🤖 feat: add local dev workflow, envtest integration tests, and Kind e2e CI (#8)

## Summary

Add complete local cluster development workflow, envtest integration
testing, and CI coverage for the `coder-k8s` operator.

## Background

The repo had kubebuilder markers in API types and RBAC markers in the
controller, but no CRD YAML manifests, no integration tests, no local
dev workflow documentation, and no CI envtest or e2e coverage. This PR
addresses all of those gaps.

## Implementation

### Phase 1: Manifest generation pipeline
- Added `sigs.k8s.io/controller-tools v0.20.0` as a vendored dependency
(via `internal/deps/controllergen_tools.go` build-tagged file)
- Added `hack/update-manifests.sh` script with fail-fast assertions
(mirrors existing `hack/update-codegen.sh` pattern)
- Added `make manifests` target
- Generated and committed CRD (`config/crd/bases/`), RBAC
(`config/rbac/`), and sample CR (`config/samples/`)

### Phase 2: envtest integration tests
- Added `internal/controller/suite_test.go` — envtest `TestMain`
lifecycle harness with scheme registration and defensive assertions
- Added `internal/controller/codercontrolplane_controller_test.go` — 4
integration test cases:
  - `TestReconcile_NotFound` — reconcile non-existent CR returns nil
  - `TestReconcile_ExistingResource` — reconcile existing CR returns nil
  - `TestReconcile_NilClient` — assertion error on nil client
  - `TestReconcile_NilScheme` — assertion error on nil scheme
- Added `make setup-envtest` and `make test-integration` targets
- Updated `make test` to automatically set up envtest assets

### Phase 3: CI updates
- Updated `test` job to install envtest assets and export
`KUBEBUILDER_ASSETS`
- Added `e2e-kind` job: creates Kind cluster, builds/loads image,
deploys controller with CRDs/RBAC/e2e manifests, applies sample CR, and
verifies resource exists
- All actions SHA-pinned (matching repo convention)

### Documentation
- Expanded `README.md` with: project description, prerequisites,
OrbStack quick start, essential commands, testing strategy, and project
structure sections

## Risks

- **Low**: `setup-envtest@release-0.23` uses a branch ref rather than a
pinned commit. This tracks the controller-runtime v0.23.x release
branch. Could be pinned to a pseudo-version if strict immutability is
desired.
- **Low**: The `e2e-kind` job assumes `jq` is present on `ubuntu-latest`
(currently true).

---

<details>
<summary>📋 Implementation Plan</summary>

# Implementation Plan: Local cluster development + integration/e2e
testing for `coder-k8s`

## Context / Why
You want a concrete execution plan an agent can follow to: (1) develop
quickly against a local Kubernetes cluster, (2) add reliable integration
testing, and (3) add CI coverage in GitHub Actions. The current
repository is scaffold-level, so the plan prioritizes a fast inner loop
first (OrbStack), then deterministic tests (`envtest`), then a
real-cluster smoke test (Kind in CI).

This plan explicitly addresses your CRD note: **the API types/markers
exist, but generated CRD YAML manifests are not currently present in the
repo**.

## Evidence
- `api/v1alpha1/codercontrolplane_types.go` contains kubebuilder markers
(`+kubebuilder:resource`, `+kubebuilder:subresource:status`) and CRD
types.
- `hack/update-codegen.sh` only runs `deepcopy-gen`; no CRD/manifest
generation.
- `Makefile` has `test/build/lint/vuln/codegen` but no `manifests`,
`install`, or integration/e2e targets.
- `.github/workflows/ci.yaml` runs lint/unit/build checks only; no
envtest/Kind job.
- `main.go` uses `ctrl.GetConfigOrDie()`, so local out-of-cluster runs
depend on kubeconfig context.
- `main_test.go` currently contains unit-style checks only.
- Repo root currently has no `config/crd` or sample manifests (YAML
files are only workflows/tooling YAML plus vendor files).

These files are sufficient to design a full implementation path.

## Implementation details

### Planned edit map (ordered)
1. `internal/deps/deps.go` — import block: add blank import for
`sigs.k8s.io/controller-tools/cmd/controller-gen` (vendoring anchor).
2. `hack/update-manifests.sh` (new) — script entrypoint + fail-fast
assertions + `controller-gen` invocation.
3. `Makefile` — `.PHONY` list + new targets: `manifests`,
`setup-envtest`, `test-integration`.
4. `config/crd/bases/*`, `config/rbac/*`, `config/samples/*`
(new/generated) — committed generated manifests + sample CR.
5. `README.md` — new “Local development (OrbStack)” and “Testing
strategy” sections.
6. `internal/controller/suite_test.go` (new) — `TestMain` envtest
lifecycle harness.
7. `internal/controller/codercontrolplane_controller_test.go` (new) —
integration tests around `Reconcile` assertions and not-found/exists
flows.
8. `.github/workflows/ci.yaml` — `test` job envtest setup; new
`e2e-kind` job.
9. `test/e2e/*` or `config/e2e/*` (new) — minimal Kind smoke
deployment/test assets.


