🤖 feat: apply CoderControlPlane licenses from Secret

Add licenseSecretRef support on CoderControlPlane and reconcile Enterprise
license uploads after control-plane/operator readiness. Track successful
applies with licenseLastApplied and licenseLastAppliedHash to avoid duplicate
uploads, and handle Secret rotation.

Also adds Secret field indexing/watch wiring for referenced license Secrets,
pluggable SDK-backed license uploader, generated CRD/docs updates, sample
manifest updates, and controller tests for pending/apply/idempotency/rotation
and NotSupported behavior.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `.21`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=1.21 -->

Author: ThomasK33

api/v1alpha1/codercontrolplane_types.go

@@ -10,6 +10,8 @@ const (
 	CoderControlPlanePhasePending = "Pending"
 	// CoderControlPlanePhaseReady indicates at least one control plane pod is ready.
 	CoderControlPlanePhaseReady = "Ready"
+	// CoderControlPlaneConditionLicenseApplied indicates whether the operator uploaded the configured license.
+	CoderControlPlaneConditionLicenseApplied = "LicenseApplied"
 )
 
 // CoderControlPlaneSpec defines the desired state of a CoderControlPlane.
@@ -32,6 +34,11 @@ type CoderControlPlaneSpec struct {
 	// OperatorAccess configures bootstrap API access to the coderd instance.
 	// +kubebuilder:default={}
 	OperatorAccess OperatorAccessSpec `json:"operatorAccess,omitempty"`
+	// LicenseSecretRef references a Secret key containing a Coder Enterprise
+	// license JWT. When set, the controller uploads the license after the
+	// control plane is ready and re-uploads when the Secret value changes.
+	// +optional
+	LicenseSecretRef *SecretKeySelector `json:"licenseSecretRef,omitempty"`
 }
 
 // OperatorAccessSpec configures the controller-managed coderd operator user.
@@ -56,6 +63,14 @@ type CoderControlPlaneStatus struct {
 	OperatorTokenSecretRef *SecretKeySelector `json:"operatorTokenSecretRef,omitempty"`
 	// OperatorAccessReady reports whether operator API access bootstrap succeeded.
 	OperatorAccessReady bool `json:"operatorAccessReady,omitempty"`
+	// LicenseLastApplied is the timestamp of the most recent successful
+	// operator-managed license upload.
+	// +optional
+	LicenseLastApplied *metav1.Time `json:"licenseLastApplied,omitempty"`
+	// LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT
+	// that LicenseLastApplied refers to.
+	// +optional
+	LicenseLastAppliedHash string `json:"licenseLastAppliedHash,omitempty"`
 	// Phase is a high-level readiness indicator.
 	Phase string `json:"phase,omitempty"`
 	// Conditions are Kubernetes-standard conditions for this resource.

api/v1alpha1/types_shared.go

@@ -5,6 +5,8 @@ import corev1 "k8s.io/api/core/v1"
 const (
 	// DefaultTokenSecretKey is the default key used for proxy session tokens.
 	DefaultTokenSecretKey = "token"
+	// DefaultLicenseSecretKey is the default key used for Coder license JWTs.
+	DefaultLicenseSecretKey = "license"
 )
 
 // ServiceSpec defines the Service configuration reconciled by the operator.

api/v1alpha1/zz_generated.deepcopy.go

@@ -226,6 +226,21 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              licenseSecretRef:
+                description: |-
+                  LicenseSecretRef references a Secret key containing a Coder Enterprise
+                  license JWT. When set, the controller uploads the license after the
+                  control plane is ready and re-uploads when the Secret value changes.
+                properties:
+                  key:
+                    description: Key is the key inside the Secret data map.
+                    type: string
+                  name:
+                    description: Name is the Kubernetes Secret name.
+                    type: string
+                required:
+                - name
+                type: object
               operatorAccess:
                 default: {}
                 description: OperatorAccess configures bootstrap API access to the
@@ -330,6 +345,17 @@ spec:
                   - type
                   type: object
                 type: array
+              licenseLastApplied:
+                description: |-
+                  LicenseLastApplied is the timestamp of the most recent successful
+                  operator-managed license upload.
+                format: date-time
+                type: string
+              licenseLastAppliedHash:
+                description: |-
+                  LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT
+                  that LicenseLastApplied refers to.
+                type: string
               observedGeneration:
                 description: ObservedGeneration tracks the spec generation this status
                   reflects.

config/crd/bases/coder.com_codercontrolplanes.yaml

@@ -5,3 +5,6 @@ metadata:
   namespace: default
 spec:
   image: "ghcr.io/coder/coder-k8s:main"
+  licenseSecretRef:
+    name: coder-license
+    key: license

config/samples/coder_v1alpha1_codercontrolplane.yaml

@@ -26,6 +26,9 @@
 | `operatorAccess` | `OperatorAccessSpec` | OperatorAccess configures bootstrap API access to the coderd instance. |
 | ├─ `disabled` | `bool` | Disabled turns off creation and management of the `coder-k8s-operator` user and API token. |
 | └─ `generatedTokenSecretName` | `string` | GeneratedTokenSecretName stores the generated operator API token. |
+| `licenseSecretRef` | `SecretKeySelector` | LicenseSecretRef references a Secret key containing a Coder Enterprise license JWT. When set, the controller uploads the license after the control plane is ready and re-uploads when the Secret value changes. |
+| ├─ `name` | `string` | Name is the Kubernetes Secret name. |
+| └─ `key` | `string` | Key is the key inside the Secret data map. |
 
 ## Status
 
@@ -38,6 +41,8 @@
 | ├─ `name` | `string` | Name is the Kubernetes Secret name. |
 | └─ `key` | `string` | Key is the key inside the Secret data map. |
 | `operatorAccessReady` | `bool` | OperatorAccessReady reports whether operator API access bootstrap succeeded. |
+| `licenseLastApplied` | `metav1.Time` | LicenseLastApplied is the timestamp of the most recent successful operator-managed license upload. |
+| `licenseLastAppliedHash` | `string` | LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT that LicenseLastApplied refers to. |
 | `phase` | `string` | Phase is a high-level readiness indicator. |
 | `conditions` | `[]metav1.Condition` | Conditions are Kubernetes-standard conditions for this resource. |
 

docs/reference/api/codercontrolplane.md

@@ -90,6 +90,7 @@ func SetupControllers(mgr manager.Manager) error {
 		Client:                    client,
 		Scheme:                    managerScheme,
 		OperatorAccessProvisioner: coderbootstrap.NewPostgresOperatorAccessProvisioner(),
+		LicenseUploader:           controller.NewSDKLicenseUploader(),
 	}
 	if err := reconciler.SetupWithManager(mgr); err != nil {
 		return fmt.Errorf("unable to create controller: %w", err)