zeekayandHanzo AI
d355c4f44c
lux.cloud maps org sdm to NodeID-Dwsrq..., which is foundation pod luxd-4 — a name pointed at someone else's node. luxd-5 carries SDM's own identity, minted with `lux key staker` and held in KMS under env mainnet path staking. The pod is an ordinary peer; bonding it is a separate decision. The image digest beside tag v1.36.68 was v1.36.58's. The chart renders repo:tag@digest and pulls by digest, so the next pod created would have run v1.36.58 under a v1.36.68 label. Corrected to the digest the five pods actually report. Index 5 joins the KMSSecret key list: under creationPolicy Owner an unlisted key is a dropped key. Co-authored-by: Hanzo Dev <[email protected]>
163 lines
5.2 KiB
YAML
163 lines
5.2 KiB
YAML
# KMSSecret sync CRs — luxd node identity (staking TLS + BLS signer keys).
|
|
#
|
|
# Source of truth: kms.lux.cloud. That hostname now resolves to the lux-k8s
|
|
# instance — namespace `lux-kms-go`, statefulset `kms`, ghcr.io/luxfi/kms
|
|
# v1.12.13, on a retained 5Gi PVC. It is a store of its own, not the
|
|
# hanzo-k8s one that also answers kms.hanzo.ai, and the two hold different
|
|
# keyspaces; read back what you expect before trusting either. Storage
|
|
# coordinates: org `lux` (= the universal-auth credential's `owner` claim —
|
|
# the org rides the TOKEN, not the URL), env {mainnet,testnet,devnet},
|
|
# path `staking` (NO leading slash server-side; the operator normalises),
|
|
# names `staker-N.crt`, `staker-N.key`, `signer-N.key.b64`.
|
|
#
|
|
# Binary convention: the BLS signer key is raw 32 bytes, which cannot ride a
|
|
# JSON string. It is stored base64-encoded under `signer-N.key.b64`; the
|
|
# kms-operator (>= v0.4.2) strips the suffix and decodes on projection, so the
|
|
# managed `luxd-staking` Secret carries `signer-N.key` with the exact bytes
|
|
# the luxd startup scripts already consume. Nothing else changes shape.
|
|
#
|
|
# luxfi/kms has no list endpoint — `keys` MUST enumerate every name.
|
|
#
|
|
# ROLLOUT GATE (both required BEFORE these CRs reconcile):
|
|
# 1. ghcr.io/luxfi/kms >= v1.12.11 rolled on hanzo-k8s hanzo/kms
|
|
# (adds the org-less /v1/kms/secrets tenant surface the operator speaks)
|
|
# 2. ghcr.io/hanzoai/kms-operator >= v0.4.2 rolled in kms-operator-system
|
|
# (tenant surface client + *.b64 decode-on-projection)
|
|
# Until both are live the operator fails CLOSED (no projection, existing
|
|
# Secret untouched) — the same posture the fleet ran on since April.
|
|
#
|
|
# lux-mainnet: manifest is canonical here but `kubectl apply` is gated on the
|
|
# mainnet change-freeze owner; testnet/devnet apply freely.
|
|
---
|
|
apiVersion: secrets.lux.network/v1alpha1
|
|
kind: KMSSecret
|
|
metadata:
|
|
name: luxd-staking-kms-sync
|
|
namespace: lux-mainnet
|
|
spec:
|
|
hostAPI: https://kms.lux.cloud
|
|
resyncInterval: 300
|
|
authentication:
|
|
universalAuth:
|
|
credentialsRef:
|
|
secretName: universal-auth-credentials
|
|
secretNamespace: lux-mainnet
|
|
secretsScope:
|
|
projectSlug: lux
|
|
envSlug: mainnet
|
|
secretsPath: /staking
|
|
keys:
