🤖 feat: apply CoderControlPlane licenses from Secret

ThomasK33 · ThomasK33 · commit ca6a2a8f8a12 · 2026-02-12T13:56:26.000Z
Add licenseSecretRef support on CoderControlPlane and reconcile Enterprise
license uploads after control-plane/operator readiness. Track successful
applies with licenseLastApplied and licenseLastAppliedHash to avoid duplicate
uploads, and handle Secret rotation.

Also adds Secret field indexing/watch wiring for referenced license Secrets,
pluggable SDK-backed license uploader, generated CRD/docs updates, sample
manifest updates, and controller tests for pending/apply/idempotency/rotation
and NotSupported behavior.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `.21`_

&lt;!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=1.21 --&gt;
diff --git a/api/v1alpha1/codercontrolplane_types.go b/api/v1alpha1/codercontrolplane_types.go
@@ -10,6 +10,8 @@ const (
 	CoderControlPlanePhasePending = "Pending"
 	// CoderControlPlanePhaseReady indicates at least one control plane pod is ready.
 	CoderControlPlanePhaseReady = "Ready"
+	// CoderControlPlaneConditionLicenseApplied indicates whether the operator uploaded the configured license.
+	CoderControlPlaneConditionLicenseApplied = "LicenseApplied"
 )
 
 // CoderControlPlaneSpec defines the desired state of a CoderControlPlane.
@@ -32,6 +34,11 @@ type CoderControlPlaneSpec struct {
 	// OperatorAccess configures bootstrap API access to the coderd instance.
 	// +kubebuilder:default={}
 	OperatorAccess OperatorAccessSpec `json:"operatorAccess,omitempty"`
+	// LicenseSecretRef references a Secret key containing a Coder Enterprise
+	// license JWT. When set, the controller uploads the license after the
+	// control plane is ready and re-uploads when the Secret value changes.
+	// +optional
+	LicenseSecretRef *SecretKeySelector `json:"licenseSecretRef,omitempty"`
 }
 
 // OperatorAccessSpec configures the controller-managed coderd operator user.
@@ -56,6 +63,14 @@ type CoderControlPlaneStatus struct {
 	OperatorTokenSecretRef *SecretKeySelector `json:"operatorTokenSecretRef,omitempty"`
 	// OperatorAccessReady reports whether operator API access bootstrap succeeded.
 	OperatorAccessReady bool `json:"operatorAccessReady,omitempty"`
+	// LicenseLastApplied is the timestamp of the most recent successful
+	// operator-managed license upload.
+	// +optional
+	LicenseLastApplied *metav1.Time `json:"licenseLastApplied,omitempty"`
+	// LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT
+	// that LicenseLastApplied refers to.
+	// +optional
+	LicenseLastAppliedHash string `json:"licenseLastAppliedHash,omitempty"`
 	// Phase is a high-level readiness indicator.
 	Phase string `json:"phase,omitempty"`
 	// Conditions are Kubernetes-standard conditions for this resource.
diff --git a/api/v1alpha1/types_shared.go b/api/v1alpha1/types_shared.go
@@ -5,6 +5,8 @@ import corev1 "k8s.io/api/core/v1"
 const (
 	// DefaultTokenSecretKey is the default key used for proxy session tokens.
 	DefaultTokenSecretKey = "token"
+	// DefaultLicenseSecretKey is the default key used for Coder license JWTs.
+	DefaultLicenseSecretKey = "license"
 )
 
