🤖 feat: bootstrap coderd operator access from CoderControlPlane

api/v1alpha1/codercontrolplane_types.go

@@ -29,6 +29,19 @@ type CoderControlPlaneSpec struct {
 	ExtraEnv []corev1.EnvVar `json:"extraEnv,omitempty"`
 	// ImagePullSecrets are used by the pod to pull private images.
 	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+	// OperatorAccess configures bootstrap API access to the coderd instance.
+	// +kubebuilder:default={}
+	OperatorAccess OperatorAccessSpec `json:"operatorAccess,omitempty"`
+}
+
+// OperatorAccessSpec configures the controller-managed coderd operator user.
+type OperatorAccessSpec struct {
+	// Disabled turns off creation and management of the `coder-k8s-operator`
+	// user and API token.
+	// +kubebuilder:default=false
+	Disabled bool `json:"disabled,omitempty"`
+	// GeneratedTokenSecretName stores the generated operator API token.
+	GeneratedTokenSecretName string `json:"generatedTokenSecretName,omitempty"`
 }
 
 // CoderControlPlaneStatus defines the observed state of a CoderControlPlane.
@@ -39,6 +52,10 @@ type CoderControlPlaneStatus struct {
 	ReadyReplicas int32 `json:"readyReplicas,omitempty"`
 	// URL is the in-cluster URL for the control plane service.
 	URL string `json:"url,omitempty"`
+	// OperatorTokenSecretRef points to the Secret key containing the `coder-k8s-operator` API token.
+	OperatorTokenSecretRef *SecretKeySelector `json:"operatorTokenSecretRef,omitempty"`
+	// OperatorAccessReady reports whether operator API access bootstrap succeeded.
+	OperatorAccessReady bool `json:"operatorAccessReady,omitempty"`
 	// Phase is a high-level readiness indicator.
 	Phase string `json:"phase,omitempty"`
 	// Conditions are Kubernetes-standard conditions for this resource.

config/crd/bases/coder.com_codercontrolplanes.yaml

@@ -226,6 +226,22 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              operatorAccess:
+                default: {}
+                description: OperatorAccess configures bootstrap API access to the
+                  coderd instance.
+                properties:
+                  disabled:
+                    default: false
+                    description: |-
+                      Disabled turns off creation and management of the `coder-k8s-operator`
+                      user and API token.
+                    type: boolean
+                  generatedTokenSecretName:
+                    description: GeneratedTokenSecretName stores the generated operator
+                      API token.
+                    type: string
+                type: object
               replicas:
                 default: 1
                 description: Replicas is the desired number of control plane pods.
@@ -319,6 +335,24 @@ spec:
                   reflects.
                 format: int64
                 type: integer
+              operatorAccessReady:
+                description: OperatorAccessReady reports whether operator API access
+                  bootstrap succeeded.
+                type: boolean
+              operatorTokenSecretRef:
+                description: |-
+                  OperatorTokenSecretRef points to the Secret key containing the
+                  `coder-k8s-operator` API token.
+                properties:
+                  key:
+                    description: Key is the key inside the Secret data map.
+                    type: string
+                  name:
+                    description: Name is the Kubernetes Secret name.
+                    type: string
+                required:
+                - name
+                type: object
               phase:
                 description: Phase is a high-level readiness indicator.
                 type: string

docs/reference/api/codercontrolplane.md

@@ -19,6 +19,7 @@
 | `spec.extraArgs` | `[]string` | ExtraArgs are appended to the default Coder server arguments. |
 | `spec.extraEnv` | `[]k8s.io/api/core/v1.EnvVar` | ExtraEnv are injected into the Coder control plane container. |
 | `spec.imagePullSecrets` | `[]k8s.io/api/core/v1.LocalObjectReference` | ImagePullSecrets are used by the pod to pull private images. |
+| `spec.operatorAccess` | `github.com/coder/coder-k8s/api/v1alpha1.OperatorAccessSpec` | OperatorAccess configures bootstrap API access to the coderd instance. |
 
 ## Status
 
@@ -27,6 +28,8 @@
 | `status.observedGeneration` | `int64` | ObservedGeneration tracks the spec generation this status reflects. |
 | `status.readyReplicas` | `int32` | ReadyReplicas is the number of ready pods observed in the deployment. |
 | `status.url` | `string` | URL is the in-cluster URL for the control plane service. |
+| `status.operatorTokenSecretRef` | `github.com/coder/coder-k8s/api/v1alpha1.SecretKeySelector` | OperatorTokenSecretRef points to the Secret key containing the `coder-k8s-operator` API token. |
+| `status.operatorAccessReady` | `bool` | OperatorAccessReady reports whether operator API access bootstrap succeeded. |
 | `status.phase` | `string` | Phase is a high-level readiness indicator. |
 | `status.conditions` | `[]metav1.Condition` | Conditions are Kubernetes-standard conditions for this resource. |
 

go.mod

@@ -5,6 +5,7 @@ go 1.25.7
 require (
 	github.com/coder/coder/v2 v2.30.0
 	github.com/google/uuid v1.6.0
+	github.com/lib/pq v1.10.9
 	github.com/modelcontextprotocol/go-sdk v1.3.0
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da

go.sum

@@ -525,6 +525,8 @@ github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc
 github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ=
 github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
 github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 h1:PpXWgLPs+Fqr325bN2FD2ISlRRztXibcX6e8f5FR5Dc=

internal/app/controllerapp/controllerapp.go

@@ -86,8 +86,9 @@ func Run(ctx context.Context) error {
 	}
 
 	reconciler := &controller.CoderControlPlaneReconciler{
-		Client: client,
-		Scheme: managerScheme,
+		Client:                    client,
+		Scheme:                    managerScheme,
+		OperatorAccessProvisioner: coderbootstrap.NewPostgresOperatorAccessProvisioner(),
 	}
 	if err := reconciler.SetupWithManager(mgr); err != nil {
 		return fmt.Errorf("unable to create controller: %w", err)