hip-0409

HIP-409: KMS CRD. Status Final. Hanzo architectural specification.

HIP-0409: KMS CRD

Abstract

The KMS CRD is the facade Kind for the Hanzo secrets manager (luxfi/kms; hanzoai/kms is archived). It is a Service facade with a thicker reconciler: it also produces KMSSecret cross-references and Universal-Auth credentials. See HIP-027 for the KMS design.

Specification

Group + version

hanzo.ai/v1, plural kmsapps, shortname kms.

Spec fields

Same shape as Service (HIP-400). Conventionally:

• image.repository: ghcr.io/luxfi/kms
• ports: containerPort: 8080 (HTTP), containerPort: 9000 (metrics)
• mounts kms-encryption-key for at-rest encryption — the bootstrap set, and

deliberately not a database connection string: the store keeps per-org encrypted files (HIP-1134), so there is no separate database to bootstrap (HIP-0027 §KMS's Own Secrets, HIP-0144)

Example CR

apiVersion: hanzo.ai/v1
kind: KMS
metadata:
  name: kms
  namespace: hanzo
spec:
  image:
    repository: ghcr.io/luxfi/kms
    tag: v2.4.1
  replicas: 2
  ports:
    - name: http
      containerPort: 8080
      servicePort: 80
  envFrom:
    - secretRef:
        name: kms-secrets
  readinessProbe:
    path: /healthz
    port: 8080

Generated K8s resources

Deployment, Service. KMS itself exposes a CRD (KMSSecret) that any other Service can reference via spec.kmsSecrets.

Operator reconciler

~/work/hanzo/operator/src/controllers/service.rs (via KMS facade).

Related services

• HIP-0027 (KMS standard)
• All services depend on KMS for secret resolution.

Status

Implemented in hanzoai/operator v0.3.0+. CR kms active in cluster.