 // ServiceSpec defines the Service configuration reconciled by the operator.
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/coder.com_codercontrolplanes.yaml b/config/crd/bases/coder.com_codercontrolplanes.yaml
@@ -226,6 +226,21 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              licenseSecretRef:
+                description: |-
+                  LicenseSecretRef references a Secret key containing a Coder Enterprise
+                  license JWT. When set, the controller uploads the license after the
+                  control plane is ready and re-uploads when the Secret value changes.
+                properties:
+                  key:
+                    description: Key is the key inside the Secret data map.
+                    type: string
+                  name:
+                    description: Name is the Kubernetes Secret name.
+                    type: string
+                required:
+                - name
+                type: object
               operatorAccess:
                 default: {}
                 description: OperatorAccess configures bootstrap API access to the
@@ -330,6 +345,17 @@ spec:
                   - type
                   type: object
                 type: array
+              licenseLastApplied:
+                description: |-
+                  LicenseLastApplied is the timestamp of the most recent successful
+                  operator-managed license upload.
+                format: date-time
+                type: string
+              licenseLastAppliedHash:
+                description: |-
+                  LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT
+                  that LicenseLastApplied refers to.
+                type: string
               observedGeneration:
                 description: ObservedGeneration tracks the spec generation this status
                   reflects.
diff --git a/config/samples/coder_v1alpha1_codercontrolplane.yaml b/config/samples/coder_v1alpha1_codercontrolplane.yaml
@@ -5,3 +5,6 @@ metadata:
   namespace: default
 spec:
   image: "ghcr.io/coder/coder-k8s:main"
+  licenseSecretRef:
+    name: coder-license
+    key: license
diff --git a/docs/reference/api/codercontrolplane.md b/docs/reference/api/codercontrolplane.md
@@ -13,55 +13,38 @@
 
 | Field | Type | Description |
 | --- | --- | --- |
-| `image` | string | Image is the container image used for the Coder control plane pod. |
-| `replicas` | integer | Replicas is the desired number of control plane pods. |
-| `service` | [ServiceSpec](#servicespec) | Service controls the service created in front of the control plane. |
-| `extraArgs` | string array | ExtraArgs are appended to the default Coder server arguments. |
-| `extraEnv` | [EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#envvar-v1-core) array | ExtraEnv are injected into the Coder control plane container. |
-| `imagePullSecrets` | [LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#localobjectreference-v1-core) array | ImagePullSecrets are used by the pod to pull private images. |
-| `operatorAccess` | [OperatorAccessSpec](#operatoraccessspec) | OperatorAccess configures bootstrap API access to the coderd instance. |
+| `image` | `string` | Image is the container image used for the Coder control plane pod. |
+| `replicas` | `int32` | Replicas is the desired number of control plane pods. |
+| `service` | `ServiceSpec` | Service controls the service created in front of the control plane. |
+| ├─ `type` | `corev1.ServiceType` | Type controls the Kubernetes service type. |
+| ├─ `port` | `int32` | Port controls the exposed service port. |
+| └─ `annotations` | `map[string]string` | Annotations are applied to the reconciled service object. |
+| `extraArgs` | `[]string` | ExtraArgs are appended to the default Coder server arguments. |
+| `extraEnv` | `[]corev1.EnvVar` | ExtraEnv are injected into the Coder control plane container. |
+| `imagePullSecrets` | `[]corev1.LocalObjectReference` | ImagePullSecrets are used by the pod to pull private images. |
+| └─ `name` | `string` | Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: [https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names) |
+| `operatorAccess` | `OperatorAccessSpec` | OperatorAccess configures bootstrap API access to the coderd instance. |
+| ├─ `disabled` | `bool` | Disabled turns off creation and management of the `coder-k8s-operator` user and API token. |
+| └─ `generatedTokenSecretName` | `string` | GeneratedTokenSecretName stores the generated operator API token. |
+| `licenseSecretRef` | `SecretKeySelector` | LicenseSecretRef references a Secret key containing a Coder Enterprise license JWT. When set, the controller uploads the license after the control plane is ready and re-uploads when the Secret value changes. |
+| ├─ `name` | `string` | Name is the Kubernetes Secret name. |
+| └─ `key` | `string` | Key is the key inside the Secret data map. |
 
