feat: reconcile control planes and workspace proxies#23
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c22f1b1df
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
ibetitsmike
force-pushed
the
mike/operator-controlplane-workspaceproxy
branch
from
5c22f1b to
91002f5
Compare
|
@codex review Addressed the previously unresolved Codex threads and pushed follow-up fixes:
Validation run locally:
|
|
@codex review Follow-up fix pushed after CI feedback:
Re-validated locally:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a75c6ff317
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
ibetitsmike
force-pushed
the
mike/operator-controlplane-workspaceproxy
branch
from
a75c6ff to
1d76c01
Compare
|
@codex review\n\nRebased this branch onto current |
|
@codex review Follow-up fix pushed for the remaining label-length thread:
Validation run locally:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b864dc315
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| func controlPlaneLabels(name string) map[string]string { | ||
| return map[string]string{ | ||
| "app.kubernetes.io/name": "coder-control-plane", | ||
| "app.kubernetes.io/instance": name, |
There was a problem hiding this comment.
controlPlaneLabels sets app.kubernetes.io/instance to the full CoderControlPlane name, but Kubernetes label values are limited to 63 characters; any valid CR name longer than that will cause child Deployment/Service writes to be rejected during reconciliation. This means long-named control planes cannot converge even though the CR itself can be created, so this label needs the same truncate+hash handling added for WorkspaceProxy.
Useful? React with 👍 / 👎.
1 participant
Summary
This PR upgrades
coder-k8sfrom a placeholder controller into a functional operator for two resource types:CoderControlPlane(coder.com/v1alpha1)WorkspaceProxy(coder.com/v1alpha1)It reconciles control-plane and workspace-proxy Deployments/Services, supports optional proxy bootstrap token creation through the Coder SDK, and updates generated manifests/codegen/output accordingly.
Background
coder-k8spreviously scaffolded API types and controller wiring, but reconciliation was intentionally no-op. We need a usable operator path for deploying and managing:through CRDs stored in etcd and managed with standard Kubernetes workflows.
Implementation
CoderControlPlaneAPI:image,replicas,service,extraArgs,extraEnv,imagePullSecrets)observedGeneration,readyReplicas,url,phase,conditions)api/v1alpha1/types_shared.go.WorkspaceProxyAPI (workspaceproxy_types.go) with:primaryAccessURL+proxySessionTokenSecretRef)bootstrap.coderURL, credentials secret, generated token secret)WorkspaceProxyReconciler:internal/coderbootstrap/client.go:github.com/coder/coder/v2/codersdkas-isgo.mod/go.sum/vendor.Validation
make codegenmake manifestsmake testmake buildmake verify-vendorRisks
codersdkcurrently pulls in a large transitive dependency graph and causes substantial vendor churn.wsproxy server.Generated with
mux• Model:openai:gpt-5.3-codex• Thinking:xhigh• Cost:$0.54Latest updates (February 10, 2026)
Rebased the branch onto
main(806142a).Addressed Codex feedback to avoid unnecessary bootstrap credential reads:
WorkspaceProxyReconciler.resolveProxyCredentialsnow checks for an existing generated proxy token Secret before reading bootstrap credentials.Added regression coverage:
TestWorkspaceProxyReconcile_WithBootstrap_UsesExistingTokenWithoutCredentialsverifies reconcile succeeds with an existing token secret and no bootstrap credential secret.Re-synced
go.mod,go.sum, andvendor/after the rebase so vendored dependencies and module metadata remain consistent.Bounded
app.kubernetes.io/instancelabel values for WorkspaceProxy children to 63 characters with deterministic hash suffixing to avoid reconciliation failures on long CR names; addedTestWorkspaceProxyReconcile_TruncatesLongInstanceLabelValuecoverage.