From c09b91880faa50d11a3be751613e1a9c30afeba7 Mon Sep 17 00:00:00 2001
From: Yolean k8s-qa <noreply@k8s-qa.bots.yolean.se>
Date: Mon, 5 Oct 2026 11:12:52 +0000
Subject: [PATCH] y-build: TLS to a remote buildkitd via BUILDKIT_TLS_DIR

buildctl reads only BUILDKIT_HOST from the environment; its TLS client
files are flags (--tlsdir, --tlscacert, --tlscert, --tlskey) that must
come before the subcommand, and y-build passes only --addr. So y-build
could reach ystack's in-cluster buildkitd, or a plaintext one, but not a
buildkitd that requires client certificates.

y-buildctl now prepends --tlsdir "$BUILDKIT_TLS_DIR" when that is set.
The directory holds ca.pem, cert.pem and key.pem, which is also the layout
of DOCKER_CERT_PATH, so one client cert directory can serve a remote
dockerd and buildkitd. Every y-buildctl call gets it, including y-build's
build and the debug workers probe.

y-build refuses BUILDKIT_TLS_DIR without BUILDKIT_HOST: the in-cluster
buildkitd it would discover has no TLS, and the failure would otherwise
surface as a confusing fallback to port 8547.

Unchanged without the env: the in-cluster discovery and every flag.

Verified against moby/buildkit v0.33.0 with --tlscacert/--tlscert/--tlskey:
- y-buildctl debug workers with BUILDKIT_HOST + BUILDKIT_TLS_DIR: ok
- y-build --push=false --output --file-output, multi-stage: ok, builds.json
  has imageName, tag@digest, mediaType, output
- the same without BUILDKIT_TLS_DIR: fails at connect, as it should
- BUILDKIT_TLS_DIR alone: the new error
- a larger multi-stage build with network access in RUN: same time over
  TLS as over plaintext

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 bin/y-build    | 6 ++++++
 bin/y-buildctl | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/bin/y-build b/bin/y-build
index 6b660bad..dcf794c5 100755
--- a/bin/y-build
+++ b/bin/y-build
@@ -9,6 +9,8 @@ set -eo pipefail
 #   --format <oci|tarball> format for --output, as in crane pull --format (default oci)
 #   --tarball <path>       shorthand for --output <path> --format tarball
 #   --push=false           skip push to registry
+# Env BUILDKIT_HOST selects buildkitd (default: ystack's in-cluster one), and BUILDKIT_TLS_DIR
+# its TLS client files (see y-buildctl).
 BUILDCTL_OPTS=""
 FILE_OUTPUT=""
 OUTPUT_PATH=""
@@ -155,6 +157,10 @@ fi
 DEFAULT_REGISTRY=builds-registry.ystack.svc.cluster.local
 [ -z "$BUILDS_REGISTRY" ] && BUILDS_REGISTRY=$DEFAULT_REGISTRY
 [ -z "$PUSH_REGISTRY" ]   && PUSH_REGISTRY=$DEFAULT_REGISTRY
+if [ -z "$BUILDKIT_HOST" ] && [ -n "$BUILDKIT_TLS_DIR" ]; then
+  echo "ERROR BUILDKIT_TLS_DIR is set but BUILDKIT_HOST is not; ystack's in-cluster buildkitd has no TLS" >&2
+  exit 1
+fi
 if [ -z "$BUILDKIT_HOST" ]; then
   BUILDKIT_HOSTNAME=buildkitd.ystack.svc.cluster.local
   # Prefer port 80 (Gateway API) for local clusters, fall back to 8547 (y-kubefwd for remote clusters)
diff --git a/bin/y-buildctl b/bin/y-buildctl
index 51e1d8ed..2e4c3537 100755
--- a/bin/y-buildctl
+++ b/bin/y-buildctl
@@ -5,4 +5,8 @@ YBIN="$(dirname $0)"
 
 version=$(y-bin-download $YBIN/y-bin.runner.yaml buildctl)
 
+# buildctl takes TLS client files only as flags; BUILDKIT_HOST is its only env.
+# BUILDKIT_TLS_DIR holds ca.pem, cert.pem and key.pem, the layout of DOCKER_CERT_PATH.
+[ -z "$BUILDKIT_TLS_DIR" ] || set -- --tlsdir "$BUILDKIT_TLS_DIR" "$@"
+
 y-buildctl-v${version}-bin "$@" || exit $?