fix: respect envFrom access URL and probe defaults

Author: ThomasK33

internal/controller/codercontrolplane_controller.go

@@ -731,6 +731,10 @@ func buildProbe(spec coderv1alpha1.ProbeSpec, path, portName string) *corev1.Pro
 			},
 		},
 		InitialDelaySeconds: spec.InitialDelaySeconds,
+		PeriodSeconds:       10,
+		TimeoutSeconds:      1,
+		SuccessThreshold:    1,
+		FailureThreshold:    3,
 	}
 	if spec.PeriodSeconds != nil {
 		probe.PeriodSeconds = *spec.PeriodSeconds
@@ -755,6 +759,16 @@ func (r *CoderControlPlaneReconciler) reconcileDeployment(ctx context.Context, c
 
 	deployment := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: coderControlPlane.Name, Namespace: coderControlPlane.Namespace}}
 
+	injectClusterAccessURL := coderControlPlane.Spec.EnvUseClusterAccessURL == nil || *coderControlPlane.Spec.EnvUseClusterAccessURL
+	accessURLConfiguredViaEnvFrom := false
+	if injectClusterAccessURL {
+		var err error
+		accessURLConfiguredViaEnvFrom, err = envFromMayDefineEnvVar(coderControlPlane.Spec.EnvFrom, "CODER_ACCESS_URL")
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, deployment, func() error {
 		labels := controlPlaneLabels(coderControlPlane.Name)
 		deployment.Labels = maps.Clone(labels)
@@ -795,12 +809,12 @@ func (r *CoderControlPlaneReconciler) reconcileDeployment(ctx context.Context, c
 		}
 
 		tlsEnabled := controlPlaneTLSEnabled(coderControlPlane)
-		if coderControlPlane.Spec.EnvUseClusterAccessURL == nil || *coderControlPlane.Spec.EnvUseClusterAccessURL {
+		if injectClusterAccessURL {
 			configuredAccessURL, err := findEnvVar(coderControlPlane.Spec.ExtraEnv, "CODER_ACCESS_URL")
 			if err != nil {
 				return err
 			}
-			if configuredAccessURL == nil {
+			if configuredAccessURL == nil && !accessURLConfiguredViaEnvFrom {
 				scheme := "http"
 				accessURLPort := coderControlPlane.Spec.Service.Port
 				if accessURLPort == 0 {
@@ -2039,6 +2053,40 @@ func (r *CoderControlPlaneReconciler) resolvePostgresURLFromExtraEnv(
 	return r.readSecretValue(ctx, coderControlPlane.Namespace, secretRef.Name, secretRef.Key)
 }
 
+func envFromMayDefineEnvVar(envFromSources []corev1.EnvFromSource, envVarName string) (bool, error) {
+	if strings.TrimSpace(envVarName) == "" {
+		return false, fmt.Errorf("assertion failed: environment variable name must not be empty")
+	}
+
+	for i := range envFromSources {
+		envFromSource := envFromSources[i]
+		if envFromSource.ConfigMapRef != nil && envFromSource.SecretRef != nil {
+			return false, fmt.Errorf("assertion failed: envFrom[%d] must not set both configMapRef and secretRef", i)
+		}
+
+		prefix := strings.TrimSpace(envFromSource.Prefix)
+		if prefix != "" && !strings.HasPrefix(envVarName, prefix) {
+			continue
+		}
+
+		if envFromSource.ConfigMapRef != nil {
+			if strings.TrimSpace(envFromSource.ConfigMapRef.Name) == "" {
+				return false, fmt.Errorf("assertion failed: envFrom[%d].configMapRef.name must not be empty", i)
+			}
+			return true, nil
+		}
+
+		if envFromSource.SecretRef != nil {
+			if strings.TrimSpace(envFromSource.SecretRef.Name) == "" {
+				return false, fmt.Errorf("assertion failed: envFrom[%d].secretRef.name must not be empty", i)
+			}
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
 func findEnvVar(envVars []corev1.EnvVar, name string) (*corev1.EnvVar, error) {
 	if strings.TrimSpace(name) == "" {
 		return nil, fmt.Errorf("assertion failed: environment variable name must not be empty")

internal/controller/codercontrolplane_controller_test.go

@@ -2823,6 +2823,53 @@ func TestReconcile_DeploymentAlignment(t *testing.T) {
 		}
 	})
 
