38 lines
1.4 KiB
Cheetah
38 lines
1.4 KiB
Cheetah
# Runtime-rendered (envsubst) Certificate template — applied on demand by
|
|
# _method_issue-client-cert <client-name> in buildkit_lite-lib.sh.
|
|
#
|
|
# This file is the canonical source of truth for the schema of a buildkit
|
|
# client identity. Edit here; the lib helper just substitutes env vars.
|
|
#
|
|
# Required env vars at envsubst time:
|
|
# BUILDKIT_CLIENT_NAME — short identity ("lian-build", "ops-jpl", "woodpecker")
|
|
# BUILDKIT_NAMESPACE — namespace where the CA Issuer lives
|
|
# BUILDKIT_MTLS_CA_ISSUER — name of the Issuer that signs leaf client certs
|
|
# BUILDKIT_CLIENT_DURATION — leaf cert validity (e.g. 2160h)
|
|
# BUILDKIT_CLIENT_RENEW — renewal lead time (e.g. 360h)
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: buildkit-client-${BUILDKIT_CLIENT_NAME}
|
|
namespace: ${BUILDKIT_NAMESPACE}
|
|
labels:
|
|
app.kubernetes.io/managed-by: provisioning
|
|
app.kubernetes.io/component: buildkit-mtls-client
|
|
librecloud.online/buildkit-client: "${BUILDKIT_CLIENT_NAME}"
|
|
spec:
|
|
commonName: ${BUILDKIT_CLIENT_NAME}
|
|
secretName: buildkit-client-${BUILDKIT_CLIENT_NAME}-tls
|
|
duration: ${BUILDKIT_CLIENT_DURATION}
|
|
renewBefore: ${BUILDKIT_CLIENT_RENEW}
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|
|
usages:
|
|
- client auth
|
|
- digital signature
|
|
- key encipherment
|
|
issuerRef:
|
|
name: ${BUILDKIT_MTLS_CA_ISSUER}
|
|
kind: Issuer
|
|
group: cert-manager.io
|