mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
b4e75f5f08
The operator reconciled `secrets.lux.network` on Hanzo clusters. It is a Lux-lineage component — it depends on luxfi/kms and luxfi/keys — but the group is what every manifest in the estate names, and a Hanzo cluster naming a Lux domain is the white-label rule broken in the most-copied place there is. Group becomes kms.hanzo.ai, version stays v1 and there is no alpha: a second served version is the thing a migration exists to remove, not something to carry. The CRD bases are renamed to match, because the filename carries the group and a stale name is a manifest that applies to nothing. Two tests hold it. One pins group and version. The other walks the tree and fails on any file still naming the old group — a rename that misses one manifest ships a CRD the operator has no RBAC for, and that surfaces as "no permission" long after the commit that caused it. This is the operator half only. Nothing in a cluster moves until the objects are migrated, and that sequence is not a sed: 147 live CRs, two of which are creationPolicy Owner, so deleting those two CRs deletes the Secrets they manage.
113 lines
3.6 KiB
YAML
113 lines
3.6 KiB
YAML
apiVersion: kms.hanzo.ai/v1
|
|
kind: KMSSecret
|
|
metadata:
|
|
name: kmssecret-sample
|
|
labels:
|
|
label-to-be-passed-to-managed-secret: sample-value
|
|
annotations:
|
|
example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
|
|
spec:
|
|
hostAPI: https://kms.hanzo.ai/api
|
|
resyncInterval: 10
|
|
# tls:
|
|
# caRef:
|
|
# secretName: custom-ca-certificate
|
|
# secretNamespace: default
|
|
# key: ca.crt
|
|
authentication:
|
|
# Make sure to only have 1 authentication method defined, serviceToken/universalAuth.
|
|
# If you have multiple authentication methods defined, it may cause issues.
|
|
|
|
# (Deprecated) Service Token Auth
|
|
serviceToken:
|
|
serviceTokenSecretReference:
|
|
secretName: service-token
|
|
secretNamespace: default
|
|
secretsScope:
|
|
envSlug: <env-slug>
|
|
secretsPath: <secrets-path>
|
|
recursive: true
|
|
|
|
# Universal Auth
|
|
universalAuth:
|
|
secretsScope:
|
|
projectSlug: new-ob-em
|
|
envSlug: dev # "dev", "staging", "prod", etc..
|
|
secretsPath: "/" # Root is "/"
|
|
recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
|
|
credentialsRef:
|
|
secretName: universal-auth-credentials
|
|
secretNamespace: default
|
|
|
|
# Native Kubernetes Auth
|
|
kubernetesAuth:
|
|
serviceAccountRef:
|
|
name: <secret-name>
|
|
namespace: <secret-namespace>
|
|
identityId: <machine-identity-id>
|
|
serviceAccountTokenPath: "/path/to/your/service-account/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
|
|
# secretsScope is identical to the secrets scope in the universalAuth field in this sample.
|
|
secretsScope:
|
|
projectSlug: your-project-slug
|
|
envSlug: prod
|
|
secretsPath: "/path"
|
|
recursive: true
|
|
|
|
# AWS IAM Auth
|
|
awsIamAuth:
|
|
identityId: <your-machine-identity-id>
|
|
|
|
# secretsScope is identical to the secrets scope in the universalAuth field in this sample.
|
|
secretsScope:
|
|
projectSlug: your-project-slug
|
|
envSlug: prod
|
|
secretsPath: "/path"
|
|
recursive: true
|
|
|
|
# Azure Auth
|
|
azureAuth:
|
|
identityId: <your-machine-identity-id>
|
|
resource: https://management.azure.com/&client_id=your_client_id # This field is optional, and will default to "https://management.azure.com/" if nothing is provided.
|
|
|
|
# secretsScope is identical to the secrets scope in the universalAuth field in this sample.
|
|
secretsScope:
|
|
projectSlug: your-project-slug
|
|
envSlug: prod
|
|
secretsPath: "/path"
|
|
recursive: true
|
|
|
|
# GCP ID Token Auth
|
|
gcpIdTokenAuth:
|
|
identityId: <your-machine-identity-id>
|
|
|
|
# secretsScope is identical to the secrets scope in the universalAuth field in this sample.
|
|
secretsScope:
|
|
projectSlug: your-project-slug
|
|
envSlug: prod
|
|
secretsPath: "/path"
|
|
recursive: true
|
|
|
|
# GCP IAM Auth
|
|
gcpIamAuth:
|
|
identityId: <your-machine-identity-id>
|
|
serviceAccountKeyFilePath: "/path/to-service-account-key-file-path.json"
|
|
|
|
# secretsScope is identical to the secrets scope in the universalAuth field in this sample.
|
|
secretsScope:
|
|
projectSlug: your-project-slug
|
|
envSlug: prod
|
|
secretsPath: "/path"
|
|
recursive: true
|
|
|
|
managedKubeSecretReferences:
|
|
- secretName: managed-secret
|
|
secretNamespace: default
|
|
creationPolicy: "Orphan" ## Owner | Orphan
|
|
# secretType: kubernetes.io/dockerconfigjson
|
|
|
|
# # To be depreciated soon
|
|
# tokenSecretReference:
|
|
# secretName: service-token
|
|
# secretNamespace: default
|