mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
b4e75f5f08
The operator reconciled `secrets.lux.network` on Hanzo clusters. It is a Lux-lineage component — it depends on luxfi/kms and luxfi/keys — but the group is what every manifest in the estate names, and a Hanzo cluster naming a Lux domain is the white-label rule broken in the most-copied place there is. Group becomes kms.hanzo.ai, version stays v1 and there is no alpha: a second served version is the thing a migration exists to remove, not something to carry. The CRD bases are renamed to match, because the filename carries the group and a stale name is a manifest that applies to nothing. Two tests hold it. One pins group and version. The other walks the tree and fails on any file still naming the old group — a rename that misses one manifest ships a CRD the operator has no RBAC for, and that surfaces as "no permission" long after the commit that caused it. This is the operator half only. Nothing in a cluster moves until the objects are migrated, and that sequence is not a sed: 147 live CRs, two of which are creationPolicy Owner, so deleting those two CRs deletes the Secrets they manage.
46 lines
1.5 KiB
YAML
46 lines
1.5 KiB
YAML
apiVersion: kms.hanzo.ai/v1
|
|
kind: KMSPushSecret
|
|
metadata:
|
|
name: kms-api-secret-sample-push
|
|
spec:
|
|
resyncInterval: 1m
|
|
hostAPI: https://kms.hanzo.ai/api
|
|
|
|
# Optional, defaults to replacement.
|
|
updatePolicy: Replace # If set to replace, existing secrets inside KMS will be replaced by the value of the PushSecret on sync.
|
|
|
|
# Optional, defaults to no deletion.
|
|
deletionPolicy: Delete # If set to delete, the secret(s) inside KMS managed by the operator, will be deleted if the KMSPushSecret CRD is deleted.
|
|
|
|
destination:
|
|
projectId: <project-id>
|
|
environmentSlug: <env-slug>
|
|
secretsPath: <secret-path>
|
|
|
|
push:
|
|
secret:
|
|
secretName: push-secret-source-secret # Secret CRD
|
|
secretNamespace: default
|
|
|
|
# Only have one authentication method defined or you are likely to run into authentication issues.
|
|
# Remove all except one authentication method.
|
|
authentication:
|
|
awsIamAuth:
|
|
identityId: <machine-identity-id>
|
|
azureAuth:
|
|
identityId: <machine-identity-id>
|
|
gcpIamAuth:
|
|
identityId: <machine-identity-id>
|
|
serviceAccountKeyFilePath: </path-to-service-account-key-file.json>
|
|
gcpIdTokenAuth:
|
|
identityId: <machine-identity-id>
|
|
kubernetesAuth:
|
|
identityId: <machine-identity-id>
|
|
serviceAccountRef:
|
|
name: <secret-name>
|
|
namespace: <secret-namespace>
|
|
universalAuth:
|
|
credentialsRef:
|
|
secretName: <secret-name> # universal-auth-credentials
|
|
secretNamespace: <secret-namespace> # default
|