mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zooqueen
3b14e17649
Docker Build & Push (Reusable) / create-manifest (push) Blocked by required conditions
Docker Build & Push (Reusable) / tag-single-arch (push) Blocked by required conditions
Docker Build & Push (Reusable) / deploy (push) Blocked by required conditions
Docker Build & Push (Reusable) / sbom (push) Blocked by required conditions
Docker Build & Push (Reusable) / build-amd64 (push) Waiting to run
Docker Build & Push (Reusable) / build-arm64 (push) Skipped
Build kms / build (push) Waiting to run
Release / Build binaries (linux/amd64) (push) Waiting to run
Release / GitHub Release (push) Blocked by required conditions
Release / Multi-arch Docker (ghcr.io/hanzoai/kms) (push) Blocked by required conditions
Release / Notify universe (auto-bump pin) (push) Blocked by required conditions
Release / Build binaries (darwin/arm64) (push) Failing after 0s
Release / Build binaries (darwin/amd64) (push) Failing after 0s
Release / Build binaries (linux/arm64) (push) Failing after 0s
Every module in this graph is public and notarized, so `go mod download` resolves through the module proxy and verifies against sum.golang.org. Both Dockerfiles drop the build ARG and the git credential rewrite; the release workflow stops passing a token as a build argument and stops setting GOPRIVATE/GONOSUMDB for the binary matrix. Root go.sum gains the module hashes for the versions MVS selects across the sdk/go replace, which `go build` requires under -mod=readonly.
56 lines
2.2 KiB
Docker
56 lines
2.2 KiB
Docker
# Dockerfile.kms-fetch — init-container image for fetching secrets from KMS
|
|
# over ZAP at pod boot. See k8s Secrets → KMS-ZAP migration plan.
|
|
#
|
|
# Build:
|
|
# docker buildx build -f Dockerfile.kms-fetch \
|
|
# -t ghcr.io/hanzoai/kms-fetch:0.1.0 \
|
|
# --platform linux/amd64 .
|
|
#
|
|
# Use (init container in a Deployment):
|
|
# initContainers:
|
|
# - name: kms-fetch
|
|
# image: ghcr.io/hanzoai/kms-fetch:0.1.0
|
|
# env:
|
|
# - { name: KMS_URL, value: https://kms.{env}.<tenant-domain> }
|
|
# - { name: KMS_PROJECT, value: hanzo }
|
|
# - { name: KMS_ENV, value: {env} }
|
|
# - { name: KMS_SECRETS, value: "DB_URL=path/db_url,API_KEY=path/api_key" }
|
|
# - { name: IAM_CLIENT_ID, valueFrom: { secretKeyRef: { name: <svc>-iam-bootstrap, key: client_id }}}
|
|
# - { name: IAM_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: <svc>-iam-bootstrap, key: client_secret }}}
|
|
# volumeMounts:
|
|
# - { name: secrets, mountPath: /secrets }
|
|
|
|
FROM golang:1.26-bookworm AS build
|
|
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
# kmsclient is an in-repo module built via a local replace (see go.mod).
|
|
# Stage its go.mod/go.sum so `go mod download` can read the replaced module's
|
|
# graph before the full source tree is copied.
|
|
COPY sdk/go/go.mod sdk/go/go.sum ./sdk/go/
|
|
# Every module in this graph is public. They resolve through the module proxy
|
|
# and verify against the checksum database under the h1: hashes already in
|
|
# go.sum, so this build carries no credential and sets no GOPRIVATE — the
|
|
# checksum database stays authoritative for every dependency.
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
go mod download
|
|
|
|
COPY . .
|
|
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
|
|
go build -ldflags="-s -w" -o /kms-fetch ./cmd/kms-fetch/
|
|
|
|
# Distroless static — no shell, no package manager, just the binary + CA
|
|
# certs. The init container exits 0 on success and the main container
|
|
# continues, so it doesn't need an interactive runtime.
|
|
FROM gcr.io/distroless/static:nonroot
|
|
|
|
COPY --from=build /kms-fetch /kms-fetch
|
|
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["/kms-fetch"]
|