Summary

This PR fixes CoderProvisioner bring-up and reconcile stability issues discovered in smoke testing.

Background

During an end-to-end smoke test, CoderProvisioner failed to reach Ready due to RBAC escalation issues and provisioner pod startup failures. Logs also showed repeated metadata backfill/rotation activity that could repeatedly hit coderd and trigger rate limiting when reconcile retries occurred.

Implementation

• Added manager RBAC markers for delegated provisioner role verbs on:
  • pods (get/list/watch/create/update/patch/delete)
  • persistentvolumeclaims (get/list/watch/create/update/patch/delete)
• Regenerated RBAC output so config/rbac/role.yaml includes those verbs.
• Stopped coderd metadata-backfill churn when a usable key secret already exists by stamping status baseline fields locally instead of re-calling/rotating keys in that retry path.
• Updated provisioner pod launch wiring:
  • explicit command: ["coder"]
  • args use coder provisioner start
  • removed CODER_ORGANIZATION injection for key-auth daemon startup (avoids CLI rejection when --key is used).
• Updated controller tests accordingly.
• Regenerated CRD/docs for the updated API comment text.

Validation

• make verify-vendor
• make test
• make build
• make lint
• make test-integration
• make manifests
• make docs-reference
• Runtime smoke verification in kind:
  • CoderProvisioner reaches phase=Ready, readyReplicas=1
  • provisioner pod logs include successfully connected to coderd

Risks

• Low to moderate: changes are isolated to CoderProvisioner reconcile/deployment composition and generated RBAC/docs.
• Main behavior change is intentionally avoiding metadata-backfill coderd calls when a usable key secret already exists; this reduces churn/rate-limit risk during retry loops.

Generated with mux • Model: openai:gpt-5.3-codex • Thinking: xhigh • Cost: $0.00