From d25d7148ad140ed99c476c3db3028cfa750e24f4 Mon Sep 17 00:00:00 2001 From: Thomas Kosiewski Date: Fri, 2 Oct 2026 12:55:45 +0000 Subject: [PATCH] docs: name the manager-role binding as the source of CA key access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The standalone row of the CA key table said that coder-k8s can read the key if its ServiceAccount exists. The access comes from the manager-role ClusterRoleBinding, not from the ServiceAccount alone. Signed-off-by: Thomas Kosiewski --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I568eb7f6e5364e908c5c44696be6cbd1223df855 --- docs/how-to/deploy-aggregated-apiserver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/how-to/deploy-aggregated-apiserver.md b/docs/how-to/deploy-aggregated-apiserver.md index c228b2260..c91c097a2 100644 --- a/docs/how-to/deploy-aggregated-apiserver.md +++ b/docs/how-to/deploy-aggregated-apiserver.md @@ -197,7 +197,7 @@ For each type of deployment: | Deployment | Runs as | Can read the CA key | | --- | --- | --- | | `--app=all` ([Option A](#option-a-all-in-one-recommended)) | `coder-k8s` | Yes. Also, the process keeps all Secrets in the cluster in its cache, because the controllers watch Secrets. | -| Standalone `--app=aggregated-apiserver` ([Option B](#option-b-standalone)) | `coder-k8s-apiserver`, with `config/apiserver-standalone/` | Yes, and no other Secret. It can `get` and `update` only `coder-k8s-apiserver-tls`. It cannot list, watch, or create Secrets. If the `coder-k8s` ServiceAccount exists in the cluster, `coder-k8s` can also read the key. | +| Standalone `--app=aggregated-apiserver` ([Option B](#option-b-standalone)) | `coder-k8s-apiserver`, with `config/apiserver-standalone/` | Yes, and no other Secret. It can `get` and `update` only `coder-k8s-apiserver-tls`. It cannot list, watch, or create Secrets. If `coder-k8s` is installed with its `manager-role` binding, `coder-k8s` can also read the key. | | Controller only (`dist/install.yaml`) | `coder-k8s` | Only if an aggregated API server created the Secret in a namespace of the cluster. This bundle never creates it. | For `--app=all`, a narrower Role does not change this. One process runs both the controller and the aggregated API server with one ServiceAccount, and the controller needs access to Secrets in all namespaces. The same access also covers the operator token Secrets. These give owner rights in Coder, and are more sensitive than the CA key. Limit who can read Secrets in `coder-system` and in all namespaces. If the Secret was possibly exposed, [replace the CA](#replace-the-ca).