Skip to content

Commit 3677e93

Browse files
nboyersNoah BoyersmatifaliDevelopmentCatsNoah Boyers
authored
Add Cloud DevOps workspace template for EKS (#518)
Co-authored-by: Noah Boyers <noah@MacBook-Pro.local> Co-authored-by: Atif Ali <atif@coder.com> Co-authored-by: DevCats <christofer@coder.com> Co-authored-by: Noah Boyers <noah@coder.com>
1 parent a3ba616 commit 3677e93

10 files changed

Lines changed: 1283 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
.DS_Store
12
# Logs
23
logs
34
*.log

‎registry/nboyers/.gitignore‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Local and OS files
2+
.DS_Store
3+
Thumbs.db
4+
*.log
5+
*.tmp
6+
*.swp
7+
*.bak
8+
9+
# Terraform
10+
.terraform/
11+
.terraform.lock.hcl
12+
terraform.tfstate
13+
terraform.tfstate.backup
14+
crash.log
15+
16+
# Node / Bun / Python / other tool artifacts
17+
node_modules/
18+
bun.lockb
19+
package-lock.json
20+
__pycache__/
21+
*.pyc
22+
23+
# Cloud credentials and keys
24+
*.pem
25+
*.key
26+
*.p12
27+
*.json
28+
*.env
29+
.envrc
30+
aws-credentials
31+
gcp.json
32+
azure-creds.json
33+
34+
# Archives
35+
*.zip
36+
*.tar.gz
37+
*.tgz
38+
39+
# Workspace artifacts
40+
workspace/
41+
output/

‎registry/nboyers/.images/avatar.png‎

1.62 MB
Loading

‎registry/nboyers/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
display_name: "Noah Boyers"
3+
bio: "Cloud & DevOps engineer with an MBA, building scalable multi-cloud infrastructure."
4+
avatar: "./.images/avatar.png"
5+
github: "noahboyers"
6+
linkedin: "https://www.linkedin.com/in/nboyers"
7+
website: "https://nobosoftware.com"
8+
support_email: "hello@nobosoftware.com"
9+
status: "community"
10+
---
11+
12+
# Noah Boyers
13+
14+
Cloud and DevOps engineer focused on scalable, secure, and automated infrastructure across AWS, Azure, and GCP.

‎registry/nboyers/templates/cloud-dev/README.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
display_name: "Cloud DevOps Workspace"
3+
description: "A multi-cloud DevOps workspace that runs on Amazon EKS and provides authenticated access to AWS, Azure, and GCP."
4+
icon: "https://raw.githubusercontent.com/coder/coder-icons/main/icons/cloud-devops.svg"
5+
tags:
6+
- devops
7+
- kubernetes
8+
- aws
9+
- eks
10+
- multi-cloud
11+
- terraform
12+
- cdk
13+
- pulumi
14+
---
15+
16+
# Cloud DevOps Workspace
17+
18+
A secure, company-standard DevOps environment for platform and cloud engineers.
19+
20+
This template deploys workspaces **into an existing Amazon EKS cluster** and provides developers with tools and credentials to work with **AWS, Azure, and GCP** from inside their workspace.
21+
22+
Supports multiple Infrastructure-as-Code frameworks — **Terraform**, **AWS CDK**, and **Pulumi** — for flexible, multi-cloud development.
23+
24+
## Features
25+
26+
- **Multi-Cloud Ready** — authenticate to AWS, Azure, or GCP from a single workspace
27+
- **Runs on EKS** — leverages existing Kubernetes infrastructure for scaling and security
28+
- **IaC Tools Included** — Terraform, Terragrunt, CDK, Pulumi, tfsec, and more
29+
- **Secure Isolation** — each workspace runs in its own Kubernetes namespace
30+
- **Configurable Auth** — supports IRSA (AWS), Federated Identity (Azure), and WIF (GCP)
31+
32+
## Variables
33+
34+
| Variable | Description | Type | Default |
35+
| ------------------------------------------------------------- | --------------------------------------------------------------- | ------ | ----------- |
36+
| `host_cluster_name` | EKS cluster name where workspaces are deployed | string | — |
37+
| `iac_tool` | Infrastructure-as-Code framework (`terraform`, `cdk`, `pulumi`) | string | `terraform` |
38+
| `enable_aws` | Enable AWS authentication and tools | bool | `true` |
39+
| `enable_azure` | Enable Azure authentication and tools | bool | `false` |
40+
| `enable_gcp` | Enable GCP authentication and tools | bool | `false` |
41+
| `aws_access_key_id` / `aws_secret_access_key` | AWS credentials (optional) | string | `""` |
42+
| `azure_client_id` / `azure_client_secret` / `azure_tenant_id` | Azure credentials (optional) | string | `""` |
43+
| `gcp_service_account` | GCP Service Account JSON (optional) | string | `""` |
44+
45+
## Runtime Architecture
46+
47+
| Layer | Platform | Purpose |
48+
| ----------------------- | ------------------ | ------------------------------------------------------------ |
49+
| **Infrastructure** | Amazon EKS | Where Coder deploys and runs the workspaces |
50+
| **Workspace Container** | Ubuntu-based image | Developer environment (Terraform, CDK, Pulumi, CLIs) |
51+
| **Cloud Access** | AWS / Azure / GCP | Target environments for deploying infrastructure or services |
52+
53+
## Required Permissions and Setup Steps
54+
55+
This template **runs on EKS** but allows developers inside the workspace to authenticate with **AWS, Azure, or GCP** using their own credentials or service identities.
56+
57+
### Coder & Infrastructure (Admin Setup)
58+
59+
Your Coder deployment must have:
60+
61+
- Network access to an **existing EKS cluster**
62+
- The Coder Helm chart installed and healthy
63+
- Terraform configured with access to the EKS API
64+
65+
#### Minimum AWS IAM Permissions
66+
67+
For the identity running the template (Coder service account, Terraform runner, or user):
68+
69+
```json
70+
{
71+
"Effect": "Allow",
72+
"Action": [
73+
"eks:DescribeCluster",
74+
"eks:ListClusters",
75+
"sts:GetCallerIdentity",
76+
"sts:AssumeRole"
77+
],
78+
"Resource": "*"
79+
}
80+
```