|
|
- staker-0.crt
|
|
- staker-0.key
|
|
- signer-0.key.b64
|
|
- staker-1.crt
|
|
- staker-1.key
|
|
- signer-1.key.b64
|
|
- staker-2.crt
|
|
- staker-2.key
|
|
- signer-2.key.b64
|
|
- staker-3.crt
|
|
- staker-3.key
|
|
- signer-3.key.b64
|
|
- staker-4.crt
|
|
- staker-4.key
|
|
- signer-4.key.b64
|
|
# Index 5 is SDM's own node identity, minted 2026-08-13. It must be
|
|
# listed here or a reconcile under creationPolicy Owner would project
|
|
# a luxd-staking holding only 0-4 and take luxd-5's identity with it.
|
|
- staker-5.crt
|
|
- staker-5.key
|
|
- signer-5.key.b64
|
|
managedKubeSecretReferences:
|
|
- secretName: luxd-staking
|
|
secretNamespace: lux-mainnet
|
|
secretType: Opaque
|
|
creationPolicy: Owner
|
|
---
|
|
apiVersion: secrets.lux.network/v1alpha1
|
|
kind: KMSSecret
|
|
metadata:
|
|
name: luxd-staking-kms-sync
|
|
namespace: lux-testnet
|
|
spec:
|
|
hostAPI: https://kms.lux.cloud
|
|
resyncInterval: 300
|
|
authentication:
|
|
universalAuth:
|
|
credentialsRef:
|
|
secretName: universal-auth-credentials
|
|
secretNamespace: lux-testnet
|
|
secretsScope:
|
|
projectSlug: lux
|
|
envSlug: testnet
|
|
secretsPath: /staking
|
|
keys:
|
|
- staker-0.crt
|
|
- staker-0.key
|
|
- signer-0.key.b64
|
|
- staker-1.crt
|
|
- staker-1.key
|
|
- signer-1.key.b64
|
|
- staker-2.crt
|
|
- staker-2.key
|
|
- signer-2.key.b64
|
|
- staker-3.crt
|
|
- staker-3.key
|
|
- signer-3.key.b64
|
|
- staker-4.crt
|
|
- staker-4.key
|
|
- signer-4.key.b64
|
|
managedKubeSecretReferences:
|
|
- secretName: luxd-staking
|
|
secretNamespace: lux-testnet
|
|
secretType: Opaque
|
|
creationPolicy: Owner
|
|
---
|
|
apiVersion: secrets.lux.network/v1alpha1
|
|
kind: KMSSecret
|
|
metadata:
|
|
name: luxd-staking-kms-sync
|
|
namespace: lux-devnet
|
|
spec:
|
|
hostAPI: https://kms.lux.cloud
|
|
resyncInterval: 300
|
|
authentication:
|
|
universalAuth:
|
|
credentialsRef:
|
|
secretName: universal-auth-credentials
|
|
secretNamespace: lux-devnet
|
|
secretsScope:
|
|
projectSlug: lux
|
|
envSlug: devnet
|
|
secretsPath: /staking
|
|
keys:
|
|
- staker-0.crt
|
|
- staker-0.key
|
|
- signer-0.key.b64
|
|
- staker-1.crt
|
|
- staker-1.key
|
|
- signer-1.key.b64
|
|
- staker-2.crt
|
|
- staker-2.key
|
|
- signer-2.key.b64
|
|
- staker-3.crt
|
|
- staker-3.key
|
|
- signer-3.key.b64
|
|
- staker-4.crt
|
|
- staker-4.key
|
|
- signer-4.key.b64
|
|
- staker-5.crt
|
|
- staker-5.key
|
|
- signer-5.key.b64
|
|
- staker-6.crt
|
|
- staker-6.key
|
|
- signer-6.key.b64
|
|
- staker-7.crt
|
|
- staker-7.key
|
|
- signer-7.key.b64
|
|
managedKubeSecretReferences:
|
|
- secretName: luxd-staking
|
|
secretNamespace: lux-devnet
|
|
secretType: Opaque
|
|
creationPolicy: Owner
|