🤖 docs: keep the standalone aggregated API server session token in a Secret

[ThomasK33]

Problem

docs/how-to/deploy-aggregated-apiserver.md "Option B: standalone" passes the Coder admin session token as a literal --coder-session-token=... argument. The token then sits in plain text in the Deployment spec, and anyone who can read Deployments in coder-system can see it. This practice predates #126, which only fixed the command syntax.

Proposal

No code change is needed. Store the token in a Secret, expose it to the container as an environment variable with valueFrom.secretKeyRef, and reference it in the args with Kubernetes $(VAR) expansion, for example --coder-session-token=$(CODER_SESSION_TOKEN). Update the docs to show this, and verify on a real cluster that the server authenticates and the Deployment spec no longer contains the token.

Owner and trigger

Owner: maintainer desk. Start after #126 lands, because it edits the same block.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh

[ThomasK33]

Done in #135, which landed as 8fc3453. The squash tree matched the reviewed head merged onto main. The merge-queue run (lint, test, E2E) and the main CI and Docs runs passed.

"Option B: standalone" in docs/how-to/deploy-aggregated-apiserver.md now stores the Coder session token in a Secret, exposes it as CODER_SESSION_TOKEN with secretKeyRef, and passes --coder-session-token=$(CODER_SESSION_TOKEN). On a fresh KIND cluster with Coder v2.37.2, the server authenticated with the token from the Secret, and the token value appeared 0 times in the Deployment, ReplicaSet and Pod YAML and in the pod logs.

Anyone who can read Secrets in coder-system can still read the token.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium