Software updates (#48)

* Software updates

- Gameboard v3.7.1/3.7.2 (api/ui)
- TopoMojo v2.1.6
- Gitea v1.8.3
- Switch code-server Helm chart to vendor version (hosted on SEI charts repo)

* Add code block copy/paste to MkDocs

Fix VBoxGuestAdditions install

foundry/code-server.values.yaml

@@ -1,26 +1,44 @@
----
-# Default values for template.
+# Default values for code-server.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
+
+replicaCount: 1
+
 image:
-  repository: linuxserver/code-server
-  pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
-  tag: "4.8.1"
-secret:
-# PASSWORD: password
-  SUDO_PASSWORD: foundry
-# HASHED_PASSWORD
-
-env:
-  # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
-  TZ: "America/New_York"
-  # PUID: 1000
-  # PGID: 1000
-  # PROXY_DOMAIN: code-server.my.domain
+  repository: codercom/code-server
+  tag: '4.9.1'
+  pullPolicy: Always
+
+# Specifies one or more secrets to be used when pulling images from a
+# private container repository
+# https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry
+imagePullSecrets: []
+#  - name: registry-creds
+
+nameOverride: ""
+fullnameOverride: ""
+hostnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+priorityClassName: ""
+
 service:
-  port:
-    port: 8443
+  type: ClusterIP
+  port: 8080
+
 ingress:
   enabled: true
   annotations:
@@ -29,32 +47,155 @@ ingress:
       rewrite ^(/vscode)$ $1/ redirect;
   hosts:
     - host: foundry.local
-      paths:
-        - path: /vscode(/|$)(.*)
-          # Ignored if not kubeVersion >= 1.14-0
-          pathType: Prefix
+      paths: ["/vscode(/|$)(.*)"]
+  ingressClassName: ""
   tls:
     - secretName: appliance-cert
       hosts:
         - foundry.local
+
+# Optional additional arguments
+extraArgs: []
+  # These are the arguments normally passed to code-server; run
+  # code-server --help for a list of available options.
+  #
+  # Each argument and parameter must have its own entry; if you use
+  # --param value on the command line, then enter it here as:
+  #
+  # - --param
+  # - value
+  #
+  # If you receive an error like "Unknown option --param value", it may be
+  # because both the parameter and value are specified as a single argument,
+  # rather than two separate arguments (e.g. "- --param value" on a line).
+
+# Optional additional environment variables
+extraVars:
+#  - name: DISABLE_TELEMETRY
+#    value: true
+#  - name: DOCKER_HOST
+#    value: "tcp://localhost:2375"
+
+##
+## Init containers parameters:
+## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup
+##
+volumePermissions:
+  enabled: true
+  securityContext:
+    runAsUser: 0
+
+## Pod Security Context
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+##
+securityContext:
+  enabled: true
+  fsGroup: 1000
+  runAsUser: 1000
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #  cpu: 100m
+  #  memory: 1000Mi
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+## Persist data to a persistent volume
 persistence:
-  config:
-    enabled: true
-    emptyDir: false
-    mountPath: /config
-    ## Template downloads data Persistent Volume Storage Class
-    ## If defined, storageClassName: <storageClass>
-    ## If set to "-", storageClassName: "", which disables dynamic provisioning
-    ## If undefined (the default) or set to null, no storageClassName spec is
-    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
-    ##   GKE, AWS & OpenStack)
-    ##
-    storageClass: local-path
-    ##
-    ## If you want to reuse an existing claim, you can pass the name of the PVC using
-    ## the existingClaim variable
-    # existingClaim: your-claim
-    accessMode: ReadWriteOnce
-    size: 1Gi
-    ## Do not delete the pvc upon helm uninstall
-    skipuninstall: false
+  enabled: true
+  ## code-server data Persistent Volume Storage Class
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack)
+  ##
+  storageClass: "local-path"
+  accessMode: ReadWriteOnce
+  size: 1Gi
+  annotations: {}
+  # existingClaim: ""
+  # hostPath: /data
+
+lifecycle:
+  enabled: false
+  # postStart:
+  #  exec:
+  #    command:
+  #      - /bin/bash
+  #      - -c
+  #      - curl -s -L SOME_SCRIPT | bash
+
+## Enable an Specify container in extraContainers.
+## This is meant to allow adding code-server dependencies, like docker-dind.
+extraContainers: |
+# If docker-dind is used, DOCKER_HOST env is mandatory to set in "extraVars"
+#- name: docker-dind
+#  image: docker:19.03-dind
+#  imagePullPolicy: IfNotPresent
+#  resources:
+#    requests:
+#      cpu: 250m
+#      memory: 256M
+#  securityContext:
+#    privileged: true
+#    procMount: Default
+#  env:
+#  - name: DOCKER_TLS_CERTDIR
+#    value: ""
+#  - name: DOCKER_DRIVER
+#    value: "overlay2"
+
+extraInitContainers: |
+# - name: customization
+#   image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+#   imagePullPolicy: IfNotPresent
+#   env:
+#     - name: SERVICE_URL
+#       value: https://open-vsx.org/vscode/gallery
+#     - name: ITEM_URL
+#       value: https://open-vsx.org/vscode/item
+#   command:
+#     - sh
+#     - -c
+#     - |
+#       code-server --install-extension ms-python.python
+#       code-server --install-extension golang.Go
+#   volumeMounts:
+#     - name: data
+#       mountPath: /home/coder
+
+## Additional code-server secret mounts
+extraSecretMounts: []
+  # - name: secret-files
+  #   mountPath: /etc/secrets
+  #   secretName: code-server-secret-files
+  #   readOnly: true
+
+## Additional code-server volume mounts
+extraVolumeMounts: []
+  # - name: extra-volume
+  #   mountPath: /mnt/volume
+  #   readOnly: true
+  #   existingClaim: volume-claim
+  #   hostPath: ""
+
+extraConfigmapMounts: []
+  # - name: certs-configmap
+  #   mountPath: /etc/code-server/ssl/
+  #   subPath: certificates.crt # (optional)
+  #   configMap: certs-configmap
+  #   readOnly: true
+
+password: foundry

