hip-0409

HIP-409: KMS CRD. Status Active. Hanzo's own standard — read this before implementing against it.

HIP-0409: KMS CRD

Abstract

The KMS CRD is the facade Kind for the Hanzo secrets manager (hanzoai/kms). It is a Service facade with a thicker reconciler: it also produces KMSSecret cross-references and Universal-Auth credentials. See HIP-027 for the KMS design.

Specification

Group + version

hanzo.ai/v1, plural kmsapps, shortname kms.

Spec fields

Same shape as Service (HIP-400). Conventionally:

• image.repository: ghcr.io/hanzoai/kms
• ports: containerPort: 8080 (HTTP), containerPort: 9000 (metrics)
• mounts kms-postgres secret for backing DB
• mounts kms-encryption-key secret for at-rest encryption

Example CR

apiVersion: hanzo.ai/v1
kind: KMS
metadata:
  name: kms
  namespace: hanzo
spec:
  image:
    repository: ghcr.io/hanzoai/kms
    tag: v2.4.1
  replicas: 2
  ports:
    - name: http
      containerPort: 8080
      servicePort: 80
  envFrom:
    - secretRef:
        name: kms-secrets
  readinessProbe:
    path: /api/status
    port: 8080

Generated K8s resources

Deployment, Service. KMS itself exposes a CRD (KMSSecret) that any other Service can reference via spec.kmsSecrets.

Operator reconciler

~/work/hanzo/operator/src/controllers/service.rs (via KMS facade).

Related services

• HIP-0027 (KMS standard)
• All services depend on KMS for secret resolution.

Status

Implemented in hanzoai/operator v0.3.0+. CR kms active in cluster.