fix: capture key material during metadata-only ensure

Author: ThomasK33

internal/controller/coderprovisioner_controller.go

@@ -311,7 +311,8 @@ func (r *CoderProvisionerReconciler) Reconcile(ctx context.Context, req ctrl.Req
 		// Secret is usable and no drift detected, but status metadata
 		// is empty (e.g. upgrade from older version). Call EnsureProvisionerKey
 		// to populate IDs/name and establish the baseline for future drift detection.
-		// The key material will be empty (already exists), but that's OK.
+		// Typically the key already exists and Key will be empty, but if the
+		// remote key was deleted we capture the new key material too.
 		response, ensureErr := r.BootstrapClient.EnsureProvisionerKey(ctx, coderbootstrap.EnsureProvisionerKeyRequest{
 			CoderURL:         controlPlane.Status.URL,
 			SessionToken:     sessionToken,
@@ -332,6 +333,11 @@ func (r *CoderProvisionerReconciler) Reconcile(ctx context.Context, req ctrl.Req
 			if response.KeyName != "" {
 				provisionerKeyName = response.KeyName
 			}
+			// If coderd created a new key (remote was missing), capture the
+			// material so ensureProvisionerKeySecret writes it to the Secret.
+			if response.Key != "" {
+				keyMaterial = response.Key
+			}
 			appliedOrgName = organizationName
 			appliedTagsHash = desiredTagsHash
 			setCondition(

internal/controller/coderprovisioner_controller_test.go

@@ -345,7 +345,7 @@ func TestCoderProvisionerReconciler_ExistingSecret(t *testing.T) {
 			OrganizationID: uuid.New(),
 			KeyID:          uuid.New(),
 			KeyName:        provisionerName,
-			Key:            "new-key-material",
+			Key:            "", // Empty: coderd returns no plaintext for existing keys.
 		}},
 	}
 	reconciler := &controller.CoderProvisionerReconciler{Client: k8sClient, Scheme: scheme, BootstrapClient: bootstrapClient}