|
| 1 | +#!/bin/sh |
| 2 | +# Copyright (c) 2022 Gitpod GmbH. All rights reserved. |
| 3 | +# Licensed under the MIT License. See License-MIT.txt in the project root for license information. |
| 4 | + |
| 5 | + |
| 6 | +set -ex |
| 7 | + |
| 8 | +# check for minimum requirements |
| 9 | +REQUIRED_MEM_KB=$((6 * 1024 * 1024)) |
| 10 | +total_mem_kb=$(awk '/MemTotal:/ {print $2}' /proc/meminfo) |
| 11 | +if [ "${total_mem_kb}" -lt "${REQUIRED_MEM_KB}" ]; then |
| 12 | + echo "Preview installation of Gitpod requires a system with at least 6GB of memory" |
| 13 | + exit 1 |
| 14 | +fi |
| 15 | + |
| 16 | +REQUIRED_CORES=4 |
| 17 | +total_cores=$(nproc) |
| 18 | +if [ "${total_cores}" -lt "${REQUIRED_CORES}" ]; then |
| 19 | + echo "Preview installation of Gitpod requires a system with at least 4 CPU Cores" |
| 20 | + exit 1 |
| 21 | +fi |
| 22 | + |
| 23 | +# Get container's IP address |
| 24 | +if [ -z "${DOMAIN}" ]; then |
| 25 | + NODE_IP=$(hostname -i) |
| 26 | + DOMAIN_STRING=$(echo "${NODE_IP}" | sed "s/\./-/g") |
| 27 | + DOMAIN="${DOMAIN_STRING}.nip.io" |
| 28 | +fi |
| 29 | + |
| 30 | +echo "Gitpod Domain: $DOMAIN" |
| 31 | + |
| 32 | +if [ -f /sys/fs/cgroup/cgroup.controllers ]; then |
| 33 | + echo "[$(date -Iseconds)] [CgroupV2 Fix] Evacuating Root Cgroup ..." |
| 34 | + # move the processes from the root group to the /init group, |
| 35 | + # otherwise writing subtree_control fails with EBUSY. |
| 36 | + mkdir -p /sys/fs/cgroup/init |
| 37 | + busybox xargs -rn1 < /sys/fs/cgroup/cgroup.procs > /sys/fs/cgroup/init/cgroup.procs || : |
| 38 | + # enable controllers |
| 39 | + sed -e 's/ / +/g' -e 's/^/+/' <"/sys/fs/cgroup/cgroup.controllers" >"/sys/fs/cgroup/cgroup.subtree_control" |
| 40 | + echo "[$(date -Iseconds)] [CgroupV2 Fix] Done" |
| 41 | +fi |
| 42 | + |
| 43 | +mount --make-shared /sys/fs/cgroup |
| 44 | +mount --make-shared /proc |
| 45 | +mount --make-shared /var/gitpod |
| 46 | + |
| 47 | +# install in local store |
| 48 | +mkcert -install |
| 49 | +cat "${HOME}"/.local/share/mkcert/rootCA.pem >> /etc/ssl/certs/ca-certificates.crt |
| 50 | +# also send root cert into a volume |
| 51 | +cat "${HOME}"/.local/share/mkcert/rootCA.pem > /var/gitpod/gitpod-ca.crt |
| 52 | + |
| 53 | +cat << EOF > /var/lib/rancher/k3s/server/manifests/ca-pair.yaml |
| 54 | +apiVersion: v1 |
| 55 | +kind: Secret |
| 56 | +metadata: |
| 57 | + name: ca-key-pair |
| 58 | +data: |
| 59 | + ca.crt: $(base64 -w0 "${HOME}"/.local/share/mkcert/rootCA.pem) |
| 60 | + tls.crt: $(base64 -w0 "${HOME}"/.local/share/mkcert/rootCA.pem) |
| 61 | + tls.key: $(base64 -w0 "${HOME}"/.local/share/mkcert/rootCA-key.pem) |
| 62 | +EOF |
| 63 | + |
| 64 | +cat << EOF > /var/lib/rancher/k3s/server/manifests/issuer.yaml |
| 65 | +apiVersion: cert-manager.io/v1 |
| 66 | +kind: Issuer |
| 67 | +metadata: |
| 68 | + name: ca-issuer |
| 69 | +spec: |
| 70 | + ca: |
| 71 | + secretName: ca-key-pair |
| 72 | +EOF |
| 73 | + |
| 74 | +echo "creating Gitpod SSL secret..." |
| 75 | +cat << EOF > /var/lib/rancher/k3s/server/manifests/https-cert.yaml |
| 76 | +apiVersion: cert-manager.io/v1 |
| 77 | +kind: Certificate |
| 78 | +metadata: |
| 79 | + name: https-cert |
| 80 | +spec: |
| 81 | + secretName: https-certificates |
