diff --git a/charts/kms-core/README.md b/charts/kms-core/README.md index 6d8d8fd0d2..68c42c45e6 100644 --- a/charts/kms-core/README.md +++ b/charts/kms-core/README.md @@ -15,14 +15,3 @@ To pull and install the OCI Helm chart from hub.zama.ai: helm registry login hub.zama.ai helm install kms oci://hub.zama.ai/zama-protocol/zama-ai/kms/charts/kms-core - -## Local testing - -When `minio.enabled=true`, connect to minio UI on http://localhost:9001: - - kubectl port-forward svc/minio 9001 - -Interact with the bucket using the `aws` CLI: - - kubectl port-forward svc/minio 9000 - AWS_ACCESS_KEY_ID=kms-access-key-id AWS_SECRET_ACCESS_KEY=kms-secret-access-key aws --endpoint-url http://localhost:9000 --region eu-west-1 s3 ls s3://kms-public diff --git a/charts/kms-core/templates/_helpers.tpl b/charts/kms-core/templates/_helpers.tpl index b65f779a2b..c40e9239b0 100644 --- a/charts/kms-core/templates/_helpers.tpl +++ b/charts/kms-core/templates/_helpers.tpl @@ -152,17 +152,11 @@ export KMS_CORE__BACKUP_VAULT__KEYCHAIN__AWS_KMS__ROOT_KEY_SPEC="${KMS_CORE__BAC {{- end }} {{- if $.Values.kmsCore.thresholdMode.tls.enabled }} # Fetch CA certificates for all peers (needed for peer verification) -# In minio/localstack context: CORE_CLIENT__S3_ENDPOINT is just the endpoint, need to add bucket -# In AWS context: CORE_CLIENT__S3_ENDPOINT already contains the bucket path -{{- if $.Values.minio.enabled }} -S3_BASE_URL="${CORE_CLIENT__S3_ENDPOINT}/{{ .Values.kmsCore.publicVault.s3.bucket }}" -{{- else }} S3_BASE_URL="${CORE_CLIENT__S3_ENDPOINT}" -{{- end }} echo "Fetching TLS certificates from S3 base URL: ${S3_BASE_URL}" {{- range .Values.kmsCore.thresholdMode.peersList }} -{{- if or $.Values.minio.enabled (not $.Values.kmsCore.nitroEnclave.enabled) }} -# For minio/localstack or non-enclave threshold: use direct path to cert.pem +{{- if not $.Values.kmsCore.nitroEnclave.enabled }} +# For non-enclave threshold: use direct path to cert.pem CERT_PATH="PUB-p{{ .id }}/CACert/cert.pem" echo "Fetching CA cert for party {{ .id }} from: ${S3_BASE_URL}/${CERT_PATH}" # Retry logic: wait for certificate to appear (for parallel deployments) @@ -199,8 +193,8 @@ fi {{- end }} {{- end }} # Fetch private key only for this party (party {{ .Values.kmsPeers.id }}) -{{- if or $.Values.minio.enabled (not $.Values.kmsCore.nitroEnclave.enabled) }} -# For minio/localstack or non-enclave threshold: use direct path to key.pem +{{- if not $.Values.kmsCore.nitroEnclave.enabled }} +# For non-enclave threshold: use direct path to key.pem KEY_PATH="PUB-p{{ .Values.kmsPeers.id }}/PrivateKey/key.pem" echo "Fetching private key from: ${S3_BASE_URL}/${KEY_PATH}" # Retry logic: wait for private key to appear (for parallel deployments) diff --git a/charts/kms-core/templates/kms-core-client-cronjob.yaml b/charts/kms-core/templates/kms-core-client-cronjob.yaml index 1aeb1bb970..7f4186edfa 100644 --- a/charts/kms-core/templates/kms-core-client-cronjob.yaml +++ b/charts/kms-core/templates/kms-core-client-cronjob.yaml @@ -21,13 +21,8 @@ spec: - name: kms-core-client image: {{ .Values.kmsCoreClient.image.name }}:{{ .Values.kmsCoreClient.image.tag }} env: - {{ if .Values.minio.enabled }} - - name: S3_ENDPOINT - value: "{{ .Values.minio.endpoint }}/{{ .Values.kmsCore.publicVault.s3.bucket }}/{{ .Values.kmsCore.publicVault.s3.path }}" - {{ else }} - name: S3_ENDPOINT value: "https://{{ .Values.kmsCore.publicVault.s3.bucket }}.s3.{{ .Values.kmsCore.aws.region }}.amazonaws.com" - {{ end }} - name: NUM_MAJORITY value: '{{ .Values.kmsCoreClient.num_majority | int }}' - name: NUM_RECONSTRUCT diff --git a/charts/kms-core/templates/kms-core-client-statefulset.yaml b/charts/kms-core/templates/kms-core-client-statefulset.yaml index ab57582895..e51e47c5c2 100644 --- a/charts/kms-core/templates/kms-core-client-statefulset.yaml +++ b/charts/kms-core/templates/kms-core-client-statefulset.yaml @@ -23,13 +23,8 @@ spec: - name: kms-core-client image: {{ .Values.kmsCoreClient.image.name }}:{{ .Values.kmsCoreClient.image.tag }} env: - {{- if .Values.minio.enabled }} - - name: S3_ENDPOINT - value: "{{ .Values.minio.endpoint }}/{{ .Values.kmsCore.publicVault.s3.bucket }}" - {{- else }} - name: S3_ENDPOINT value: "https://{{ .Values.kmsCore.publicVault.s3.bucket }}.s3.