docs: state who can read the aggregated API server CA key

[ThomasK33]

Refs #143. Step 1 of 3: docs only.

The warning on the serving-CA Secret (coder-k8s-apiserver-tls) said only readers "in the server's namespace" can use its CA key. Readers with cluster-wide Secret access can too, and so can the coder-k8s ServiceAccount through manager-role.

What changed

In docs/how-to/deploy-aggregated-apiserver.md:

• The warning now covers anyone who can read this Secret, and links to a new section.
• The new section, "Who can read the CA key", covers:
  • the impact: someone who has the key and can also redirect the Service's traffic can impersonate the server;
  • the identities that can read the key;
  • a table by deployment mode.
• It states plainly that for --app=all a narrower Role would not help. One process runs the controller and the aggregated API server under one ServiceAccount, and the controller needs cluster-wide Secret access.

Next

Steps 2 and 3 give standalone --app=aggregated-apiserver deployments their own ServiceAccount, with access to only this one Secret. This is where least privilege actually improves.

Validation

cspell, markdownlint-cli2 and make docs-check (mkdocs build --strict) pass, and the new anchors resolve.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T12:18:24.382832Z	2ad701b	PR opened
🔒 Security Review	✅ Completed 2026-09-25T12:19:17.459468Z	2ad701b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2ad701bcd0

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.