JetBrains CodeCanvas 2024.3 Help

Installation to Amazon EKS

This guide describes how to install the CodeCanvas application to a Kubernetes (K8s) cluster hosted in AWS EKS (Elastic Kubernetes Service). It implies that the database and object storage services are hosted in AWS, namely, in RDS and S3.

I. Pre-installation steps

Before you begin the installation, make sure you've completed the steps described below.

1. Set up PostgreSQL databases

CodeCanvas requires two PostgreSQL databases: one for the CodeCanvas application and another for the Jump server.

  1. Install PostgreSQL server (version 12.2 – 15.5). The server must be accessible from the CodeCanvas application cluster, e.g., you can create a pod with the server in the same cluster.

  2. Create dedicated databases for the CodeCanvas application and the Jump server.

  3. Ensure that the database server is up and running before proceeding with the installation.

2. Create AWS S3 bucket

Create an AWS S3 bucket to store CodeCanvas and user data.

3. Prepare CodeCanvas application cluster

  1. Amazon EKS cluster

    Set up an Amazon EKS cluster for the CodeCanvas application. Make sure the cluster meets the requirements from the table below.

    Requirement

    Description

    Helm

    Version 3.6.0 or later

    Kubernetes (K8s)

    Version 1.29 or later

    Cluster nodes

    At least four nodes with Linux OS (x86_64), recommended min resources: 4 CPU cores and 8GB memory

  2. Namespace

    Create a dedicated namespace for the CodeCanvas application (replace NAMESPACE_PLACEHOLDER with an actual namespace name):

    kubectl create namespace NAMESPACE_PLACEHOLDER
  3. Ingress controller

    Install an Ingress controller compatible with your Kubernetes setup. In our example, we use an ingress-nginx controller.

4. Prepare dev environment cluster

  1. Amazon EKS cluster

    Set up a Kubernetes cluster for dev environments. Make sure the cluster meets the requirements from the table below. Depending on your needs, you can create multiple dev environment clusters (the requirements are the same for all clusters). To reduce latency for end users, we recommend deploying the dev environment cluster in the same region as the potential dev environment users.

    Requirement

    Description

    Helm

    Version 3.6.0 or later

    Kubernetes (K8s)

    Version 1.29 or later

    Cluster nodes

    Sufficient nodes to run dev environments, each with Linux OS (Ubuntu, x86_64), recommended min resources: 4 CPU cores and 8GB memory

  2. Namespace

    Create a dedicated namespace for the dev environment cluster (replace NAMESPACE_PLACEHOLDER with an actual namespace name):

    kubectl create namespace NAMESPACE_PLACEHOLDER
  3. CSI driver

    Install the ebs.csi.aws.com CSI driver in the cluster. For installation instructions, refer to the AWS documentation.

  4. CSI snapshot controller

    Install the CSI snapshot controller in the cluster to enable Kubernetes snapshot manipulation. You can install it using the AWS-managed add-on or manually.

  5. Storage class

    Create a storage class for persistent volumes. You can use our recommended storage class configuration below.

    apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: ebs-sc-gp3-16000iops-750mgbps mountOptions: - debug parameters: type: gp3 iops: "16000" throughput: "750" provisioner: ebs.csi.aws.com allowVolumeExpansion: true reclaimPolicy: Delete volumeBindingMode: Immediate
  6. Volume snapshot class

    Create a volume snapshot class for managing snapshots. You can use our recommended volume snapshot class configuration below.

    apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-aws-vsc driver: ebs.csi.aws.com deletionPolicy: Delete
  7. CSI snapshot validation webhook

    Install an add-on to the CSI driver that implements K8s snapshot validation. For the instructions, refer to the K8s documentation. Tested with v6.2.2.

5. Configure DNS and TLS

  1. Domain name

    Register a domain name for the CodeCanvas instance, e.g., codecanvas.example.com.

