🤖 fix: handle duplicate rollback license uploads as converged

Treat duplicate-license upload responses as converged success and persist
`licenseLastApplied*`/Applied condition, so rollback rotations (A→B→A)
do not loop on non-idempotent backend errors.

Also adds a regression test for rollback duplicate-upload convergence.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `$1.21`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=1.21 -->

Author: ThomasK33

internal/controller/codercontrolplane_controller.go

@@ -651,6 +651,23 @@ func (r *CoderControlPlaneReconciler) reconcileLicense(
 	}
 
 	if err := r.LicenseUploader.AddLicense(ctx, nextStatus.URL, operatorToken, licenseJWT); err != nil {
+		if isDuplicateLicenseUploadError(err) {
+			now := metav1.Now()
+			nextStatus.LicenseLastApplied = &now
+			nextStatus.LicenseLastAppliedHash = licenseHash
+			if err := setControlPlaneCondition(
+				nextStatus,
+				coderControlPlane.Generation,
+				coderv1alpha1.CoderControlPlaneConditionLicenseApplied,
+				metav1.ConditionTrue,
+				licenseConditionReasonApplied,
+				"Configured license already exists in coderd.",
+			); err != nil {
+				return ctrl.Result{}, err
+			}
+			return ctrl.Result{}, nil
+		}
+
 		var sdkErr *codersdk.Error
 		if errors.As(err, &sdkErr) {
 			switch sdkErr.StatusCode() {
@@ -1053,6 +1070,30 @@ func (r *CoderControlPlaneReconciler) reconcileRequestsForLicenseSecret(
 	return requests
 }
 
+func isDuplicateLicenseUploadError(err error) bool {
+	var sdkErr *codersdk.Error
+	if !errors.As(err, &sdkErr) {
+		return false
+	}
+
+	message := strings.ToLower(strings.TrimSpace(sdkErr.Message + " " + sdkErr.Detail))
+	if message == "" {
+		return false
+	}
+
+	if strings.Contains(message, "licenses_jwt_key") {
+		return true
+	}
+	if strings.Contains(message, "duplicate key") {
+		return true
+	}
+	if strings.Contains(message, "already exists") {
+		return true
+	}
+
+	return false
+}
+
 func mergeControlPlaneStatusDelta(
 	baseStatus coderv1alpha1.CoderControlPlaneStatus,
 	nextStatus coderv1alpha1.CoderControlPlaneStatus,

internal/controller/codercontrolplane_controller_test.go

@@ -51,6 +51,7 @@ type licenseUploadCall struct {
 
 type fakeLicenseUploader struct {
 	err               error
+	addLicenseErrs    []error
 	hasAnyLicenseErr  error
 	hasAnyLicense     *bool
 	hasAnyLicenseCall int
@@ -63,6 +64,11 @@ func (f *fakeLicenseUploader) AddLicense(_ context.Context, coderURL, sessionTok
 		sessionToken: sessionToken,
 		licenseJWT:   licenseJWT,
 	})
+	if len(f.addLicenseErrs) > 0 {
+		err := f.addLicenseErrs[0]
+		f.addLicenseErrs = f.addLicenseErrs[1:]
+		return err
+	}
 	return f.err
 }
 
@@ -779,6 +785,132 @@ func TestReconcile_LicenseRotationUploadsNewSecretValue(t *testing.T) {
 	}
 }
 
