fix: use HTTPS SDK URL when TLS service port is 443

Author: ThomasK33

internal/controller/codercontrolplane_controller.go

@@ -1393,7 +1393,12 @@ func controlPlaneSDKURL(coderControlPlane *coderv1alpha1.CoderControlPlane) stri
 		servicePort = defaultControlPlanePort
 	}
 
-	return fmt.Sprintf("http://%s.%s.svc.cluster.local:%d", coderControlPlane.Name, coderControlPlane.Namespace, servicePort)
+	scheme := "http"
+	if controlPlaneTLSEnabled(coderControlPlane) && servicePort == 443 {
+		scheme = "https"
+	}
+
+	return fmt.Sprintf("%s://%s.%s.svc.cluster.local:%d", scheme, coderControlPlane.Name, coderControlPlane.Namespace, servicePort)
 }
 
 func (r *CoderControlPlaneReconciler) reconcileOperatorAccess(

internal/controller/codercontrolplane_controller_test.go

@@ -735,6 +735,77 @@ func TestReconcile_LicenseUsesInternalHTTPURLWhenTLSEnabled(t *testing.T) {
 	}
 }
 
+func TestReconcile_LicenseUsesHTTPSWhenTLSAndServicePort443(t *testing.T) {
+	ensureGatewaySchemeRegistered(t)
+	ctx := context.Background()
+
+	licenseSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-license-tls-443-url-secret", Namespace: "default"},
+		Data: map[string][]byte{
+			coderv1alpha1.DefaultLicenseSecretKey: []byte("license-jwt-tls-443-url"),
+		},
+	}
+	if err := k8sClient.Create(ctx, licenseSecret); err != nil {
+		t.Fatalf("create license secret: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = k8sClient.Delete(ctx, licenseSecret)
+	})
+
+	cp := &coderv1alpha1.CoderControlPlane{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-license-tls-443-url", Namespace: "default"},
+		Spec: coderv1alpha1.CoderControlPlaneSpec{
+			ExtraEnv: []corev1.EnvVar{{
+				Name:  "CODER_PG_CONNECTION_URL",
+				Value: "postgres://example/license-tls-443-url",
+			}},
+			Service: coderv1alpha1.ServiceSpec{Port: 443},
+			TLS: coderv1alpha1.TLSSpec{
+				SecretNames: []string{"coder-internal-tls-443-secret"},
+			},
+			LicenseSecretRef: &coderv1alpha1.SecretKeySelector{Name: licenseSecret.Name},
+		},
+	}
+	if err := k8sClient.Create(ctx, cp); err != nil {
+		t.Fatalf("create test CoderControlPlane: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = k8sClient.Delete(ctx, cp)
+	})
+
+	provisioner := &fakeOperatorAccessProvisioner{token: "operator-token-license-tls-443-url"}
+	uploader := &fakeLicenseUploader{}
+	r := &controller.CoderControlPlaneReconciler{
+		Client:                    k8sClient,
+		Scheme:                    scheme,
+		OperatorAccessProvisioner: provisioner,
+		LicenseUploader:           uploader,
+	}
+
+	if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}}); err != nil {
+		t.Fatalf("first reconcile control plane: %v", err)
+	}
+	deployment := &appsv1.Deployment{}
+	if err := k8sClient.Get(ctx, types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}, deployment); err != nil {
+		t.Fatalf("get reconciled deployment: %v", err)
+	}
+	deployment.Status.ReadyReplicas = 1
+	deployment.Status.Replicas = 1
+	if err := k8sClient.Status().Update(ctx, deployment); err != nil {
+		t.Fatalf("update deployment status: %v", err)
+	}
+
+	if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}}); err != nil {
+		t.Fatalf("second reconcile control plane: %v", err)
+	}
+	if len(uploader.calls) != 1 {
+		t.Fatalf("expected one license upload call, got %d", len(uploader.calls))
+	}
+	if got := uploader.calls[0].coderURL; got != "https://test-license-tls-443-url.default.svc.cluster.local:443" {
+		t.Fatalf("expected license upload URL %q, got %q", "https://test-license-tls-443-url.default.svc.cluster.local:443", got)
+	}
+}
+
 func TestReconcile_LicenseReuploadsWhenBackendHasNoLicenses(t *testing.T) {
 	ensureGatewaySchemeRegistered(t)
 	ctx := context.Background()