{{ .Values.kmsCore.aws.region }}.amazonaws.com" - {{- end }} - name: NUM_MAJORITY value: '{{ .Values.kmsCoreClient.num_majority | int }}' - name: NUM_RECONSTRUCT @@ -40,11 +35,9 @@ spec: value: '{{ .Values.kmsCoreClient.fhe_parameter | quote }}' command: - /app/load-core-client-config.sh - {{- if not .Values.minio.enabled }} envFrom: - configMapRef: name: {{ .Values.kmsCoreClient.envFrom.configmap.name }} - {{- end }} volumeMounts: - mountPath: /app/load-core-client-config.sh subPath: load-core-client-config.sh diff --git a/charts/kms-core/templates/kms-core-configmap.yaml b/charts/kms-core/templates/kms-core-configmap.yaml index c46eb29889..82faf04cdd 100644 --- a/charts/kms-core/templates/kms-core-configmap.yaml +++ b/charts/kms-core/templates/kms-core-configmap.yaml @@ -15,20 +15,16 @@ data: aws.toml: | [aws] region = "${AWS_REGION}" - {{- if .Values.minio.enabled }} - s3_endpoint = "{{ .Values.minio.endpoint }}" - {{- else }} role_arn = "${AWS_ROLE_ARN}" - {{- if .Values.kmsCore.nitroEnclave.enabled }} - {{- if .Values.kmsCore.nitroEnclave.ports.imds }} + {{- if .Values.kmsCore.nitroEnclave.enabled }} + {{- if .Values.kmsCore.nitroEnclave.ports.imds }} imds_endpoint = "http://localhost:{{ .Values.kmsCore.nitroEnclave.ports.imds }}" - {{- end }} - {{- if .Values.kmsCore.nitroEnclave.ports.sts }} + {{- end }} + {{- if .Values.kmsCore.nitroEnclave.ports.sts }} sts_endpoint = "https://localhost:{{ .Values.kmsCore.nitroEnclave.ports.sts }}" - {{- end }} + {{- end }} s3_endpoint = "https://localhost:{{ .Values.kmsCore.nitroEnclave.ports.s3 }}" awskms_endpoint = "https://localhost:{{ .Values.kmsCore.nitroEnclave.ports.awskms }}" - {{- end }} {{- end }} vaults.toml: | {{- if .Values.kmsCore.publicVault.s3.enabled }} diff --git a/charts/kms-core/templates/kms-core-statefulset.yaml b/charts/kms-core/templates/kms-core-statefulset.yaml index 64cd8a60af..d69e4bcc87 100644 --- a/charts/kms-core/templates/kms-core-statefulset.yaml +++ b/charts/kms-core/templates/kms-core-statefulset.yaml @@ -78,7 +78,7 @@ spec: value: {{ .Values.runMode }} - name: RUST_LOG value: {{ .Values.rustLog }} - {{- if and .Values.kmsCore.envFrom.configmap.name (not .Values.minio.enabled) }} + {{- if .Values.kmsCore.envFrom.configmap.name }} - name: CORE_CLIENT__S3_ENDPOINT valueFrom: configMapKeyRef: @@ -135,12 +135,6 @@ spec: key: {{ .Values.kmsCore.envFrom.configmap.key.backupVaultKeychainAWSKMSRootKeySpec }} {{- end }} {{- else }} - - name: AWS_ACCESS_KEY_ID - value: {{ .Values.minio.username}} - - name: AWS_SECRET_ACCESS_KEY - value: {{ .Values.minio.password}} - - name: CORE_CLIENT__S3_ENDPOINT - value: {{ .Values.minio.endpoint }} - name: KMS_CORE__PRIVATE_VAULT__STORAGE__S3__BUCKET value: {{ .Values.kmsCore.privateVault.s3.bucket | quote }} {{- if .Values.kmsCore.privateVault.s3.prefix }} @@ -316,9 +310,6 @@ spec: env echo "generating keys" kms-gen-keys --cmd signing-keys \ - {{- if .Values.minio.enabled }} - --aws-s3-endpoint {{ .Values.minio.endpoint }} \ - {{- end }} --aws-region {{ .Values.kmsCore.aws.region }} \ {{- if .Values.kmsCore.publicVault.s3.enabled }} --public-storage s3 \ @@ -379,7 +370,7 @@ spec: value: {{ .Values.runMode }} - name: RUST_LOG value: {{ .Values.rustLog }} - {{- if and .Values.kmsCore.envFrom.configmap.name (not .Values.minio.enabled) }} + {{- if .Values.kmsCore.envFrom.configmap.name }} - name: KMS_CORE__PRIVATE_VAULT__STORAGE__S3__BUCKET valueFrom: configMapKeyRef: @@ -431,12 +422,6 @@ spec: key: {{ .Values.kmsCore.envFrom.configmap.key.backupVaultKeychainAWSKMSRootKeySpec }} {{- end }} {{- else }} - - name: AWS_ACCESS_KEY_ID - value: {{ .Values.minio.username}} - - name: AWS_SECRET_ACCESS_KEY - value: {{ .Values.minio.password}} - - name: CORE_CLIENT__S3_ENDPOINT - value: {{ .Values.minio.endpoint }} - name: KMS_CORE__PRIVATE_VAULT__STORAGE__S3__BUCKET value: {{ .Values.kmsCore.privateVault.s3.bucket | quote }} {{- if .Values.kmsCore.privateVault.s3.prefix }} @@ -513,15 +498,6 @@ spec: args: - -c - | - {{- if .Values.minio.enabled }} - mkdir -p ~/.aws/ - cat > ~/.aws/credentials <