mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
f3fbb687d2
Following the earlier AdminShell+CollectionCRUD rewrite (PR #14) which already deleted backend/, backend-go/, cloudformation/, helm-charts/, nginx/, sink/, wasm/, upgrade-impact/, e2e/, migration/, package.json and switched the frontend to a 184K Hanzo-first build, complete the cleanup by deleting the remaining Infisical-era residue: - docs/ (1.0G Infisical mintlify docs) - .env.example, .env.dev.example, .env.migration.example, .env.test.example (legacy Postgres/Redis envs; no Go code references them) - .eslintignore, .husky/ (TS toolchain leftovers) - CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md (Infisical repo boilerplate) Working tree drops from ~1.0G to <600K of content (1.5G total is .git/ which `git gc --aggressive --prune=now` shrinks locally; the remote keeps its history shape — anyone pulling gets the lean checkout). Build + test verification: go build ./... (4 cmd binaries: green) go test ./... -count=1 -short (all packages: ok) Kept: cmd/, pkg/, sdk/, frontend/ (AdminShell), schema/, examples/, root Go (audit.go, auth.go, consensus.go, embed.go, jwks.go, mount.go, versioning.go + tests), Dockerfile, Dockerfile.kms-fetch, Makefile, LLM.md, CLAUDE.md, DEPRECATED.md, SOVEREIGN-KMS-ARCHITECTURE.md, TFHE-KMS-ARCHITECTURE.md, LICENSE, README.md, VERSION, .github/ (8 Hanzo workflows: build, build-kms-fetch, check-fe-ts-and-lint, ci, pr-preview, release, validate-pr-title, workflow-sanity).
127 lines
4.2 KiB
Bash
Executable File
127 lines
4.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Setup script for Google Cloud Workload Identity with Lux KMS
|
|
# This script configures Workload Identity binding between GKE and GCP service accounts
|
|
|
|
set -e
|
|
|
|
# Configuration
|
|
PROJECT_ID="${GOOGLE_CLOUD_PROJECT_ID:-lux-kms-production}"
|
|
CLUSTER_NAME="${GKE_CLUSTER_NAME:-lux-kms-cluster}"
|
|
CLUSTER_REGION="${GKE_CLUSTER_REGION:-us-east1}"
|
|
GCP_SA_NAME="${GCP_SERVICE_ACCOUNT:-lux-kms-sa}"
|
|
K8S_SA_NAME="${K8S_SERVICE_ACCOUNT:-lux-kms-sa}"
|
|
K8S_NAMESPACE="${K8S_NAMESPACE:-lux-kms}"
|
|
|
|
echo "========================================="
|
|
echo "Google Cloud Workload Identity Setup"
|
|
echo "========================================="
|
|
echo ""
|
|
echo "Configuration:"
|
|
echo " Project ID: $PROJECT_ID"
|
|
echo " Cluster Name: $CLUSTER_NAME"
|
|
echo " Cluster Region: $CLUSTER_REGION"
|
|
echo " GCP SA: $GCP_SA_NAME"
|
|
echo " Kubernetes SA: $K8S_SA_NAME"
|
|
echo " Kubernetes NS: $K8S_NAMESPACE"
|
|
echo ""
|
|
|
|
# Step 1: Enable Workload Identity on GKE cluster
|
|
echo "Step 1: Enabling Workload Identity on GKE cluster..."
|
|
gcloud container clusters update "$CLUSTER_NAME" \
|
|
--region="$CLUSTER_REGION" \
|
|
--workload-pool="$PROJECT_ID.svc.id.goog" \
|
|
--project="$PROJECT_ID"
|
|
|
|
echo "✓ Workload Identity enabled on cluster"
|
|
echo ""
|
|
|
|
# Step 2: Create Kubernetes namespace
|
|
echo "Step 2: Creating Kubernetes namespace..."
|
|
kubectl create namespace "$K8S_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
|
|
echo "✓ Namespace created"
|
|
echo ""
|
|
|
|
# Step 3: Create Kubernetes Service Account
|
|
echo "Step 3: Creating Kubernetes Service Account..."
