# Declarative buildkit-client identity for lian-build.
# Source of truth — rendered via envsubst by setup-buildkit-client.sh in this catalog.
#
# Cross-namespace: this Certificate lives in BUILDKIT_CLIENT_CA_ISSUER_NAMESPACE
# (where the buildkit_lite namespace-scoped CA Issuer resides). cert-manager
# applies the Issuer's policy regardless of which namespace requests the cert.
#
# Required env vars (sourced from NCL `lian_build.buildkit_client` block):
#   BUILDKIT_CLIENT_NAME                 — e.g. "lian-build"
#   BUILDKIT_CLIENT_CA_ISSUER_NAMESPACE  — e.g. "build-system"
#   BUILDKIT_CLIENT_CA_ISSUER_NAME       — e.g. "buildkit-ca-issuer"
#   BUILDKIT_CLIENT_DURATION             — e.g. "2160h"
#   BUILDKIT_CLIENT_RENEW_BEFORE         — e.g. "360h"
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: buildkit-client-${BUILDKIT_CLIENT_NAME}
  namespace: ${BUILDKIT_CLIENT_CA_ISSUER_NAMESPACE}
  labels:
    app.kubernetes.io/managed-by: provisioning
    app.kubernetes.io/component: buildkit-mtls-client
    app.kubernetes.io/part-of: lian-build
    librecloud.online/buildkit-client: "${BUILDKIT_CLIENT_NAME}"
spec:
  commonName: ${BUILDKIT_CLIENT_NAME}
  secretName: buildkit-client-${BUILDKIT_CLIENT_NAME}-tls
  duration: ${BUILDKIT_CLIENT_DURATION}
  renewBefore: ${BUILDKIT_CLIENT_RENEW_BEFORE}
  privateKey:
    algorithm: ECDSA
    size: 256
    rotationPolicy: Always
  usages:
    - client auth
    - digital signature
    - key encipherment
  issuerRef:
    name: ${BUILDKIT_CLIENT_CA_ISSUER_NAME}
    kind: Issuer
    group: cert-manager.io