mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
b4e75f5f08
The operator reconciled `secrets.lux.network` on Hanzo clusters. It is a Lux-lineage component — it depends on luxfi/kms and luxfi/keys — but the group is what every manifest in the estate names, and a Hanzo cluster naming a Lux domain is the white-label rule broken in the most-copied place there is. Group becomes kms.hanzo.ai, version stays v1 and there is no alpha: a second served version is the thing a migration exists to remove, not something to carry. The CRD bases are renamed to match, because the filename carries the group and a stale name is a manifest that applies to nothing. Two tests hold it. One pins group and version. The other walks the tree and fails on any file still naming the old group — a rename that misses one manifest ships a CRD the operator has no RBAC for, and that surfaces as "no permission" long after the commit that caused it. This is the operator half only. Nothing in a cluster moves until the objects are migrated, and that sequence is not a sed: 147 live CRs, two of which are creationPolicy Owner, so deleting those two CRs deletes the Secrets they manage.
157 lines
5.2 KiB
Go
157 lines
5.2 KiB
Go
package controllers
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
secretsv1 "github.com/hanzoai/kms-operator/api/v1"
|
|
"k8s.io/apimachinery/pkg/api/meta"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
)
|
|
|
|
func (r *KMSPushSecretReconciler) SetReconcileStatusCondition(ctx context.Context, kmsPushSecret *secretsv1.KMSPushSecret, err error) error {
|
|
|
|
if kmsPushSecret.Status.Conditions == nil {
|
|
kmsPushSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if err != nil {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/Reconcile",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "Error",
|
|
Message: fmt.Sprintf("Reconcile failed, secrets were not pushed to KMS. Error: %s", err.Error()),
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/Reconcile",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "OK",
|
|
Message: "Reconcile succeeded, secrets were pushed to KMS",
|
|
})
|
|
}
|
|
|
|
return r.Client.Status().Update(ctx, kmsPushSecret)
|
|
|
|
}
|
|
|
|
func (r *KMSPushSecretReconciler) SetFailedToReplaceSecretsStatusCondition(ctx context.Context, kmsPushSecret *secretsv1.KMSPushSecret, failMessage string) error {
|
|
if kmsPushSecret.Status.Conditions == nil {
|
|
kmsPushSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if failMessage != "" {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToReplaceSecrets",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "Error",
|
|
Message: failMessage,
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToReplaceSecrets",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "OK",
|
|
Message: "No errors, no secrets failed to be replaced in KMS",
|
|
})
|
|
}
|
|
|
|
return r.Client.Status().Update(ctx, kmsPushSecret)
|
|
}
|
|
|
|
func (r *KMSPushSecretReconciler) SetFailedToCreateSecretsStatusCondition(ctx context.Context, kmsPushSecret *secretsv1.KMSPushSecret, failMessage string) error {
|
|
if kmsPushSecret.Status.Conditions == nil {
|
|
kmsPushSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if failMessage != "" {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToCreateSecrets",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "Error",
|
|
Message: failMessage,
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToCreateSecrets",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "OK",
|
|
Message: "No errors encountered, no secrets failed to be created in KMS",
|
|
})
|
|
}
|
|
|
|
return r.Client.Status().Update(ctx, kmsPushSecret)
|
|
}
|
|
|
|
func (r *KMSPushSecretReconciler) SetFailedToUpdateSecretsStatusCondition(ctx context.Context, kmsPushSecret *secretsv1.KMSPushSecret, failMessage string) error {
|
|
if kmsPushSecret.Status.Conditions == nil {
|
|
kmsPushSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if failMessage != "" {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToUpdateSecrets",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "Error",
|
|
Message: failMessage,
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToUpdateSecrets",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "OK",
|
|
Message: "No errors encountered, no secrets failed to be updated in KMS",
|
|
})
|
|
}
|
|
|
|
return r.Client.Status().Update(ctx, kmsPushSecret)
|
|
}
|
|
|
|
func (r *KMSPushSecretReconciler) SetFailedToDeleteSecretsStatusCondition(ctx context.Context, kmsPushSecret *secretsv1.KMSPushSecret, failMessage string) error {
|
|
if kmsPushSecret.Status.Conditions == nil {
|
|
kmsPushSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if failMessage != "" {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToDeleteSecrets",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "Error",
|
|
Message: failMessage,
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/FailedToDeleteSecrets",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "OK",
|
|
Message: "No errors encountered, no secrets failed to be deleted",
|
|
})
|
|
}
|
|
|
|
return r.Client.Status().Update(ctx, kmsPushSecret)
|
|
}
|
|
|
|
func (r *KMSPushSecretReconciler) SetAuthenticatedStatusCondition(ctx context.Context, kmsPushSecret *secretsv1.KMSPushSecret, errorToConditionOn error) error {
|
|
if kmsPushSecret.Status.Conditions == nil {
|
|
kmsPushSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if errorToConditionOn != nil {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/Authenticated",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "Error",
|
|
Message: "Failed to authenticate with KMS API. This can be caused by invalid service token or an invalid API host that is set. Check operator logs for more info",
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsPushSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/Authenticated",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "OK",
|
|
Message: "Successfully authenticated with KMS API",
|
|
})
|
|
}
|
|
|
|
return r.Client.Status().Update(ctx, kmsPushSecret)
|
|
}
|