Function jwt_signing_secret

crates/openshell-server/src/certgen.rs:321–341

Build an `Opaque` Secret carrying the gateway-minted sandbox JWT signing material. Mounted only on the gateway pod — sandbox pods receive a per-pod gateway-signed token, never the signing key itself.

(name: &str, signing_pem: &str, public_pem: &str, kid: &str)

/// signing material. Mounted only on the gateway pod — sandbox pods
/// receive a per-pod gateway-signed token, never the signing key itself.
fn jwt_signing_secret(name: &str, signing_pem: &str, public_pem: &str, kid: &str) -> Secret {
    let mut data = BTreeMap::new();
    data.insert(
        "signing.pem".to_string(),
        ByteString(signing_pem.as_bytes().to_vec()),
    );
    data.insert(
        "public.pem".to_string(),
        ByteString(public_pem.as_bytes().to_vec()),
    );
    data.insert("kid".to_string(), ByteString(kid.as_bytes().to_vec()));
    Secret {
        metadata: ObjectMeta {
            name: Some(name.to_string()),
            ..Default::default()
        },
        type_: Some("Opaque".to_string()),
        data: Some(data),
        ..Default::default()
    }
}

// ─────────────────────────────── Local mode ───────────────────────────────