mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
b4e75f5f08
The operator reconciled `secrets.lux.network` on Hanzo clusters. It is a Lux-lineage component — it depends on luxfi/kms and luxfi/keys — but the group is what every manifest in the estate names, and a Hanzo cluster naming a Lux domain is the white-label rule broken in the most-copied place there is. Group becomes kms.hanzo.ai, version stays v1 and there is no alpha: a second served version is the thing a migration exists to remove, not something to carry. The CRD bases are renamed to match, because the filename carries the group and a stale name is a manifest that applies to nothing. Two tests hold it. One pins group and version. The other walks the tree and fails on any file still naming the old group — a rename that misses one manifest ships a CRD the operator has no RBAC for, and that surfaces as "no permission" long after the commit that caused it. This is the operator half only. Nothing in a cluster moves until the objects are migrated, and that sequence is not a sed: 147 live CRs, two of which are creationPolicy Owner, so deleting those two CRs deletes the Secrets they manage.
101 lines
3.7 KiB
Go
101 lines
3.7 KiB
Go
package controllers
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/go-logr/logr"
|
|
secretsv1 "github.com/hanzoai/kms-operator/api/v1"
|
|
"github.com/hanzoai/kms-operator/packages/util"
|
|
"k8s.io/apimachinery/pkg/api/meta"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
)
|
|
|
|
func (r *KMSSecretReconciler) SetReadyToSyncSecretsConditions(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, secretsCount int, errorToConditionOn error) {
|
|
if kmsSecret.Status.Conditions == nil {
|
|
kmsSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if errorToConditionOn != nil {
|
|
meta.SetStatusCondition(&kmsSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/ReadyToSyncSecrets",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "Error",
|
|
Message: fmt.Sprintf("Failed to sync secrets. This can be caused by invalid access token or an invalid API host that is set. Error: %v", errorToConditionOn),
|
|
})
|
|
|
|
meta.SetStatusCondition(&kmsSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/AutoRedeployReady",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "Stopped",
|
|
Message: fmt.Sprintf("Auto redeployment has been stopped because the operator failed to sync secrets. Error: %v", errorToConditionOn),
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/ReadyToSyncSecrets",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "OK",
|
|
Message: fmt.Sprintf("KMS controller has started syncing your secrets. Last reconcile synced %d secrets", secretsCount),
|
|
})
|
|
}
|
|
|
|
err := r.Client.Status().Update(ctx, kmsSecret)
|
|
if err != nil {
|
|
logger.Error(err, "Could not set condition for ReadyToSyncSecrets")
|
|
}
|
|
}
|
|
|
|
func (r *KMSSecretReconciler) SetKMSTokenLoadCondition(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, authStrategy util.AuthStrategyType, errorToConditionOn error) {
|
|
if kmsSecret.Status.Conditions == nil {
|
|
kmsSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if errorToConditionOn == nil {
|
|
meta.SetStatusCondition(&kmsSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/LoadedKMSToken",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "OK",
|
|
Message: fmt.Sprintf("KMS controller has loaded the KMS token in provided Kubernetes secret, using %v authentication strategy", authStrategy),
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/LoadedKMSToken",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "Error",
|
|
Message: fmt.Sprintf("Failed to load KMS Token from the provided Kubernetes secret because: %v", errorToConditionOn),
|
|
})
|
|
}
|
|
|
|
err := r.Client.Status().Update(ctx, kmsSecret)
|
|
if err != nil {
|
|
logger.Error(err, "Could not set condition for LoadedKMSToken")
|
|
}
|
|
}
|
|
|
|
func (r *KMSSecretReconciler) SetKMSAutoRedeploymentReady(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, numDeployments int, errorToConditionOn error) {
|
|
if kmsSecret.Status.Conditions == nil {
|
|
kmsSecret.Status.Conditions = []metav1.Condition{}
|
|
}
|
|
|
|
if errorToConditionOn == nil {
|
|
meta.SetStatusCondition(&kmsSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/AutoRedeployReady",
|
|
Status: metav1.ConditionTrue,
|
|
Reason: "OK",
|
|
Message: fmt.Sprintf("KMS has found %v deployments which are ready to be auto redeployed when secrets change", numDeployments),
|
|
})
|
|
} else {
|
|
meta.SetStatusCondition(&kmsSecret.Status.Conditions, metav1.Condition{
|
|
Type: "kms.hanzo.ai/AutoRedeployReady",
|
|
Status: metav1.ConditionFalse,
|
|
Reason: "Error",
|
|
Message: fmt.Sprintf("Failed reconcile deployments because: %v", errorToConditionOn),
|
|
})
|
|
}
|
|
|
|
err := r.Client.Status().Update(ctx, kmsSecret)
|
|
if err != nil {
|
|
logger.Error(err, "Could not set condition for AutoRedeployReady")
|
|
}
|
|
}
|