Add default workspace image to org setting #18723

mustard-mh · 2023-09-15T10:27:08Z

Description

Summary generated by Copilot

`🤖 Generated by Copilot at f347e3b`

This pull request adds support for setting a default workspace image for an organization, which affects the workspace config for projects and prebuilds that belong to that organization. It also refactors some dashboard components and adds some error handling and UI logic for the organization settings page. It modifies the data model, the database migration, the server API, the client hooks, and the prebuild integrations to implement this feature.

Related Issue(s)

Fixes EXP-614

How to test

Dashboard UX

It can view org settings under /settings page as a member (join mine https://hw-org-img.preview.gitpod-dev.com/orgs/join?inviteId=b42773ab-7c5c-4f40-864c-ad808aed555f)
It can modify org settings as a owner of org

Workspace Image

Workspaces under org without image configured on .gitpod.yml should go with org settings
- Try with gitpod/gitpod-base as your org image, start with https://github.com/gitpod-io/empty, there should have no node installed
Specify an image on .gitpod.yml, it should work with that image too
- Try with gitpod/workspace-go
- Try with https://github.com/mustard-mh/test/tree/custom-img , it should have leeway cli

GP-CLI gp validate

When using gp validate [doc] , it should align to section Workspace Image above too

Private ECR

It should work with private ecr feature Add ECR authentication support to image-builder #18506
- TODO

Documentation

Preview status

Gitpod was successfully deployed to your preview environment.

🏷️ Name - hw-org-img
🔗 URL - hw-org-img.preview.gitpod-dev.com/workspaces.
📚 Documentation - See our internal documentation for information on how to interact with your preview environment.
📦 Version - hw-org-img-gha.16981
🗒️ Logs - GCP Logs Explorer

Build Options

Build

/werft with-werft
Run the build with werft instead of GHA
leeway-no-cache
/werft no-test
Run Leeway with --dont-test

Publish

/werft publish-to-npm
/werft publish-to-jb-marketplace

Installer

analytics=segment
with-dedicated-emulation
workspace-feature-flags
Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

/werft with-local-preview
If enabled this will build install/preview
/werft with-preview
/werft with-large-vm
/werft with-gce-vm
If enabled this will create the environment on GCE infra
with-integration-tests=all
Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
with-monitoring

/hold

…ault)

components/dashboard/src/teams/TeamSettings.tsx

Co-authored-by: Filip Troníček <[email protected]>

components/server/src/workspace/workspace-starter.ts

akosyakov

I tested and generally it works.

/hold

there are some discussions though have we can surface issues with access to the default image to members and owners. see https://gitpod.slack.com/archives/C05H5UQBW6Q/p1695027536449729?thread_ts=1695026341.413039&cid=C05H5UQBW6Q

mustard-mh · 2023-09-18T09:46:57Z

Unit tests added, try it with exec yarn mocha --opts mocha.opts './**/config-provider.spec.js' --exclude './node_modules/**' on components/server

gtsiolis

Thanks for adding this, @mustard-mh. 🌮

I've added below a few comments on UX—most importantly a suggestion for adding a message for users when their workspace could break because of the custom default image set.

We can improve the UX more around this feature in later iterations:

Better checks
Better form UX
Include auth for private registries
...

components/dashboard/src/teams/TeamSettings.tsx

gtsiolis · 2023-09-18T09:27:34Z

components/gitpod-cli/cmd/init.go

-			d = []byte(`# List the start up tasks. Learn more: https://www.gitpod.io/docs/configure/workspaces/tasks
+			defaultImage, err := getDefaultWorkspaceImage(ctx)
+			if err != nil {
+				fmt.Printf("failed to get organization default workspace image: %v\n", err)


issue: Not the best line to comment on this, but org users can easily run into non-functional workspace start flow if image is inaccessible, tags are missing, etc. See relevant discussion (internal). Cc @akosyakov

Error 1 Error 2 ...

gtsiolis · 2023-09-18T09:47:00Z

components/server/src/workspace/gitpod-server-impl.ts

@@ -2507,6 +2509,7 @@ export class GitpodServerImpl implements GitpodServerWithTracing, Disposable {
        const user = await this.checkAndBlockUser("updateOrgSettings");
        traceAPIParams(ctx, { orgId, userId: user.id });
        await this.guardTeamOperation(orgId, "update");
+        // TODO: call ImageBuilder ResolveBaseImage to dry test if we can access this image


thought: This could be out of the scope of this PR, but from the relevant discussion (internal) with @akosyakov, an idea could be to try to validate the image on load, and nudge org owners when something is wrong. This could be surfacing also in the dashboard as global alert. 💡

Checking Error OK

Later on, we could improve UX by also moving the help text and also this status check above the text input.

