Skip to content

🤖 docs: name the manager-role binding as the source of CA key access #170

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ThomasK33 merged 1 commit into from
Oct 2, 2026
Merged

🤖 docs: name the manager-role binding as the source of CA key access #170

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/how-to/deploy-aggregated-apiserver.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,7 @@ For each type of deployment:
| Deployment | Runs as | Can read the CA key |
| --- | --- | --- |
| `--app=all` ([Option A](#option-a-all-in-one-recommended)) | `coder-k8s` | Yes. Also, the process keeps all Secrets in the cluster in its cache, because the controllers watch Secrets. |
| Standalone `--app=aggregated-apiserver` ([Option B](#option-b-standalone)) | `coder-k8s-apiserver`, with `config/apiserver-standalone/` | Yes, and no other Secret. It can `get` and `update` only `coder-k8s-apiserver-tls`. It cannot list, watch, or create Secrets. If the `coder-k8s` ServiceAccount exists in the cluster, `coder-k8s` can also read the key. |
| Standalone `--app=aggregated-apiserver` ([Option B](#option-b-standalone)) | `coder-k8s-apiserver`, with `config/apiserver-standalone/` | Yes, and no other Secret. It can `get` and `update` only `coder-k8s-apiserver-tls`. It cannot list, watch, or create Secrets. If `coder-k8s` is installed with its `manager-role` binding, `coder-k8s` can also read the key. |
| Controller only (`dist/install.yaml`) | `coder-k8s` | Only if an aggregated API server created the Secret in a namespace of the cluster. This bundle never creates it. |

For `--app=all`, a narrower Role does not change this. One process runs both the controller and the aggregated API server with one ServiceAccount, and the controller needs access to Secrets in all namespaces. The same access also covers the operator token Secrets. These give owner rights in Coder, and are more sensitive than the CA key. Limit who can read Secrets in `coder-system` and in all namespaces. If the Secret was possibly exposed, [replace the CA](#replace-the-ca).
Expand Down
Loading