### Phase 1 — OrbStack-first local development workflow (recommended
first)

1. **Add manifest generation pipeline (CRD/RBAC) and commit generated
outputs.**
- Edit `internal/deps/deps.go` to keep `controller-tools` vendored, then
run `go mod tidy && go mod vendor`.
- Add `hack/update-manifests.sh` with fail-fast assertions and
deterministic output directories.
- Add `Makefile` target `manifests` and wire it into local docs/CI
checks where appropriate.
   - Create and commit:
     - `config/crd/bases/coder.com_codercontrolplanes.yaml`
     - `config/rbac/role.yaml` (and related generated RBAC if produced)
     - `config/samples/coder_v1alpha1_codercontrolplane.yaml`

   ```bash
   # hack/update-manifests.sh (shape)
   #!/usr/bin/env bash
   set -euo pipefail

   SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
   [[ -d "${SCRIPT_ROOT}/api/v1alpha1" ]] || {
echo "assertion failed: expected API package at
${SCRIPT_ROOT}/api/v1alpha1" >&2
     exit 1
   }

   cd "${SCRIPT_ROOT}"
GOFLAGS=-mod=vendor go run
./vendor/sigs.k8s.io/controller-tools/cmd/controller-gen \
     crd:crdVersions=v1 \
     rbac:roleName=manager-role \
     paths=./... \
     output:crd:artifacts:config=config/crd/bases \
     output:rbac:artifacts:config=config/rbac
   ```

2. **Add a simple OrbStack local-dev runbook in `README.md`.**
- Include exact commands for applying CRDs, running controller, applying
sample CR, and checking logs/events.
- Keep this as the default dev loop; no Kind required for normal
iteration.

   ```bash
   make manifests
   kubectl apply -f config/crd/bases/
   GOFLAGS=-mod=vendor go run .
   kubectl apply -f config/samples/coder_v1alpha1_codercontrolplane.yaml
   kubectl get codercontrolplanes -A
   ```

3. **Acceptance criteria (Phase 1).**
- Fresh clone can generate/apply CRDs and create a sample
`CoderControlPlane`.
- Controller runs locally against OrbStack context without extra cluster
tooling.

---

### Phase 2 — Add `envtest` integration tests (highest-value test
investment)

1. **Create envtest suite harness for controller package.**
- Add `internal/controller/suite_test.go` that starts/stops
`envtest.Environment`.
- Register `client-go` and `coderv1alpha1` schemes and construct a
controller-runtime client.
- Keep defensive assertions (nil checks + explicit assertion-failed
text) in helpers.

   ```go
   // internal/controller/suite_test.go (shape)
   var (
     testEnv *envtest.Environment
     cfg     *rest.Config
     k8sClient client.Client
   )

   func TestMain(m *testing.M) {
testEnv = &envtest.Environment{CRDDirectoryPaths:
[]string{"../../config/crd/bases"}}
     var err error
     cfg, err = testEnv.Start()
if err != nil { panic(fmt.Errorf("assertion failed: envtest start: %w",
err)) }
     // build scheme + client
     code := m.Run()
     if stopErr := testEnv.Stop(); stopErr != nil { panic(stopErr) }
     os.Exit(code)
   }
   ```

2. **Add reconciliation integration tests in
`internal/controller/codercontrolplane_controller_test.go`.**
   - Cases to add now:
     - Reconcile returns nil when CR exists.
     - Reconcile returns nil on NotFound.
     - Reconcile returns assertion error when `Client` is nil.
     - Reconcile returns assertion error when `Scheme` is nil.
- Keep tests minimal and deterministic while reconciler is still
placeholder logic.

3. **Add explicit Make targets for integration tests + envtest binary
setup.**
   - Add targets like:
     - `make setup-envtest`
     - `make test-integration`
   - Ensure targets fail fast if envtest assets are missing.

4. **Acceptance criteria (Phase 2).**
- `make test` (or split unit/integration pair) passes locally with
vendoring.
- Integration tests run without requiring a running Kubernetes cluster.

