busbar 0.1.2 — admin-mTLS works out of the box (live-cluster fix)

Testing the admin plane on a cert-manager cluster showed adminTLS.enabled
gave only a server cert, but busbar's boot-guard requires mTLS
(client_ca_file) on a network-exposed admin listener → crash loop.

- Wire client_ca_file from the ca.crt cert-manager writes into the
  server-cert Secret, so adminTLS.certManager.enabled=true is real mTLS
  with no extra config. Explicit clientCASecret still wins.
- Guard: adminTLS.enabled + existingSecret + no clientCASecret now fails
  helm install with guidance instead of crash-looping.

Verified on kind + cert-manager: admin+mTLS boots (client_ca_file present),
ingress + NetworkPolicy (admin restricted to one namespace) apply cleanly.

Author: MattJackson

charts/busbar/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.2
+
+Found by testing the admin-mTLS path on a live (cert-manager) cluster:
+
+- **`adminTLS.enabled` now yields real mTLS.** busbar's boot-guard requires a client CA
+  (`client_ca_file`) on a network-exposed admin listener, not just a server cert — a
+  server-cert-only config crash-looped. The chart now wires `client_ca_file` from the
+  `ca.crt` that cert-manager writes into the server-cert Secret (clients present certs
+  signed by the same issuing CA), so `adminTLS.certManager.enabled=true` works out of the
+  box. An explicit `clientCASecret` still takes precedence.
+- **New guard:** `adminTLS.enabled` with an `existingSecret` but no `clientCASecret` (where
+  the chart can't derive a CA) now fails `helm install` with guidance instead of
+  crash-looping the pod.
+
 ## 0.1.1
 
 Fixes found by deploying the chart to a live (kind) cluster — none were catchable by

charts/busbar/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: busbar
 description: A production-grade Helm chart for busbar, a Rust LLM gateway with a data plane and a separate, loopback-by-default, mTLS-gated admin plane.
 type: application
-version: 0.1.1
+version: 0.1.2
 appVersion: "1.4.0"
 kubeVersion: ">=1.24.0-0"
 home: https://getbusbar.com

charts/busbar/templates/_helpers.tpl

@@ -90,6 +90,11 @@ clear message so the user never ships an un-bootable deployment.
 {{- if and (not .Values.adminTLS.enabled) (not .Values.adminInsecure) -}}
 {{ fail "\n\nservice.admin.enabled=true exposes the admin plane on a non-loopback address (0.0.0.0:8081), which busbar's boot-guard REFUSES TO BOOT unless the admin listener requires mTLS or an explicit insecure waiver is set.\n\nFix one of:\n  --set adminTLS.enabled=true    (recommended: mTLS via cert-manager or an existing cert + client CA)\n  --set adminInsecure=true       (insecure waiver; only in a trusted, network-policied namespace)\n\nOr leave service.admin.enabled=false (default) to keep the admin plane on loopback.\n" }}
 {{- end -}}
+{{- /* mTLS needs a client CA, not just a server cert. cert-manager wires the issuing CA
+       automatically; with an existingSecret the operator must supply a client CA. */}}
+{{- if and .Values.adminTLS.enabled (not .Values.adminTLS.certManager.enabled) (not .Values.adminTLS.clientCASecret) -}}
+{{ fail "\n\nadminTLS.enabled provides a server cert but no client CA, and busbar's admin boot-guard requires mTLS (client_ca_file) on a network-exposed admin listener — a server cert alone is not enough.\n\nFix one of:\n  --set adminTLS.certManager.enabled=true   (cert-manager wires the issuing CA as the client CA automatically)\n  --set adminTLS.clientCASecret=<secret>    (a Secret with ca.crt that admin clients must chain to)\n  --set adminInsecure=true                  (skip mTLS; token-only admin plane)\n" }}
+{{- end -}}
 {{- end -}}
 {{- end }}
 

charts/busbar/templates/configmap.yaml

@@ -19,8 +19,14 @@ data:
     admin_tls:
       cert_file: /etc/busbar/tls/admin/tls.crt
       key_file: /etc/busbar/tls/admin/tls.key
+      {{- /* busbar's boot-guard requires client_ca_file (real mTLS), not just server TLS.
+             With an explicit client CA, use it. Otherwise fall back to the ca.crt that
+             cert-manager writes into the server-cert Secret (the issuing CA) so mTLS works
+             out of the box: admin clients present certs signed by that same CA. */}}
       {{- if .Values.adminTLS.clientCASecret }}
       client_ca_file: /etc/busbar/tls/admin-ca/ca.crt
+      {{- else if .Values.adminTLS.certManager.enabled }}
+      client_ca_file: /etc/busbar/tls/admin/ca.crt
       {{- end }}
     {{- end }}
     {{- if .Values.dataTLS.enabled }}