🤖 feat: reconcile CoderControlPlane licenses from Secret

ThomasK33 · ThomasK33 · commit 6f550f4acd1b · 2026-02-12T14:01:19.000Z
Add CoderControlPlane license Secret support and operator-managed license
upload reconciliation with readiness/operator-access preconditions,
status tracking (`licenseLastApplied`, `licenseLastAppliedHash`),
idempotency hashing, Secret rotation handling, and license status conditions.

Also wire a codersdk-backed uploader, add referenced Secret field indexing
and watches, update controller app wiring, add focused controller tests, and
regenerate CRD/deepcopy/docs/sample artifacts. Includes docs reference
regeneration to align with CI output formatting.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `$1.21`_

&lt;!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=1.21 --&gt;
diff --git a/api/v1alpha1/codercontrolplane_types.go b/api/v1alpha1/codercontrolplane_types.go
@@ -10,6 +10,8 @@ const (
 	CoderControlPlanePhasePending = "Pending"
 	// CoderControlPlanePhaseReady indicates at least one control plane pod is ready.
 	CoderControlPlanePhaseReady = "Ready"
+	// CoderControlPlaneConditionLicenseApplied indicates whether the operator uploaded the configured license.
+	CoderControlPlaneConditionLicenseApplied = "LicenseApplied"
 )
 
 // CoderControlPlaneSpec defines the desired state of a CoderControlPlane.
@@ -32,6 +34,11 @@ type CoderControlPlaneSpec struct {
 	// OperatorAccess configures bootstrap API access to the coderd instance.
 	// +kubebuilder:default={}
 	OperatorAccess OperatorAccessSpec `json:"operatorAccess,omitempty"`
+	// LicenseSecretRef references a Secret key containing a Coder Enterprise
+	// license JWT. When set, the controller uploads the license after the
+	// control plane is ready and re-uploads when the Secret value changes.
+	// +optional
+	LicenseSecretRef *SecretKeySelector `json:"licenseSecretRef,omitempty"`
 }
 
 // OperatorAccessSpec configures the controller-managed coderd operator user.
@@ -56,6 +63,14 @@ type CoderControlPlaneStatus struct {
 	OperatorTokenSecretRef *SecretKeySelector `json:"operatorTokenSecretRef,omitempty"`
 	// OperatorAccessReady reports whether operator API access bootstrap succeeded.
 	OperatorAccessReady bool `json:"operatorAccessReady,omitempty"`
+	// LicenseLastApplied is the timestamp of the most recent successful
+	// operator-managed license upload.
+	// +optional
+	LicenseLastApplied *metav1.Time `json:"licenseLastApplied,omitempty"`
+	// LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT
+	// that LicenseLastApplied refers to.
+	// +optional
+	LicenseLastAppliedHash string `json:"licenseLastAppliedHash,omitempty"`
 	// Phase is a high-level readiness indicator.
 	Phase string `json:"phase,omitempty"`
 	// Conditions are Kubernetes-standard conditions for this resource.
diff --git a/api/v1alpha1/types_shared.go b/api/v1alpha1/types_shared.go
@@ -5,6 +5,8 @@ import corev1 "k8s.io/api/core/v1"
 const (
 	// DefaultTokenSecretKey is the default key used for proxy session tokens.
 	DefaultTokenSecretKey = "token"
+	// DefaultLicenseSecretKey is the default key used for Coder license JWTs.
+	DefaultLicenseSecretKey = "license"
 )
 