---

### Phase 3 — CI updates (GitHub Actions)

1. **Extend existing `test` job in `.github/workflows/ci.yaml` to run
envtest-backed tests.**
   - Install envtest binaries in CI.
   - Export `KUBEBUILDER_ASSETS`.
   - Run `go test ./...` with `GOFLAGS=-mod=vendor`.

   ```yaml
   - name: Setup envtest assets
     run: |
go run sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.23.1 use
1.35.x --bin-dir ./bin -p path > /tmp/kubebuilder_assets_path
echo "KUBEBUILDER_ASSETS=$(cat /tmp/kubebuilder_assets_path)" >>
$GITHUB_ENV

   - name: Run tests
     env:
       GOFLAGS: -mod=vendor
       KUBEBUILDER_ASSETS: ${{ env.KUBEBUILDER_ASSETS }}
     run: go test ./... -count=1
   ```

2. **Add separate Kind-based smoke e2e job (new job, not replacement).**
   - Add `e2e-kind` job after `test`.
- Use `helm/kind-action` (or equivalent pinned action) to create
ephemeral cluster.
- Build image, load into Kind, apply CRDs, deploy controller manifest,
apply sample CR.
- Assert smoke outcome (resource exists; controller pod healthy; no
crashloop).

   ```yaml
   e2e-kind:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
       - uses: actions/checkout@...
       - uses: helm/kind-action@...
       - run: make manifests
       - run: kubectl apply -f config/crd/bases/
       - run: docker build -f Dockerfile.goreleaser -t coder-k8s:e2e .
       - run: kind load docker-image coder-k8s:e2e
       - run: kubectl apply -f config/e2e/ # deployment + RBAC + sample
- run: kubectl wait --for=condition=Available deploy/coder-k8s -n
coder-system --timeout=120s
   ```

3. **Acceptance criteria (Phase 3).**
   - PR CI covers lint/unit/integration plus a real-cluster smoke job.
- Failures clearly indicate whether logic broke (`test`) or cluster
packaging/deploy broke (`e2e-kind`).

---

### Phase 4 — Optional DevSpace/Tilt layer (defer unless team asks)

1. **Decision gate:** only implement if multiple developers need
standardized hot-reload/dev deployment workflows.
2. If enabled, add `devspace.yaml` (or `Tiltfile`) that wraps the
**same** manifests and image build path used in CI.
3. Keep OrbStack path as baseline fallback and document both flows
succinctly.

<details>
<summary>Why deferred</summary>
This repo currently has a minimal reconciler and no complex dependent
resources yet. Adding DevSpace/Tilt immediately would increase
maintenance surface before there is enough deployment complexity to
justify it.
</details>

## Execution order (for agent handoff)
1. Phase 1 manifests + OrbStack docs.
2. Phase 2 envtest harness/tests.
3. Phase 3 CI envtest + Kind smoke job.
4. Phase 4 optional tooling only if requested.

## Validation checklist the implementing agent must run
- `make verify-vendor`
- `make manifests` (new target)
- `make test`
- `make build`
- If workflows changed: `go run
github.com/rhysd/actionlint/cmd/actionlint@v1.7.10`
- Optional local smoke: run controller against OrbStack and apply sample
CR.

</details>

---
_Generated with `mux` • Model: `anthropic:claude-opus-4-6` • Thinking:
`xhigh` • Cost: `$0.68`_

<!-- mux-attribution: model=anthropic:claude-opus-4-6 thinking=xhigh
costs=0.68 -->

Author: ThomasK33

.github/workflows/ci.yaml

@@ -108,16 +108,84 @@ jobs:
           go mod vendor
           git diff --exit-code -- go.mod go.sum vendor/
 
+      - name: Setup envtest assets
+        env:
+          GOFLAGS: -mod=vendor
+        run: |
+          KUBEBUILDER_ASSETS_PATH="$(go run ./vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest use 1.35.x --bin-dir "${{ github.workspace }}/bin/envtest" -p path)"
+          echo "KUBEBUILDER_ASSETS=${KUBEBUILDER_ASSETS_PATH}" >> "$GITHUB_ENV"
+
       - name: Run tests
         env:
           GOFLAGS: -mod=vendor
-        run: go test ./...
+          KUBEBUILDER_ASSETS: ${{ env.KUBEBUILDER_ASSETS }}
+        run: go test ./... -count=1
 
       - name: Build
         env:
           GOFLAGS: -mod=vendor
         run: go build ./...
 
