38 lines
1.2 KiB
Django/Jinja
38 lines
1.2 KiB
Django/Jinja
{% if taskserv.mtls.enabled and taskserv.mtls.cert_manager.enabled %}
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ taskserv.mtls.server_cert_secret }}
|
|
namespace: {{ taskserv.namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: {{ taskserv.deployment }}
|
|
app.kubernetes.io/managed-by: provisioning
|
|
app.kubernetes.io/component: buildkit-mtls-server
|
|
spec:
|
|
commonName: {{ taskserv.mtls.cert_manager.server_common_name }}
|
|
secretName: {{ taskserv.mtls.server_cert_secret }}
|
|
duration: {{ taskserv.mtls.cert_manager.server_duration }}
|
|
renewBefore: {{ taskserv.mtls.cert_manager.server_renew_before }}
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|
|
usages:
|
|
- server auth
|
|
- digital signature
|
|
- key encipherment
|
|
dnsNames:
|
|
{% for dns in taskserv.mtls.cert_manager.server_dns_names %}
|
|
- {{ dns }}
|
|
{% endfor %}
|
|
{% if taskserv.mtls.cert_manager.server_ip_sans | length > 0 %}
|
|
ipAddresses:
|
|
{% for ip in taskserv.mtls.cert_manager.server_ip_sans %}
|
|
- {{ ip }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
issuerRef:
|
|
name: {{ taskserv.mtls.cert_manager.ca_issuer_name }}
|
|
kind: Issuer
|
|
group: cert-manager.io
|
|
{% endif %}
|