mirror of
https://github.com/hanzokms/cli.git
synced 2026-10-30 20:30:00 +00:00
zeekayandHanzo Dev
8f643abe3b
Two call sites, two different reasons they were wrong. `bootstrap --output k8-secret` dialled the cluster and created-or-updated a corev1.Secret from a Go template. Nothing invokes it — zero references across hanzo/kms, hanzo/kms-operator and hanzo/universe — and writing per-service Secrets is the kms-operator's job, not a CLI's. Deleted, along with --output and the three --k8-secret-* flags: one legal output value is not a choice. `pam kubernetes access` never dialled a cluster at all. It used clientcmd to splice a cluster/user/context into the operator's own ~/.kube/config, flip current-context, and revert on shutdown. It now writes a self-contained session kubeconfig (0600, removed on shutdown) and prints KUBECONFIG=<path>. That is a net code decrease — the whole revert block goes — and it closes the three TODOs the original left admitting it took no lock: a SIGKILLed proxy or two concurrent sessions could leave the real kubeconfig pointing at a dead port. It is never read or written now. Verified by rendering one and running kubectl config view --minify against it, which resolves only if current-context, cluster and user cross-reference. go.mod loses every k8s.io/* entry (-30 go.mod, -65 go.sum). Co-authored-by: Hanzo Dev <[email protected]>