1.12 is the consensus-native KMS: it constructs a ConsensusAuthorizer at start
and refuses to run without one — 'consensus validator authority is empty
(refusing to boot fail-open)'. The refusal is right; there is no open mode by
design. But nothing provides this pod the authority snapshot the operator is
meant to drop at KMS_CONSENSUS_FILE, so the upgrade crash-looped and took the
Zoo KMS down for ~90 minutes until it was rolled back.
Adopting 1.12 needs the consensus authority provisioned first. Pinning the
generation that runs is not a preference here — it is the difference between a
KMS and a CrashLoopBackOff.
Co-authored-by: Hanzo Dev <[email protected]>
zeekayandHanzo Dev
c26e084dfa