 // ServiceSpec defines the Service configuration reconciled by the operator.
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/coder.com_codercontrolplanes.yaml b/config/crd/bases/coder.com_codercontrolplanes.yaml
@@ -226,6 +226,21 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              licenseSecretRef:
+                description: |-
+                  LicenseSecretRef references a Secret key containing a Coder Enterprise
+                  license JWT. When set, the controller uploads the license after the
+                  control plane is ready and re-uploads when the Secret value changes.
+                properties:
+                  key:
+                    description: Key is the key inside the Secret data map.
+                    type: string
+                  name:
+                    description: Name is the Kubernetes Secret name.
+                    type: string
+                required:
+                - name
+                type: object
               operatorAccess:
                 default: {}
                 description: OperatorAccess configures bootstrap API access to the
@@ -330,6 +345,17 @@ spec:
                   - type
                   type: object
                 type: array
+              licenseLastApplied:
+                description: |-
+                  LicenseLastApplied is the timestamp of the most recent successful
+                  operator-managed license upload.
+                format: date-time
+                type: string
+              licenseLastAppliedHash:
+                description: |-
+                  LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT
+                  that LicenseLastApplied refers to.
+                type: string
               observedGeneration:
                 description: ObservedGeneration tracks the spec generation this status
                   reflects.
diff --git a/config/samples/coder_v1alpha1_codercontrolplane.yaml b/config/samples/coder_v1alpha1_codercontrolplane.yaml
@@ -5,3 +5,6 @@ metadata:
   namespace: default
 spec:
   image: "ghcr.io/coder/coder-k8s:main"
+  licenseSecretRef:
+    name: coder-license
+    key: license
diff --git a/docs/reference/api/codercontrolplane.md b/docs/reference/api/codercontrolplane.md
@@ -20,6 +20,7 @@
 | `extraEnv` | [EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#envvar-v1-core) array | ExtraEnv are injected into the Coder control plane container. |
 | `imagePullSecrets` | [LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#localobjectreference-v1-core) array | ImagePullSecrets are used by the pod to pull private images. |
 | `operatorAccess` | [OperatorAccessSpec](#operatoraccessspec) | OperatorAccess configures bootstrap API access to the coderd instance. |
+| `licenseSecretRef` | [SecretKeySelector](#secretkeyselector) | LicenseSecretRef references a Secret key containing a Coder Enterprise license JWT. When set, the controller uploads the license after the control plane is ready and re-uploads when the Secret value changes. |
 
 ## Status
 
@@ -30,6 +31,8 @@
 | `url` | string | URL is the in-cluster URL for the control plane service. |
 | `operatorTokenSecretRef` | [SecretKeySelector](#secretkeyselector) | OperatorTokenSecretRef points to the Secret key containing the `coder-k8s-operator` API token. |
 | `operatorAccessReady` | boolean | OperatorAccessReady reports whether operator API access bootstrap succeeded. |
+| `licenseLastApplied` | [Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#time-v1-meta) | LicenseLastApplied is the timestamp of the most recent successful operator-managed license upload. |
+| `licenseLastAppliedHash` | string | LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT that LicenseLastApplied refers to. |
 | `phase` | string | Phase is a high-level readiness indicator. |
 | `conditions` | [Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#condition-v1-meta) array | Conditions are Kubernetes-standard conditions for this resource. |
 
diff --git a/internal/app/controllerapp/controllerapp.go b/internal/app/controllerapp/controllerapp.go
@@ -90,6 +90,7 @@ func SetupControllers(mgr manager.Manager) error {
 		Client:                    client,
 		Scheme:                    managerScheme,
 		OperatorAccessProvisioner: coderbootstrap.NewPostgresOperatorAccessProvisioner(),
+		LicenseUploader:           controller.NewSDKLicenseUploader(),
 	}
 	if err := reconciler.SetupWithManager(mgr); err != nil {
 		return fmt.Errorf("unable to create controller: %w", err)
diff --git a/internal/controller/codercontrolplane_controller.go b/internal/controller/codercontrolplane_controller.go
diff --git a/internal/controller/codercontrolplane_controller_test.go b/internal/controller/codercontrolplane_controller_test.go

Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,8 @@ import corev1 "k8s.io/api/core/v1"`
`5`	`5`	`const (`
`6`	`6`	`// DefaultTokenSecretKey is the default key used for proxy session tokens.`
`7`	`7`	`DefaultTokenSecretKey = "token"`
	`8`	`+ // DefaultLicenseSecretKey is the default key used for Coder license JWTs.`
	`9`	`+ DefaultLicenseSecretKey = "license"`
`8`	`10`	`)`
`9`	`11`
`10`	`12`	`// ServiceSpec defines the Service configuration reconciled by the operator.`
Original file line number	Diff line number	Diff line change
`@@ -90,6 +90,7 @@ func SetupControllers(mgr manager.Manager) error {`
`90`	`90`	`Client: client,`
`91`	`91`	`Scheme: managerScheme,`
`92`	`92`	`OperatorAccessProvisioner: coderbootstrap.NewPostgresOperatorAccessProvisioner(),`
	`93`	`+ LicenseUploader: controller.NewSDKLicenseUploader(),`
`93`	`94`	`}`
`94`	`95`	`if err := reconciler.SetupWithManager(mgr); err != nil {`
`95`	`96`	`return fmt.Errorf("unable to create controller: %w", err)`