+  e2e-kind:
+    name: E2E Smoke (Kind)
+    needs: [changes, test]
+    if: needs.changes.outputs.go == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Create Kind cluster
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+        with:
+          cluster_name: e2e
+
+      - name: Build binary
+        env:
+          GOFLAGS: -mod=vendor
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: amd64
+        run: go build -o coder-k8s ./
+
+      - name: Build and load image
+        run: |
+          docker build -f Dockerfile.goreleaser -t ghcr.io/coder/coder-k8s:e2e .
+          kind load docker-image ghcr.io/coder/coder-k8s:e2e --name e2e
+
+      - name: Apply CRDs and RBAC
+        run: |
+          kubectl apply -f config/crd/bases/
+          kubectl apply -f config/rbac/
+
+      - name: Deploy controller
+        run: |
+          kubectl apply -f config/e2e/namespace.yaml
+          kubectl apply -f config/e2e/
+
+      - name: Wait for controller
+        run: kubectl wait --for=condition=Available deploy/coder-k8s -n coder-system --timeout=120s
+
+      - name: Apply sample CR
+        run: kubectl apply -f config/samples/coder_v1alpha1_codercontrolplane.yaml
+
+      - name: Verify CR exists
+        run: |
+          kubectl get codercontrolplanes -A
+          COUNT=$(kubectl get codercontrolplanes -A -o json | jq '.items | length')
+          if [ "$COUNT" -lt 1 ]; then
+            echo "assertion failed: expected at least 1 CoderControlPlane resource" >&2
+            exit 1
+          fi
+
   lint-actions:
     name: Lint GitHub Actions
     needs: changes
@@ -167,15 +235,16 @@ jobs:
 
   publish-main:
     name: Publish GHCR :main
-    needs: [changes, test, lint, lint-actions]
+    needs: [changes, test, lint, lint-actions, e2e-kind]
     if: |
       always() &&
       github.event_name == 'push' &&
       github.ref == 'refs/heads/main' &&
       needs.changes.outputs.publish == 'true' &&
       (needs.test.result == 'success' || needs.test.result == 'skipped') &&
       (needs.lint.result == 'success' || needs.lint.result == 'skipped') &&
-      (needs.lint-actions.result == 'success' || needs.lint-actions.result == 'skipped')
+      (needs.lint-actions.result == 'success' || needs.lint-actions.result == 'skipped') &&
+      (needs.e2e-kind.result == 'success' || needs.e2e-kind.result == 'skipped')
     runs-on: ubuntu-latest
     permissions:
       contents: read

Makefile

@@ -1,8 +1,10 @@
 GOFLAGS ?= -mod=vendor
 VENDOR_STAMP := vendor/.modules.stamp
 MODULE_FILES := go.mod $(wildcard go.sum)
+ENVTEST_K8S_VERSION ?= 1.35.x
+ENVTEST_ASSETS_DIR := $(shell pwd)/bin/envtest
 
-.PHONY: vendor test build lint vuln verify-vendor codegen
+.PHONY: vendor test test-integration setup-envtest build lint vuln verify-vendor codegen manifests
 
 $(VENDOR_STAMP): $(MODULE_FILES)
 	go mod tidy
@@ -12,9 +14,17 @@ $(VENDOR_STAMP): $(MODULE_FILES)
 
 vendor: $(VENDOR_STAMP)
 
-test: $(VENDOR_STAMP)
+setup-envtest:
+	GOFLAGS=-mod=vendor go run ./vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest use $(ENVTEST_K8S_VERSION) --bin-dir $(ENVTEST_ASSETS_DIR) -p path > /dev/null
+
+test: $(VENDOR_STAMP) setup-envtest
+	KUBEBUILDER_ASSETS="$$(GOFLAGS=-mod=vendor go run ./vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest use $(ENVTEST_K8S_VERSION) --bin-dir $(ENVTEST_ASSETS_DIR) -p path)" \
 	GOFLAGS=$(GOFLAGS) go test ./...
 
+test-integration: $(VENDOR_STAMP) setup-envtest
+	KUBEBUILDER_ASSETS="$$(GOFLAGS=-mod=vendor go run ./vendor/sigs.k8s.io/controller-runtime/tools/setup-envtest use $(ENVTEST_K8S_VERSION) --bin-dir $(ENVTEST_ASSETS_DIR) -p path)" \
+	GOFLAGS=$(GOFLAGS) go test ./internal/controller/... -count=1 -v
+
 build: $(VENDOR_STAMP)
 	GOFLAGS=$(GOFLAGS) go build ./...
 
