Repository navigation
y-build TLS support - #87
Merged
Merged
Conversation
buildctl reads only BUILDKIT_HOST from the environment; its TLS client files are flags (--tlsdir, --tlscacert, --tlscert, --tlskey) that must come before the subcommand, and y-build passes only --addr. So y-build could reach ystack's in-cluster buildkitd, or a plaintext one, but not a buildkitd that requires client certificates. y-buildctl now prepends --tlsdir "$BUILDKIT_TLS_DIR" when that is set. The directory holds ca.pem, cert.pem and key.pem, which is also the layout of DOCKER_CERT_PATH, so one client cert directory can serve a remote dockerd and buildkitd. Every y-buildctl call gets it, including y-build's build and the debug workers probe. y-build refuses BUILDKIT_TLS_DIR without BUILDKIT_HOST: the in-cluster buildkitd it would discover has no TLS, and the failure would otherwise surface as a confusing fallback to port 8547. Unchanged without the env: the in-cluster discovery and every flag. Verified against moby/buildkit v0.33.0 with --tlscacert/--tlscert/--tlskey: - y-buildctl debug workers with BUILDKIT_HOST + BUILDKIT_TLS_DIR: ok - y-build --push=false --output --file-output, multi-stage: ok, builds.json has imageName, tag@digest, mediaType, output - the same without BUILDKIT_TLS_DIR: fails at connect, as it should - BUILDKIT_TLS_DIR alone: the new error - a larger multi-stage build with network access in RUN: same time over TLS as over plaintext Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets y-build reach a buildkitd that requires TLS client certs, e.g. in a KVM guest.
buildctl reads only BUILDKIT_HOST from env; TLS files must be global flags. So y-buildctl now prepends
--tlsdir "$BUILDKIT_TLS_DIR"when set (ca.pem/cert.pem/key.pem, same layout as DOCKER_CERT_PATH). y-build errors if BUILDKIT_TLS_DIR is set without BUILDKIT_HOST, since in-cluster buildkitd has no TLS.Without the env var nothing changes.
Tested against moby/buildkit v0.33.0 with TLS: debug workers, y-build --push=false --output --file-output, and the two error cases.