mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
ce44297263
Drops the legacy github.com/luxfi/kms-go SDK (Infisical-derived) and
moves every HTTP call onto the canonical surface served by
~/work/hanzo/kms cmd/kmsd at kms.hanzo.ai:
POST /v1/kms/auth/login {clientId, clientSecret}
GET /v1/kms/orgs/{org}/secrets/{path...}/{name}?env= Authorization: Bearer
POST /v1/kms/orgs/{org}/secrets upsert
PATCH /v1/kms/orgs/{org}/secrets/{path...}/{name} version CAS via If-Match
DELETE /v1/kms/orgs/{org}/secrets/{path...}/{name}?env=
The canonical server exposes no list endpoint and no opaque secret ID,
so KMSSecret now requires an explicit secretsScope.keys roster and
KMSPushSecret tracks managed names directly. The KMSDynamicSecret CRD
and controller are removed — the canonical server has no
dynamic-secrets / lease routes.
New packages/kmsapi in-tree HTTP client mirrors the lux/operator Rust
hardening profile (commit 7164368):
* Bearer token cache keyed on SHA-256(clientId|clientSecret|host).
A swapped host or rotated credential invalidates the entry
atomically. 60s refresh skew, 1h default TTL.
* Hijack guard: tokens are bound to the host that minted them.
* Control-byte rejection on every URL-relevant input and every
response value (NUL + C0 except TAB/LF/CR). PEM blobs pass; NUL
never does.
* Input bounds: host ≤512, slug ≤64, path ≤256, name ≤128 chars,
≤128 keys/CR.
* Empty-fetch fail-closed: KMSSecret refuses to project an empty
Secret on the read path.
* Same-namespace credentialsRef enforcement: a CR in namespace A
cannot read a Secret from a privileged namespace it does not own.
* 4 MiB hard cap on response bodies, 15s per-request timeout.
CRD changes (KMSSecret.spec.authentication.universalAuth.secretsScope):
+ keys: []string (required, ≥1, ≤128) — explicit fetch roster
- recursive: bool — no list endpoint exists
Forward break only: every other auth strategy (service token, service
account, K8s/AWS/Azure/GCP machine identity) and the
KMSDynamicSecret CRD are gone, with no env-flag fallbacks. Restore
each only when kmsd grows the corresponding canonical route.
go test ./... passes, including 28 new unit tests in packages/kmsapi
covering hijack guard, control-byte rejection, scope bounds, version
CAS, 404 -> ErrNotFound, 409 -> ErrVersionConflict, and the full
HTTP request/response shape against httptest.
11 lines
515 B
Go
11 lines
515 B
Go
// Package util/workspace.go was a thin wrapper over the legacy KMS
|
|
// /v1/workspace/{id} endpoint. The canonical luxfi/kms surface has no
|
|
// concept of a "workspace ID -> slug" lookup — orgs are addressed
|
|
// directly by slug under /v1/kms/orgs/{org}/secrets/...
|
|
//
|
|
// The file is intentionally empty in the package-level public API; it
|
|
// exists only to keep the package import path stable for
|
|
// any downstream consumers in the operator that import it
|
|
// transitively. Do not add new helpers here.
|
|
package util
|