mirror of
https://github.com/hanzoai/operator.git
synced 2026-10-30 15:06:11 +00:00
zeekayandHanzo Dev
9c75ad2f19
The KMSSecret projector had no way to authenticate. Its only transport was zap, whose server wants a signed envelope the client does not build, so every fetch was rejected at parse and the projector was opt-in and off. KMS is IAM-fronted: POST /v1/kms/auth/login exchanges a client credential for IAM's own JWT, and GET /v1/kms/secrets/<path>/<name>?env= returns the value scoped to the `owner` claim on that token. So the operator reads it the way every other reader does — as one IAM client, from its own environment: KMS_CLIENT_ID, KMS_CLIENT_SECRET, KMS_URL (default http://cloud.hanzo.svc:8000). The bearer is minted once and held until a margin before it expires; a 401 re-mints it and retries once, and a second 401 is an answer about authority, so it fails closed. `transport: "iam"` selects it. Zap keeps its transport and its reason for being off, and the two are fetchers behind one trait: rename, literals, secret type, ownership, the hijack guard and the SSA apply are one path, so a transport is only ever where the bytes come from. The identity stays the operator's. `credentialsRef` is refused on both transports because a CR naming one would be choosing a tenant, and `zapAddr` is ignored on iam because a CR naming the host would aim the operator's bearer at it. A path, a key or an env that could address something other than what the CR names is refused before a URL is built. The gate is KMS_PROJECTOR; the module is `kms`, since it is no longer the zap one. cargo test --lib: 362 passed, 0 failed. cargo clippy --all-targets -- -D warnings: clean. Co-authored-by: Hanzo Dev <[email protected]>
79 lines
2.8 KiB
TOML
79 lines
2.8 KiB
TOML
[workspace]
|
|
# Standalone crate — explicit empty workspace prevents inheritance from any
|
|
# stray Cargo.toml above this directory in the parent ~/work/hanzo workspace.
|
|
|
|
[package]
|
|
name = "operator"
|
|
version = "0.7.20"
|
|
edition = "2021"
|
|
license = "BSD-3-Clause"
|
|
repository = "https://github.com/hanzoai/operator"
|
|
description = "Kubernetes operator for Hanzo platform (canonical Rust impl, all universes)"
|
|
|
|
[lib]
|
|
name = "operator"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "operator"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "generate-crd-yaml"
|
|
path = "src/bin/generate_crd_yaml.rs"
|
|
|
|
[dependencies]
|
|
tokio = { version = "1.48", features = ["full"] }
|
|
async-trait = "0.1"
|
|
futures = "0.3"
|
|
|
|
# kube ↔ k8s-openapi ↔ schemars is a coherent set. kube 4 requires
|
|
# k8s-openapi ^0.28 and schemars ^1; the CustomResource derive emits
|
|
# schemars-1 JsonSchema, so our `#[derive(JsonSchema)]` must be schemars 1.
|
|
kube = { version = "4.0", features = ["runtime", "derive", "ws"] }
|
|
k8s-openapi = { version = "0.28", features = ["v1_33"] }
|
|
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
serde_yaml = "0.9"
|
|
|
|
clap = { version = "4.5", features = ["derive", "env"] }
|
|
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
thiserror = "2.0"
|
|
anyhow = "1.0"
|
|
# k8s-openapi 0.28 moved meta/v1 Time + MicroTime onto jiff::Timestamp (kube 4
|
|
# dropped chrono), so jiff is now the operator's sole timestamp library — used
|
|
# both at the k8s boundary and for the CRD-wrapper RFC3339 strings.
|
|
jiff = "0.2"
|
|
schemars = "1.0"
|
|
|
|
byteorder = "1"
|
|
base64 = "0.22"
|
|
rand = "0.9"
|
|
sha2 = "0.10"
|
|
|
|
# Native GitOps image automation. `semver` selects the newest matching image
|
|
# tag (range + `*`); `regex` backs the `regex:<pat>` policy. Both are already in
|
|
# the dependency tree (transitively, via kube / tracing-subscriber), so declaring
|
|
# them direct adds no new build — the ImageUpdate selection logic is pure over
|
|
# these and is the one place that reimplements a Flux GitOps-toolkit algorithm
|
|
# (semver image selection) natively rather than vendoring the toolkit.
|
|
semver = "1"
|
|
regex = "1"
|
|
|
|
# reqwest 0.13 replaced the old `rustls-tls` feature: `rustls` now pulls rustls
|
|
# core + the aws-lc-rs provider + rustls-platform-verifier (cert roots), so we
|
|
# no longer carry OpenSSL. `http2` keeps the h2 support 0.12 enabled by default.
|
|
reqwest = { version = "0.13", default-features = false, features = ["json", "http2", "rustls"] }
|
|
# rustls 0.23 compiles both aws-lc-rs (via reqwest) and ring (via kube) providers;
|
|
# install aws-lc-rs explicitly at startup (main.rs) to resolve the otherwise-ambiguous
|
|
# process-level CryptoProvider — rustls panics on first TLS use without this.
|
|
rustls = { version = "0.23", features = ["aws_lc_rs"] }
|
|
axum = "0.8"
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1.48", features = ["full", "test-util"] }
|