wehub-resource-sync
d25d482dc2
Publish CLI Package / publish-npm (push) Waiting to run
Publish Python SDK / publish-pypi (push) Waiting to run
Publish TypeScript SDK / publish-npm (push) Waiting to run
CI / Migrate Dev DB (push) Has been skipped
CI / Detect Version (push) Has been cancelled
CI / Migrate DB (push) Has been cancelled
CI / Build Dev ECR (./docker/app.Dockerfile, ECR_APP) (push) Has been cancelled
CI / Build Dev ECR (./docker/db.Dockerfile, ECR_MIGRATIONS) (push) Has been cancelled
CI / Build Dev ECR (./docker/pii.Dockerfile, ECR_PII) (push) Has been cancelled
CI / Build Dev ECR (./docker/realtime.Dockerfile, ECR_REALTIME) (push) Has been cancelled
CI / Deploy Trigger.dev (Dev) (push) Has been cancelled
CI / Build AMD64 (./docker/app.Dockerfile, ECR_APP, ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Build AMD64 (./docker/db.Dockerfile, ECR_MIGRATIONS, ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Build AMD64 (./docker/pii.Dockerfile, ECR_PII, ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Build AMD64 (./docker/realtime.Dockerfile, ECR_REALTIME, ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/app.Dockerfile, ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/db.Dockerfile, ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/pii.Dockerfile, ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/realtime.Dockerfile, ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Check Docs Changes (push) Has been cancelled
CI / Process Docs (push) Has been cancelled
CI / Create GitHub Release (push) Has been cancelled
CI / Test and Build (push) Has been cancelled
85 lines
3.3 KiB
YAML
85 lines
3.3 KiB
YAML
{{- if .Values.certManager.enabled }}
|
|
{{- /*
|
|
cert-manager Issuer Bootstrap Pattern
|
|
|
|
PREREQUISITE: cert-manager must be installed in your cluster before enabling this.
|
|
The root CA Certificate is created in the namespace specified by certManager.rootCA.namespace
|
|
(defaults to "cert-manager"). Ensure this namespace exists and cert-manager is running there.
|
|
|
|
Install cert-manager: https://cert-manager.io/docs/installation/
|
|
|
|
This implements the recommended pattern from cert-manager documentation:
|
|
1. A self-signed ClusterIssuer (for bootstrapping the root CA only)
|
|
2. A root CA Certificate (self-signed, used to sign other certificates)
|
|
3. A CA ClusterIssuer (uses the root CA to sign certificates)
|
|
|
|
Reference: https://cert-manager.io/docs/configuration/selfsigned/
|
|
*/ -}}
|
|
|
|
---
|
|
# 1. Self-Signed ClusterIssuer (Bootstrap Only)
|
|
# This issuer is used ONLY to create the root CA certificate.
|
|
# It should NOT be used directly for application certificates.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: {{ .Values.certManager.selfSignedIssuer.name }}
|
|
labels:
|
|
{{- include "sim.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: cert-manager
|
|
spec:
|
|
selfSigned: {}
|
|
|
|
---
|
|
# 2. Root CA Certificate
|
|
# This certificate is signed by the self-signed issuer and becomes the root of trust.
|
|
# The secret created here will be used by the CA issuer to sign certificates.
|
|
# NOTE: This must be created in the cert-manager namespace (or the namespace specified
|
|
# in certManager.rootCA.namespace). Ensure cert-manager is installed there first.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ .Values.certManager.rootCA.certificateName }}
|
|
namespace: {{ .Values.certManager.rootCA.namespace | default "cert-manager" }} # Must match cert-manager's cluster-resource-namespace
|
|
labels:
|
|
{{- include "sim.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: cert-manager
|
|
spec:
|
|
isCA: true
|
|
commonName: {{ .Values.certManager.rootCA.commonName }}
|
|
secretName: {{ .Values.certManager.rootCA.secretName }}
|
|
duration: {{ .Values.certManager.rootCA.duration | default "87600h" }}
|
|
renewBefore: {{ .Values.certManager.rootCA.renewBefore | default "2160h" }}
|
|
privateKey:
|
|
algorithm: {{ .Values.certManager.rootCA.privateKey.algorithm | default "RSA" }}
|
|
size: {{ .Values.certManager.rootCA.privateKey.size | default 4096 }}
|
|
subject:
|
|
organizations:
|
|
{{- if .Values.certManager.rootCA.subject.organizations }}
|
|
{{- toYaml .Values.certManager.rootCA.subject.organizations | nindent 6 }}
|
|
{{- else }}
|
|
- {{ .Release.Name }}
|
|
{{- end }}
|
|
issuerRef:
|
|
name: {{ .Values.certManager.selfSignedIssuer.name }}
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|
|
|
|
---
|
|
# 3. CA ClusterIssuer
|
|
# This is the issuer that should be used by applications to obtain certificates.
|
|
# It signs certificates using the root CA created above.
|
|
# NOTE: This issuer may briefly show "not ready" on first install while cert-manager
|
|
# processes the Certificate above and creates the secret. It will auto-reconcile.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: {{ .Values.certManager.caIssuer.name }}
|
|
labels:
|
|
{{- include "sim.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: cert-manager
|
|
spec:
|
|
ca:
|
|
secretName: {{ .Values.certManager.rootCA.secretName }}
|
|
{{- end }}
|