foundry/gameboard.values.yaml

@@ -141,7 +141,7 @@ gameboard-ui:
     repository: cmusei/gameboard-ui
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "3.7.1"
+    tag: "3.7.2"
 
   imagePullSecrets: []
   nameOverride: ""

foundry/gitea.values.yaml

@@ -31,7 +31,7 @@ image:
   registry: ""
   repository: gitea/gitea
   # Overrides the image tag whose default is the chart appVersion.
-  tag: 1.17.4
+  tag: 1.18.3
   pullPolicy: Always
   rootless: false # only possible when running 1.14 or later
 
@@ -333,6 +333,7 @@ gitea:
     server:
       DOMAIN: https://foundry.local/gitea/
       ROOT_URL: https://foundry.local/gitea/
+      DISABLE_SSH: true
     database:
       DB_TYPE: postgres
       HOST: postgresql:5432

foundry/install.sh

@@ -39,8 +39,8 @@ kubectl create secret generic pgpassfile --from-literal=pgpassfile=postgresql:54
 helm install -f pgadmin4.values.yaml pgadmin4 runix/pgadmin4
 
 # Install code-server (browser-based VS Code)
-helm repo add nicholaswilde https://nicholaswilde.github.io/helm-charts/
-helm install -f code-server.values.yaml code-server nicholaswilde/code-server
+helm repo add sei https://helm.cyberforce.site/charts
+helm install -f code-server.values.yaml code-server sei/code-server
 
 # Kubernetes Dashboard
 helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
@@ -52,7 +52,6 @@ cp certs/root-ca.pem ../mkdocs/docs/root-ca.crt
 
 # Install Identity
 sed -i -r "s/<GITEA_OAUTH_CLIENT_SECRET>/$GITEA_OAUTH_CLIENT_SECRET/" identity.values.yaml
-helm repo add sei https://helm.cyberforce.site/charts
 helm install --wait -f identity.values.yaml identity sei/identity
 
 # Install Gitea

foundry/topomojo.values.yaml

@@ -9,7 +9,7 @@ topomojo-api:
     repository: cmusei/topomojo-api
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "2.1.5"
+    tag: "2.1.6"
 
   imagePullSecrets: []
   nameOverride: ""
@@ -166,7 +166,7 @@ topomojo-ui:
     repository: cmusei/topomojo-ui
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "2.1.4"
+    tag: "2.1.6"
 
   imagePullSecrets: []
   nameOverride: ""

mkdocs/mkdocs.yml

@@ -3,8 +3,15 @@ site_url: https://foundry.local/start
 markdown_extensions:
   - attr_list
   - md_in_html
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.superfences
 theme:
   name: material
+  features:
+    - content.code.copy
   palette:
     - media: "(prefers-color-scheme: light)"
       scheme: default
@@ -25,7 +32,7 @@ theme:
 repo_url: https://github.com/cmu-sei/foundry-appliance
 repo_name: cmu-sei/foundry-appliance
 edit_uri: ""
-copyright: Copyright © 2022 Carnegie Mellon University
+copyright: Copyright © 2023 Carnegie Mellon University
 extra:
   social:
     - icon: fontawesome/brands/github

setup-appliance

@@ -61,7 +61,7 @@ netplan apply
 apt-get install -y dnsmasq avahi-daemon jq nfs-common sshpass kubectl helm pwgen build-essential
 
 # Install VirtualBox Guest Additions
-if [ -f "~/VBoxGuestAdditions.iso" ]; then
+if [ -f ~/VBoxGuestAdditions.iso ]; then
     mount -o loop ~/VBoxGuestAdditions.iso /mnt
     /mnt/VBoxLinuxAdditions.run
     umount /mnt