  2. DNS zones

    Install ExternalDNS in the CodeCanvas application cluster to manage DNS records.

  3. TLS certificates

    Install cert-manager in the CodeCanvas application cluster to manage TLS certificates issued by Let's Encrypt.

  4. Subdomains

    Configure subdomains for the CodeCanvas application components. The configuration in custom.values.yaml supposes the following DNS domain naming scheme:

    • EXTERNAL_DOMAIN_PLACEHOLDER – the main domain for the CodeCanvas application that serves the main administrative UI and REST API. For example, codecanvas.example.com

    • computeservice.EXTERNAL_DOMAIN_PLACEHOLDER – the subdomain that serves the compute-service REST API. It is an internal domain customarily accessed only by dev environment pods.

    • gateway.EXTERNAL_DOMAIN_PLACEHOLDER – serves the gateway-relay service. It is an external domain accessed by user IDE clients.

    • jump.EXTERNAL_DOMAIN_PLACEHOLDER – serves the REST API of the jump-server service. It is an internal domain customarily accessed only by dev environment pods and the server.

    • ssh.EXTERNAL_DOMAIN_PLACEHOLDER – serves the SSH service of the jump-server service. It is an external domain accessed by user IDE clients.

6. Set up IAM roles and permissions

To grant CodeCanvas access to a storage bucket in AWS, you can use either static credentials or IAM roles for service accounts (IRSA). We recommend using IRSA.

Configure the IRSA role for the CodeCanvas application service account. CodeCanvas requires write permission to the bucket. For details on how to set up IRSA, refer to the AWS documentation.

7. (Optional) Configure the SMTP server

CodeCanvas uses the SMTP server to send various emails to users, for example, invitation links during the user creation, email verification, and other notifications. If you want to enable this functionality, ensure you have an SMTP server accessible from the CodeCanvas application cluster.

II. Install CodeCanvas

1. Create custom.values.yaml

Create a custom.values.yaml and copy the snippet below to it. You will replace placeholders with actual values in the next steps.

application: replicaCount: 2 serviceAccount: name: "CODECANVAS_KSA_NAME" annotations: "eks.amazonaws.com/role-arn": "CODECANVAS_IRSA_ARN" ingress: annotations: "cert-manager.io/cluster-issuer": "CERT_MANAGER_NAME_PLACEHOLDER" ingressClassName: "INGRESS_CLASS_PLACEHOLDER" hostname: "EXTERNAL_DOMAIN_PLACEHOLDER" computeHostname: "computeservice.EXTERNAL_DOMAIN_PLACEHOLDER" tls: - hosts: - "EXTERNAL_DOMAIN_PLACEHOLDER" - "computeservice.EXTERNAL_DOMAIN_PLACEHOLDER" secretName: codecanvas-and-computeservice-tls config: codecanvas: relay: url: wss://gateway.EXTERNAL_DOMAIN_PLACEHOLDER jump: enabled: true sshHost: ssh.EXTERNAL_DOMAIN_PLACEHOLDER sshExternalHost: ssh.EXTERNAL_DOMAIN_PLACEHOLDER hotPool: enabled: true execution: k8s: worker: storageClassName: "WORKER_STORAGE_CLASS_NAME_PLACEHOLDER" volumeSnapshotClassName: "WORKER_VOLUME_SNAPSHOT_CLASS_NAME_PLACEHOLDER" secret: objectStorage: existingSecretName: "codecanvas-objectstorage-secret-ext" postgresql: existingSecretName: "codecanvas-db-secret-ext" codecanvas: jump: jwtPrivateKey: | JUMP_PRIVATE_KEY_PLACEHOLDER jumpHostPrivateKey: | JUMP_HOST_PRIVATE_KEY_PLACEHOLDER localAdministrator: firstName: "Admin" lastName: "Admin" username: "ADMIN_USERNAME_PLACEHOLDER" password: "ADMIN_PASSWORD_PLACEHOLDER" email: "ADMIN_EMAIL_PLACEHOLDER" masterSecret: "MASTER_SECRET_PLACEHOLDER" relay: jwtPrivateKey: | GATEWAY_PRIVATE_KEY_PLACEHOLDER jump: enabled: true application: sshService: type: LoadBalancer annotations: "external-dns.alpha.kubernetes.io/hostname": "ssh.EXTERNAL_DOMAIN_PLACEHOLDER" ingress: enabled: true ingressClassName: "INGRESS_CLASS_PLACEHOLDER" hostname: "jump.EXTERNAL_DOMAIN_PLACEHOLDER" annotations: "cert-manager.io/cluster-issuer": "CERT_MANAGER_NAME_PLACEHOLDER" tls: - hosts: - "jump.EXTERNAL_DOMAIN_PLACEHOLDER" secretName: jump-tls secret: postgresql: existingSecretName: "jump-db-secret-ext" jump: sshHostKey: | JUMP_HOST_PRIVATE_KEY_PLACEHOLDER ecdsaPublicKey: | JUMP_PUBLIC_KEY_PLACEHOLDER relay: application: ingress: ingressClassName: "INGRESS_CLASS_PLACEHOLDER" hostname: "gateway.EXTERNAL_DOMAIN_PLACEHOLDER" annotations: "cert-manager.io/cluster-issuer": "CERT_MANAGER_NAME_PLACEHOLDER" tls: - hosts: - "gateway.EXTERNAL_DOMAIN_PLACEHOLDER" secretName: gateway-tls secret: relayJwtPublicKey: | GATEWAY_PUBLIC_KEY_PLACEHOLDER

