Skip to content

feat: allow users to pause prebuilt workspace reconciliation #18700

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 2, 2025
Merged

feat: allow users to pause prebuilt workspace reconciliation #18700

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4751936
feat: add cli commands to pause and resume prebuilt workspace reconci…
SasSwart Jul 1, 2025
0b4d669
renumber migrations
SasSwart Jul 1, 2025
caa9224
make gen
SasSwart Jul 1, 2025
140d820
get prebuilds to honor the pause setting and expose a metric to show …
SasSwart Jul 2, 2025
cdd55fe
deduplicate prebuilds pause business logic
SasSwart Jul 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 75 additions & 0 deletions coderd/apidoc/docs.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

65 changes: 65 additions & 0 deletions coderd/apidoc/swagger.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions coderd/audit/diff.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ type Auditable interface {
database.NotificationsSettings |
database.OAuth2ProviderApp |
database.OAuth2ProviderAppSecret |
database.PrebuildsSettings |
database.CustomRole |
database.AuditableOrganizationMember |
database.Organization |
Expand Down
10 changes: 10 additions & 0 deletions coderd/audit/request.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,8 @@ func ResourceTarget[T Auditable](tgt T) string {
return "" // no target?
case database.NotificationsSettings:
return "" // no target?
case database.PrebuildsSettings:
return "" // no target?
case database.OAuth2ProviderApp:
return typed.Name
case database.OAuth2ProviderAppSecret:
Expand Down Expand Up @@ -176,6 +178,9 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
case database.NotificationsSettings:
// Artificial ID for auditing purposes
return typed.ID
case database.PrebuildsSettings:
// Artificial ID for auditing purposes
return typed.ID
case database.OAuth2ProviderApp:
return typed.ID
case database.OAuth2ProviderAppSecret:
Expand Down Expand Up @@ -231,6 +236,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
return database.ResourceTypeHealthSettings
case database.NotificationsSettings:
return database.ResourceTypeNotificationsSettings
case database.PrebuildsSettings:
return database.ResourceTypePrebuildsSettings
case database.OAuth2ProviderApp:
return database.ResourceTypeOauth2ProviderApp
case database.OAuth2ProviderAppSecret:
Expand Down Expand Up @@ -288,6 +295,9 @@ func ResourceRequiresOrgID[T Auditable]() bool {
case database.NotificationsSettings:
// Artificial ID for auditing purposes
return false
case database.PrebuildsSettings:
// Artificial ID for auditing purposes
return false
case database.OAuth2ProviderApp:
return false
case database.OAuth2ProviderAppSecret:
Expand Down
11 changes: 11 additions & 0 deletions coderd/database/dbauthz/dbauthz.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2304,6 +2304,10 @@ func (q *querier) GetPrebuildMetrics(ctx context.Context) ([]database.GetPrebuil
return q.db.GetPrebuildMetrics(ctx)
}

func (q *querier) GetPrebuildsSettings(ctx context.Context) (string, error) {
return q.db.GetPrebuildsSettings(ctx)
}

func (q *querier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
empty := database.GetPresetByIDRow{}

Expand Down Expand Up @@ -5101,6 +5105,13 @@ func (q *querier) UpsertOAuthSigningKey(ctx context.Context, value string) error
return q.db.UpsertOAuthSigningKey(ctx, value)
}

func (q *querier) UpsertPrebuildsSettings(ctx context.Context, value string) error {
if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceDeploymentConfig); err != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to clarify here on the rbac side, this means that only a user with this permission can update the setting. From https://github.com/coder/coder/blob/main/coderd/rbac/roles.go currently, only the auditorRole has this permission. Is that intended?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auditor only has read though?

coder/coderd/rbac/roles.go

Line 327 in 8a69f6a

ResourceDeploymentConfig.Type: {policy.ActionRead},

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, good catch! 👀 So it means that only the owner of the ResourceDeploymentConfig can update the settings, right? Should we maybe extend it to the Admins? 🤔

Copy link
Member

@johnstcn johnstcn Jul 2, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think there exists any other suitable role that should have permission to edit site-wide deployment config? Our choices are site-wide template admin or site-wide user admin, neither of which feel right to me. Site-wide auditor should only have read permissions, and all of the org-scoped admins are out of site-wide scope.

This might be something to explore in a separate PR.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this could definitely be addressed in a separate PR. You might be right that adding the permission to admin roles isn’t the best approach. My main concern was that currently only users with the Owner role can update this setting. In our dogfood environment, this works fine since many users have the Owner role, but this is not the typical case.

On second thought, limiting this permission to the Owner role does make sense, since it’s an important command and users should be fully aware of the implications when using it.

return err
}
return q.db.UpsertPrebuildsSettings(ctx, value)
}

func (q *querier) UpsertProvisionerDaemon(ctx context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) {
res := rbac.ResourceProvisionerDaemon.InOrg(arg.OrganizationID)
if arg.Tags[provisionersdk.TagScope] == provisionersdk.ScopeUser {
Expand Down
6 changes: 6 additions & 0 deletions coderd/database/dbauthz/dbauthz_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5071,6 +5071,12 @@ func (s *MethodTestSuite) TestPrebuilds() {
check.Args().
Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead)
}))
s.Run("GetPrebuildsSettings", s.Subtest(func(db database.Store, check *expects) {
check.Args().Asserts()
}))
s.Run("UpsertPrebuildsSettings", s.Subtest(func(db database.Store, check *expects) {
check.Args("foo").Asserts(rbac.ResourceDeploymentConfig, policy.ActionUpdate)
}))
s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
check.Args().
Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).
Expand Down
18 changes: 17 additions & 1 deletion coderd/database/dbmem/dbmem.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,7 @@ type data struct {
presets []database.TemplateVersionPreset
presetParameters []database.TemplateVersionPresetParameter
presetPrebuildSchedules []database.TemplateVersionPresetPrebuildSchedule
prebuildsSettings []byte
}

func tryPercentileCont(fs []float64, p float64) float64 {
Expand Down Expand Up @@ -4277,7 +4278,14 @@ func (*FakeQuerier) GetPrebuildMetrics(_ context.Context) ([]database.GetPrebuil
return make([]database.GetPrebuildMetricsRow, 0), nil
}

func (q *FakeQuerier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
func (q *FakeQuerier) GetPrebuildsSettings(_ context.Context) (string, error) {
q.mutex.RLock()
defer q.mutex.RUnlock()

return string(slices.Clone(q.prebuildsSettings)), nil
}

func (q *FakeQuerier) GetPresetByID(_ context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
q.mutex.RLock()
defer q.mutex.RUnlock()

Expand Down Expand Up @@ -12313,6 +12321,14 @@ func (q *FakeQuerier) UpsertOAuthSigningKey(_ context.Context, value string) err
return nil
}

func (q *FakeQuerier) UpsertPrebuildsSettings(_ context.Context, value string) error {
q.mutex.Lock()
defer q.mutex.Unlock()

q.prebuildsSettings = []byte(value)
return nil
}

func (q *FakeQuerier) UpsertProvisionerDaemon(_ context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) {
if err := validateDatabaseType(arg); err != nil {
return database.ProvisionerDaemon{}, err
Expand Down
14 changes: 14 additions & 0 deletions coderd/database/dbmetrics/querymetrics.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

29 changes: 29 additions & 0 deletions coderd/database/dbmock/dbmock.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion coderd/database/dump.sql
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading