mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
b4e75f5f08
The operator reconciled `secrets.lux.network` on Hanzo clusters. It is a Lux-lineage component — it depends on luxfi/kms and luxfi/keys — but the group is what every manifest in the estate names, and a Hanzo cluster naming a Lux domain is the white-label rule broken in the most-copied place there is. Group becomes kms.hanzo.ai, version stays v1 and there is no alpha: a second served version is the thing a migration exists to remove, not something to carry. The CRD bases are renamed to match, because the filename carries the group and a stale name is a manifest that applies to nothing. Two tests hold it. One pins group and version. The other walks the tree and fails on any file still naming the old group — a rename that misses one manifest ships a CRD the operator has no RBAC for, and that surfaces as "no permission" long after the commit that caused it. This is the operator half only. Nothing in a cluster moves until the objects are migrated, and that sequence is not a sed: 147 live CRs, two of which are creationPolicy Owner, so deleting those two CRs deletes the Secrets they manage.
32 lines
1.5 KiB
YAML
32 lines
1.5 KiB
YAML
# This kustomization.yaml is not intended to be run by itself,
|
|
# since it depends on service name and namespace that are out of this kustomize package.
|
|
# It should be run by config/default
|
|
resources:
|
|
- bases/kms.hanzo.ai_kmssecrets.yaml
|
|
- bases/kms.hanzo.ai_kmspushsecrets.yaml
|
|
- bases/kms.hanzo.ai_clustergenerators.yaml
|
|
# Password and UUID are generator types (api/v1/generators.go), consumed
|
|
# by a KMSSecret's generatorRef rather than reconciled by a controller of their
|
|
# own — which is presumably why they were never listed. But a CRD that is not
|
|
# installed is a KMSSecret that fails at admission, and every cluster in the
|
|
# estate already HAS these two installed, so the install manifest was
|
|
# describing a narrower operator than the one actually deployed.
|
|
- bases/kms.hanzo.ai_passwords.yaml
|
|
- bases/kms.hanzo.ai_uuids.yaml
|
|
#+kubebuilder:scaffold:crdkustomizeresource
|
|
|
|
patchesStrategicMerge:
|
|
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
|
|
# patches here are for enabling the conversion webhook for each CRD
|
|
#- patches/webhook_in_kmssecrets.yaml
|
|
#+kubebuilder:scaffold:crdkustomizewebhookpatch
|
|
|
|
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
|
|
# patches here are for enabling the CA injection for each CRD
|
|
#- patches/cainjection_in_kmssecrets.yaml
|
|
#+kubebuilder:scaffold:crdkustomizecainjectionpatch
|
|
|
|
# the following config is for teaching kustomize how to do kustomization for CRDs.
|
|
configurations:
|
|
- kustomizeconfig.yaml
|