cert-manager-pki.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

{{- if .Values.certManager.enabled }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ include "openshell.issuerSelfSigned" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ include "openshell.fullname" . }}-ca
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
spec:
  isCA: true
  commonName: openshell-ca
  secretName: {{ .Values.certManager.caSecretName | quote }}
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: {{ include "openshell.issuerSelfSigned" . }}
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ include "openshell.fullname" . }}-ca-issuer
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
spec:
  ca:
    secretName: {{ .Values.certManager.caSecretName | quote }}
---
{{- $externalServerIssuer := .Values.certManager.serverIssuerRef.name }}
{{- if $externalServerIssuer }}
{{- range .Values.certManager.serverDnsNames }}
{{- /* Single-label names (e.g. "openshell") are also rejected by ACME CAs but are intentionally not checked here — the guard targets recognisable internal-network patterns. */ -}}
{{- if or (eq . "localhost") (hasSuffix ".localhost" .) (hasSuffix ".svc.cluster.local" .) (hasSuffix ".svc" .) (eq . "host.docker.internal") (eq . "host.containers.internal") }}
{{- fail (printf "certManager.serverIssuerRef.name is set (external issuer) but certManager.serverDnsNames contains %q — external CAs (e.g. ACME / Let's Encrypt) reject internal-only names per CA/Browser Forum baseline requirements. Override certManager.serverDnsNames with your externally-resolvable hostname(s)." .) }}
{{- end }}
{{- end }}
{{- end }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ include "openshell.fullname" . }}-server
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
spec:
  secretName: {{ .Values.server.tls.certSecretName | quote }}
  duration: {{ .Values.certManager.certificateDuration | quote }}
  renewBefore: {{ .Values.certManager.certificateRenewBefore | quote }}
  {{- if $externalServerIssuer }}
  # External issuers (e.g. ACME) reject internal-only names (cluster-local,
  # localhost, loopback IPs) per CA/Browser Forum baseline requirements, and
  # require any commonName to also appear in dnsNames. Only request the
  # externally-resolvable SANs the operator configured — no defaults, no IPs.
  {{- if .Values.certManager.serverDnsNames }}
  commonName: {{ first .Values.certManager.serverDnsNames | quote }}
  {{- end }}
  dnsNames:
    {{- range .Values.certManager.serverDnsNames }}
    - {{ . | quote }}
    {{- end }}
  {{- else }}
  # The chart fullname is always the first entry of defaultServerDnsNames
  # below, so it's always valid as a commonName.
  #
  # Upgrade note: this replaces the previously-hardcoded "openshell-server"
  # commonName. The ACME commonName-must-be-a-SAN constraint this exists for
  # only applies to the external-issuer branch above, but this branch was
  # changed too for consistency. Existing self-signed/internal-CA deployments
  # will get a new server cert with a different Subject CN on next reissue
  # after upgrading — SAN-based hostname verification (what TLS clients
  # actually check) is unaffected.
  commonName: {{ include "openshell.fullname" . }}
  dnsNames:
    {{- range (include "openshell.defaultServerDnsNames" . | fromYamlArray) }}
    - {{ . | quote }}
    {{- end }}
    {{- range .Values.certManager.serverDnsNames }}
    - {{ . | quote }}
    {{- end }}
  {{- if .Values.certManager.serverIpAddresses }}
  ipAddresses:
    {{- toYaml .Values.certManager.serverIpAddresses | nindent 4 }}
  {{- end }}
  {{- end }}
  privateKey:
    algorithm: ECDSA
    size: 256
  usages:
    - server auth
    - digital signature
    - key encipherment
  issuerRef:
    {{- if .Values.certManager.serverIssuerRef.name }}
    name: {{ .Values.certManager.serverIssuerRef.name }}
    kind: {{ .Values.certManager.serverIssuerRef.kind | default "ClusterIssuer" }}
    group: {{ .Values.certManager.serverIssuerRef.group | default "cert-manager.io" }}
    {{- else }}
    name: {{ include "openshell.fullname" . }}-ca-issuer
    kind: Issuer
    group: cert-manager.io
    {{- end }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ include "openshell.fullname" . }}-client
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
spec:
  secretName: {{ .Values.server.tls.clientTlsSecretName | quote }}
  duration: {{ .Values.certManager.certificateDuration | quote }}
  renewBefore: {{ .Values.certManager.certificateRenewBefore | quote }}
  commonName: openshell-client
  privateKey:
    algorithm: ECDSA
    size: 256
  usages:
    - client auth
    - digital signature
    - key encipherment
  issuerRef:
    {{- if .Values.certManager.clientIssuerRef.name }}
    name: {{ .Values.certManager.clientIssuerRef.name }}
    kind: {{ .Values.certManager.clientIssuerRef.kind | default "ClusterIssuer" }}
    group: {{ .Values.certManager.clientIssuerRef.group | default "cert-manager.io" }}
    {{- else }}
    name: {{ include "openshell.fullname" . }}-ca-issuer
    kind: Issuer
    group: cert-manager.io
    {{- end }}
{{- end }}