🤖 feat: ship generated install bundle and CI freshness checks - #89

Summary

Adds a generated, single-file install bundle, dist/install.yaml, so the operator installs with one kubectl apply. The bundle runs the operator in controller mode only. A CI check keeps the bundle in sync with its sources. The getting-started guide now uses the bundle.

Background

Installing meant applying ten CRD, RBAC and Deployment files one by one. This PR was opened in February and held. Its quickstart path did not converge on repeated apply (#105, since fixed by #116), and its review budget had run out. The maintainer has since extended that budget. The PR has been rebuilt on current main with a reduced scope.

Scope refresh (2026-09-24):

• Kept: one bundle, dist/install.yaml, the kustomize sources behind it, a freshness check and the getting-started update.
• Dropped: the duplicate dist/minimal-installer.yaml, which was byte-identical to dist/install.yaml, plus the quickstart manifests (config/quickstart/*, dist/quickstart-installer.yaml). Restoring a supported quickstart is separate follow-up work that depends on 🤖 fix: handle template imports that outlast the request deadline #117.
• Controller-only (security review of this PR): the bundle no longer contains the aggregated API server's Service and APIService, or the two RBAC bindings only that server uses. config/default/controller-mode-patch.yaml runs the bundled Deployment with --app=controller and drops the container ports that mode does not serve. deploy/deployment.yaml and the per-file manifests are unchanged; the aggregated API server keeps its own how-to.
• Earlier heads: the previous published head bd2d2e2d and the private candidate are preserved.

Implementation

• Tooling: kustomize v5.8.1 as a pinned, vendored go tool. This adds seven modules and changes no existing module versions; vendor/ gains only new files.
• Sources:
  • config/default/kustomization.yaml combines the coder-system namespace, the CRDs, the controller's RBAC and the operator Deployment, patched to --app=controller.
  • hack/update-manifests.sh writes config/default/kustomization.yaml with each CRD and RBAC file listed individually. config/crd/bases/ and config/rbac/ stay free of kustomization files, so the existing kubectl apply -f config/crd/bases/ -f config/rbac/ installs in the README, docs, hack/kind-dev.sh and the E2E keep working. The script stops if a kustomization file appears there. An earlier revision of this refresh broke those installs, and the PR's Kind E2E caught it.
• Build: make build-installer regenerates dist/install.yaml (write to a temp file, then rename). Two runs are byte-identical.
• CI: the required lint job regenerates the bundle and fails on any diff or untracked generated file. Enforcement comes from the existing required check, so no branch-protection change is needed. lint now also runs on PRs that change installer inputs.
• Docs: docs/tutorials/getting-started.md installs from $BASE/dist/install.yaml, in the style of 🤖 refactor: rewrite README and docs for readability #123. It says what the bundle does not install, and it documents a safe cleanup order: control plane first, then the bundle.

Validation

• Local gates on this head: the freshness step, verify-vendor, build, lint, test, actionlint, docs-check, markdownlint and cspell pass. govulncheck (run on an earlier head with the same go.mod) reports only the known module-level GO-2026-5932. The kustomize modules have no advisories.
• Freshness check negative controls: a CRD marker changed without regenerating fails; an untracked file under dist/ fails; a new file in config/rbac/ without regenerating fails; the clean tree passes.
• Directory installs: kubectl apply -f config/e2e/namespace.yaml, -f config/crd/bases/, -f config/rbac/ and the README's combined command succeed on a throwaway KIND cluster. On the previous revision they failed with the same error as CI.
• The bundle includes the new spec.database.connectionSecretRef field from 🤖 feat: reference the external PostgreSQL Secret from CoderControlPlane #122.
• Live KIND run of the controller-only bundle (commit 13066a2, dist/install.yaml sha256 1d04b902…). Nothing was pre-applied. The applied copy differs from dist/install.yaml only in the operator image tag and imagePullPolicy, because the image was built from this source and loaded into the cluster.
  1. kubectl apply creates only the Namespace, 3 CRDs, ServiceAccount, ClusterRole, ClusterRoleBinding and Deployment. The pod runs with --app=controller and declares only the health port. The APIService v1alpha1.aggregation.coder.com does not exist.
  2. The tutorial's sample CoderControlPlane reaches Ready, and its Deployment and Service come up.
  3. Uninstalling in the documented order removes the control plane, CRDs, namespaces and cluster RBAC. The cluster, containers and image were deleted afterwards.
• Earlier run with the full bundle (before this reduction): re-applying the bundle was a no-op and the CloudNativePG example reached Ready with DatabaseSecretResolved=True. Those steps were not repeated on the controller-only bundle.

Accelerated replays of the install and control-plane steps (idle gaps trimmed, so durations are shorter than wall time):

Risks

• Scope: new files, and one changed install path in the tutorial. Existing per-file manifests are unchanged. The bundle installs less than kubectl apply -f deploy/ does: users who want the aggregated API server follow its how-to.
• Image: the bundle uses the same ghcr.io/coder/coder-k8s:latest image as deploy/deployment.yaml. The tutorial says to pin a release tag and the image for reproducible installs.
• Size: about 93k vendored lines for kustomize. That follows the repository's vendored-tool pattern and keeps generation reproducible.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh • Cost: $1622.82