Proposed UX for help text placement, out of the scope of this PR

gtsiolis · 2023-09-18T09:53:07Z

components/dashboard/src/teams/TeamSettings.tsx

+            <TextInputField
+                label="Default Image"
+                // TODO: Provide document links
+                hint="Use any official Gitpod Docker image, or Docker image reference"
+                value={defaultWorkspaceImage}
+                onChange={setDefaultWorkspaceImage}
+                disabled={isLoading || !org?.isOwner}
+            />


issue(non-blocking): Minor UX issue, but could we use a placeholder for now when someone is deleting the text input_ here? Feels a bit unintuitive when you delete all text and click save that there's a default value overriding the empty text input. Could be improved later.

gtsiolis · 2023-09-18T09:57:15Z

components/server/src/workspace/workspace-starter.ts

+        orgIdEnv.setName("GITPOD_WORKSPACE_DEFAULT_IMAGE");
+        orgIdEnv.setValue(await this.configProvider.getDefaultImage(workspace.organizationId));
+        sysEnvvars.push(orgIdEnv);
+
        const spec = new StartWorkspaceSpec();


suggestion: Definitely not the best line to comment about this, but since setting a non-reachable or non-functional workspace image could break UX for many org users, we could at least inform users why their workspace is broken.

From relevant discussion (internal):

Otherwise, users would be left in blank if they don't have organization settings access. I don't think users can guess there's something wrong with the custom image, right?

What do you think of adding an error alert in the workspace start, when a custom default image, and ideally we could check if it's accessible or not? If we can't check if the image is reachable, we could tone down the error as we do with the last editor warning and warn users that there's a custom set image that could be responsible for this workspace error.

What do you think?

Error alert Warning alert

☝️ Copy for the warning could be improved.
☝️ We use that area for the latest editor warning, which could be nice if we replaced. In the future, we could hide the latest editor warning all together or tone down the message.

@mustard-mh can we do something here?

components/gitpod-cli/cmd/validate.go

Co-authored-by: George Tsiolis <[email protected]>

components/supervisor/pkg/supervisor/config.go

mustard-mh · 2023-09-18T10:56:22Z

📔 To summarize:

Use FGA instead of hard code permission check in dashboard @svenefftinge [src] EXP-628
Call ImageBuilder ResolveBaseImage to dry test if we can access this image @geropl @akosyakov @gtsiolis [src] EXP-629
- Add related warning / error messages
  - on Dashboard when change org settings @gtsiolis [src] EXP-630
  - on Dashboard when start workspace -> we need to think about it since there's no specify error code in registry-facade and ws-manager-mk2 may need someone from @gitpod-io/team-engine to help us @geropl @akosyakov @gtsiolis [src] EXP-631
  - on GP-CLI gp init gp validate @gtsiolis [src] EXP-632
Add server/public API to get default workspace image @geropl @akosyakov [src] EXP-633
- Add placeholder to Dashboard org settings page @gtsiolis [src] EXP-634

Going to smoke test this PR, and only push necessary changes then.

akosyakov · 2023-09-18T10:59:23Z

on Dashboard when change org settings @gtsiolis [https://github.com//pull/18723#discussion_r1328482602] EXP-630

It is not only on change of default workspace image, but whenever someone to see it as well. There can be other conditions why it fails not only when default image is changing.

on GP-CLI gp init gp validate @gtsiolis [https://github.com//pull/18723#discussion_r1328461586] EXP-632

Here we don't need to do anyhting. It is outside of Gitpod control. User has to docker login and so on.

mustard-mh · 2023-09-18T11:06:51Z

It is not only on change of default workspace image, but whenever someone to see it as well. There can be other conditions why it fails not only when default image is changing.

@akosyakov Could you explain this in detail?

Here we don't need to do anyhting. It is outside of Gitpod control. User has to docker login and so on.

User who has private ECR permission on workspace start don't have that permission on in workspace docker pull, it's because we don't attach related env to workspace for security issues.

@akosyakov So you mean that it's ok if we just left docker pull output to them

akosyakov · 2023-09-18T11:12:27Z

@akosyakov Could you explain this in detail?

Someone did some external change which broke default image pull, i.e. changed auth to registry, deleted a tag or so. In #18723 (comment) is proposed to validate on page load, so owner can go to this page and see whether everything is alright with the default image. The indicator is not part of changing org settings, but decoupled check which happens always, does not prevent from update the setting. They are not coupled. Org service does not need to know about image builder.

@akosyakov So you mean that it's ok if we just left docker pull output to them

yes

mustard-mh · 2023-09-18T11:15:55Z

@akosyakov I see, Linear updated 🙏

akosyakov · 2023-09-18T12:24:10Z

Do we still need to do anything of rest can be addressed with follow-up PRs? @gtsiolis @mustard-mh @loujaybee

mustard-mh · 2023-09-19T10:22:47Z

Smoke tested test cases, going to unhold ✅

laushinka · 2023-09-19T11:28:45Z

Thanks for this great progress, @mustard-mh! In case we're going very back and forth on the validation aspect, let's move that to a different PR, and focus this one on adding the setting.

