🤖 docs: keep the standalone session token in a Secret

[ThomasK33]

Part of #127.

What changed

docs/how-to/deploy-aggregated-apiserver.md, "Option B: standalone", passed the Coder session token as a literal --coder-session-token=... argument, so the token sat in plain text in the Deployment spec. The step now:

1. Stores the token in a Secret (kubectl -n coder-system create secret generic coder-k8s-session-token --from-file=token=./coder-session-token).
2. Adds CODER_SESSION_TOKEN to the container from that Secret with valueFrom.secretKeyRef.
3. Passes --coder-session-token=$(CODER_SESSION_TOKEN). Kubernetes expands the variable when it starts the container, so the Deployment holds only a reference to the Secret.

Docs only; no code change. This is about where the token is stored. It does not change what the aggregated API server does with requests.

Validation

A fresh KIND cluster with a real Coder v2.37.2, following the edited doc commands (only the token file path and Coder URL were substituted):

• The Secret, apply and patch commands succeed; the Deployment rolls out, the APIService is Available, and both resource lists are served.
• The pod args contain the literal --coder-session-token=$(CODER_SESSION_TOKEN), and the env var comes from secretKeyRef.
• Creating a template through the aggregated API works, and Coder lists it as created by the admin, so the token from the Secret authenticated.
• Searching for the token value: 0 matches in the Deployment, ReplicaSet and Pod YAML, and 0 in the pod logs. Control: the decoded Secret data matches (1), so the search does find the token when it is there.

The token was never shown on screen. Docs gates on this head: make docs-check, markdownlint-cli2 0.18.1 and cspell 8.19.4 pass.

Screen recording of the run. Its timing lags the terminal by about 2 s in places; the screenshots are the primary evidence.

live-kind-run.webm

Not covered

A missing Secret and "Option A" were not tested. The env add operation replaces any env vars already set on the container; deploy/deployment.yaml sets none.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium • Cost: $1731.02

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T06:26:04.193747Z	261af65	PR opened
🔒 Security Review	✅ Completed 2026-09-25T06:26:50.001680Z	261af65	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 261af65aba

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.