77 lines
4.7 KiB
Text
77 lines
4.7 KiB
Text
let _context_lib = import "schemas/catalog/context.ncl" in
|
|
|
|
{
|
|
BuildkitLite = {
|
|
namespace | String,
|
|
deployment | String,
|
|
port | std.number.Nat,
|
|
image | String,
|
|
replicas | std.number.Nat,
|
|
resources | {
|
|
requests | { cpu | String, memory | String },
|
|
limits | { cpu | String, memory | String },
|
|
},
|
|
privileged | Bool,
|
|
|
|
requires | {
|
|
capabilities | Array String | default = [],
|
|
} | default = {},
|
|
|
|
provides | {
|
|
service | String | optional,
|
|
interface | String | optional,
|
|
} | default = {},
|
|
|
|
grpc | {
|
|
keepalive_time | String | doc "Server→client gRPC ping interval. Keeps NAT entries alive during long builds." | default = "30s",
|
|
keepalive_timeout | String | doc "Time buildkitd waits for a ping ack before closing the connection." | default = "10s",
|
|
} | default = {},
|
|
|
|
vpn_service | {
|
|
enabled | Bool | doc "Expose buildkitd through a NodePort reachable on the daoshi node IP (wuwei VPN)." | default = false,
|
|
nodeport | std.number.Nat | doc "Fixed NodePort in 30000-32767. Used only when enabled." | default = 31234,
|
|
external_ips | Array String | doc "Optional externalIPs to bind the Service on (use only with single-node clusters)." | default = [],
|
|
service_name | String | doc "Name suffix for the VPN-facing Service. Final name: <deployment>-vpn." | default = "vpn",
|
|
} | default = {},
|
|
|
|
mtls | {
|
|
enabled | Bool | doc "Enable mTLS on buildkitd. Required when vpn_service is enabled in any non-trusted network." | default = false,
|
|
ca_secret | String | doc "K8s Secret (same namespace) with key ca.crt — clients must present a cert signed by this CA." | default = "buildkit-mtls-ca",
|
|
server_cert_secret | String | doc "K8s Secret (same namespace) with keys tls.crt and tls.key — buildkitd server cert/key." | default = "buildkit-mtls-server",
|
|
cert_mount_path | String | doc "Mount path inside the buildkitd container for cert material." | default = "/etc/buildkit/certs",
|
|
|
|
cert_manager | {
|
|
enabled | Bool | doc "Provision CA and server cert via cert-manager (SelfSigned ClusterIssuer → CA Certificate → namespaced CA Issuer → server Certificate)." | default = false,
|
|
cluster_issuer_name | String | doc "Name of the SelfSigned ClusterIssuer (shared, idempotent)." | default = "buildkit-selfsigned-issuer",
|
|
ca_issuer_name | String | doc "Name of the namespace-scoped CA Issuer that signs leaf certs." | default = "buildkit-ca-issuer",
|
|
ca_common_name | String | doc "Subject CN on the CA cert." | default = "buildkit-mtls-ca",
|
|
ca_duration | String | doc "CA validity (ISO 8601 duration). 5 years default." | default = "43800h",
|
|
ca_renew_before | String | doc "CA renewal lead time." | default = "720h",
|
|
server_common_name | String | doc "Subject CN on the server leaf cert." | default = "buildkitd",
|
|
server_dns_names | Array String | doc "DNS SANs on the server cert (at least one VPN hostname recommended)." | default = ["buildkitd"],
|
|
server_ip_sans | Array String | doc "IP SANs on the server cert (node IP for direct VPN access)." | default = [],
|
|
server_duration | String | doc "Server cert validity." | default = "2160h",
|
|
server_renew_before | String | doc "Server cert renewal lead time." | default = "360h",
|
|
} | default = {},
|
|
} | default = {},
|
|
|
|
operations | {
|
|
install | Bool | default = true,
|
|
update | Bool | default = false,
|
|
delete | Bool | default = false,
|
|
health | Bool | default = false,
|
|
} | default = {},
|
|
|
|
cache | {
|
|
enabled | Bool | doc "Back the buildkitd cache dir with a PersistentVolumeClaim instead of the image's ephemeral anonymous VOLUME. The anonymous VOLUME grows unbounded on the node root filesystem and on a control-plane node can fill / and trigger DiskPressure eviction. Requires a working CSI on the target node." | default = false,
|
|
size | String | doc "Cache PVC size." | default = "10Gi",
|
|
storage_class | String | doc "StorageClass for the cache PVC. Default local-path (node-local disk) — the buildkit cache is disposable, so a paid cloud volume is unnecessary; gckeepstorage bounds the actual size." | default = "local-path",
|
|
mount_path | String | doc "buildkitd cache directory (the image's declared VOLUME)." | default = "/var/lib/buildkit",
|
|
gc_keep_storage | String | doc "buildkitd worker GC ceiling — keeps the on-disk cache under this size. Set below the PVC size to leave headroom for the active build." | default = "8GB",
|
|
} | default = {},
|
|
|
|
context | _context_lib.ComponentContext | optional,
|
|
|
|
..
|
|
},
|
|
}
|