mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekayandGitHub
6ab565e2ba
Introduces a kmsapi.Transport interface so the reconciler can talk to
the canonical luxfi/kms surface over either JSON-over-HTTP or the
binary ZAP wire (opcodes 0x0040..0x0043) on the same KMS daemon.
Why: sub-100µs in-cluster secret CRUD for the operator, on the same
authoritative store as the HTTP path. The HTTP transport stays the
default — ZAP is opt-in per KMSSecret/KMSPushSecret via host scheme:
http(s)://… → kmsapi.Client (today's path, unchanged)
zap://host:port → kmszap.Client (new, NodeID-bound)
zap+mdns://_kms._tcp → kmszap.Client (mDNS discovery)
Auth model — important divergence from HTTP, documented in
packages/kmszap/client.go: ZAP authorises by peer NodeID + ACL
(KMS_ZAP_ACL), not by IAM bearer token. Operator deployments wanting
ZAP MUST register their NodeID with the kmsd ACL. clientId/clientSecret
on the CR's universalAuth credentialsRef are ignored on the ZAP path
(the call still works because Login() returns a synthetic
"zap:<nodeID>" token kept by the existing token cache).
Files:
packages/kmsapi/transport.go — Transport interface, IsZAPHost
packages/kmszap/client.go — ZAP-backed kmsapi.Transport impl
packages/util/transport.go — shared BuildTransport factory
controllers/kmssecret + kmspushsecret — use util.BuildTransport
packages/util/{auth,secrets,models}.go — signatures use Transport
26 lines
791 B
Go
26 lines
791 B
Go
// Package util/models.go: per-CR runtime variables shared across
|
|
// reconcile invocations.
|
|
package util
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/hanzoai/kms-operator/packages/kmsapi"
|
|
)
|
|
|
|
// ResourceVariables is the per-CR cached runtime state. It is keyed
|
|
// by CR UID and re-used across reconciles to keep the kmsapi token
|
|
// cache warm and avoid login storms on a 401 loop.
|
|
//
|
|
// KMSClient is the transport interface (HTTP or ZAP). The reconciler
|
|
// picks the concrete implementation based on host scheme:
|
|
//
|
|
// "http(s)://…" → kmsapi.Client (JSON over HTTP)
|
|
// "zap://host:port" or
|
|
// "zap+mdns://_kms._tcp" → kmszap.Client (binary ZAP wire)
|
|
type ResourceVariables struct {
|
|
KMSClient kmsapi.Transport
|
|
CancelCtx context.CancelFunc
|
|
AuthDetails AuthenticationDetails
|
|
}
|