mirror of
https://github.com/hanzokms/csi-provider.git
synced 2026-10-30 20:50:44 +00:00
zeekayandHanzo Dev
ee7665a0fd
The official golang images set GOTOOLCHAIN=local. A floating golang:1.26 tag
that resolves one patch behind the `go` directive in go.mod therefore kills the
container build outright:
go: go.mod requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)
This already shipped as a live failure in hanzoai/visor v1.108.16. go.mod here
declares go 1.26.4 against a floating tag, so the repo is one go.mod patch bump
away from the same break.
Two orthogonal changes:
- pin the base to golang:1.26.5 -> hermetic; the image and the
directive always agree, nothing to download.
- ENV GOTOOLCHAIN=auto -> resilient; if go.mod later moves
past the pin, the toolchain is fetched (checksum-verified via sum.golang.org)
instead of hard-failing. This is what stops the class recurring.
The `go` directive in go.mod is deliberately unchanged: a newer toolchain
building an older directive is always valid, and raising the directive would
propagate a floor to every consumer.
Verified: golang:1.26.5 exists and today resolves to the same digest as
golang:1.26 (sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647),
so the pin is behavior-neutral right now. go build ./... and go vet ./... pass
locally on go1.26.5 (the repo has no test files).
Co-authored-by: Hanzo Dev <[email protected]>
Hanzo KMS Provider for Secrets Store CSI Driver
Hanzo KMS provider for the Secrets Store CSI driver will allow you to mount Hanzo KMS secrets directly into your Kubernetes pods while maintaining secret-zero in your Kubernetes cluster.
Installation
Prerequisites
- Kubernetes version >= 1.20
- Secrets store CSI driver installed with
tokenRequestsaudience configured - Kubernetes service account configured for native authentication with Hanzo KMS
Using helm (Recommended)
helm repo add kms-helm-charts 'https://dl.cloudsmith.io/public/hanzokms/helm-charts/helm/charts'
helm repo update
helm install kms-csi-provider kms-helm-charts/kms-csi-provider
Using yaml
You can also install using the deployment config in the deployment folder:
kubectl apply -f deployment/kms-csi-provider.deployment.yaml
Usage
For guidance, refer to the official documentation here.
Troubleshooting
To troubleshoot issues with the Hanzo KMS CSI provider, refer to the logs of the Hanzo KMS CSI provider running on the same node as your pod.
kubectl logs kms-csi-provider-7x44t
You can also refer to the logs of the secrets store CSI driver. Modify the command below with the appropriate pod and namespace of your secrets store CSI driver installation.
kubectl logs csi-secrets-store-csi-driver-7h4jp -n=kube-system