A Kubernetes operator that bridges Hardware Security Module (HSM) data storage with Kubernetes Secrets, providing true secret portability th
fix helm deploy
+1
-56
-53
Dockerfile.alpine
-53
Dockerfile.alpine
···
1
-
# Production Dockerfile with real PKCS#11 support
2
-
# Build the manager and agent binaries with CGO enabled
3
-
FROM golang:1.24-alpine AS builder
4
-
ARG TARGETOS
5
-
ARG TARGETARCH
6
-
7
-
# Install build dependencies for PKCS#11 and USB event monitoring
8
-
RUN apk add --no-cache \
9
-
gcc \
10
-
g++ \
11
-
eudev-dev \
12
-
linux-headers
13
-
14
-
# Return to workspace for Go builds
15
-
WORKDIR /workspace
16
-
17
-
# Copy the Go Modules manifests
18
-
COPY go.mod go.mod
19
-
COPY go.sum go.sum
20
-
# cache deps before building and copying source so that we don't need to re-download as much
21
-
# and so that source changes don't invalidate our downloaded layer
22
-
RUN go mod download
23
-
24
-
COPY cmd/ cmd/
25
-
COPY api/ api/
26
-
COPY internal/ internal/
27
-
COPY web/ web/
28
-
29
-
# Build unified binary with CGO enabled for PKCS#11 support (agent mode needs it)
30
-
RUN CGO_ENABLED=1 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o hsm-operator cmd/hsm-operator/main.go
31
-
32
-
FROM alpine:3.22
33
-
RUN apk add --no-cache opensc-dev ccid pcsc-lite openssl libtool libusb ca-certificates eudev
34
-
35
-
WORKDIR /
36
-
COPY --from=builder /workspace/hsm-operator .
37
-
COPY --from=builder /workspace/web ./web/
38
-
COPY entrypoint.sh /entrypoint.sh
39
-
RUN chmod +x /entrypoint.sh
40
-
41
-
# Create USB device access groups and add user to them
42
-
RUN addgroup -g 20 dialout && \
43
-
adduser 65532 dialout && \
44
-
addgroup -g 85 usb 2>/dev/null || true && \
45
-
adduser 65532 usb 2>/dev/null || true
46
-
47
-
RUN mkdir -p /var/run/pcscd /var/lock/pcsc && \
48
-
chown -R 65532:65532 /var/run/pcscd /var/lock/pcsc && \
49
-
chmod 755 /var/run/pcscd /var/lock/pcsc
50
-
51
-
USER 65532:65532
52
-
53
-
ENTRYPOINT ["/entrypoint.sh"]
+1
-3
helm/hsm-secrets-operator/templates/deployment.yaml
+1
-3
helm/hsm-secrets-operator/templates/deployment.yaml
···
39
39
- name: manager
40
40
image: {{ include "hsm-secrets-operator.image" . }}
41
41
imagePullPolicy: {{ .Values.image.pullPolicy }}
42
-
command:
43
-
- /entrypoint.sh
44
-
- manager
45
42
args:
43
+
- --mode=manager
46
44
- --leader-elect={{ .Values.leaderElection.enabled }}
47
45
{{- if .Values.config.verboseLogging }}
48
46
- --zap-log-level=debug