2. Assign an AWS IRSA role to the CodeCanvas application

In custom.values.yaml, replace CODECANVAS_IRSA_ARN with the actual ARN of the AWS IRSA role that the CodeCanvas application should use.

3. Specify external domain

In custom.values.yaml, replace EXTERNAL_DOMAIN_PLACEHOLDER with the domain name you've registered for your CodeCanvas instance.

4. Set up cert-manager

In custom.values.yaml, replace CERT_MANAGER_NAME_PLACEHOLDER with the name of cert-manager used in your cluster.

5. Specify database settings

The CodeCanvas installation implies that you use an external PostgreSQL database. Though you can use any PostgreSQL database, we recommend using Amazon RDS.

5.1 Obtain credentials

Obtain the credentials for the database user that has permissions to create, read, update, and delete all entities in the schema.

5.2 Create a database secret

A database secret is used to secure access to the PostgreSQL database.

  1. Create a codecanvas-db-secret.yaml file and copy the snippet below to it.

    apiVersion: v1 kind: Secret type: Opaque metadata: name: codecanvas-db-secret-ext namespace: NAMESPACE_PLACEHOLDER stringData: DB_HOST: "CODECANVAS_DB_HOST_PLACEHOLDER" DB_NAME: "CODECANVAS_DB_NAME_PLACEHOLDER" DB_PASSWORD: "CODECANVAS_DB_PASSWORD_PLACEHOLDER" DB_PORT: "CODECANVAS_DB_PORT_PLACEHOLDER" DB_USERNAME: "CODECANVAS_DB_USERNAME_PLACEHOLDER"
  2. Replace the following placeholders:

    • NAMESPACE_PLACEHOLDER with your Kubernetes namespace

    • CODECANVAS_DB_PASSWORD_PLACEHOLDER with a password for the CODECANVAS_DB_USERNAME_PLACEHOLDER user

    • CODECANVAS_DB_HOST_PLACEHOLDER with the PostgreSQL hostname

    • CODECANVAS_DB_PORT_PLACEHOLDER with the PostgreSQL port

  3. Run:

    kubectl apply -f codecanvas-db-secret.yaml
  4. Delete the codecanvas-db-secret.yaml file.

