89 lines
3.3 KiB
Text
89 lines
3.3 KiB
Text
|
let _concerns_lib = import "schemas/lib/concerns.ncl" in
|
||
|
|
|
||
|
|
{
|
||
|
|
AcmeIssuer = {
|
||
|
|
name | String,
|
||
|
|
acme_server | String,
|
||
|
|
email | String,
|
||
|
|
solver | [| 'dns01, 'http01 |],
|
||
|
|
zone | String,
|
||
|
|
dns_provider | [| 'cloudflare, 'hetzner, 'aws |] | optional,
|
||
|
|
secret_ref | String | optional,
|
||
|
|
},
|
||
|
|
|
||
|
|
SelfSignedIssuer = {
|
||
|
|
name | String,
|
||
|
|
},
|
||
|
|
|
||
|
|
CaIssuer = {
|
||
|
|
name | String,
|
||
|
|
secret_ref | String,
|
||
|
|
},
|
||
|
|
|
||
|
|
IssuerSpec = [| 'acme AcmeIssuer, 'ca CaIssuer, 'selfsigned SelfSignedIssuer |],
|
||
|
|
|
||
|
|
CertificateSpec = {
|
||
|
|
name | String,
|
||
|
|
namespace | String,
|
||
|
|
dns_names | Array String,
|
||
|
|
issuer_ref | String,
|
||
|
|
secret_name | String,
|
||
|
|
is_ca | Bool | default = false,
|
||
|
|
duration | String | default = "2160h",
|
||
|
|
renew_before | String | default = "720h",
|
||
|
|
key_algorithm | [| 'ECDSA, 'RSA |] | default = 'ECDSA,
|
||
|
|
key_size | Number | default = 256,
|
||
|
|
},
|
||
|
|
|
||
|
|
TlsBackup = {
|
||
|
|
enabled | Bool | default = false,
|
||
|
|
kubectl_version | String | default = "v1.32.3",
|
||
|
|
nushell_image | String | default = "ghcr.io/nushell/nushell:latest",
|
||
|
|
},
|
||
|
|
|
||
|
|
CertManager = {
|
||
|
|
version | String,
|
||
|
|
namespace | String | default = "cert-manager",
|
||
|
|
cluster_issuers | Array {
|
||
|
|
kind | [| 'acme, 'ca, 'selfsigned |],
|
||
|
|
name | String,
|
||
|
|
acme_server | String | optional,
|
||
|
|
email | String | optional,
|
||
|
|
solver | [| 'dns01, 'http01 |] | optional,
|
||
|
|
zone | String | optional,
|
||
|
|
dns_provider | [| 'cloudflare, 'hetzner, 'aws |] | optional,
|
||
|
|
secret_ref | String | optional,
|
||
|
|
# One entry per DNS-01 solver. dns_zones scopes a solver to specific
|
||
|
|
# zones (cert-manager's selector.dnsZones) — omit for the catch-all
|
||
|
|
# solver. Needed when a single issuer must resolve SANs that span
|
||
|
|
# more than one Cloudflare zone (e.g. a cert with names in both
|
||
|
|
# jesusperez.pro and librecloud.online).
|
||
|
|
solvers | Array {
|
||
|
|
secret_ref | String,
|
||
|
|
dns_zones | Array String | optional,
|
||
|
|
} | optional,
|
||
|
|
} | default = [],
|
||
|
|
mode | [| 'cluster |] | default = 'cluster,
|
||
|
|
tls_backup | TlsBackup | optional,
|
||
|
|
|
||
|
|
# DNS-01 challenge resolution: bypass the cluster CoreDNS (which can have
|
||
|
|
# split-horizon overrides without fallthrough that return SERVFAIL for
|
||
|
|
# _acme-challenge.* subdomains) and resolve directly via public recursive
|
||
|
|
# nameservers when verifying TXT record propagation.
|
||
|
|
dns01_recursive_nameservers | Array String | default = ["1.1.1.1:53", "8.8.8.8:53"],
|
||
|
|
dns01_recursive_only | Bool | default = true,
|
||
|
|
|
||
|
|
# Installs cert-manager-csi-driver DaemonSet alongside the controller.
|
||
|
|
# Required by components using tls_rotation = 'csi_driver (e.g. private_ingress).
|
||
|
|
# When false the csi-driver.yaml template renders empty and is skipped by the
|
||
|
|
# installer. When true, the DaemonSet is installed in the cert-manager namespace.
|
||
|
|
csi_driver_enabled | Bool | default = false,
|
||
|
|
csi_driver_version | String | default = "v0.10.1",
|
||
|
|
|
||
|
|
# ServiceConcerns umbrella (ADR-008). cert-manager itself does not own
|
||
|
|
# data — it generates Secrets that are consumed by other components.
|
||
|
|
# Captured by SystemBackupDef.tls_certmanager.
|
||
|
|
concerns | _concerns_lib.ServiceConcerns | optional,
|
||
|
|
},
|
||
|
|
}
|