Function run_kubernetes

crates/openshell-server/src/certgen.rs:123–264

(args: &CertgenArgs, bundle: &PkiBundle)

}

async fn run_kubernetes(args: &CertgenArgs, bundle: &PkiBundle) -> Result<()> {
    let namespace = args
        .namespace
        .as_deref()
        .ok_or_else(|| miette::miette!("--namespace is required (or set POD_NAMESPACE)"))?;

    let client = Client::try_default()
        .await
        .into_diagnostic()
        .wrap_err("failed to construct in-cluster Kubernetes client")?;
    let api: Api<Secret> = Api::namespaced(client, namespace);

    if args.jwt_only {
        let jwt_name = args
            .jwt_secret_name
            .as_deref()
            .ok_or_else(|| miette::miette!("--jwt-secret-name is required"))?;
        let jwt_exists = api
            .get_opt(jwt_name)
            .await
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to read secret {jwt_name}"))?
            .is_some();
        if jwt_exists {
            info!(
                namespace = %namespace,
                jwt = %jwt_name,
                "JWT signing secret already exists, skipping."
            );
            return Ok(());
        }

        let jwt_secret = jwt_signing_secret(
            jwt_name,
            &bundle.jwt_signing_key_pem,
            &bundle.jwt_public_key_pem,
            &bundle.jwt_key_id,
        );
        api.create(&PostParams::default(), &jwt_secret)
            .await
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to create secret {jwt_name}"))?;
        info!(
            namespace = %namespace,
            jwt = %jwt_name,
            "JWT signing secret created."
        );
        return Ok(());
    }

    let server_name = args
        .server_secret_name
        .as_deref()
        .ok_or_else(|| miette::miette!("--server-secret-name is required"))?;
    let client_name = args
        .client_secret_name
        .as_deref()
        .ok_or_else(|| miette::miette!("--client-secret-name is required"))?;