6. Specify Jump server database settings

The Jump server also uses an external PostgreSQL database.

6.1 Obtain credentials

Obtain the credentials for the database user that has permissions to create, read, update, and delete all entities in the schema.

6.2 Create a database secret

A database secret is used to secure access to the PostgreSQL database.

  1. Create a jump-db-secret.yaml file and copy the snippet below to it.

    apiVersion: v1 kind: Secret type: Opaque metadata: name: jump-db-secret-ext namespace: NAMESPACE_PLACEHOLDER stringData: DB_HOST: "JUMPSERVER_DB_HOST_PLACEHOLDER" DB_NAME: "JUMPSERVER_DB_NAME_PLACEHOLDER" DB_PASSWORD: "JUMPSERVER_DB_PASSWORD_PLACEHOLDER" DB_PORT: "JUMPSERVER_DB_PORT_PLACEHOLDER" DB_USERNAME: "JUMPSERVER_DB_USERNAME_PLACEHOLDER"
  2. Replace the following placeholders:

    • NAMESPACE_PLACEHOLDER with your Kubernetes namespace

    • JUMPSERVER_DB_PASSWORD_PLACEHOLDER with a password for the JUMPSERVER_DB_USERNAME_PLACEHOLDER user

    • JUMPSERVER_DB_HOST_PLACEHOLDER with the PostgreSQL hostname

    • JUMPSERVER_DB_PORT_PLACEHOLDER with the PostgreSQL port

  3. Run:

    kubectl apply -f jump-db-secret.yaml
  4. Delete the jump-db-secret.yaml file.

7. Specify object storage settings

This installation implies that you use an AWS S3 bucket for storing user data.

You should authorize CodeCanvas to access your S3 object storage in one of two ways: using static credentials or IAM roles for service accounts (IRSA). We recommend using IRSA.

If you decide to use IRSA, there is no need to create a Kubernetes secret with static credentials. Instead, you should modify the custom.values.yaml file to enable IRSA.

In custom.values.yaml, replace the following section:

secret: objectStorage: existingSecretName: "codecanvas-objectstorage-secret-ext"

with

secret: objectStorage: region: "CODECANVAS_OBJECT_STORAGE_REGION_PLACEHOLDER" bucket: "CODECANVAS_OBJECT_STORAGE_BUCKET_PLACEHOLDER"

Replace the following placeholders:

  • CODECANVAS_OBJECT_STORAGE_REGION_PLACEHOLDER with the AWS region where the bucket is located (e.g., eu-west-1)

  • CODECANVAS_OBJECT_STORAGE_BUCKET_PLACEHOLDER with the name of the S3 bucket created for CodeCanvas

To set up authorization in your S3 object storage with static credentials, you should create an object storage secret and provide a username and password.

  1. Create an object-storage-secret.yaml file and copy the snippet below to it.

    apiVersion: v1 kind: Secret type: Opaque metadata: name: codecanvas-objectstorage-secret-ext namespace: NAMESPACE_PLACEHOLDER stringData: CODECANVAS_OBJECT_STORAGE_ACCESS_KEY: "CODECANVAS_OBJECT_STORAGE_ACCESS_KEY_PLACEHOLDER" CODECANVAS_OBJECT_STORAGE_SECRET_KEY: "CODECANVAS_OBJECT_STORAGE_SECRET_KEY_PLACEHOLDER" CODECANVAS_OBJECT_STORAGE_BUCKET: "CODECANVAS_OBJECT_STORAGE_BUCKET_PLACEHOLDER" CODECANVAS_OBJECT_STORAGE_REGION: "CODECANVAS_OBJECT_STORAGE_REGION_PLACEHOLDER"
  2. Replace the following placeholders:

    • NAMESPACE_PLACEHOLDER with your Kubernetes namespace

    • CODECANVAS_OBJECT_STORAGE_ACCESS_KEY_PLACEHOLDER with the AWS access key

    • CODECANVAS_OBJECT_STORAGE_SECRET_KEY_PLACEHOLDER with the AWS secret key

    • CODECANVAS_OBJECT_STORAGE_BUCKET_PLACEHOLDER with the name of the S3 bucket created for CodeCanvas

    • CODECANVAS_OBJECT_STORAGE_REGION_PLACEHOLDER with the AWS region where the bucket is located (e.g., eu-west-1)

  3. Run:

    kubectl apply -f object-storage-secret.yaml
  4. Delete the object-storage-secret.yaml file.

