PKI Options
Options for: cert-manager, trust-manager, pki-auth.
All options are under lab.clusters.<name>.components.
cert-manager.acme.dns01.cloudflare.apiToken
Cloudflare API token (if set, auto-creates the Secret)
Type: null or string
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.dns01.cloudflare.apiTokenSecretName
Name of Secret containing the Cloudflare API token (key: api-token)
Type: string
Default: "cloudflare-api-token"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.dns01.provider
Public DNS provider for ACME DNS01 challenges
Type: one of "none", "cloudflare", "route53"
Default: "none"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.dns01.route53.accessKeyID
AWS access key ID (for explicit credentials)
Type: string
Default: ""
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.dns01.route53.hostedZoneID
Route53 hosted zone ID
Type: string
Default: ""
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.dns01.route53.region
AWS region for Route53
Type: string
Default: "us-east-1"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.dns01.route53.secretAccessKey
AWS secret access key (if set, auto-creates the Secret)
Type: null or string
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.dns01.route53.secretAccessKeySecretName
Name of Secret containing AWS secret access key (key: secret-access-key)
Type: string
Default: "route53-credentials"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.email
Email for ACME registration
Type: string
Default: ""
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.enable
Create an ACME ClusterIssuer for Let’s Encrypt
Type: boolean
Default: false
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.issuerName
Name of the ACME ClusterIssuer
Type: string
Default: "letsencrypt"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.server
ACME server URL (use staging for testing)
Type: string
Default: "https://acme-v02.api.letsencrypt.org/directory"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.acme.solvers
Raw ACME solver config (overrides dns01 provider if set)
Type: list of (attribute set)
Default: [ ]
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.chart
cert-manager Helm chart derivation (default: cataCharts.cert-manager)
Type: package
Default: <derivation helm-chart-https-charts.jetstack.io-cert-manager-1.17.2>
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.enable
Whether to enable cert-manager.
Type: boolean
Default: false
Example: true
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.namespace
Namespace for cert-manager
Type: string
Default: "cert-manager"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.phase
Deployment phase this component belongs to
Type: string
Default: "operators"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.ref
Computed references for cert-manager
Type: attribute set
Default: { }
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.selfSignedCA.enable
Create a self-signed CA ClusterIssuer
Type: boolean
Default: false
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.selfSignedCA.issuerName
Name of the ClusterIssuer backed by the self-signed CA
Type: string
Default: "lab-ca"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
cert-manager.version
cert-manager version
Type: string
Default: "v1.16.1"
Declared in: modules/lab/cluster/components/pki/cert-manager.nix
pki-auth.ca.commonName
CA certificate Common Name
Type: string
Default: "catallaxy-‹name›-ca"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.ca.keyAlgorithm
CA private key algorithm
Type: one of "ecdsa-p256", "ecdsa-p384", "ed25519", "rsa-2048", "rsa-4096"
Default: "ecdsa-p256"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.ca.validity
CA certificate validity period
Type: string
Default: "10y"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.defaults.keyAlgorithm
Default key algorithm for client certificates
Type: one of "ecdsa-p256", "ecdsa-p384", "ed25519", "rsa-2048", "rsa-4096"
Default: "ecdsa-p256"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.defaults.renewBefore
Renew certificate this long before expiry
Type: string
Default: "30d"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.defaults.validity
Default client certificate validity
Type: string
Default: "1y"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.enable
Whether to enable PKI-based authentication (client certificates).
Type: boolean
Default: false
Example: true
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.namespace
Namespace for PKI auth RBAC resources
Type: string
Default: "pki-auth"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.phase
Deployment phase this component belongs to
Type: string
Default: "infrastructure"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.rbac
Map of ClusterRoleBinding name → cert Organization → ClusterRole
Type: attribute set of (submodule)
Default: { }
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.rbac.<name>.clusterRole
ClusterRole to bind to this group
Type: string
Default: "cluster-admin"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.rbac.<name>.organization
Certificate Organization value (Kubernetes group name)
Type: string
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.ref
Computed references for PKI auth
Type: attribute set
Default: { }
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users
Users who receive client certificates for Kubernetes auth
Type: attribute set of (submodule)
Default: { }
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.commonName
Certificate Common Name — becomes the Kubernetes username. Typically an email address.
Type: string
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.keyAlgorithm
Override key algorithm for this user
Type: null or string
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.organizations
Certificate Organization fields — become Kubernetes groups. Bind these to ClusterRoles via the rbac option.
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.validity
Override certificate validity for this user
Type: null or string
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.yubikey.pinPolicy
YubiKey PIN policy
Type: one of "once", "always", "never"
Default: "once"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.yubikey.serialNumber
YubiKey serial number for automatic provisioning.
When set, cata pki provision will target this specific device.
Type: null or string
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.yubikey.slot
PIV slot for the certificate (9a=authentication, 9c=signing)
Type: string
Default: "9a"
Declared in: modules/lab/cluster/auth/pki.nix
pki-auth.users.<name>.yubikey.touchPolicy
YubiKey touch policy (always=tap every use, cached=tap once per 15s)
Type: one of "always", "cached", "never"
Default: "always"
Declared in: modules/lab/cluster/auth/pki.nix
trust-manager.chart
This option has no description.
Type: package
Default: <derivation helm-chart-https-charts.jetstack.io-trust-manager-0.22.1>
Declared in: modules/lab/cluster/components/pki/trust-manager.nix
trust-manager.enable
Whether to enable trust-manager (CA bundle distribution).
Type: boolean
Default: false
Example: true
Declared in: modules/lab/cluster/components/pki/trust-manager.nix
trust-manager.namespace
This option has no description.
Type: string
Default: "cert-manager"
Declared in: modules/lab/cluster/components/pki/trust-manager.nix
trust-manager.phase
This option has no description.
Type: string
Default: "operators"
Declared in: modules/lab/cluster/components/pki/trust-manager.nix
trust-manager.ref
This option has no description.
Type: attribute set
Default: { }
Declared in: modules/lab/cluster/components/pki/trust-manager.nix