+	t.Run("EnvFromAccessURLTakesPrecedence", func(t *testing.T) {
+		configMap := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-deployment-alignment-envfrom-access-url", Namespace: "default"},
+			Data: map[string]string{
+				"CODER_ACCESS_URL": "https://envfrom.example.test",
+			},
+		}
+		if err := k8sClient.Create(ctx, configMap); err != nil {
+			t.Fatalf("create configmap: %v", err)
+		}
+		t.Cleanup(func() {
+			_ = k8sClient.Delete(ctx, configMap)
+		})
+
+		cp := &coderv1alpha1.CoderControlPlane{
+			ObjectMeta: metav1.ObjectMeta{Name: "test-deployment-alignment-envfrom-access-url", Namespace: "default"},
+			Spec: coderv1alpha1.CoderControlPlaneSpec{
+				Image: "test-deployment-alignment:latest",
+				EnvFrom: []corev1.EnvFromSource{{
+					ConfigMapRef: &corev1.ConfigMapEnvSource{
+						LocalObjectReference: corev1.LocalObjectReference{Name: configMap.Name},
+					},
+				}},
+			},
+		}
+		if err := k8sClient.Create(ctx, cp); err != nil {
+			t.Fatalf("create control plane: %v", err)
+		}
+		t.Cleanup(func() {
+			_ = k8sClient.Delete(ctx, cp)
+		})
+
+		r := &controller.CoderControlPlaneReconciler{Client: k8sClient, Scheme: scheme}
+		if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}}); err != nil {
+			t.Fatalf("reconcile control plane: %v", err)
+		}
+
+		deployment := &appsv1.Deployment{}
+		if err := k8sClient.Get(ctx, types.NamespacedName{Name: cp.Name, Namespace: cp.Namespace}, deployment); err != nil {
+			t.Fatalf("get deployment: %v", err)
+		}
+		container := deployment.Spec.Template.Spec.Containers[0]
+		if countEnvVar(container.Env, "CODER_ACCESS_URL") != 0 {
+			t.Fatalf("expected operator to skip default CODER_ACCESS_URL when envFrom is configured, got %v", container.Env)
+		}
+	})
+
 	t.Run("ResourcesAndSecurityContextsApplied", func(t *testing.T) {
 		runAsUser := int64(1001)
 		allowPrivilegeEscalation := false
@@ -2921,6 +2968,18 @@ func TestReconcile_ProbeConfiguration(t *testing.T) {
 		if container.ReadinessProbe.HTTPGet.Port != intstr.FromString("http") {
 			t.Fatalf("expected readiness probe port name %q, got %#v", "http", container.ReadinessProbe.HTTPGet.Port)
 		}
+		if container.ReadinessProbe.PeriodSeconds != 10 {
+			t.Fatalf("expected readiness probe default periodSeconds=10, got %d", container.ReadinessProbe.PeriodSeconds)
+		}
+		if container.ReadinessProbe.TimeoutSeconds != 1 {
+			t.Fatalf("expected readiness probe default timeoutSeconds=1, got %d", container.ReadinessProbe.TimeoutSeconds)
+		}
+		if container.ReadinessProbe.SuccessThreshold != 1 {
+			t.Fatalf("expected readiness probe default successThreshold=1, got %d", container.ReadinessProbe.SuccessThreshold)
+		}
+		if container.ReadinessProbe.FailureThreshold != 3 {
+			t.Fatalf("expected readiness probe default failureThreshold=3, got %d", container.ReadinessProbe.FailureThreshold)
+		}
 	})
 
 	t.Run("LivenessProbeDisabled", func(t *testing.T) {