8. Create a master secret

The CodeCanvas application keeps user secrets (e.g., credentials to external services) in the database in an encrypted form. The master secret is used to encrypt and decrypt these data.

  1. Generate the master secret by running

    openssl rand -base64 32
  2. In custom.values.yaml, replace MASTER_SECRET_PLACEHOLDER with the generated value.

9. Configure the system administrator account

The system administrator account will be used for logging in to and configuring CodeCanvas after the installation.

  1. In custom.values.yaml, replace ADMIN_USERNAME_PLACEHOLDER and ADMIN_PASSWORD_PLACEHOLDER with desired administrator credentials.

  2. Replace ADMIN_EMAIL_PLACEHOLDER with an email address for receiving administrator notifications from CodeCanvas.

10. Specify the storage class

In custom.values.yaml, replace WORKER_STORAGE_CLASS_NAME_PLACEHOLDER with the storage class name you've created.

11. Specify the volume snapshot class name

In custom.values.yaml, replace WORKER_VOLUME_SNAPSHOT_CLASS_NAME_PLACEHOLDER with the volume snapshot class name you've created.

12. Create gateway-relay keys

The Relay server acts as an intermediary between JetBrains Gateway on a user machine and the dev environment. The communication between them is secured with SSL/TLS. To establish a secure connection, the gateway and the Relay server must have a pair of keys which you need to generate. The public key is shared with the Relay server. The private key is then used by JetBrains Gateway to authenticate dev environments in the Relay server.

  1. Generate a private key:

    openssl ecparam -name prime256v1 -genkey -noout -out gateway-ec-prime256v1-priv-key.pem
    cat gateway-ec-prime256v1-priv-key.pem
  2. In custom.values.yaml, replace GATEWAY_PRIVATE_KEY_PLACEHOLDER with the generated key value.

  3. Generate a public key:

    openssl ec -in gateway-ec-prime256v1-priv-key.pem -pubout > gateway-ec-prime256v1-pub-key.pem
    cat gateway-ec-prime256v1-pub-key.pem
  4. In custom.values.yaml, replace GATEWAY_PUBLIC_KEY_PLACEHOLDER with the generated key value.

  5. Delete the gateway-ec-prime256v1-priv-key.pem and gateway-ec-prime256v1-pub-key.pem files.

13. Create Jump server keys

The Jump server acts as an intermediate server that provides indirect SSH connections between a user machine (SSH client, VS Code in the remote mode, etc.) and the SSH daemon in a dev environment. The SSH connection requires a pair of keys which you need to generate. The public key is shared with the Jump server. The private key is then used by the SSH client to authenticate in the Jump server.

  1. Generate a private key:

    openssl ecparam -name prime256v1 -genkey -noout -out jump-ec-prime256v1-priv-key.pem
    cat jump-ec-prime256v1-priv-key.pem
  2. In custom.values.yaml, replace JUMP_PRIVATE_KEY_PLACEHOLDER with the generated key value.

  3. Generate a public key:

    openssl ec -in jump-ec-prime256v1-priv-key.pem -pubout > jump-ec-prime256v1-pub-key.pem
    cat jump-ec-prime256v1-pub-key.pem
  4. In custom.values.yaml, replace JUMP_PUBLIC_KEY_PLACEHOLDER with the generated key value.

