LicenseSecretRef references a Secret key containing a Coder Enterprise license JWT. When set, the controller uploads the license after the control plane is ready and re-uploads when the Secret value changes.
MCPServers configures CoderMCPServer objects that use this control plane. Removing it disables in Coder each server config that a CoderMCPServer created through this control plane.
WorkspacePools configures CoderWorkspacePool objects that use this control plane. It has no effect yet: the CoderWorkspacePool controller is not shipped.
EntitlementsLastChecked is when the operator last queried coderd entitlements.
externalProvisionerDaemonsEntitlement
string
ExternalProvisionerDaemonsEntitlement is the entitlement value for feature "external_provisioner_daemons". Values: entitled, grace_period, not_entitled, unknown.
AIGatewaySpec configures CoderAIGatewayKey objects that use a
CoderControlPlane (CoderControlPlane.spec.aiGateway).
Field
Type
Description
allowKeys
boolean
AllowKeys lets CoderAIGatewayKey objects in this namespace create and rotate Coder AI Gateway keys with this control plane's operator token. A gateway key lets its holder load the API key of every enabled AI provider, so this delegates that power to everyone who can create CoderAIGatewayKey objects here. When false (the default), the controller creates no key. Setting it back to false stops new keys and rotations. The current key of each CoderAIGatewayKey stays until that object is deleted.
ConnectionSecretRef references a key in a Secret in the CoderControlPlane's namespace. The value must be a postgres:// or postgresql:// connection URL. The controller injects it into the Coder container as CODER_PG_CONNECTION_URL through a Secret reference and uses it for operator access bootstrap. Running pods keep the old value after the Secret changes; restart the Deployment after rotating credentials.
ExposeSpec configures external exposure for the control plane.
At most one of Ingress or Gateway may be set.
+kubebuilder:validation:XValidation:rule="!(has(self.ingress) && has(self.gateway))",message="only one of ingress or gateway may be set"
MCPServersSpec configures CoderMCPServer objects that use a
CoderControlPlane (CoderControlPlane.spec.mcpServers).
Field
Type
Description
organizations
string array
Organizations are the names of the Coder organizations whose MCP server configs CoderMCPServer objects can create, change and delete with this control plane's operator token. This delegates Coder organization-admin power over MCP servers in these organizations to everyone who can create CoderMCPServer objects here. A CoderMCPServer for an organization outside this list creates and changes nothing. Removing an organization disables in Coder each server config that a CoderMCPServer created there, with one request that holds only enabled: false, and then changes nothing else. After the organization is listed again, a spec edit enables the server. Deleting a CoderMCPServer still deletes the config it created.
allowForceOn
boolean
AllowForceOn lets CoderMCPServer objects use availability: force_on, which adds a server to every new chat of each user who can read it, without that user's choice. When false (the default), such objects create and change nothing, and a server config that one of them created is disabled in Coder, as for a removed organization.
OperatorAccessSpec configures the controller-managed coderd operator user.
Field
Type
Description
disabled
boolean
Disabled turns off creation and management of the coder-k8s-operator user and API token.
generatedTokenSecretName
string
GeneratedTokenSecretName stores the generated operator API token. The default is <name>-operator-token. The Secret must not exist yet, or must have this control plane as its controller owner.
TemplateTestsSpec configures CoderTemplateTest runs against a control plane.
Field
Type
Description
ownerUserID
string
OwnerUserID is the UUID of the Coder user that owns every test workspace. Use a dedicated low-privilege tester user: each start build gives the owner's API token to the template's Terraform. Tests stay pending until this is set.
allowRetain
boolean
AllowRetain lets the annotation coder.com/deletion-policy: retain on a CoderTemplateTest release the test without deleting its workspace. This delegates that power to everyone who can create tests against this control plane: they can leave workspaces, and their owner's session keys, in Coder. When false (the default), the controller ignores retain and deletes the workspace.
WorkspacePoolOwner allows one Coder user as the owner of pool workspaces.
Field
Type
Description
userID
string
UserID is the UUID of the Coder user, in lower case with hyphens, as Coder writes it. One user has one spelling, so the list holds each owner once. Coder's prebuilds system user is refused: Coder's prebuild reconciler can delete or hand out the workspaces it owns.
templates
string array
Templates are the only Coder templates, as <organization>.<template>, that pools of this owner can build.
maxWorkspaces
integer
MaxWorkspaces caps the workspaces of this owner across all pools of this control plane: unclaimed, bound, and used.
Owners are the Coder users that pools on this control plane can use as owners, each with the templates it can build and a workspace cap. They are the admin's consent that pools make Coder build these templates as this owner. Every start build gives the owner's API token to the template's Terraform. A pool whose owner or template is not listed creates no workspace. This field has no effect yet: the CoderWorkspacePool controller is not shipped.