backfill workbench tools in k8s operator

[zreigz]

• backfill workbench tools in k8s operator
• fix secret key rotation

Test Plan

Test environment: https://console.your-env.onplural.sh/

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[linear]

PROD-5068

[soffi-ai]

Soffi AI Summary

This PR significantly expands the WorkbenchTool Kubernetes CRD in the Go controller to achieve feature parity with the server-side workbench tool definitions. Previously, the CRD was missing most of the tool configuration options; this backfill adds the full set of supported tool types and connection configs so operators can declaratively manage workbench tools via Kubernetes manifests.

Key changes:

• CRD schema expansion (workbenchtool_types.go): Added ~700 lines of new Go type definitions covering the full range of supported tool connection types: Azure DevOps, Bitbucket Cloud, Bitbucket Data Center, Azure Functions, Lambda, Cloud Run, Prometheus, Loki, Tempo, Jaeger, Elasticsearch, Datadog, Dynatrace, Splunk, CloudWatch, and others. Also added top-level approval (requires human approval before execution) and bindings (read/write access policies) fields to the spec.

• CRD manifests regenerated: Both go/controller/config/crd/bases/ and charts/controller/crds/ YAML manifests were regenerated to reflect all new spec fields (~984 lines added each), along with updated zz_generated.deepcopy.go for the new types.

• Controller logic updated (workbench_tool_controller.go): The reconciler was extended to map the new spec fields (approval, bindings, all new connection configs) into the GraphQL mutation sent to the Elixir server, ensuring new CRD fields are actually synced to the backend.

• Test coverage added: A new controller test file (workbench_tool_controller_test.go) with 433 lines covers reconciliation scenarios for the expanded spec.

• Docs and samples updated: API reference docs and a sample workbench.yaml manifest were added/updated to demonstrate the new capabilities.

• Bug fixes: A fix for secret key rotation and a Diff correction were included alongside the main feature work.

Commits

Commit	Summary
5190ccb	Core feature: expanded the WorkbenchTool CRD type definitions to include the full set of tool connection types (Azure DevOps, Bitbucket, Lambda, Prometheus, Datadog, Elasticsearch, etc.), added approval and bindings fields to the spec, updated the controller reconciler to map these new fields into GraphQL mutations, regenerated all CRD manifests and deepcopy code, added controller tests, and updated sample manifests.
f6f8dd1	Fixed a bug in secret key rotation logic within the workbench tool controller.
85fcfdd	Updated the generated API reference docs to reflect the newly added WorkbenchTool spec fields.
c9c19de	Fixed a Diff issue, likely correcting a comparison or diff-rendering bug introduced or exposed by the CRD expansion.

Deploy in Soffi

---

Updated: 2026-07-28 10:55 UTC

[greptile-apps]

Greptile Summary

This PR expands Kubernetes WorkbenchTool support to cover additional integrations and policies.

• Adds configuration schemas and attribute conversion for SCM, observability, messaging, function, search, and Docker tools.
• Adds approval, policy bindings, and SCM/cloud/MCP connection references to WorkbenchTool reconciliation.
• Regenerates deepcopy code, CRD manifests, and packaged controller charts.

Confidence Score: 3/5

The PR should not merge until Docker WorkbenchTools correctly synchronize rotated Secret-backed registry credentials.

The update decision hashes only the WorkbenchTool spec and does not watch referenced Secrets, so rotating Docker credentials leaves Console using stale authentication data.

Files Needing Attention: go/controller/internal/controller/workbench_tool_controller.go

Important Files Changed

Filename	Overview
go/controller/internal/controller/workbench_tool_controller.go	Adds SCM references, bindings, and Docker authentication, but Docker Secret rotation is hidden by the spec-only update gate.
go/controller/api/v1alpha1/workbenchtool_types.go	Adds the expanded WorkbenchTool API model and converts its configurations into Console API attributes.
go/controller/config/crd/bases/deployments.plural.sh_workbenchtools.yaml	Regenerates the WorkbenchTool CRD schema for the newly supported fields and integrations.
go/controller/api/v1alpha1/zz_generated.deepcopy.go	Regenerates deep-copy implementations for the expanded API types.

_{Reviews (1): Last reviewed commit: "backfill workbench tools in k8s operator" | Re-trigger Greptile}