  5. Delete the jump-ec-prime256v1-priv-key.pem and jump-ec-prime256v1-pub-key.pem files.

  6. Generate a private host key:

    openssl genrsa -traditional 2048 2>/dev/null
  7. In custom.values.yaml, replace JUMP_HOST_PRIVATE_KEY_PLACEHOLDER with the generated key value.

14. Specify the Ingress class

In custom.values.yaml, replace INGRESS_CLASS_PLACEHOLDER with the Ingress class used for the CodeCanvas Kubernetes cluster.

15. Specify the Kubernetes service account for the CodeCanvas pod

Suppose you've set up a Service account in the application cluster and prefer the service account name to be independent of the Helm release name. In that case, you may want to specify a particular name for the Kubernetes service account that the CodeCanvas Helm chart will create. To do this, in custom.values.yaml, replace CODECANVAS_KSA_NAME with the desired name.

16. (Optional) Configure Sysbox container runtime

By default, CodeCanvas runs worker containers in the --privileged mode (the containers have root privileges on the host node). If you want to avoid this due to security reasons, install Sysbox Container Runtime as described here.

17. Install the CodeCanvas chart

Run:

helm upgrade -n NAMESPACE_PLACEHOLDER --wait --install \ -f custom.values.yaml \ codecanvas \ oci://public.registry.jetbrains.space/p/codecanvas/release-charts/codecanvas \ --version 2024.3

Here:

  • NAMESPACE_PLACEHOLDER is your Kubernetes namespace

  • codecanvas is the Helm release name. You can change it if needed

III. Verify the installation

After you install your CodeCanvas instance, verify the installation.

1. Verify the state of CodeCanvas pods

Run:

kubectl -n NAMESPACE_PLACEHOLDER get pods

All pods must be in the Running state. On average, it takes about 2 minutes after deployment for a pod to become active.

If the pods are not Running, try finding the cause by running:

kubectl -n NAMESPACE_PLACEHOLDER get event

and

kubectl -n NAMESPACE_PLACEHOLDER describe pod POD_NAME

2. Verify domain name resolution

The domain name must resolve to the Ingress load balancer. You can check this by running:

nslookup EXTERNAL_DOMAIN_PLACEHOLDER
nslookup gateway.EXTERNAL_DOMAIN_PLACEHOLDER
nslookup jump.EXTERNAL_DOMAIN_PLACEHOLDER
nslookup ssh.EXTERNAL_DOMAIN_PLACEHOLDER

The output must not contain any errors.

3. Check the CodeCanvas application

Open your CodeCanvas instance in a browser. When logging in to CodeCanvas, use the administrator credentials provided during the installation.

IV. Connect the dev environment cluster

To connect the dev environment cluster to CodeCanvas, you should create a connection in the CodeCanvas application.

  1. Select Administration in the header navigation, then in the sidebar menu, select Computing Platforms.

  2. Click New connection.

    Connect dev environment cluster
  3. Give this connection a Name, specify the cluster's Kubernetes namespace, and click Save. The connection will be added to the list. Here you can also modify the pod YAML template according to your needs. Learn more

  4. Click the connection in the list to open its details.

  5. The connection details page provides the snippet of the helm upgrade command that you should use to install the CodeCanvas operator in the dev environment cluster. This operator will communicate with the CodeCanvas application and start/stop dev environments in the cluster.

    Connect dev environment cluster

    To connect to the CodeCanvas application, it will need an access token:

    1. Click Generate token.

    2. Copy the snippet to the clipboard.

  6. Install the CodeCanvas operator Helm chart on the dev environment cluster using the snippet.

  7. Click Test connection and ensure that all checks are successful.

    Connect dev environment cluster. Test connection

V. Post-installation steps

After successfully verifying the installation and connecting the dev environment cluster, you can proceed to configure your CodeCanvas instance: creating dev environment instance types, adding users, namespaces, and so on.

Last modified: 20 December 2024