zeekay
6f461b102f
* scripts/kms-crd-host-migrate.sh — bulk-patch every KMSSecret CRD's
hostAPI to point at kms.lux-kms-go.svc.cluster.local. Idempotent.
Already executed against lux-k8s + hanzo-k8s (147 CRDs).
* scripts/kms-orphan-audit.sh — audit which K8s Secrets are NOT backed
by a KMSSecret CRD or whitelisted bootstrap creds. Output:
lux-k8s 323 non-system Secrets, 268 orphan
hanzo-k8s 461 non-system Secrets, 367 orphan
Most orphans are ARC runner state, cert-manager cert content, and
operator-internal config — not appropriate for KMS migration.
Run before sweeping anything.
47 lines
1.7 KiB
Bash
Executable File
47 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Audit K8s Secrets that are NOT (a) backed by a KMSSecret CRD,
|
|
# (b) system secrets, (c) TLS, (d) image pull, (e) Helm release.
|
|
set -uo pipefail
|
|
|
|
audit_cluster() {
|
|
local ctx=$1
|
|
echo "=========== ${ctx} ==========="
|
|
|
|
# All KMSSecret-managed K8s Secret refs (managed by operator)
|
|
local managed
|
|
managed=$(kubectl --context "${ctx}" get kmssecrets -A \
|
|
-o jsonpath='{range .items[*]}{.spec.managedSecretReference.secretNamespace}{"/"}{.spec.managedSecretReference.secretName}{"\n"}{end}' \
|
|
2>/dev/null | sort -u)
|
|
echo " KMSSecret-managed targets: $(echo "$managed" | grep -c .)"
|
|
|
|
# All K8s Secrets, excluding system types
|
|
local all
|
|
all=$(kubectl --context "${ctx}" get secrets -A \
|
|
--field-selector type!=kubernetes.io/service-account-token \
|
|
--field-selector type!=kubernetes.io/dockerconfigjson \
|
|
--field-selector type!=kubernetes.io/tls \
|
|
--field-selector type!=helm.sh/release.v1 \
|
|
-o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{"\n"}{end}' \
|
|
2>/dev/null | sort -u)
|
|
local total
|
|
total=$(echo "$all" | grep -c .)
|
|
echo " Non-system Secrets total: ${total}"
|
|
|
|
# Orphans = in all but not managed and not whitelisted
|
|
local orphans
|
|
orphans=$(comm -23 <(echo "$all") <(echo "$managed") \
|
|
| grep -vE '^[^/]+/(universal-auth-credentials|ghcr-luxfi|ghcr-secret|ghcr-zoo|kms-machine-identity)$' \
|
|
| grep -vE 'sh\.helm\.release')
|
|
local count
|
|
count=$(echo "$orphans" | grep -c . || true)
|
|
echo " Orphan Secrets (no KMSSecret CRD backing, not bootstrap creds): ${count}"
|
|
if [ "$count" != "0" ] && [ -n "$orphans" ]; then
|
|
echo " Sample (first 10):"
|
|
echo "$orphans" | head -10 | sed 's/^/ /'
|
|
fi
|
|
}
|
|
|
|
for ctx in lux-k8s hanzo-k8s; do
|
|
audit_cluster "$ctx"
|
|
done
|