mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekayandHanzo Dev
4bcdcbfbf6
Both modules declare go 1.27.1 and the build images follow. go fix applied the modernizers: promoted-field keys in struct literals, SplitSeq, strings.Cut, new(expr), slices.Contains and any. The ptr helper had no callers left once new(expr) could say it. omitzero is not applied; it changes what the JSON says, so it is a per-field decision. Co-authored-by: Hanzo Dev <[email protected]>
56 lines
2.2 KiB
Docker
56 lines
2.2 KiB
Docker
# Dockerfile.kms-fetch — init-container image for fetching secrets from KMS
|
|
# over ZAP at pod boot. See k8s Secrets → KMS-ZAP migration plan.
|
|
#
|
|
# Build:
|
|
# docker buildx build -f Dockerfile.kms-fetch \
|
|
# -t ghcr.io/hanzoai/kms-fetch:0.1.0 \
|
|
# --platform linux/amd64 .
|
|
#
|
|
# Use (init container in a Deployment):
|
|
# initContainers:
|
|
# - name: kms-fetch
|
|
# image: ghcr.io/hanzoai/kms-fetch:0.1.0
|
|
# env:
|
|
# - { name: KMS_URL, value: https://kms.{env}.<tenant-domain> }
|
|
# - { name: KMS_PROJECT, value: hanzo }
|
|
# - { name: KMS_ENV, value: {env} }
|
|
# - { name: KMS_SECRETS, value: "DB_URL=path/db_url,API_KEY=path/api_key" }
|
|
# - { name: IAM_CLIENT_ID, valueFrom: { secretKeyRef: { name: <svc>-iam-bootstrap, key: client_id }}}
|
|
# - { name: IAM_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: <svc>-iam-bootstrap, key: client_secret }}}
|
|
# volumeMounts:
|
|
# - { name: secrets, mountPath: /secrets }
|
|
|
|
FROM golang:1.27.1-bookworm AS build
|
|
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
# kmsclient is an in-repo module built via a local replace (see go.mod).
|
|
# Stage its go.mod/go.sum so `go mod download` can read the replaced module's
|
|
# graph before the full source tree is copied.
|
|
COPY sdk/go/go.mod sdk/go/go.sum ./sdk/go/
|
|
# Every module in this graph is public. They resolve through the module proxy
|
|
# and verify against the checksum database under the h1: hashes already in
|
|
# go.sum, so this build carries no credential and sets no GOPRIVATE — the
|
|
# checksum database stays authoritative for every dependency.
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
go mod download
|
|
|
|
COPY . .
|
|
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
|
|
go build -ldflags="-s -w" -o /kms-fetch ./cmd/kms-fetch/
|
|
|
|
# Distroless static — no shell, no package manager, just the binary + CA
|
|
# certs. The init container exits 0 on success and the main container
|
|
# continues, so it doesn't need an interactive runtime.
|
|
FROM gcr.io/distroless/static:nonroot
|
|
|
|
COPY --from=build /kms-fetch /kms-fetch
|
|
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["/kms-fetch"]
|