controllers

Documentation

Overview

Package controllers/kmssecret_helper.go: read-side reconciler.

The reconciler:

1. Loads (or reuses) a kmsapi.Client per CR UID.
2. Resolves universalAuth credentials (the only supported strategy) and mints a bearer token via cached login.
3. Fetches every key listed in secretsScope.keys via single-secret GETs.
4. Empty-fetch fail-closed: refuses to project an empty Secret.
5. Applies the templating engine and writes / updates the managed Kubernetes Secret(s) and ConfigMap(s).

Removed (forward break):

• service-token / service-account auth (no canonical surface).
• kubernetes/AWS IAM/Azure/GCP machine-identity auth (no canonical surface — restore only when kmsd grows the routes).
• github.com/luxfi/kms-go SDK dep.

Index

• Constants
• type IdentityEnsurer
• type KMSSecretReconciler
  • func (r *KMSSecretReconciler) GetLogger(req ctrl.Request) logr.Logger
  • func (r *KMSSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
  • func (r *KMSSecretReconciler) ReconcileKMSSecret(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, ...) (int, error)
  • func (r *KMSSecretReconciler) SetKMSAutoRedeploymentReady(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, ...)
  • func (r *KMSSecretReconciler) SetKMSTokenLoadCondition(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, ...)
  • func (r *KMSSecretReconciler) SetReadyToSyncSecretsConditions(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, ...)
  • func (r *KMSSecretReconciler) SetupWithManager(mgr ctrl.Manager) error

Constants

const FINALIZER_NAME = "secrets.finalizers.lux.network"

Types

type IdentityEnsurer

type IdentityEnsurer interface {
	EnsureServiceIdentity(ctx context.Context, ref bootstrap.MnemonicRef, servicePath string) (string, error)
}

IdentityEnsurer is the seam the bootstrap.Reconciler implements. The KMSSecret reconciler calls EnsureServiceIdentity at the top of every pass so the consumer's mnemonic + NodeID is in place before any KMS request goes out — guaranteeing the consumer can authenticate to the kmsd ZAP server on first successful fetch.

type KMSSecretReconciler

type KMSSecretReconciler struct {
	client.Client
	BaseLogger logr.Logger
	Scheme     *runtime.Scheme

	// IdentityEnsurer guarantees a mnemonic Secret + derived NodeID
	// exists for the CR's consumer. May be nil in tests; production
	// wiring passes a bootstrap.Reconciler.
	IdentityEnsurer IdentityEnsurer

	// DefaultMnemonicNamespace is the fallback namespace for
	// per-service mnemonic Secrets when the CR's
	// spec.mnemonicSecretRef.secretNamespace is empty. Defaults to
	// "hanzo" via the bootstrap config.
	DefaultMnemonicNamespace string
}

KMSSecretReconciler reconciles a KMSSecret object

func (*KMSSecretReconciler) GetLogger

func (r *KMSSecretReconciler) GetLogger(req ctrl.Request) logr.Logger

func (*KMSSecretReconciler) Reconcile

func (r *KMSSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

func (*KMSSecretReconciler) ReconcileKMSSecret

func (r *KMSSecretReconciler) ReconcileKMSSecret(
	ctx context.Context,
	logger logr.Logger,
	kmsSecret *secretsv1.KMSSecret,
	managedKubeSecretReferences []secretsv1.ManagedKubeSecretConfig,
	managedKubeConfigMapReferences []secretsv1.ManagedKubeConfigMapConfig,
) (int, error)

ReconcileKMSSecret runs the full read+project pipeline for a single KMSSecret CR.

func (*KMSSecretReconciler) SetKMSAutoRedeploymentReady

func (r *KMSSecretReconciler) SetKMSAutoRedeploymentReady(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, numDeployments int, errorToConditionOn error)

func (*KMSSecretReconciler) SetKMSTokenLoadCondition

func (r *KMSSecretReconciler) SetKMSTokenLoadCondition(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, authStrategy util.AuthStrategyType, errorToConditionOn error)

func (*KMSSecretReconciler) SetReadyToSyncSecretsConditions

func (r *KMSSecretReconciler) SetReadyToSyncSecretsConditions(ctx context.Context, logger logr.Logger, kmsSecret *secretsv1.KMSSecret, secretsCount int, errorToConditionOn error)

func (*KMSSecretReconciler) SetupWithManager

func (r *KMSSecretReconciler) SetupWithManager(mgr ctrl.Manager) error