mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
b4e75f5f08
The operator reconciled `secrets.lux.network` on Hanzo clusters. It is a Lux-lineage component — it depends on luxfi/kms and luxfi/keys — but the group is what every manifest in the estate names, and a Hanzo cluster naming a Lux domain is the white-label rule broken in the most-copied place there is. Group becomes kms.hanzo.ai, version stays v1 and there is no alpha: a second served version is the thing a migration exists to remove, not something to carry. The CRD bases are renamed to match, because the filename carries the group and a stale name is a manifest that applies to nothing. Two tests hold it. One pins group and version. The other walks the tree and fails on any file still naming the old group — a rename that misses one manifest ships a CRD the operator has no RBAC for, and that surfaces as "no permission" long after the commit that caused it. This is the operator half only. Nothing in a cluster moves until the objects are migrated, and that sequence is not a sed: 147 live CRs, two of which are creationPolicy Owner, so deleting those two CRs deletes the Secrets they manage.
43 lines
1.4 KiB
Go
43 lines
1.4 KiB
Go
package constants
|
|
|
|
import "errors"
|
|
|
|
const SERVICE_ACCOUNT_ACCESS_KEY = "serviceAccountAccessKey"
|
|
const SERVICE_ACCOUNT_PUBLIC_KEY = "serviceAccountPublicKey"
|
|
const SERVICE_ACCOUNT_PRIVATE_KEY = "serviceAccountPrivateKey"
|
|
|
|
const KMS_MACHINE_IDENTITY_CLIENT_ID = "clientId"
|
|
const KMS_MACHINE_IDENTITY_CLIENT_SECRET = "clientSecret"
|
|
|
|
const KMS_TOKEN_SECRET_KEY_NAME = "kmsToken"
|
|
const SECRET_VERSION_ANNOTATION = "kms.hanzo.ai/version" // used to set the version of secrets via Etag
|
|
const OPERATOR_SETTINGS_CONFIGMAP_NAME = "kms-config"
|
|
const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "kms-operator-system"
|
|
const KMS_DOMAIN = "https://kms.hanzo.ai/api"
|
|
|
|
const KMS_PUSH_SECRET_FINALIZER_NAME = "pushsecret.kms.hanzo.ai/finalizer"
|
|
const KMS_DYNAMIC_SECRET_FINALIZER_NAME = "dynamicsecret.kms.hanzo.ai/finalizer"
|
|
|
|
type PushSecretReplacePolicy string
|
|
type PushSecretDeletionPolicy string
|
|
|
|
const (
|
|
PUSH_SECRET_REPLACE_POLICY_ENABLED PushSecretReplacePolicy = "Replace"
|
|
PUSH_SECRET_DELETE_POLICY_ENABLED PushSecretDeletionPolicy = "Delete"
|
|
)
|
|
|
|
type ManagedKubeResourceType string
|
|
|
|
const (
|
|
MANAGED_KUBE_RESOURCE_TYPE_SECRET ManagedKubeResourceType = "Secret"
|
|
MANAGED_KUBE_RESOURCE_TYPE_CONFIG_MAP ManagedKubeResourceType = "ConfigMap"
|
|
)
|
|
|
|
type DynamicSecretLeaseRevocationPolicy string
|
|
|
|
const (
|
|
DYNAMIC_SECRET_LEASE_REVOCATION_POLICY_ENABLED DynamicSecretLeaseRevocationPolicy = "Revoke"
|
|
)
|
|
|
|
var ErrInvalidLease = errors.New("invalid dynamic secret lease")
|