jakman85andClaude Opus 5.5
04eb38584a
R-TLS-01/docs/08 govern externally reachable TLS and ADR-0006 puts workload mTLS out of scope, but tls-lifecycle-automated required ACME for every Certificate, which platform/buildkit's internal CA cannot satisfy. Clause (5b) accepts the tls-scope=workload-mtls annotation only when the certificate proves it: no Gateway serves it, internal names only, namespaced selfSigned/ca issuer backed by an exempt CA certificate. Also fixes yamllint comma spacing in the buildkitd mounts. Co-Authored-By: Claude Opus 5.5 <[email protected]>
116 lines
4.0 KiB
YAML
116 lines
4.0 KiB
YAML
---
|
|
# mTLS for buildkitd, issued by cert-manager from a CA that exists ONLY for this purpose.
|
|
#
|
|
# buildkit-selfsigned (Issuer) --signs--> buildkit-ca (CA Certificate, 10y)
|
|
# buildkit-ca (Issuer) --signs--> buildkitd-tls (server, the daemon presents it)
|
|
# --signs--> buildkit-client-ci (client, CI presents it)
|
|
#
|
|
# buildkitd verifies EVERY client certificate against this CA (--tlscacert), so holding a client
|
|
# certificate signed by it is what "may build" means. Nothing else in the cluster trusts this CA,
|
|
# and it trusts nothing else.
|
|
#
|
|
# THE CLIENT CERTIFICATE REACHES CI AS ACTIONS SECRETS, not through the cluster: CI jobs hold no
|
|
# cluster credential (R-SEC-02). infra/gitea/buildkit-client-secret.sh copies ca.crt/tls.crt/
|
|
# tls.key from the Secret below into the repository secrets BUILDKIT_CA, BUILDKIT_CLIENT_CERT and
|
|
# BUILDKIT_CLIENT_KEY without printing them. Re-run it after every renewal (see renewBefore).
|
|
#
|
|
# WHY A PRIVATE CA AND NOT LET'S ENCRYPT. The platform's TLS rule (R-TLS-01/02, docs/08,
|
|
# ADR-0006: ACME DNS-01) is about EXTERNALLY REACHABLE services; ADR-0006 itself says "mTLS between
|
|
# workloads is a separate concern … not covered here", and a public CA cannot issue for a
|
|
# `*.svc.cluster.local` name or a client-auth certificate anyway. buildkitd is ClusterIP-only. Each
|
|
# Certificate below is therefore annotated `homelab.keithjackson.dev/tls-scope: workload-mtls`,
|
|
# which the L0 check tls-lifecycle-automated accepts ONLY if the certificate proves it: no
|
|
# Gateway serves its Secret, every name is cluster-internal, and the issuer is a namespaced
|
|
# selfSigned/CA Issuer whose CA is itself issued here. Issuance and renewal stay unattended.
|
|
#
|
|
# ROTATION. cert-manager renews both leaves `renewBefore` their expiry and rewrites the Secrets.
|
|
# * server: buildkitd reads its certificate at START, so the pod must restart inside the 30-day
|
|
# renewal window (a node reboot by kured, a Deployment rollout, or a manual restart).
|
|
# * client: the Actions secrets are a COPY; re-run the script. Until then CI fails loudly at
|
|
# its TLS preflight (.gitea/workflows/scripts/images.sh), never silently.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: buildkit-selfsigned
|
|
namespace: buildkit
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: buildkit-ca
|
|
namespace: buildkit
|
|
annotations:
|
|
homelab.keithjackson.dev/tls-scope: workload-mtls # see the header: R-TLS-01 is about external TLS
|
|
spec:
|
|
isCA: true
|
|
commonName: buildkit-ca
|
|
secretName: buildkit-ca
|
|
duration: 87600h # 10 years: rotating the CA means re-issuing everything and re-copying
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
issuerRef:
|
|
name: buildkit-selfsigned
|
|
kind: Issuer
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: buildkit-ca
|
|
namespace: buildkit
|
|
spec:
|
|
ca:
|
|
secretName: buildkit-ca
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: buildkitd-tls
|
|
namespace: buildkit
|
|
annotations:
|
|
homelab.keithjackson.dev/tls-scope: workload-mtls
|
|
spec:
|
|
secretName: buildkitd-tls
|
|
commonName: buildkitd.buildkit.svc.cluster.local
|
|
dnsNames:
|
|
- buildkitd.buildkit.svc.cluster.local # what CI dials (platform/buildkit/versions.env)
|
|
- buildkitd.buildkit.svc
|
|
- buildkitd
|
|
duration: 8760h
|
|
renewBefore: 720h
|
|
usages:
|
|
- server auth
|
|
- digital signature
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|
|
issuerRef:
|
|
name: buildkit-ca
|
|
kind: Issuer
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: buildkit-client-ci
|
|
namespace: buildkit
|
|
annotations:
|
|
homelab.keithjackson.dev/tls-scope: workload-mtls
|
|
spec:
|
|
secretName: buildkit-client-ci
|
|
commonName: gitea-actions-image-pipeline
|
|
duration: 8760h
|
|
renewBefore: 720h
|
|
usages:
|
|
- client auth
|
|
- digital signature
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|
|
issuerRef:
|
|
name: buildkit-ca
|
|
kind: Issuer
|