mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-11-02 09:27:09 +00:00
zeekay
b4e75f5f08
The operator reconciled `secrets.lux.network` on Hanzo clusters. It is a Lux-lineage component — it depends on luxfi/kms and luxfi/keys — but the group is what every manifest in the estate names, and a Hanzo cluster naming a Lux domain is the white-label rule broken in the most-copied place there is. Group becomes kms.hanzo.ai, version stays v1 and there is no alpha: a second served version is the thing a migration exists to remove, not something to carry. The CRD bases are renamed to match, because the filename carries the group and a stale name is a manifest that applies to nothing. Two tests hold it. One pins group and version. The other walks the tree and fails on any file still naming the old group — a rename that misses one manifest ships a CRD the operator has no RBAC for, and that surfaces as "no permission" long after the commit that caused it. This is the operator half only. Nothing in a cluster moves until the objects are migrated, and that sequence is not a sed: 147 live CRs, two of which are creationPolicy Owner, so deleting those two CRs deletes the Secrets they manage.
97 lines
3.7 KiB
YAML
97 lines
3.7 KiB
YAML
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.20.1
|
|
name: clustergenerators.kms.hanzo.ai
|
|
spec:
|
|
group: kms.hanzo.ai
|
|
names:
|
|
kind: ClusterGenerator
|
|
listKind: ClusterGeneratorList
|
|
plural: clustergenerators
|
|
singular: clustergenerator
|
|
scope: Cluster
|
|
versions:
|
|
- name: v1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: ClusterGenerator represents a cluster-wide generator
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
properties:
|
|
generator:
|
|
description: Generator the spec for this generator, must match the
|
|
kind.
|
|
properties:
|
|
passwordSpec:
|
|
description: PasswordSpec controls the behavior of the password
|
|
generator.
|
|
properties:
|
|
allowRepeat:
|
|
default: false
|
|
description: set allowRepeat to true to allow repeating characters.
|
|
type: boolean
|
|
digits:
|
|
description: |-
|
|
digits specifies the number of digits in the generated
|
|
password. If omitted it defaults to 25% of the length of the password
|
|
type: integer
|
|
length:
|
|
default: 24
|
|
description: |-
|
|
Length of the password to be generated.
|
|
Defaults to 24
|
|
type: integer
|
|
noUpper:
|
|
default: false
|
|
description: Set noUpper to disable uppercase characters
|
|
type: boolean
|
|
symbolCharacters:
|
|
description: |-
|
|
symbolCharacters specifies the special characters that should be used
|
|
in the generated password.
|
|
type: string
|
|
symbols:
|
|
description: |-
|
|
symbols specifies the number of symbol characters in the generated
|
|
password. If omitted it defaults to 25% of the length of the password
|
|
type: integer
|
|
type: object
|
|
uuidSpec:
|
|
description: UUIDSpec controls the behavior of the uuid generator.
|
|
type: object
|
|
type: object
|
|
kind:
|
|
description: Kind the kind of this generator.
|
|
enum:
|
|
- Password
|
|
- UUID
|
|
type: string
|
|
required:
|
|
- kind
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|