != '') {
22+
set $forwardTo $http_x_forwarded_for;
23+
}
24+
add_header C-Real-IP $realIP;
25+
add_header C-Forwarded-For $forwardTo;
26+
add_header C-Request-Host $reqHost;
27+
proxy_set_header X-Real-IP $realIP;
28+
proxy_set_header X-Forwarded-For $forwardTo;
29+
proxy_set_header Host $reqHost;
30+
proxy_set_header X-NginX-Proxy true;
31+
proxy_http_version 1.1;
32+
proxy_redirect off;
33+
proxy_pass http://codetogether-collab:1080;
34+
proxy_set_header Upgrade $http_upgrade;
35+
proxy_set_header Connection "upgrade";
36+
proxy_read_timeout 360;
37+
proxy_connect_timeout 360;
38+
proxy_send_timeout 360;
39+
}
40+
}
141
server {
242
server_name <server-fqdn>;
343
listen 443 ssl http2;
@@ -14,10 +54,10 @@ server {
1454
ssl_protocols TLSv1.2;
1555
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
1656

17-
# create the passthrough to the CodeTogether HQ container
57+
# create the passthrough to the CodeTogether Intel container
1858
location / {
1959

20-
# set passthru parameters for the CodeTogether HQ container
60+
# set passthru parameters for the CodeTogether Intel container
2161
set $realIP $remote_addr;
2262
set $forwardTo $proxy_add_x_forwarded_for;
2363
set $reqHost $http_host;
@@ -32,7 +72,7 @@ server {
3272
proxy_set_header Host $reqHost;
3373

3474
# setup the backend to service the HQ requests
35-
proxy_pass http://127.0.0.1:1080;
75+
proxy_pass http://codetogether-intel:1080;
3676
proxy_set_header X-NginX-Proxy true;
3777
proxy_http_version 1.1;
3878
proxy_redirect off;

‎compose/compose.yaml‎

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,39 @@
1-
services:
1+
services:
2+
codetogether-collab:
3+
image: registry.digitalocean.com/codetogether-registry/codetogether-collab:latest
4+
container_name: codetogether-collab
5+
environment:
6+
- CT_LICENSE_URL=http://codetogether-intel:1080
7+
- CT_SERVER_URL=https://your-collab-server-fqdn
8+
- CT_INTEL_SECRET=your-collab-intel-secret
9+
- CT_AV_ENABLED=false
10+
- CT_AV_LAN_IP=auto
11+
networks:
12+
- codetogethernet
13+
depends_on:
14+
codetogether-intel:
15+
condition: service_healthy
16+
nginx:
17+
image: nginx:latest
18+
container_name: codetogether-nginx
19+
ports:
20+
- "443:443"
21+
volumes:
22+
- ./nginx/nginx.conf:/etc/nginx/nginx.conf
23+
- ./nginx/ssl:/etc/nginx/ssl
24+
- ./nginx/log:/var/log/nginx
25+
networks:
26+
- codetogethernet
27+
depends_on:
28+
codetogether-intel:
29+
condition: service_healthy
230
codetogether-intel:
3-
image: hub.edge.codetogether.com/releases/codetogether-intel:latest
31+
image: registry.digitalocean.com/codetogether-registry/codetogether-intel:latest
432
container_name: codetogether-intel
533
environment:
6-
- CT_HQ_BASE_URL=https://your-hq-server-fqdn
34+
- CT_HQ_BASE_URL=https://your-intel-server-fqdn
735
networks:
8-
- hqnet
36+
- codetogethernet
937
volumes:
1038
- ./cthq.properties:/opt/codetogether/runtime/cthq.properties:ro
1139
ports:
@@ -14,16 +42,18 @@ services:
1442
cassandra:
1543
condition: service_healthy
1644
healthcheck:
17-
test: ["CMD", "grep", "-q", "CodeTogether HQ backend started", "/var/log/codetogether-runtime/server.log"]
45+
test: ["CMD", "grep", "-q", "CodeTogether Intel backend started", "/var/log/codetogether-runtime/server.log"]
1846
start_period: 20s
1947
interval: 10s
2048
timeout: 10s
21-
retries: 30
49+
retries: 50
2250
cassandra:
2351
image: cassandra:latest
2452
container_name: codetogether-cassandra
53+
ports:
54+
- 9042:9042
2555
networks:
26-
- hqnet
56+
- codetogethernet
2757
environment:
2858
- HEAP_NEWSIZE=96M
2959
- MAX_HEAP_SIZE=512M
@@ -38,7 +68,7 @@ services:
3868
start_period: 30s
3969
interval: 10s
4070
timeout: 10s
41-
retries: 20
71+
retries: 70
4272
networks:
43-
hqnet:
44-
driver: bridge
73+
codetogethernet:
74+
driver: bridge

‎compose/cthq.properties‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ hq.base.url=https://<server-fqdn>
33
hq.sso.redirect.uri=https://<server-fqdn>/api/v1/auth/sso/success/insights
44
hq.sso.client.id=<clientid>
55
hq.sso.client.secret=<clientsecret>
6+
hq.collab.url=https://your-collab-server-fqdn
7+
hq.collab.secret=<your-collab-intel-secret>
68

79
# Generic single sign-on configuration
810
hq.sso.client.issuer.url=https://<sso-fqdn>/<path>/.well-known/openid-configuration

0 commit comments

Comments
 (0)