 ## Status
 
 | Field | Type | Description |
 | --- | --- | --- |
-| `observedGeneration` | integer | ObservedGeneration tracks the spec generation this status reflects. |
-| `readyReplicas` | integer | ReadyReplicas is the number of ready pods observed in the deployment. |
-| `url` | string | URL is the in-cluster URL for the control plane service. |
-| `operatorTokenSecretRef` | [SecretKeySelector](#secretkeyselector) | OperatorTokenSecretRef points to the Secret key containing the `coder-k8s-operator` API token. |
-| `operatorAccessReady` | boolean | OperatorAccessReady reports whether operator API access bootstrap succeeded. |
-| `phase` | string | Phase is a high-level readiness indicator. |
-| `conditions` | [Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#condition-v1-meta) array | Conditions are Kubernetes-standard conditions for this resource. |
-
-## Referenced types
-
-### OperatorAccessSpec
-
-OperatorAccessSpec configures the controller-managed coderd operator user.
-
-| Field | Type | Description |
-| --- | --- | --- |
-| `disabled` | boolean | Disabled turns off creation and management of the `coder-k8s-operator` user and API token. |
-| `generatedTokenSecretName` | string | GeneratedTokenSecretName stores the generated operator API token. |
-
-### SecretKeySelector
-
-SecretKeySelector identifies a key in a Secret.
-
-| Field | Type | Description |
-| --- | --- | --- |
-| `name` | string | Name is the Kubernetes Secret name. |
-| `key` | string | Key is the key inside the Secret data map. |
-
-### ServiceSpec
-
-ServiceSpec defines the Service configuration reconciled by the operator.
-
-| Field | Type | Description |
-| --- | --- | --- |
-| `type` | [ServiceType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#servicetype-v1-core) | Type controls the Kubernetes service type. |
-| `port` | integer | Port controls the exposed service port. |
-| `annotations` | object (keys:string, values:string) | Annotations are applied to the reconciled service object. |
+| `observedGeneration` | `int64` | ObservedGeneration tracks the spec generation this status reflects. |
+| `readyReplicas` | `int32` | ReadyReplicas is the number of ready pods observed in the deployment. |
+| `url` | `string` | URL is the in-cluster URL for the control plane service. |
+| `operatorTokenSecretRef` | `SecretKeySelector` | OperatorTokenSecretRef points to the Secret key containing the `coder-k8s-operator` API token. |
+| ├─ `name` | `string` | Name is the Kubernetes Secret name. |
+| └─ `key` | `string` | Key is the key inside the Secret data map. |
+| `operatorAccessReady` | `bool` | OperatorAccessReady reports whether operator API access bootstrap succeeded. |
+| `licenseLastApplied` | `metav1.Time` | LicenseLastApplied is the timestamp of the most recent successful operator-managed license upload. |
+| `licenseLastAppliedHash` | `string` | LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT that LicenseLastApplied refers to. |
+| `phase` | `string` | Phase is a high-level readiness indicator. |
+| `conditions` | `[]metav1.Condition` | Conditions are Kubernetes-standard conditions for this resource. |
 
 ## Source
 
diff --git a/internal/app/controllerapp/controllerapp.go b/internal/app/controllerapp/controllerapp.go
@@ -90,6 +90,7 @@ func SetupControllers(mgr manager.Manager) error {
 		Client:                    client,
 		Scheme:                    managerScheme,
 		OperatorAccessProvisioner: coderbootstrap.NewPostgresOperatorAccessProvisioner(),
+		LicenseUploader:           controller.NewSDKLicenseUploader(),
 	}
 	if err := reconciler.SetupWithManager(mgr); err != nil {
 		return fmt.Errorf("unable to create controller: %w", err)
diff --git a/internal/controller/codercontrolplane_controller.go b/internal/controller/codercontrolplane_controller.go
diff --git a/internal/controller/codercontrolplane_controller_test.go b/internal/controller/codercontrolplane_controller_test.go

Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,8 @@ import corev1 "k8s.io/api/core/v1"`
`5`	`5`	`const (`
`6`	`6`	`// DefaultTokenSecretKey is the default key used for proxy session tokens.`
`7`	`7`	`DefaultTokenSecretKey = "token"`
	`8`	`+ // DefaultLicenseSecretKey is the default key used for Coder license JWTs.`
	`9`	`+ DefaultLicenseSecretKey = "license"`
`8`	`10`	`)`
`9`	`11`
`10`	`12`	`// ServiceSpec defines the Service configuration reconciled by the operator.`
Original file line number	Diff line number	Diff line change
`@@ -90,6 +90,7 @@ func SetupControllers(mgr manager.Manager) error {`
`90`	`90`	`Client: client,`
`91`	`91`	`Scheme: managerScheme,`
`92`	`92`	`OperatorAccessProvisioner: coderbootstrap.NewPostgresOperatorAccessProvisioner(),`
	`93`	`+ LicenseUploader: controller.NewSDKLicenseUploader(),`
`93`	`94`	`}`
`94`	`95`	`if err := reconciler.SetupWithManager(mgr); err != nil {`
`95`	`96`	`return fmt.Errorf("unable to create controller: %w", err)`