mustard-mh · 2023-09-19T12:51:28Z

/unhold

🎉

roboquat added do-not-merge/hold do-not-merge/work-in-progress size/L labels Sep 15, 2023

mustard-mh added 2 commits September 15, 2023 11:11

Add default workspace image to org setting

b7dd2e6

[db] add migration

5cb3118

mustard-mh force-pushed the hw/org-img branch from 0fecdd4 to 5cb3118 Compare September 15, 2023 11:12

mustard-mh added 8 commits September 15, 2023 12:08

fixup

90a851e

[dashboard] add org default image settings

2c6c5d1

fixup

03262da

dashboard fixup

88e8909

Add server image test TODO

bc074ba

[server] assign global workspace default image

5080271

[dashboard] allow to submit empty string (will fallback to global def…

7652208

…ault)

[gp-cli] support gp validate with default image

d22e969

roboquat added size/XXL and removed size/L labels Sep 15, 2023

[dashboard] save default image

7e6e29c

mustard-mh marked this pull request as ready for review September 15, 2023 20:16

mustard-mh requested a review from a team as a code owner September 15, 2023 20:16

github-actions bot added the team: team-experience label Sep 15, 2023

mustard-mh marked this pull request as draft September 15, 2023 20:17

mustard-mh added 3 commits September 15, 2023 20:46

fixup

f347e3b

fixup

0a7b1ff

[gp-cli] improve output

dea9564

mustard-mh marked this pull request as ready for review September 15, 2023 21:47

mustard-mh added 2 commits September 15, 2023 22:06

[gp-cli] improve gp init

ae32c3a

[gp-cli] gp validate compatibility

2771ff4

mustard-mh marked this pull request as draft September 15, 2023 22:19

filiptronicek reviewed Sep 16, 2023

View reviewed changes

components/dashboard/src/teams/TeamSettings.tsx Outdated Show resolved Hide resolved

Update components/dashboard/src/teams/TeamSettings.tsx

e2a7849

Co-authored-by: Filip Troníček <[email protected]>

Add unit tests

c8ccb52

akosyakov reviewed Sep 18, 2023

View reviewed changes

components/server/src/workspace/workspace-starter.ts Outdated Show resolved Hide resolved

akosyakov approved these changes Sep 18, 2023

View reviewed changes

gtsiolis reviewed Sep 18, 2023

View reviewed changes

Rename to DefaultWorkspaceImage

8dd6695

akosyakov reviewed Sep 18, 2023

View reviewed changes

components/gitpod-cli/cmd/validate.go Outdated Show resolved Hide resolved

Update components/dashboard/src/teams/TeamSettings.tsx

06cfd08

Co-authored-by: George Tsiolis <[email protected]>

akosyakov reviewed Sep 18, 2023

View reviewed changes

components/supervisor/pkg/supervisor/config.go Show resolved Hide resolved

mustard-mh added 2 commits September 18, 2023 10:08

Add empty image fallback to supervisor

1941376

Fix default workspace image setup

c2df290

mustard-mh added 2 commits September 18, 2023 15:27

Update org settings fields

4987594

fixup

5f0daea

mustard-mh force-pushed the hw/org-img branch 2 times, most recently from 1faf203 to 22cca8d Compare September 18, 2023 17:55

Allow empty image to set to default one

97ae60f

mustard-mh force-pushed the hw/org-img branch from 22cca8d to 97ae60f Compare September 18, 2023 19:06

roboquat removed the do-not-merge/hold label Sep 19, 2023

roboquat merged commit 04e576f into main Sep 19, 2023

roboquat deleted the hw/org-img branch September 19, 2023 12:52

mustard-mh mentioned this pull request Sep 21, 2023

Add default image get to PAPI and improve Dashboard #18767

Merged

14 tasks

Add default workspace image to org setting #18723

Add default workspace image to org setting #18723

Uh oh!

Conversation

mustard-mh commented Sep 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

🤖 Generated by Copilot at f347e3b

Related Issue(s)

How to test

Documentation

Preview status

Build Options

Uh oh!

Uh oh!

Uh oh!

akosyakov left a comment

Choose a reason for hiding this comment

Uh oh!

mustard-mh commented Sep 18, 2023

Uh oh!

gtsiolis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gtsiolis Sep 18, 2023

Choose a reason for hiding this comment

Uh oh!

gtsiolis Sep 18, 2023

Choose a reason for hiding this comment

Uh oh!

gtsiolis Sep 18, 2023

Choose a reason for hiding this comment

Uh oh!

gtsiolis Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akosyakov Sep 18, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mustard-mh commented Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

akosyakov commented Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mustard-mh commented Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

akosyakov commented Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mustard-mh commented Sep 18, 2023

Uh oh!

akosyakov commented Sep 18, 2023

Uh oh!

mustard-mh commented Sep 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

laushinka commented Sep 19, 2023

Uh oh!

mustard-mh commented Sep 19, 2023

Uh oh!

Uh oh!

mustard-mh commented Sep 15, 2023 •

edited

Loading

`🤖 Generated by Copilot at f347e3b`

gtsiolis Sep 18, 2023 •

edited

Loading

mustard-mh commented Sep 18, 2023 •

edited

Loading

akosyakov commented Sep 18, 2023 •

edited

Loading

mustard-mh commented Sep 18, 2023 •

edited

Loading

akosyakov commented Sep 18, 2023 •

edited

Loading

mustard-mh commented Sep 19, 2023 •

edited

Loading