@@ -32,5 +42,8 @@ verify-vendor:
 	go mod vendor
 	git diff --exit-code -- go.mod go.sum vendor/
 
+manifests: $(VENDOR_STAMP)
+	bash ./hack/update-manifests.sh
+
 codegen: $(VENDOR_STAMP)
 	bash ./hack/update-codegen.sh

README.md

@@ -1 +1,57 @@
 # coder-k8s
+
+## Project description
+
+`coder-k8s` is a Go-based Kubernetes operator for managing `CoderControlPlane` resources (`coder.com/v1alpha1`). It is built with `sigs.k8s.io/controller-runtime`.
+
+## Prerequisites
+
+- Go 1.25+ (`go.mod` currently declares Go 1.25.7)
+- A Kubernetes cluster (OrbStack is recommended for local development; any cluster works)
+- `kubectl` configured to point at your cluster context
+
+## Quick start / Local development (OrbStack)
+
+```bash
+# Generate CRD and RBAC manifests
+make manifests
+
+# Apply CRDs to your cluster
+kubectl apply -f config/crd/bases/
+
+# Run the controller locally (uses your kubeconfig context)
+GOFLAGS=-mod=vendor go run .
+
+# In another terminal: apply the sample CR
+kubectl apply -f config/samples/coder_v1alpha1_codercontrolplane.yaml
+
+# Verify
+kubectl get codercontrolplanes -A
+```
+
+## Essential commands
+
+| Command | Description |
+| --- | --- |
+| `make build` | Build the project |
+| `make test` | Run tests |
+| `make manifests` | Generate CRD/RBAC manifests |
+| `make codegen` | Run deepcopy code generation |
+| `make verify-vendor` | Verify vendor consistency |
+| `make lint` | Run linter (requires `golangci-lint`) |
+| `make vuln` | Run vulnerability check (requires `govulncheck`) |
+
+## Testing strategy
+
+- **Unit tests**: `make test` runs all tests, including unit tests in `main_test.go`.
+- **Integration tests**: Use `envtest` to exercise reconciliation against a lightweight API server (no real cluster needed). Run them via `make test` (included in the full suite) or `make test-integration` (focused on controller tests only).
+- **E2E smoke tests**: Recommended CI smoke coverage uses a Kind-based flow that deploys the controller image and verifies pod health.
+
+## Project structure
+
+- `api/v1alpha1/` — CRD types and generated deepcopy code
+- `internal/controller/` — Reconciliation logic
+- `config/crd/bases/` — Generated CRD manifests
+- `config/rbac/` — Generated RBAC manifests
+- `config/samples/` — Sample custom resources
+- `hack/` — Code generation and maintenance scripts

config/crd/bases/coder.com_codercontrolplanes.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: codercontrolplanes.coder.com
+spec:
+  group: coder.com
+  names:
+    kind: CoderControlPlane
+    listKind: CoderControlPlaneList
+    plural: codercontrolplanes
+    singular: codercontrolplane
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: CoderControlPlane is the schema for Coder control plane resources.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: CoderControlPlaneSpec defines the desired state of a CoderControlPlane.
+            properties:
+              image:
+                description: Image is the placeholder container image for the control
+                  plane deployment.
+                type: string
+            type: object
+          status:
+            description: CoderControlPlaneStatus defines the observed state of a CoderControlPlane.
+            properties:
+              phase:
+                description: Phase is a placeholder status field for future reconciliation
+                  stages.
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

config/e2e/clusterrole-binding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: coder-k8s
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: manager-role
+subjects:
+  - kind: ServiceAccount
+    name: coder-k8s
+    namespace: coder-system

config/e2e/deployment.yaml

@@ -0,0 +1,37 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coder-k8s
+  namespace: coder-system
+  labels:
+    app: coder-k8s
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: coder-k8s
+  template:
+    metadata:
+      labels:
+        app: coder-k8s
+    spec:
+      serviceAccountName: coder-k8s
+      containers:
+        - name: manager
+          image: ghcr.io/coder/coder-k8s:e2e
+          imagePullPolicy: Never
+          ports:
+            - containerPort: 8081
+              name: health
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: 5
+            periodSeconds: 10

config/e2e/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: coder-system

config/e2e/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: coder-k8s
+  namespace: coder-system

config/rbac/role.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+rules:
+- apiGroups:
+  - coder.com
+  resources:
+  - codercontrolplanes
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - coder.com
+  resources:
+  - codercontrolplanes/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - coder.com
+  resources:
+  - codercontrolplanes/status
+  verbs:
+  - get
+  - patch
+  - update

config/samples/coder_v1alpha1_codercontrolplane.yaml

@@ -0,0 +1,7 @@
+apiVersion: coder.com/v1alpha1
+kind: CoderControlPlane
+metadata:
+  name: codercontrolplane-sample
+  namespace: default
+spec:
+  image: "ghcr.io/coder/coder-k8s:main"