‎registry/nboyers/templates/cloud-dev/main.tf‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
terraform {
2+
required_providers {
3+
coder = {
4+
source = "coder/coder"
5+
version = "~> 0.23"
6+
}
7+
kubernetes = {
8+
source = "hashicorp/kubernetes"
9+
version = "~> 2.23"
10+
}
11+
aws = {
12+
source = "hashicorp/aws"
13+
version = "~> 5.0"
14+
}
15+
}
16+
}
17+
18+
# --- Coder workspace context ---
19+
data "coder_workspace" "me" {}
20+
data "coder_workspace_owner" "me" {}
21+
22+
# --- EKS connection ---
23+
data "aws_eks_cluster" "eks" {
24+
name = trimspace(var.host_cluster_name)
25+
}
26+
27+
28+
data "aws_eks_cluster_auth" "eks" {
29+
name = trimspace(var.host_cluster_name)
30+
}
31+
32+
provider "kubernetes" {
33+
host = data.aws_eks_cluster.eks.endpoint
34+
cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks.certificate_authority[0].data)
35+
token = data.aws_eks_cluster_auth.eks.token
36+
}
37+
38+
# --- Namespace per workspace ---
39+
resource "kubernetes_namespace" "workspace" {
40+
metadata {
41+
name = "coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}"
42+
labels = {
43+
"coder.workspace" = data.coder_workspace.me.name
44+
"coder.owner" = data.coder_workspace_owner.me.name
45+
}
46+
}
47+
}
48+
49+
# --- ServiceAccount (IRSA optional) ---
50+
resource "kubernetes_service_account" "workspace" {
51+
metadata {
52+
name = "coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}"
53+
namespace = kubernetes_namespace.workspace.metadata[0].name
54+
55+
annotations = var.enable_aws && var.aws_role_arn != "" ? {
56+
"eks.amazonaws.com/role-arn" = var.aws_role_arn
57+
} : {}
58+
}
59+
}
60+
61+
# --- Coder Agent definition ---
62+
resource "coder_agent" "main" {
63+
os = "linux"
64+
arch = "amd64"
65+
66+
startup_script = file("${path.module}/scripts/setup-workspace.sh")
67+
68+
env = {
69+
# IaC tool & cloud toggles
70+
IAC_TOOL = var.iac_tool
71+
ENABLE_AWS = tostring(var.enable_aws)
72+
ENABLE_AZURE = tostring(var.enable_azure)
73+
ENABLE_GCP = tostring(var.enable_gcp)
74+
75+
# Developer credentials
76+
AWS_ACCESS_KEY_ID = var.aws_access_key_id
77+
AWS_SECRET_ACCESS_KEY = var.aws_secret_access_key
78+
AZURE_CLIENT_ID = var.azure_client_id
79+
AZURE_TENANT_ID = var.azure_tenant_id
80+
AZURE_CLIENT_SECRET = var.azure_client_secret
81+
GCP_SERVICE_ACCOUNT = var.gcp_service_account
82+
}
83+
}
84+
85+
# --- Kubernetes Pod (runs workspace container) ---
86+
resource "kubernetes_pod" "workspace" {
87+
count = data.coder_workspace.me.start_count
88+
89+
metadata {
90+
name = "coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}"
91+
namespace = kubernetes_namespace.workspace.metadata[0].name
92+
labels = {
93+
"app" = "coder-workspace"
94+
"coder.owner" = data.coder_workspace_owner.me.name
95+
"coder.agent" = "true"
96+
}
97+
}
98+
99+
spec {
100+
service_account_name = kubernetes_service_account.workspace.metadata[0].name
101+
102+
container {
103+
name = "workspace"
104+
image = "codercom/enterprise-base:ubuntu"
105+
command = ["/bin/bash", "-c", coder_agent.main.init_script]
106+
107+
env {
108+
name = "CODER_AGENT_TOKEN"
109+
value = coder_agent.main.token
110+
}
111+
112+
resources {
113+
requests = { cpu = "500m", memory = "1Gi" }
114+
limits = { cpu = "2", memory = "4Gi" }
115+
}
116+
}
117+
}
118+
119+
depends_on = [coder_agent.main]
120+
}

0 commit comments

Comments
 (0)