jakman85andClaude Opus 5.5
310deb0f7d
Operator decision on PR #81: no CI job may reach a privileged daemon. The act runner is untouched. - platform/buildkit (+ clusters/base/buildkit.yaml): moby/buildkit v0.34.1-rootless pinned by digest, uid 1000, not privileged; caps drop ALL + SETUID/SETGID, seccomp/AppArmor Unconfined, read-only rootfs (each measured under podman). cert-manager CA + server/client certs, ClusterIP :1234, default-deny with ingress only from the act-runner pod (DinD masquerades jobs to it). No Kyverno exception: every applied policy matches app-namespace=true only. - Each Containerfile names its shipped stage and ends in a `verify` stage holding every former `docker run` assertion (uid 65532, RUN --network=none, writable-path inventory standing in for the read-only rootfs). The old `&& echo` checks that could never fail are real assertions now. - images.sh drives buildkitd with a pinned buildx (sha256-checked) via bake; PRs build verify targets with agent-runner FROM the in-run toolbox (target: context); main verifies, then pushes. Fails loudly when the builder secrets are absent or buildkitd is unreachable. - infra/gitea/buildkit-client-secret.sh copies the client cert into Actions secrets. Co-Authored-By: Claude Opus 5.5 <[email protected]>
101 lines
3.0 KiB
YAML
101 lines
3.0 KiB
YAML
---
|
|
# mTLS for buildkitd, issued by cert-manager from a CA that exists ONLY for this purpose.
|
|
#
|
|
# buildkit-selfsigned (Issuer) --signs--> buildkit-ca (CA Certificate, 10y)
|
|
# buildkit-ca (Issuer) --signs--> buildkitd-tls (server, the daemon presents it)
|
|
# --signs--> buildkit-client-ci (client, CI presents it)
|
|
#
|
|
# buildkitd verifies EVERY client certificate against this CA (--tlscacert), so holding a client
|
|
# certificate signed by it is what "may build" means. Nothing else in the cluster trusts this CA,
|
|
# and it trusts nothing else.
|
|
#
|
|
# THE CLIENT CERTIFICATE REACHES CI AS ACTIONS SECRETS, not through the cluster: CI jobs hold no
|
|
# cluster credential (R-SEC-02). infra/gitea/buildkit-client-secret.sh copies ca.crt/tls.crt/
|
|
# tls.key from the Secret below into the repository secrets BUILDKIT_CA, BUILDKIT_CLIENT_CERT and
|
|
# BUILDKIT_CLIENT_KEY without printing them. Re-run it after every renewal (see renewBefore).
|
|
#
|
|
# ROTATION. cert-manager renews both leaves `renewBefore` their expiry and rewrites the Secrets.
|
|
# * server: buildkitd reads its certificate at START, so the pod must restart inside the 30-day
|
|
# renewal window (a node reboot by kured, a Deployment rollout, or a manual restart).
|
|
# * client: the Actions secrets are a COPY; re-run the script. Until then CI fails loudly at
|
|
# its TLS preflight (.gitea/workflows/scripts/images.sh), never silently.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: buildkit-selfsigned
|
|
namespace: buildkit
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: buildkit-ca
|
|
namespace: buildkit
|
|
spec:
|
|
isCA: true
|
|
commonName: buildkit-ca
|
|
secretName: buildkit-ca
|
|
duration: 87600h # 10 years: rotating the CA means re-issuing everything and re-copying
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
issuerRef:
|
|
name: buildkit-selfsigned
|
|
kind: Issuer
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: buildkit-ca
|
|
namespace: buildkit
|
|
spec:
|
|
ca:
|
|
secretName: buildkit-ca
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: buildkitd-tls
|
|
namespace: buildkit
|
|
spec:
|
|
secretName: buildkitd-tls
|
|
commonName: buildkitd.buildkit.svc.cluster.local
|
|
dnsNames:
|
|
- buildkitd.buildkit.svc.cluster.local # what CI dials (platform/buildkit/versions.env)
|
|
- buildkitd.buildkit.svc
|
|
- buildkitd
|
|
duration: 8760h
|
|
renewBefore: 720h
|
|
usages:
|
|
- server auth
|
|
- digital signature
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|
|
issuerRef:
|
|
name: buildkit-ca
|
|
kind: Issuer
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: buildkit-client-ci
|
|
namespace: buildkit
|
|
spec:
|
|
secretName: buildkit-client-ci
|
|
commonName: gitea-actions-image-pipeline
|
|
duration: 8760h
|
|
renewBefore: 720h
|
|
usages:
|
|
- client auth
|
|
- digital signature
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|
|
issuerRef:
|
|
name: buildkit-ca
|
|
kind: Issuer
|