mirror of https://github.com/hanzokms/cli.git synced 2026-10-30 20:30:00 +00:00

Files

T

zeekayandHanzo Dev 8f643abe3b kms-cli holds no Kubernetes client

Two call sites, two different reasons they were wrong.

`bootstrap --output k8-secret` dialled the cluster and created-or-updated a
corev1.Secret from a Go template. Nothing invokes it — zero references across
hanzo/kms, hanzo/kms-operator and hanzo/universe — and writing per-service
Secrets is the kms-operator's job, not a CLI's. Deleted, along with --output
and the three --k8-secret-* flags: one legal output value is not a choice.

`pam kubernetes access` never dialled a cluster at all. It used clientcmd to
splice a cluster/user/context into the operator's own ~/.kube/config, flip
current-context, and revert on shutdown. It now writes a self-contained session
kubeconfig (0600, removed on shutdown) and prints KUBECONFIG=<path>. That is a
net code decrease — the whole revert block goes — and it closes the three TODOs
the original left admitting it took no lock: a SIGKILLed proxy or two concurrent
sessions could leave the real kubeconfig pointing at a dead port. It is never
read or written now.

Verified by rendering one and running kubectl config view --minify against it,
which resolves only if current-context, cluster and user cross-reference.

go.mod loses every k8s.io/* entry (-30 go.mod, -65 go.sum).

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-05 19:05:02 -07:00

1.8 KiB

Raw Permalink Blame History

LLM.md - Hanzo Kms Cli

Overview

Go module: github.com/hanzokms/cli

Tech Stack

Language: Go

Build & Run

go build ./...
go test ./...

Structure

kms-cli/
  CODE_OF_CONDUCT.md
  CONTRIBUTING.md
  LICENSE
  README.md
  agent-config.yaml
  certificate-agent-config.yaml
  detect/
  docker/
  e2e/
  go.mod
  go.sum
  goreleaser.dockerfile
  kms-cli.repo
  main.go
  npm/

Key Files

README.md -- Project documentation
go.mod -- Go module definition

No Kubernetes client

The CLI links zero k8s.io/* packages. Cluster access belongs to the controllers that reconcile cluster objects (kms-operator and friends); a developer CLI is not one. Verify with grep -rn --include='*.go' '"k8s.io/' . | grep -v vendor (must be empty).

Two call sites used to link it:

kms bootstrap --output k8-secret (removed). It dialled the cluster with rest.InClusterConfig and created/updated a Secret from a Go template. Nothing invoked it — no chart, manifest, or script in hanzo/kms, hanzo/kms-operator, or hanzo/universe referenced k8-secret — and writing per-service Secrets is the kms-operator's job. bootstrap now prints its JSON response, so --output, --k8-secret-template, --k8-secret-name and --k8-secret-namespace are gone.
kms pam kubernetes access kubeconfig handling (rewritten). It used clientcmd to splice a cluster/context into the user's ~/.kube/config, flip current-context, and revert on shutdown — file surgery, never a cluster dial, and carrying three TODOs admitting it took no lock. It now writes a self-contained session kubeconfig (0600, temp file, removed on shutdown) and prints export KUBECONFIG=<path>. The user's own kubeconfig is never read or written, so a SIGKILLed proxy or two concurrent sessions can no longer leave it pointing at a dead port.

1.8 KiB Raw Permalink Blame History