🤖 feat: activate the CoderTemplateTest controller

.cspell.json

@@ -33,6 +33,8 @@
     "codersdk",
     "codertemplate",
     "codertemplates",
+    "codertemplatetest",
+    "codertemplatetests",
     "codertemplateversion",
     "codertemplateversions",
     "velero",

.github/workflows/ci.yaml

@@ -83,6 +83,9 @@ jobs:
               - 'api/aggregation/**'
               - 'internal/aggregated/**'
               - 'internal/app/apiserverapp/**'
+              - 'api/v1alpha1/**'
+              - 'internal/controller/codertemplatetest*'
+              - 'internal/app/controllerapp/**'
               - 'config/e2e/**'
               - 'deploy/**'
               - 'examples/cloudnativepg/**'
@@ -91,7 +94,6 @@ jobs:
             installer:
               - 'api/**/*.go'
               - 'config/crd/bases/**'
-              - 'config/crd/dormant/**'
               - 'config/rbac/**'
               - 'config/default/**'
               - 'deploy/deployment.yaml'
@@ -133,24 +135,15 @@ jobs:
       - name: Verify installer manifests are up to date
         run: |
           make build-installer
-          git diff --exit-code -- dist/install.yaml config/default/ config/crd/bases/ config/crd/dormant/ config/rbac/
+          git diff --exit-code -- dist/install.yaml config/default/ config/crd/bases/ config/rbac/
 
-          UNTRACKED_GENERATED="$(git ls-files --others --exclude-standard -- dist/ config/default/ config/crd/bases/ config/crd/dormant/ config/rbac/)"
+          UNTRACKED_GENERATED="$(git ls-files --others --exclude-standard -- dist/ config/default/ config/crd/bases/ config/rbac/)"
           if [[ -n "${UNTRACKED_GENERATED}" ]]; then
             echo "assertion failed: generated installer artifacts must be tracked" >&2
             printf '%s\n' "${UNTRACKED_GENERATED}" >&2
             exit 1
           fi
 
-      - name: Verify the dormant CoderTemplateTest CRD is not installed
-        # Remove this step when the CoderTemplateTest controller ships (#152).
-        run: |
-          if grep -n -E '^[[:space:]]+kind: CoderTemplateTest$|codertemplatetests\.coder\.com' \
-            dist/install.yaml config/default/kustomization.yaml config/crd/bases/*.yaml; then
-            echo "assertion failed: the CoderTemplateTest CRD must not ship before its controller" >&2
-            exit 1
-          fi
-
       - name: Run golangci-lint
         run: go tool golangci-lint run --timeout=5m ./...
 
@@ -314,7 +307,14 @@ jobs:
         env:
           AGENT_IMAGE: public.ecr.aws/docker/library/alpine@sha256:3e9b4b680bfc9fb5269227cffbd6d42be39fbf7c0b908123913864aa4447e764
         run: |
-          docker pull "$AGENT_IMAGE"
+          for attempt in 1 2 3; do
+            docker pull "$AGENT_IMAGE" && break
+            if [ "$attempt" -eq 3 ]; then
+              echo "::error::docker pull failed 3 times: $AGENT_IMAGE" >&2
+              exit 1
+            fi
+            sleep 10
+          done
           docker tag "$AGENT_IMAGE" e2e.local/alpine:3.22.6
           kind load docker-image e2e.local/alpine:3.22.6 --name e2e
 
@@ -501,7 +501,8 @@ jobs:
           kubectl -n default delete pod e2e-authn-probe --wait=false
 
       # The driver creates the CoderTemplates itself (kubectl apply of config/e2e/codertemplate*.yaml) after its setup checks.
-      - name: Template and workspace lifecycle (apply, re-apply, watch, rename, delete, recreate, tester, agent)
+      # Its last phase scales Coder to zero and deletes namespace coder: later steps must not need either.
+      - name: Template and workspace lifecycle (apply, re-apply, watch, rename, delete, recreate, tester, agent, template tests)
         if: env.E2E_FULL == 'true'
         env:
           BUILT_IMAGE_ID: ${{ steps.build_image.outputs.image_id }}

