Repository navigation
CoderAIGatewayKey CRD with automatic rotation #156
Description
Goal: create a Coder AI Gateway key and store it in a Kubernetes Secret. Coder shows the key only once and keys cannot be updated, so rotation is: create a new key, update the Secret, wait a grace period, delete the old key.
Open points: crash-safe rotation (never lose the only working key, never leak orphaned keys), which Coder user owns the key, Secret ownership and RBAC.
Prerequisites: the Coder SDK v2.37 bump and a security plan.
Owner: maintainer desk.
Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium
Activity
ThomasK33 commentedon Oct 2, 2026
Depends on #150 (Coder SDK v2.37 bump).
🤖 feat: create the first AI Gateway key and write it into the owned S…
ThomasK33 commentedon Oct 14, 2026
Follow-ups from the advisor check of #370 (K11, the CoderAIGatewayKey Kind phases). Neither blocks #370: both checks can only fail falsely, never pass falsely. Owner: me, with K12 or the first licensed E2E.
gw-leak-checkalmost always passes: Kind runs Coder unlicensed, so no key exists, and it searches only log lines that containcoderaigatewaykey. The exact-value check is the real test. Make the shape check meaningful once a licensed E2E runs, or document it as a regression guard only.e2e-ns-keepControlPlaneGone check readkubectl logs deploy/coder-k8s, which covers only the current container. An operator restart loses earlier lines and fails the check. Add--previousor read the logs of every container start.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high