Repository navigation
🤖 Use the internal Coder URL for provisioner keys and the aggregated API when TLS is on #198
Description
Problem
Two controller-side Coder clients build their URL from CoderControlPlane.status.url:
- the
CoderProvisionercontroller (internal/controller/coderprovisioner_controller.go, provisioner key calls) - the aggregated API server (
internal/aggregated/coder/controlplane_provider.go)
With TLS enabled, status.url is https://<service>.<namespace>.svc.cluster.local:443. The control-plane controller avoids that URL for its own SDK calls (controlPlaneSDKURL), because externally provisioned certificates usually do not cover the service hostname. The two callers above can therefore fail TLS verification when TLS is on. I did not verify this in a live cluster.
CoderTemplateTest (#152) already uses the internal HTTP URL when status.url is HTTPS (#197).
Proposal
Use the same rule in both callers: keep an HTTP status.url, and use controlPlaneSDKURL when it is HTTPS. Add a TLS case to their tests.
Trigger
Before the CoderTemplateTest activation PR (plan PR 7 of #152), or earlier if a user reports TLS errors from provisioner keys or the aggregated API.
Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high
Activity
ThomasK33 commentedon Oct 3, 2026
Docs note for the activation PR (plan PR 7 of #152): with TLS on,
CoderTemplateTest(and these two callers, once fixed) send the operator token to Coder over internal HTTP to the service, not over TLS. The activation docs must state that, so admins who need in-cluster encryption know to use a network policy or a service mesh.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high