🤖 Verified in-cluster HTTPS for operator calls to Coder #275

Follow-up to #198 / #273 (security review thread on internal/controlplaneurl/controlplaneurl.go, declined in round 1).

Current design: with built-in TLS (spec.tls.secretNames), every operator component sends the operator token to Coder over the plain HTTP URL of the control plane Service:

• the control-plane controller (license upload, entitlements),
• CoderTemplateTest,
• CoderProvisioner key calls,
• the aggregated API server (after 🤖 fix: use the internal Coder URL for provisioner keys and the aggregated API when TLS is on #273).

docs/how-to/deploy-controller.md ("Where the operator token goes") documents this and points to a service mesh and a NetworkPolicy.

Why not HTTPS today: status.url is https://<control plane>.<namespace>.svc.cluster.local:443. The operator image (gcr.io/distroless/static) trusts only public roots. Public CAs do not issue certificates for .cluster.local, and the repo has no setting for an extra CA bundle or a server name. A fallback from HTTPS to HTTP on a certificate error would give no protection against an attacker who can redirect traffic.

Possible feature: verified in-cluster HTTPS for all four callers, for example with a CA bundle reference and a ServerName option on CoderControlPlane. Add a Kind E2E case with built-in TLS on, because CI never exercises TLS today.

Revisit when: a user asks for in-cluster encryption of operator calls without a service mesh.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high