zeekayandHanzo Dev
8c6119f357
k8s/dns is re-exported from the live zones: bridge.lux.network, the ACME TXT left for bridge, bridge-api, mpc and api.mpc, lux.chat's Azure asuid records and the GoDaddy _domainconnect CNAMEs on lux.review and lux.training are gone, and lux.build lists the AWS ingress it has pointed at since 2026-09-19. kms.lux.cloud has no AWS backend: Lux's own KMS (lux-kms-go) runs on no cluster here. kms-gen-validator-keys.sh and kms-seed.sh no longer default to it; they require KMS_API_URL, because a default that does not resolve turned every key push into a "SKIP" line. NETWORKS.yaml stops listing mpc-api.lux.network, mpc.lux.network and kms.lux.cloud for the MPC topology. explore-fe-lux and explore-fe-zoo run one replica each; with maxUnavailable 1 a rollout stopped the only pod before its replacement was Ready, and the explorer answered 503 until it was. maxUnavailable is 0 now, as applied live. Co-authored-by: Hanzo Dev <[email protected]>
86 lines
2.9 KiB
Bash
Executable File
86 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# kms-seed.sh — Export current K8s secrets into Hanzo KMS
|
|
#
|
|
# Prerequisites:
|
|
# 1. Login: KMS_API_URL=<KMS endpoint> kms login
|
|
# 2. Create project "lux-infra" in KMS dashboard
|
|
# 3. Create environments: mainnet, testnet, devnet
|
|
# 4. Set PROJECT_ID below
|
|
#
|
|
# Production: Use IAM auth (aws-iam, gcp-iam, or kubernetes)
|
|
# Development: Use kms login for interactive auth
|
|
#
|
|
# Usage: ./scripts/kms-seed.sh
|
|
set -euo pipefail
|
|
|
|
KMS_API="${KMS_API_URL:?Set KMS_API_URL to the KMS endpoint}"
|
|
PROJECT_ID="${KMS_PROJECT_ID:?Set KMS_PROJECT_ID env var}"
|
|
|
|
echo "=== Seeding KMS with existing K8s secrets ==="
|
|
echo "Project: $PROJECT_ID"
|
|
echo "API: $KMS_API"
|
|
echo
|
|
|
|
# Helper: push a secret to KMS
|
|
push_secret() {
|
|
local env="$1" path="$2" key="$3" value="$4"
|
|
KMS_API_URL="$KMS_API" kms secrets set "$key=$value" \
|
|
--projectId "$PROJECT_ID" \
|
|
--env "$env" \
|
|
--secret-path "$path" \
|
|
2>/dev/null && echo " OK: $env$path/$key" || echo " FAIL: $env$path/$key"
|
|
}
|
|
|
|
# === Staking keys ===
|
|
for net in mainnet testnet devnet; do
|
|
ns="lux-$net"
|
|
echo "--- Staking keys ($net) ---"
|
|
for i in 0 1 2 3 4; do
|
|
for type in staker signer; do
|
|
for ext in crt key; do
|
|
secret_key="${type}-${i}.${ext}"
|
|
value=$(kubectl get secret luxd-staking -n "$ns" -o jsonpath="{.data.${secret_key}}" 2>/dev/null || true)
|
|
if [ -n "$value" ]; then
|
|
# Store base64-encoded (as K8s stores them)
|
|
push_secret "$net" "/staking" "${type}_${i}_${ext}" "$value"
|
|
fi
|
|
done
|
|
done
|
|
done
|
|
done
|
|
|
|
# === Explorer DB credentials ===
|
|
echo "--- Explorer DB credentials ---"
|
|
for chain in mainnet zoo hanzo spc pars; do
|
|
for key in POSTGRES_USER POSTGRES_PASSWORD POSTGRES_DB; do
|
|
value=$(kubectl get secret "blockscout-postgres-$chain" -n lux-explorer -o jsonpath="{.data.$key}" 2>/dev/null | base64 -d 2>/dev/null || true)
|
|
if [ -n "$value" ]; then
|
|
push_secret "mainnet" "/explorer" "${chain}_${key}" "$value"
|
|
fi
|
|
done
|
|
done
|
|
|
|
# === Bridge secrets ===
|
|
echo "--- Bridge secrets ---"
|
|
for key in database-url postgres-password; do
|
|
value=$(kubectl get secret bridge-secrets -n lux-bridge -o jsonpath="{.data.$key}" 2>/dev/null | base64 -d 2>/dev/null || true)
|
|
if [ -n "$value" ]; then
|
|
push_secret "mainnet" "/bridge" "$key" "$value"
|
|
fi
|
|
done
|
|
|
|
# === Registry credentials ===
|
|
echo "--- Registry credentials ---"
|
|
dockerconfig=$(kubectl get secret ghcr-luxfi -n lux-mainnet -o jsonpath='{.data.\.dockerconfigjson}' 2>/dev/null || true)
|
|
if [ -n "$dockerconfig" ]; then
|
|
push_secret "mainnet" "/registry" ".dockerconfigjson" "$dockerconfig"
|
|
fi
|
|
|
|
echo
|
|
echo "=== Done! Now set up IAM auth for production ==="
|
|
echo "1. Go to the KMS console > Identities > Create Machine Identity"
|
|
echo "2. Add Kubernetes auth method (for in-cluster) or IAM auth"
|
|
echo "3. For K8s auth: configure service account binding"
|
|
echo "4. Apply KMSSecret CRDs:"
|
|
echo " kubectl apply -f k8s/lux-k8s/kms-secrets.yaml"
|