|
|
kubectl create serviceaccount "$K8S_SA_NAME" \
|
|
--namespace "$K8S_NAMESPACE" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
echo "✓ Kubernetes Service Account created"
|
|
echo ""
|
|
|
|
# Step 4: Annotate Kubernetes Service Account
|
|
echo "Step 4: Annotating Kubernetes Service Account..."
|
|
kubectl annotate serviceaccount "$K8S_SA_NAME" \
|
|
--namespace "$K8S_NAMESPACE" \
|
|
iam.gke.io/gcp-service-account="$GCP_SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \
|
|
--overwrite
|
|
echo "✓ Service Account annotated"
|
|
echo ""
|
|
|
|
# Step 5: Bind GCP Service Account to Kubernetes Service Account
|
|
echo "Step 5: Binding GCP SA to Kubernetes SA..."
|
|
gcloud iam service-accounts add-iam-policy-binding \
|
|
"$GCP_SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \
|
|
--role roles/iam.workloadIdentityUser \
|
|
--member "serviceAccount:$PROJECT_ID.svc.id.goog[$K8S_NAMESPACE/$K8S_SA_NAME]" \
|
|
--project="$PROJECT_ID"
|
|
|
|
echo "✓ Workload Identity binding created"
|
|
echo ""
|
|
|
|
# Step 6: Verify configuration
|
|
echo "Step 6: Verifying Workload Identity configuration..."
|
|
|
|
# Check GCP SA exists
|
|
if gcloud iam service-accounts describe "$GCP_SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \
|
|
--project="$PROJECT_ID" > /dev/null 2>&1; then
|
|
echo "✓ GCP Service Account exists"
|
|
else
|
|
echo "✗ GCP Service Account not found"
|
|
exit 1
|
|
fi
|
|
|
|
# Check K8s SA exists and has correct annotation
|
|
K8S_SA_ANNOTATION=$(kubectl get serviceaccount "$K8S_SA_NAME" \
|
|
--namespace "$K8S_NAMESPACE" \
|
|
-o jsonpath='{.metadata.annotations.iam\.gke\.io/gcp-service-account}')
|
|
|
|
if [ "$K8S_SA_ANNOTATION" == "$GCP_SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" ]; then
|
|
echo "✓ Kubernetes Service Account properly annotated"
|
|
else
|
|
echo "✗ Kubernetes Service Account annotation incorrect"
|
|
echo " Expected: $GCP_SA_NAME@$PROJECT_ID.iam.gserviceaccount.com"
|
|
echo " Got: $K8S_SA_ANNOTATION"
|
|
exit 1
|
|
fi
|
|
|
|
echo ""
|
|
echo "========================================="
|
|
echo "Workload Identity Setup Complete!"
|
|
echo "========================================="
|
|
echo ""
|
|
echo "Next Steps:"
|
|
echo ""
|
|
echo "1. Deploy Lux KMS:"
|
|
echo " kubectl apply -f kubernetes/deployment.yaml"
|
|
echo ""
|
|
echo "2. Verify deployment:"
|
|
echo " kubectl get pods -n $K8S_NAMESPACE"
|
|
echo ""
|
|
echo "3. Check logs:"
|
|
echo " kubectl logs -n $K8S_NAMESPACE -l app.kubernetes.io/name=lux-kms"
|
|
echo ""
|
|
echo "4. Test Workload Identity:"
|
|
echo " kubectl run -it --rm test-wi \\"
|
|
echo " --namespace $K8S_NAMESPACE \\"
|
|
echo " --serviceaccount=$K8S_SA_NAME \\"
|
|
echo " --image=google/cloud-sdk:slim \\"
|
|
echo " -- gcloud auth list"
|
|
echo ""
|
|
echo " You should see: $GCP_SA_NAME@$PROJECT_ID.iam.gserviceaccount.com"
|
|
echo ""
|
|
echo "5. Access Lux KMS:"
|
|
echo " kubectl port-forward -n $K8S_NAMESPACE svc/lux-kms 8080:80"
|
|
echo " curl http://localhost:8080/health"
|
|
echo ""
|