# Runtime-rendered (envsubst) Certificate template — applied on demand by
# _method_issue-client-cert <client-name> in buildkit_lite-lib.sh.
#
# This file is the canonical source of truth for the schema of a buildkit
# client identity. Edit here; the lib helper just substitutes env vars.
#
# Required env vars at envsubst time:
#   BUILDKIT_CLIENT_NAME      — short identity ("lian-build", "ops-jpl", "woodpecker")
#   BUILDKIT_NAMESPACE        — namespace where the CA Issuer lives
#   BUILDKIT_MTLS_CA_ISSUER   — name of the Issuer that signs leaf client certs
#   BUILDKIT_CLIENT_DURATION  — leaf cert validity (e.g. 2160h)
#   BUILDKIT_CLIENT_RENEW     — renewal lead time (e.g. 360h)
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: buildkit-client-${BUILDKIT_CLIENT_NAME}
  namespace: ${BUILDKIT_NAMESPACE}
  labels:
    app.kubernetes.io/managed-by: provisioning
    app.kubernetes.io/component: buildkit-mtls-client
    librecloud.online/buildkit-client: "${BUILDKIT_CLIENT_NAME}"
spec:
  commonName: ${BUILDKIT_CLIENT_NAME}
  secretName: buildkit-client-${BUILDKIT_CLIENT_NAME}-tls
  duration: ${BUILDKIT_CLIENT_DURATION}
  renewBefore: ${BUILDKIT_CLIENT_RENEW}
  privateKey:
    algorithm: ECDSA
    size: 256
    rotationPolicy: Always
  usages:
    - client auth
    - digital signature
    - key encipherment
  issuerRef:
    name: ${BUILDKIT_MTLS_CA_ISSUER}
    kind: Issuer
    group: cert-manager.io