| 82 | + issuerRef: |
| 83 | + name: ca-issuer |
| 84 | + kind: Issuer |
| 85 | + dnsNames: |
| 86 | + - "$DOMAIN" |
| 87 | + - "*.$DOMAIN" |
| 88 | + - "*.ws.$DOMAIN" |
| 89 | +EOF |
| 90 | + |
| 91 | +mkdir -p /var/lib/rancher/k3s/server/manifests/gitpod |
| 92 | + |
| 93 | +/gitpod-installer init > config.yaml |
| 94 | +yq e -i '.domain = "'"${DOMAIN}"'"' config.yaml |
| 95 | +yq e -i '.certificate.name = "https-certificates"' config.yaml |
| 96 | +yq e -i '.certificate.kind = "secret"' config.yaml |
| 97 | +yq e -i '.customCACert.name = "ca-key-pair"' config.yaml |
| 98 | +yq e -i '.customCACert.kind = "secret"' config.yaml |
| 99 | +yq e -i '.observability.logLevel = "debug"' config.yaml |
| 100 | +yq e -i '.workspace.runtime.containerdSocket = "/run/k3s/containerd/containerd.sock"' config.yaml |
| 101 | +yq e -i '.workspace.runtime.containerdRuntimeDir = "/var/lib/rancher/k3s/agent/containerd/io.containerd.runtime.v2.task/k8s.io/"' config.yaml |
| 102 | + |
| 103 | +echo "extracting images to download ahead..." |
| 104 | +/gitpod-installer render --config config.yaml | grep 'image:' | sed 's/ *//g' | sed 's/image://g' | sed 's/\"//g' | sed 's/^-//g' | sort | uniq > /gitpod-images.txt |
| 105 | +echo "downloading images..." |
| 106 | +while read -r image "$(cat /gitpod-images.txt)"; do |
| 107 | + # shellcheck disable=SC2154 |
| 108 | + ctr images pull "$image" >/dev/null & |
| 109 | +done |
| 110 | + |
| 111 | +ctr images pull "docker.io/gitpod/workspace-full:latest" >/dev/null & |
| 112 | + |
| 113 | +/gitpod-installer render --config config.yaml --output-split-files /var/lib/rancher/k3s/server/manifests/gitpod |
| 114 | +for f in /var/lib/rancher/k3s/server/manifests/gitpod/*.yaml; do (cat "$f"; echo) >> /var/lib/rancher/k3s/server/gitpod.debug; done |
| 115 | +rm /var/lib/rancher/k3s/server/manifests/gitpod/*NetworkPolicy* |
| 116 | +for f in /var/lib/rancher/k3s/server/manifests/gitpod/*PersistentVolumeClaim*.yaml; do yq e -i '.spec.storageClassName="local-path"' "$f"; done |
| 117 | +yq eval-all -i ". as \$item ireduce ({}; . *+ \$item)" /var/lib/rancher/k3s/server/manifests/gitpod/*_StatefulSet_messagebus.yaml /app/manifests/messagebus.yaml |
| 118 | +for f in /var/lib/rancher/k3s/server/manifests/gitpod/*StatefulSet*.yaml; do yq e -i '.spec.volumeClaimTemplates[0].spec.storageClassName="local-path"' "$f"; done |
| 119 | + |
| 120 | +# removing init container from ws-daemon (systemd and Ubuntu) |
| 121 | +yq eval-all -i 'del(.spec.template.spec.initContainers[0])' /var/lib/rancher/k3s/server/manifests/gitpod/*_DaemonSet_ws-daemon.yaml |
| 122 | + |
| 123 | +for f in /var/lib/rancher/k3s/server/manifests/gitpod/*.yaml; do (cat "$f"; echo) >> /var/lib/rancher/k3s/server/manifests/gitpod.yaml; done |
| 124 | +rm -rf /var/lib/rancher/k3s/server/manifests/gitpod |
| 125 | + |
| 126 | +/bin/k3s server --disable traefik \ |
| 127 | + --node-label gitpod.io/workload_meta=true \ |
| 128 | + --node-label gitpod.io/workload_ide=true \ |
| 129 | + --node-label gitpod.io/workload_workspace_services=true \ |
| 130 | + --node-label gitpod.io/workload_workspace_regular=true \ |
| 131 | + --node-label gitpod.io/workload_workspace_headless=true |
0 commit comments