41 lines
1.6 KiB
Cheetah
41 lines
1.6 KiB
Cheetah
|
# Declarative buildkit-client identity for lian-build.
|
||
|
|
# Source of truth — rendered via envsubst by setup-buildkit-client.sh in this catalog.
|
||
|
|
#
|
||
|
|
# Cross-namespace: this Certificate lives in BUILDKIT_CLIENT_CA_ISSUER_NAMESPACE
|
||
|
|
# (where the buildkit_lite namespace-scoped CA Issuer resides). cert-manager
|
||
|
|
# applies the Issuer's policy regardless of which namespace requests the cert.
|
||
|
|
#
|
||
|
|
# Required env vars (sourced from NCL `lian_build.buildkit_client` block):
|
||
|
|
# BUILDKIT_CLIENT_NAME — e.g. "lian-build"
|
||
|
|
# BUILDKIT_CLIENT_CA_ISSUER_NAMESPACE — e.g. "build-system"
|
||
|
|
# BUILDKIT_CLIENT_CA_ISSUER_NAME — e.g. "buildkit-ca-issuer"
|
||
|
|
# BUILDKIT_CLIENT_DURATION — e.g. "2160h"
|
||
|
|
# BUILDKIT_CLIENT_RENEW_BEFORE — e.g. "360h"
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: Certificate
|
||
|
|
metadata:
|
||
|
|
name: buildkit-client-${BUILDKIT_CLIENT_NAME}
|
||
|
|
namespace: ${BUILDKIT_CLIENT_CA_ISSUER_NAMESPACE}
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/managed-by: provisioning
|
||
|
|
app.kubernetes.io/component: buildkit-mtls-client
|
||
|
|
app.kubernetes.io/part-of: lian-build
|
||
|
|
librecloud.online/buildkit-client: "${BUILDKIT_CLIENT_NAME}"
|
||
|
|
spec:
|
||
|
|
commonName: ${BUILDKIT_CLIENT_NAME}
|
||
|
|
secretName: buildkit-client-${BUILDKIT_CLIENT_NAME}-tls
|
||
|
|
duration: ${BUILDKIT_CLIENT_DURATION}
|
||
|
|
renewBefore: ${BUILDKIT_CLIENT_RENEW_BEFORE}
|
||
|
|
privateKey:
|
||
|
|
algorithm: ECDSA
|
||
|
|
size: 256
|
||
|
|
rotationPolicy: Always
|
||
|
|
usages:
|
||
|
|
- client auth
|
||
|
|
- digital signature
|
||
|
|
- key encipherment
|
||
|
|
issuerRef:
|
||
|
|
name: ${BUILDKIT_CLIENT_CA_ISSUER_NAME}
|
||
|
|
kind: Issuer
|
||
|
|
group: cert-manager.io
|