+func TestReconcile_LicenseRollbackDuplicateUploadConverges(t *testing.T) {
+	ctx := context.Background()
+
+	licenseSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-license-rollback-secret", Namespace: "default"},
+		Data: map[string][]byte{
+			coderv1alpha1.DefaultLicenseSecretKey: []byte("license-jwt-a"),
+		},
+	}
+	if err := k8sClient.Create(ctx, licenseSecret); err != nil {
+		t.Fatalf("create license secret: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = k8sClient.Delete(ctx, licenseSecret)
+	})
+
+	cp := &coderv1alpha1.CoderControlPlane{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-license-rollback", Namespace: "default"},
+		Spec: coderv1alpha1.CoderControlPlaneSpec{
+			ExtraEnv: []corev1.EnvVar{{
+				Name:  "CODER_PG_CONNECTION_URL",
+				Value: "postgres://example/license-rollback",
+			}},
+			LicenseSecretRef: &coderv1alpha1.SecretKeySelector{Name: licenseSecret.Name},
+		},
+	}
+	if err := k8sClient.Create(ctx, cp); err != nil {
+		t.Fatalf("create test CoderControlPlane: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = k8sClient.Delete(ctx, cp)
+	})
+
+	duplicateErr := codersdk.NewTestError(http.StatusInternalServerError, http.MethodPost, "/api/v2/licenses")
+	duplicateErr.Message = "duplicate key value violates unique constraint \"licenses_jwt_key\""
+	uploader := &fakeLicenseUploader{addLicenseErrs: []error{nil, nil, duplicateErr}}
+	provisioner := &fakeOperatorAccessProvisioner{token: "operator-token-license-rollback"}
+	r := &controller.CoderControlPlaneReconciler{
+		Client:                    k8sClient,
+		Scheme:                    scheme,
+		OperatorAccessProvisioner: provisioner,
+		LicenseUploader:           uploader,
+	}
+
+	if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}}); err != nil {
+		t.Fatalf("first reconcile control plane: %v", err)
+	}
+	deployment := &appsv1.Deployment{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}, deployment); err != nil {
+		t.Fatalf("get reconciled deployment: %v", err)
+	}
+	deployment.Status.ReadyReplicas = 1
+	deployment.Status.Replicas = 1
+	if err := k8sClient.Status().Update(ctx, deployment); err != nil {
+		t.Fatalf("update deployment status: %v", err)
+	}
+
+	if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}}); err != nil {
+		t.Fatalf("second reconcile control plane: %v", err)
+	}
+	if len(uploader.calls) != 1 {
+		t.Fatalf("expected initial upload call count 1, got %d", len(uploader.calls))
+	}
+
+	reconciledAfterInitial := &coderv1alpha1.CoderControlPlane{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}, reconciledAfterInitial); err != nil {
+		t.Fatalf("get reconciled control plane after initial apply: %v", err)
+	}
+	hashA := reconciledAfterInitial.Status.LicenseLastAppliedHash
+	if hashA == "" {
+		t.Fatalf("expected hash after initial apply")
+	}
+
+	secretToRotate := &corev1.Secret{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: licenseSecret.Name, Namespace: licenseSecret.Namespace}, secretToRotate); err != nil {
+		t.Fatalf("get license secret: %v", err)
+	}
+	secretToRotate.Data[coderv1alpha1.DefaultLicenseSecretKey] = []byte("license-jwt-b")
+	if err := k8sClient.Update(ctx, secretToRotate); err != nil {
+		t.Fatalf("rotate license to B: %v", err)
+	}
+	if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}}); err != nil {
+		t.Fatalf("third reconcile control plane: %v", err)
+	}
+
+	reconciledAfterB := &coderv1alpha1.CoderControlPlane{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}, reconciledAfterB); err != nil {
+		t.Fatalf("get reconciled control plane after B apply: %v", err)
+	}
+	if reconciledAfterB.Status.LicenseLastAppliedHash == hashA {
+		t.Fatalf("expected hash to change after applying B")
+	}
+
+	secretToRotateBack := &corev1.Secret{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: licenseSecret.Name, Namespace: licenseSecret.Namespace}, secretToRotateBack); err != nil {
+		t.Fatalf("get license secret for rollback: %v", err)
+	}
+	secretToRotateBack.Data[coderv1alpha1.DefaultLicenseSecretKey] = []byte("license-jwt-a")
+	if err := k8sClient.Update(ctx, secretToRotateBack); err != nil {
+		t.Fatalf("rollback license to A: %v", err)
+	}
+
+	result, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}})
+	if err != nil {
+		t.Fatalf("fourth reconcile control plane: %v", err)
+	}
+	if result.RequeueAfter > 0 {
+		t.Fatalf("expected duplicate rollback upload handling to converge without requeue, got %+v", result)
+	}
+	if len(uploader.calls) != 3 {
+		t.Fatalf("expected three upload attempts across A->B->A rollback, got %d", len(uploader.calls))
+	}
+
+	reconciledAfterRollback := &coderv1alpha1.CoderControlPlane{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}, reconciledAfterRollback); err != nil {
+		t.Fatalf("get reconciled control plane after rollback: %v", err)
+	}
+	if reconciledAfterRollback.Status.LicenseLastAppliedHash != hashA {
+		t.Fatalf("expected rollback to converge to original hash %q, got %q", hashA, reconciledAfterRollback.Status.LicenseLastAppliedHash)
+	}
+	licenseCondition := findCondition(t, reconciledAfterRollback.Status.Conditions, coderv1alpha1.CoderControlPlaneConditionLicenseApplied)
+	if licenseCondition.Status != metav1.ConditionTrue {
+		t.Fatalf("expected license condition true after duplicate rollback handling, got %q", licenseCondition.Status)
+	}
+}
+
 func TestReconcile_LicenseNotSupportedSetsConditionWithoutRequeue(t *testing.T) {
 	ctx := context.Background()