api/v1alpha1/codercontrolplane_types.go

@@ -130,12 +130,19 @@ type TemplateTestsSpec struct {
 	// OwnerUserID is the UUID of the Coder user that owns every test
 	// workspace. Use a dedicated low-privilege tester user: each start build
 	// gives the owner's API token to the template's Terraform. Tests stay
-	// pending until this is set. The CoderTemplateTest controller is not
-	// enabled yet, so this field has no effect today.
+	// pending until this is set.
 	// +kubebuilder:validation:Format=uuid
 	// +kubebuilder:validation:MaxLength=36
 	// +optional
 	OwnerUserID string `json:"ownerUserID,omitempty"`
+	// AllowRetain lets the annotation coder.com/deletion-policy: retain on a
+	// CoderTemplateTest release the test without deleting its workspace.
+	// This delegates that power to everyone who can create tests against
+	// this control plane: they can leave workspaces, and their owner's
+	// session keys, in Coder. When false (the default), the controller
+	// ignores retain and deletes the workspace.
+	// +optional
+	AllowRetain bool `json:"allowRetain,omitempty"`
 }
 
 // DatabaseSpec configures the external PostgreSQL database used by Coder.

api/v1alpha1/codertemplatetest_types.go

@@ -84,7 +84,7 @@ type CoderTemplateTestSpec struct {
 	// ControlPlaneRef names the CoderControlPlane in the same namespace. The
 	// controller calls Coder with that control plane's operator token.
 	ControlPlaneRef CoderControlPlaneReference `json:"controlPlaneRef"`
-	// Template is the Coder template as <organization>.<template>, the same
+	// Template is the Coder template as `<organization>.<template>`, the same
 	// format as aggregated CoderTemplate names. Each name has at most 32
 	// characters and is not one of Coder's reserved names new or create.
 	// +kubebuilder:validation:MaxLength=65

config/crd/bases/coder.com_codercontrolplanes.yaml

@@ -2048,13 +2048,21 @@ spec:
                 description: TemplateTests configures CoderTemplateTest runs against
                   this control plane.
                 properties:
+                  allowRetain:
+                    description: |-
+                      AllowRetain lets the annotation coder.com/deletion-policy: retain on a
+                      CoderTemplateTest release the test without deleting its workspace.
+                      This delegates that power to everyone who can create tests against
+                      this control plane: they can leave workspaces, and their owner's
+                      session keys, in Coder. When false (the default), the controller
+                      ignores retain and deletes the workspace.
+                    type: boolean
                   ownerUserID:
                     description: |-
                       OwnerUserID is the UUID of the Coder user that owns every test
                       workspace. Use a dedicated low-privilege tester user: each start build
                       gives the owner's API token to the template's Terraform. Tests stay
-                      pending until this is set. The CoderTemplateTest controller is not
-                      enabled yet, so this field has no effect today.
+                      pending until this is set.
                     format: uuid
                     maxLength: 36
                     type: string

config/crd/dormant/coder.com_codertemplatetests.yaml → config/crd/bases/coder.com_codertemplatetests.yaml

@@ -100,7 +100,7 @@ spec:
                 x-kubernetes-list-type: map
               template:
                 description: |-
-                  Template is the Coder template as <organization>.<template>, the same
+                  Template is the Coder template as `<organization>.<template>`, the same
                   format as aggregated CoderTemplate names. Each name has at most 32
                   characters and is not one of Coder's reserved names new or create.
                 maxLength: 65

config/default/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   - namespace-coder-system.yaml
   - ../crd/bases/coder.com_codercontrolplanes.yaml
   - ../crd/bases/coder.com_coderprovisioners.yaml
+  - ../crd/bases/coder.com_codertemplatetests.yaml
   - ../crd/bases/coder.com_coderworkspaceproxies.yaml
   - ../rbac/clusterrolebinding.yaml
   - ../rbac/role.yaml

config/rbac/role.yaml

@@ -100,6 +100,7 @@ rules:
   resources:
   - codercontrolplanes/finalizers
   - coderprovisioners/finalizers
+  - codertemplatetests/finalizers
   - coderworkspaceproxies/finalizers
   verbs:
   - update
@@ -108,11 +109,23 @@ rules:
   resources:
   - codercontrolplanes/status
   - coderprovisioners/status
+  - codertemplatetests/status
   - coderworkspaceproxies/status
   verbs:
   - get
   - patch
   - update
+- apiGroups:
+  - coder.com
+  resources:
+  - codertemplatetests
+  verbs:
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - coordination.k8s.io
   resources: