Support loading controller configuration from a versioned file #5337

AcidLeroy · 2022-07-25T17:16:43Z

Pull Request Motivation

The motivation for this pull request is to add a version config file for the cert-manager controller. This follows the guidance from Versioned Component Configuration Files. In addition, this closely follows the pattern defined in PR: #4546.

Checklist

Add a new ControllerConfiguration type to the v1alpha1.config.cert-manager.io API group + related code to add the new type to the schema, this should be very similar to fb81666
- ✅ Internal ControllerConfiguration and supporting functions.
- ✅ External v1apha1 ControllerConfiguration and supporting code.
Populate the new type with fields corresponding to the current controller options. Implement existing defaulting, but using defaulting functions registered for the type (see how it's done for the webhook - a defaulting function gets registered using autogenerated defaulting code with defaulter-gen. This change was done for webhook in afa8e5a (that also contains some other changes)
- ✅ Original controller defaults migrated to v1alpha1 defaults
- ✅ Defaults registered using the function SetDefaults_ControllerConfiguration.
Refactor controller command and running and initialization of the controller to use values (including defaults) from ControllerConfiguration. This change will likely be similar to afa8e5a
- ✅ cmd/controller/app/start.go command now loads values in from the configuration file.
- ✅ Initialization of the controller is now passed a ControllerConfiguration object.
Add a fuzz function for ControllerConfiguration type to config fuzzer tests similar to how it was done in 415ca56
- ✅ ConfigurationController fuzzer function has been added
Add a test to check correct precedence of controller flags vs config values like it was done in e21c6e6
- ✅ Test to check flag precedence added
Add a unittest for configfile loading like in 71a69cc
- ✅ config file is loaded the same way for both types (Webhook and Controller).
- ✅ Test covers loading logic
Add support for configmap with the new API type to helm chart similar to how it was done for webhook in 553e1e0
- ✅ Added an example to the values.yaml with a few examples of possible values.
- ✅ included a config value to the README.
- ✅ Included the configuration as a configMap that can be mounted in the controller.

Kind

/kind feature

Release Note

The cert-manager controller options are now configurable using a configuration file.

jetstack-bot · 2022-07-25T17:16:53Z

Hi @AcidLeroy. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jetstack-bot · 2023-02-15T01:26:41Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

irbekrm · 2023-03-09T15:49:23Z

/remove-lifecycle stale

internal/apis/config/controller/fuzzer/fuzzer.go

inteon · 2023-07-28T22:05:50Z

internal/apis/config/controller/v1alpha1/conversion.go

+	logsapi "k8s.io/component-base/logs/api/v1"
+)
+
+func Convert_v1alpha1_ControllerConfiguration_To_controller_ControllerConfiguration(in *v1alpha1.ControllerConfiguration, out *controller.ControllerConfiguration, s conversion.Scope) error {


nit: Do we need these 2 functions? Are they not auto-generated?

inteon · 2023-07-28T22:14:39Z

This is a great improvement @AcidLeroy!
Thank you for resolving all my questions.
/approve
/lgtm
/hold I have one optional nit, please let me know if you want to merge without fixing it.

jetstack-bot · 2023-07-28T22:15:03Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: AcidLeroy, inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

inteon · 2023-07-31T10:08:56Z

/unhold
We can fix that convert function later if necessary.

inteon · 2023-07-31T10:10:07Z

@AcidLeroy Could you also create a website documentation PR for this improvement?

inteon · 2023-07-31T10:53:14Z

@AcidLeroy Any further improvements can be made in seperate PRs.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://github.com/cert-manager/cert-manager) | minor | `v1.12.4` -> `v1.13.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.13.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.13.0) [Compare Source](cert-manager/cert-manager@v1.12.4...v1.13.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This is the 1.13 release of cert-manager! #### Community Welcome to these new cert-manager members (more info - cert-manager/cert-manager#6260): [@jsoref](https://github.com/jsoref) [@FlorianLiebhart](https://github.com/FlorianLiebhart) [@hawksight](https://github.com/hawksight) [@erikgb](https://github.com/erikgb) Thanks again to all open-source contributors with commits in this release, including: [@AcidLeroy](https://github.com/AcidLeroy) [@FlorianLiebhart](https://github.com/FlorianLiebhart) [@lucacome](https://github.com/lucacome) [@cypres](https://github.com/cypres) [@erikgb](https://github.com/erikgb) [@ubergesundheit](https://github.com/ubergesundheit) [@jkroepke](https://github.com/jkroepke) [@jsoref](https://github.com/jsoref) [@gdvalle](https://github.com/gdvalle) [@rouke-broersma](https://github.com/rouke-broersma) [@schrodit](https://github.com/schrodit) [@zhangzhiqiangcs](https://github.com/zhangzhiqiangcs) [@arukiidou](https://github.com/arukiidou) [@hawksight](https://github.com/hawksight) [@Richardds](https://github.com/Richardds) [@kahirokunn](https://github.com/kahirokunn) Thanks also to the following cert-manager maintainers for their contributions during this release: [@SgtCoDFish](https://github.com/SgtCoDFish) [@maelvls](https://github.com/maelvls) [@irbekrm](https://github.com/irbekrm) [@inteon](https://github.com/inteon) Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings! Special thanks to [@AcidLeroy](https://github.com/AcidLeroy) for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see cert-manager/cert-manager#5337) Also, thanks a lot to [@FlorianLiebhart](https://github.com/FlorianLiebhart) for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see cert-manager/cert-manager#5003) Thanks also to the [CNCF](https://www.cncf.io/), which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the [PrivateCA Issuer](https://github.com/cert-manager/aws-privateca-issuer). In addition, massive thanks to [Venafi](https://www.venafi.com/) for contributing developer time and resources towards the continued maintenance of cert-manager projects. #### Changes since v1.12.0 ##### Feature - Add support for logging options to webhook config file. ([#6243](cert-manager/cert-manager#6243), [@inteon](https://github.com/inteon)) - Add view permissions to the well-known (Openshift) user-facing `cluster-reader` aggregated cluster role ([#6241](cert-manager/cert-manager#6241), [@erikgb](https://github.com/erikgb)) - Certificate Shim: distinguish dns names and ip address in certificate ([#6267](cert-manager/cert-manager#6267), [@zhangzhiqiangcs](https://github.com/zhangzhiqiangcs)) - Cmctl can now be imported by third parties. ([#6049](cert-manager/cert-manager#6049), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Make `enableServiceLinks` configurable for all Deployments and `startupapicheck` Job in Helm chart. ([#6292](cert-manager/cert-manager#6292), [@ubergesundheit](https://github.com/ubergesundheit)) - Promoted the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta (enabled by default). ([#6298](cert-manager/cert-manager#6298), [@inteon](https://github.com/inteon)) - The cert-manager controller options are now configurable using a configuration file. ([#5337](cert-manager/cert-manager#5337), [@AcidLeroy](https://github.com/AcidLeroy)) - The pki CertificateTemplate functions now perform validation of the CSR blob, making sure we sign a Certificate that matches the IsCA and (Extended)KeyUsages that are defined in the CertificateRequest resource. ([#6199](cert-manager/cert-manager#6199), [@inteon](https://github.com/inteon)) - \[helm] Add prometheus.servicemonitor.endpointAdditionalProperties to define additional properties on a ServiceMonitor endpoint, e.g. relabelings ([#6110](cert-manager/cert-manager#6110), [@jkroepke](https://github.com/jkroepke)) ##### Design - DNS over HTTPS (DoH) is now possible for doing the self-checks during the ACME verification. The DNS check method to be used is controlled through the command line flag: `--dns01-recursive-nameservers-only=true` in combination with `--dns01-recursive-nameservers=https://<DoH-endpoint>` (e.g. `https://8.8.8.8/dns-query`). It keeps using DNS lookup as a default method. ([#5003](cert-manager/cert-manager#5003), [@FlorianLiebhart](https://github.com/FlorianLiebhart)) ##### Bug or Regression - Allow overriding default pdb .minAvailable with .maxUnavailable without setting .minAvailable to null ([#6087](cert-manager/cert-manager#6087), [@rouke-broersma](https://github.com/rouke-broersma)) - BUGFIX: `cmctl check api --wait 0` exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code ([#6109](cert-manager/cert-manager#6109), [@inteon](https://github.com/inteon)) - BUGFIX: the issuer and certificate-name annotations on a Secret were incorrectly updated when other fields are changed. ([#6147](cert-manager/cert-manager#6147), [@inteon](https://github.com/inteon)) - BUGFIX\[cainjector]: 1-character bug was causing invalid log messages and a memory leak ([#6232](cert-manager/cert-manager#6232), [@inteon](https://github.com/inteon)) - Fix CloudDNS issuers stuck in propagation check, when multiple instances are issuing for the same FQDN ([#6088](cert-manager/cert-manager#6088), [@cypres](https://github.com/cypres)) - Fix indentation of Webhook NetworkPolicy matchLabels in helm chart. ([#6220](cert-manager/cert-manager#6220), [@ubergesundheit](https://github.com/ubergesundheit)) - Fixed Cloudflare DNS01 challenge provider race condition when validating multiple domains ([#6191](cert-manager/cert-manager#6191), [@Richardds](https://github.com/Richardds)) - Fixes a bug where webhook was pulling in controller's feature gates. ⚠️ ⚠️ BREAKING ⚠️ ⚠️ : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. **Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](cert-manager/cert-manager#6093), [@irbekrm](https://github.com/irbekrm)) - Fixes an issue where cert-manager would incorrectly reject two IP addresses as being unequal when they should have compared equal. This would be most noticeable when using an IPv6 address which doesn't match how Go's `net.IP.String()` function would have printed that address. ([#6293](cert-manager/cert-manager#6293), [@SgtCoDFish](https://github.com/SgtCoDFish)) - We disabled the `enableServiceLinks` option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. ([#6143](cert-manager/cert-manager#6143), [@schrodit](https://github.com/schrodit)) - ⚠️ possibly breaking: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](cert-manager/cert-manager#6182), [@inteon](https://github.com/inteon)) ##### Other (Cleanup or Flake) - A subset of the klogs flags have been deprecated and will be removed in the future. ([#5879](cert-manager/cert-manager#5879), [@maelvls](https://github.com/maelvls)) - All service links in helm chart deployments have been disabled. ([#6144](cert-manager/cert-manager#6144), [@schrodit](https://github.com/schrodit)) - Cert-manager will now re-issue a certificate if the public key in the latest CertificateRequest resource linked to a Certificate resource does not match the public key of the key encoded in the Secret linked to that Certificate resource ([#6168](cert-manager/cert-manager#6168), [@inteon](https://github.com/inteon)) - Chore: When hostNetwork is enabled, dnsPolicy is now set to ClusterFirstWithHostNet. ([#6156](cert-manager/cert-manager#6156), [@kahirokunn](https://github.com/kahirokunn)) - Cleanup the controller configfile structure by introducing sub-structs. ([#6242](cert-manager/cert-manager#6242), [@inteon](https://github.com/inteon)) - Don't run API Priority and Fairness controller in webhook's extension apiserver ([#6085](cert-manager/cert-manager#6085), [@irbekrm](https://github.com/irbekrm)) - Helm: Add apache 2.0 license annotation ([#6225](cert-manager/cert-manager#6225), [@arukiidou](https://github.com/arukiidou)) - Make apis/acme/v1/ACMEIssuer.PreferredChain optional in JSON serialization. ([#6034](cert-manager/cert-manager#6034), [@gdvalle](https://github.com/gdvalle)) - The SecretPostIssuancePolicyChain now also makes sure that the `cert-manager.io/common-name`, `cert-manager.io/alt-names`, ... annotations on Secrets are kept at their correct value. ([#6176](cert-manager/cert-manager#6176), [@inteon](https://github.com/inteon)) - The cmctl logging has been improved and support for json logging has been added. ([#6247](cert-manager/cert-manager#6247), [@inteon](https://github.com/inteon)) - Updates Kubernetes libraries to `v0.27.2`. ([#6077](cert-manager/cert-manager#6077), [@lucacome](https://github.com/lucacome)) - Updates Kubernetes libraries to `v0.27.4`. ([#6227](cert-manager/cert-manager#6227), [@lucacome](https://github.com/lucacome)) - We now only check that the issuer name, kind and group annotations on a Secret match in case those annotations are set. ([#6152](cert-manager/cert-manager#6152), [@inteon](https://github.com/inteon)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.home/nrdufour/home-ops/pulls/84 Co-authored-by: Renovate <renovate@ptinem.io> Co-committed-by: Renovate <renovate@ptinem.io>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://togithub.com/cert-manager/cert-manager) | minor | `v1.12.4` -> `v1.13.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.13.0`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.0) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.4...v1.13.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This is the 1.13 release of cert-manager! #### Community Welcome to these new cert-manager members (more info - [cert-manager/cert-manager#6260): [@jsoref](https://togithub.com/jsoref) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@hawksight](https://togithub.com/hawksight) [@erikgb](https://togithub.com/erikgb) Thanks again to all open-source contributors with commits in this release, including: [@AcidLeroy](https://togithub.com/AcidLeroy) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@lucacome](https://togithub.com/lucacome) [@cypres](https://togithub.com/cypres) [@erikgb](https://togithub.com/erikgb) [@ubergesundheit](https://togithub.com/ubergesundheit) [@jkroepke](https://togithub.com/jkroepke) [@jsoref](https://togithub.com/jsoref) [@gdvalle](https://togithub.com/gdvalle) [@rouke-broersma](https://togithub.com/rouke-broersma) [@schrodit](https://togithub.com/schrodit) [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs) [@arukiidou](https://togithub.com/arukiidou) [@hawksight](https://togithub.com/hawksight) [@Richardds](https://togithub.com/Richardds) [@kahirokunn](https://togithub.com/kahirokunn) Thanks also to the following cert-manager maintainers for their contributions during this release: [@SgtCoDFish](https://togithub.com/SgtCoDFish) [@maelvls](https://togithub.com/maelvls) [@irbekrm](https://togithub.com/irbekrm) [@inteon](https://togithub.com/inteon) Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings! Special thanks to [@AcidLeroy](https://togithub.com/AcidLeroy) for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see [cert-manager/cert-manager#5337) Also, thanks a lot to [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see [cert-manager/cert-manager#5003) Thanks also to the [CNCF](https://www.cncf.io/), which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the [PrivateCA Issuer](https://togithub.com/cert-manager/aws-privateca-issuer). In addition, massive thanks to [Venafi](https://www.venafi.com/) for contributing developer time and resources towards the continued maintenance of cert-manager projects. #### Changes since v1.12.0 ##### Feature - Add support for logging options to webhook config file. ([#6243](https://togithub.com/cert-manager/cert-manager/issues/6243), [@inteon](https://togithub.com/inteon)) - Add view permissions to the well-known (Openshift) user-facing `cluster-reader` aggregated cluster role ([#6241](https://togithub.com/cert-manager/cert-manager/issues/6241), [@erikgb](https://togithub.com/erikgb)) - Certificate Shim: distinguish dns names and ip address in certificate ([#6267](https://togithub.com/cert-manager/cert-manager/issues/6267), [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs)) - Cmctl can now be imported by third parties. ([#6049](https://togithub.com/cert-manager/cert-manager/issues/6049), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - Make `enableServiceLinks` configurable for all Deployments and `startupapicheck` Job in Helm chart. ([#6292](https://togithub.com/cert-manager/cert-manager/issues/6292), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Promoted the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta (enabled by default). ([#6298](https://togithub.com/cert-manager/cert-manager/issues/6298), [@inteon](https://togithub.com/inteon)) - The cert-manager controller options are now configurable using a configuration file. ([#5337](https://togithub.com/cert-manager/cert-manager/issues/5337), [@AcidLeroy](https://togithub.com/AcidLeroy)) - The pki CertificateTemplate functions now perform validation of the CSR blob, making sure we sign a Certificate that matches the IsCA and (Extended)KeyUsages that are defined in the CertificateRequest resource. ([#6199](https://togithub.com/cert-manager/cert-manager/issues/6199), [@inteon](https://togithub.com/inteon)) - \[helm] Add prometheus.servicemonitor.endpointAdditionalProperties to define additional properties on a ServiceMonitor endpoint, e.g. relabelings ([#6110](https://togithub.com/cert-manager/cert-manager/issues/6110), [@jkroepke](https://togithub.com/jkroepke)) ##### Design - DNS over HTTPS (DoH) is now possible for doing the self-checks during the ACME verification. The DNS check method to be used is controlled through the command line flag: `--dns01-recursive-nameservers-only=true` in combination with `--dns01-recursive-nameservers=https://<DoH-endpoint>` (e.g. `https://8.8.8.8/dns-query`). It keeps using DNS lookup as a default method. ([#5003](https://togithub.com/cert-manager/cert-manager/issues/5003), [@FlorianLiebhart](https://togithub.com/FlorianLiebhart)) ##### Bug or Regression - Allow overriding default pdb .minAvailable with .maxUnavailable without setting .minAvailable to null ([#6087](https://togithub.com/cert-manager/cert-manager/issues/6087), [@rouke-broersma](https://togithub.com/rouke-broersma)) - BUGFIX: `cmctl check api --wait 0` exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code ([#6109](https://togithub.com/cert-manager/cert-manager/issues/6109), [@inteon](https://togithub.com/inteon)) - BUGFIX: the issuer and certificate-name annotations on a Secret were incorrectly updated when other fields are changed. ([#6147](https://togithub.com/cert-manager/cert-manager/issues/6147), [@inteon](https://togithub.com/inteon)) - BUGFIX\[cainjector]: 1-character bug was causing invalid log messages and a memory leak ([#6232](https://togithub.com/cert-manager/cert-manager/issues/6232), [@inteon](https://togithub.com/inteon)) - Fix CloudDNS issuers stuck in propagation check, when multiple instances are issuing for the same FQDN ([#6088](https://togithub.com/cert-manager/cert-manager/issues/6088), [@cypres](https://togithub.com/cypres)) - Fix indentation of Webhook NetworkPolicy matchLabels in helm chart. ([#6220](https://togithub.com/cert-manager/cert-manager/issues/6220), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Fixed Cloudflare DNS01 challenge provider race condition when validating multiple domains ([#6191](https://togithub.com/cert-manager/cert-manager/issues/6191), [@Richardds](https://togithub.com/Richardds)) - Fixes a bug where webhook was pulling in controller's feature gates. ⚠️ ⚠️ BREAKING ⚠️ ⚠️ : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. **Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) - Fixes an issue where cert-manager would incorrectly reject two IP addresses as being unequal when they should have compared equal. This would be most noticeable when using an IPv6 address which doesn't match how Go's `net.IP.String()` function would have printed that address. ([#6293](https://togithub.com/cert-manager/cert-manager/issues/6293), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - We disabled the `enableServiceLinks` option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. ([#6143](https://togithub.com/cert-manager/cert-manager/issues/6143), [@schrodit](https://togithub.com/schrodit)) - ⚠️ possibly breaking: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](https://togithub.com/cert-manager/cert-manager/issues/6182), [@inteon](https://togithub.com/inteon)) ##### Other (Cleanup or Flake) - A subset of the klogs flags have been deprecated and will be removed in the future. ([#5879](https://togithub.com/cert-manager/cert-manager/issues/5879), [@maelvls](https://togithub.com/maelvls)) - All service links in helm chart deployments have been disabled. ([#6144](https://togithub.com/cert-manager/cert-manager/issues/6144), [@schrodit](https://togithub.com/schrodit)) - Cert-manager will now re-issue a certificate if the public key in the latest CertificateRequest resource linked to a Certificate resource does not match the public key of the key encoded in the Secret linked to that Certificate resource ([#6168](https://togithub.com/cert-manager/cert-manager/issues/6168), [@inteon](https://togithub.com/inteon)) - Chore: When hostNetwork is enabled, dnsPolicy is now set to ClusterFirstWithHostNet. ([#6156](https://togithub.com/cert-manager/cert-manager/issues/6156), [@kahirokunn](https://togithub.com/kahirokunn)) - Cleanup the controller configfile structure by introducing sub-structs. ([#6242](https://togithub.com/cert-manager/cert-manager/issues/6242), [@inteon](https://togithub.com/inteon)) - Don't run API Priority and Fairness controller in webhook's extension apiserver ([#6085](https://togithub.com/cert-manager/cert-manager/issues/6085), [@irbekrm](https://togithub.com/irbekrm)) - Helm: Add apache 2.0 license annotation ([#6225](https://togithub.com/cert-manager/cert-manager/issues/6225), [@arukiidou](https://togithub.com/arukiidou)) - Make apis/acme/v1/ACMEIssuer.PreferredChain optional in JSON serialization. ([#6034](https://togithub.com/cert-manager/cert-manager/issues/6034), [@gdvalle](https://togithub.com/gdvalle)) - The SecretPostIssuancePolicyChain now also makes sure that the `cert-manager.io/common-name`, `cert-manager.io/alt-names`, ... annotations on Secrets are kept at their correct value. ([#6176](https://togithub.com/cert-manager/cert-manager/issues/6176), [@inteon](https://togithub.com/inteon)) - The cmctl logging has been improved and support for json logging has been added. ([#6247](https://togithub.com/cert-manager/cert-manager/issues/6247), [@inteon](https://togithub.com/inteon)) - Updates Kubernetes libraries to `v0.27.2`. ([#6077](https://togithub.com/cert-manager/cert-manager/issues/6077), [@lucacome](https://togithub.com/lucacome)) - Updates Kubernetes libraries to `v0.27.4`. ([#6227](https://togithub.com/cert-manager/cert-manager/issues/6227), [@lucacome](https://togithub.com/lucacome)) - We now only check that the issuer name, kind and group annotations on a Secret match in case those annotations are set. ([#6152](https://togithub.com/cert-manager/cert-manager/issues/6152), [@inteon](https://togithub.com/inteon)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: lumiere-bot <98047013+lumiere-bot[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://togithub.com/cert-manager/cert-manager) | minor | `v1.12.4` -> `v1.13.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.13.0`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.0) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.4...v1.13.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This is the 1.13 release of cert-manager! cert-manager 1.13 brings support for DNS over HTTPS, support for loading options from a versioned config file for the cert-manager controller, and more. This release also includes the promotion of the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta. #### Breaking Changes (You MUST read this before you upgrade!) 1. **BREAKING** : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) 2. **Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) 3. **Potentially breaking**: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](https://togithub.com/cert-manager/cert-manager/issues/6182), [@inteon](https://togithub.com/inteon)) #### Community Welcome to these new cert-manager members (more info - [cert-manager/cert-manager#6260): [@jsoref](https://togithub.com/jsoref) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@hawksight](https://togithub.com/hawksight) [@erikgb](https://togithub.com/erikgb) Thanks again to all open-source contributors with commits in this release, including: [@AcidLeroy](https://togithub.com/AcidLeroy) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@lucacome](https://togithub.com/lucacome) [@cypres](https://togithub.com/cypres) [@erikgb](https://togithub.com/erikgb) [@ubergesundheit](https://togithub.com/ubergesundheit) [@jkroepke](https://togithub.com/jkroepke) [@jsoref](https://togithub.com/jsoref) [@gdvalle](https://togithub.com/gdvalle) [@rouke-broersma](https://togithub.com/rouke-broersma) [@schrodit](https://togithub.com/schrodit) [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs) [@arukiidou](https://togithub.com/arukiidou) [@hawksight](https://togithub.com/hawksight) [@Richardds](https://togithub.com/Richardds) [@kahirokunn](https://togithub.com/kahirokunn) Thanks also to the following cert-manager maintainers for their contributions during this release: [@SgtCoDFish](https://togithub.com/SgtCoDFish) [@maelvls](https://togithub.com/maelvls) [@irbekrm](https://togithub.com/irbekrm) [@inteon](https://togithub.com/inteon) Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings! Special thanks to [@AcidLeroy](https://togithub.com/AcidLeroy) for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see [cert-manager/cert-manager#5337) Also, thanks a lot to [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see [cert-manager/cert-manager#5003) Thanks also to the [CNCF](https://www.cncf.io/), which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the [PrivateCA Issuer](https://togithub.com/cert-manager/aws-privateca-issuer). In addition, massive thanks to [Venafi](https://www.venafi.com/) for contributing developer time and resources towards the continued maintenance of cert-manager projects. #### Changes since v1.12.0 ##### Feature - Add support for logging options to webhook config file. ([#6243](https://togithub.com/cert-manager/cert-manager/issues/6243), [@inteon](https://togithub.com/inteon)) - Add view permissions to the well-known (Openshift) user-facing `cluster-reader` aggregated cluster role ([#6241](https://togithub.com/cert-manager/cert-manager/issues/6241), [@erikgb](https://togithub.com/erikgb)) - Certificate Shim: distinguish dns names and ip address in certificate ([#6267](https://togithub.com/cert-manager/cert-manager/issues/6267), [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs)) - Cmctl can now be imported by third parties. ([#6049](https://togithub.com/cert-manager/cert-manager/issues/6049), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - Make `enableServiceLinks` configurable for all Deployments and `startupapicheck` Job in Helm chart. ([#6292](https://togithub.com/cert-manager/cert-manager/issues/6292), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Promoted the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta (enabled by default). ([#6298](https://togithub.com/cert-manager/cert-manager/issues/6298), [@inteon](https://togithub.com/inteon)) - The cert-manager controller options are now configurable using a configuration file. ([#5337](https://togithub.com/cert-manager/cert-manager/issues/5337), [@AcidLeroy](https://togithub.com/AcidLeroy)) - The pki CertificateTemplate functions now perform validation of the CSR blob, making sure we sign a Certificate that matches the IsCA and (Extended)KeyUsages that are defined in the CertificateRequest resource. ([#6199](https://togithub.com/cert-manager/cert-manager/issues/6199), [@inteon](https://togithub.com/inteon)) - \[helm] Add prometheus.servicemonitor.endpointAdditionalProperties to define additional properties on a ServiceMonitor endpoint, e.g. relabelings ([#6110](https://togithub.com/cert-manager/cert-manager/issues/6110), [@jkroepke](https://togithub.com/jkroepke)) ##### Design - DNS over HTTPS (DoH) is now possible for doing the self-checks during the ACME verification. The DNS check method to be used is controlled through the command line flag: `--dns01-recursive-nameservers-only=true` in combination with `--dns01-recursive-nameservers=https://<DoH-endpoint>` (e.g. `https://8.8.8.8/dns-query`). It keeps using DNS lookup as a default method. ([#5003](https://togithub.com/cert-manager/cert-manager/issues/5003), [@FlorianLiebhart](https://togithub.com/FlorianLiebhart)) ##### Bug or Regression - Allow overriding default pdb .minAvailable with .maxUnavailable without setting .minAvailable to null ([#6087](https://togithub.com/cert-manager/cert-manager/issues/6087), [@rouke-broersma](https://togithub.com/rouke-broersma)) - BUGFIX: `cmctl check api --wait 0` exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code ([#6109](https://togithub.com/cert-manager/cert-manager/issues/6109), [@inteon](https://togithub.com/inteon)) - BUGFIX: the issuer and certificate-name annotations on a Secret were incorrectly updated when other fields are changed. ([#6147](https://togithub.com/cert-manager/cert-manager/issues/6147), [@inteon](https://togithub.com/inteon)) - BUGFIX\[cainjector]: 1-character bug was causing invalid log messages and a memory leak ([#6232](https://togithub.com/cert-manager/cert-manager/issues/6232), [@inteon](https://togithub.com/inteon)) - Fix CloudDNS issuers stuck in propagation check, when multiple instances are issuing for the same FQDN ([#6088](https://togithub.com/cert-manager/cert-manager/issues/6088), [@cypres](https://togithub.com/cypres)) - Fix indentation of Webhook NetworkPolicy matchLabels in helm chart. ([#6220](https://togithub.com/cert-manager/cert-manager/issues/6220), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Fixed Cloudflare DNS01 challenge provider race condition when validating multiple domains ([#6191](https://togithub.com/cert-manager/cert-manager/issues/6191), [@Richardds](https://togithub.com/Richardds)) - Fixes a bug where webhook was pulling in controller's feature gates. **⚠️ ⚠️ BREAKING ⚠️ ⚠️** : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. **⚠️Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) - Fixes an issue where cert-manager would incorrectly reject two IP addresses as being unequal when they should have compared equal. This would be most noticeable when using an IPv6 address which doesn't match how Go's `net.IP.String()` function would have printed that address. ([#6293](https://togithub.com/cert-manager/cert-manager/issues/6293), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - We disabled the `enableServiceLinks` option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. ([#6143](https://togithub.com/cert-manager/cert-manager/issues/6143), [@schrodit](https://togithub.com/schrodit)) - **⚠️Potentially breaking**: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](https://togithub.com/cert-manager/cert-manager/issues/6182), [@inteon](https://togithub.com/inteon)) ##### Other (Cleanup or Flake) - A subset of the klogs flags have been deprecated and will be removed in the future. ([#5879](https://togithub.com/cert-manager/cert-manager/issues/5879), [@maelvls](https://togithub.com/maelvls)) - All service links in helm chart deployments have been disabled. ([#6144](https://togithub.com/cert-manager/cert-manager/issues/6144), [@schrodit](https://togithub.com/schrodit)) - Cert-manager will now re-issue a certificate if the public key in the latest CertificateRequest resource linked to a Certificate resource does not match the public key of the key encoded in the Secret linked to that Certificate resource ([#6168](https://togithub.com/cert-manager/cert-manager/issues/6168), [@inteon](https://togithub.com/inteon)) - Chore: When hostNetwork is enabled, dnsPolicy is now set to ClusterFirstWithHostNet. ([#6156](https://togithub.com/cert-manager/cert-manager/issues/6156), [@kahirokunn](https://togithub.com/kahirokunn)) - Cleanup the controller configfile structure by introducing sub-structs. ([#6242](https://togithub.com/cert-manager/cert-manager/issues/6242), [@inteon](https://togithub.com/inteon)) - Don't run API Priority and Fairness controller in webhook's extension apiserver ([#6085](https://togithub.com/cert-manager/cert-manager/issues/6085), [@irbekrm](https://togithub.com/irbekrm)) - Helm: Add apache 2.0 license annotation ([#6225](https://togithub.com/cert-manager/cert-manager/issues/6225), [@arukiidou](https://togithub.com/arukiidou)) - Make apis/acme/v1/ACMEIssuer.PreferredChain optional in JSON serialization. ([#6034](https://togithub.com/cert-manager/cert-manager/issues/6034), [@gdvalle](https://togithub.com/gdvalle)) - The SecretPostIssuancePolicyChain now also makes sure that the `cert-manager.io/common-name`, `cert-manager.io/alt-names`, ... annotations on Secrets are kept at their correct value. ([#6176](https://togithub.com/cert-manager/cert-manager/issues/6176), [@inteon](https://togithub.com/inteon)) - The cmctl logging has been improved and support for json logging has been added. ([#6247](https://togithub.com/cert-manager/cert-manager/issues/6247), [@inteon](https://togithub.com/inteon)) - Updates Kubernetes libraries to `v0.27.2`. ([#6077](https://togithub.com/cert-manager/cert-manager/issues/6077), [@lucacome](https://togithub.com/lucacome)) - Updates Kubernetes libraries to `v0.27.4`. ([#6227](https://togithub.com/cert-manager/cert-manager/issues/6227), [@lucacome](https://togithub.com/lucacome)) - We now only check that the issuer name, kind and group annotations on a Secret match in case those annotations are set. ([#6152](https://togithub.com/cert-manager/cert-manager/issues/6152), [@inteon](https://togithub.com/inteon)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  Co-authored-by: repo-jeeves <106431701+repo-jeeves[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://togithub.com/cert-manager/cert-manager) | minor | `v1.12.3` -> `v1.13.1` | | [clickhouse](https://truecharts.org/charts/dependency/clickhouse) ([source](https://togithub.com/truecharts/charts)) | patch | `7.0.1` -> `7.0.8` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.1` -> `14.0.6` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.3` -> `14.0.6` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.4` -> `14.0.6` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `13.2.1` -> `13.2.2` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.2` -> `14.0.6` | | [redis](https://truecharts.org/charts/dependency/redis) ([source](https://togithub.com/truecharts/charts)) | patch | `8.0.0` -> `8.0.27` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.13.1`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.1) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.13.0...v1.13.1) v1.13.1 contains a bugfix for a name collision bug in the StableCertificateRequestName feature that was enabled by default in v1.13.0. ##### ⚠️ READ https://github.com/cert-manager/cert-manager/releases/tag/v1.13.0 before you upgrade from a < v1.13 version! #### Changes since v1.13.0 ##### Bug or Regression - BUGFIX: fix CertificateRequest name collision bug in StableCertificateRequestName feature. ([#6358](https://togithub.com/cert-manager/cert-manager/issues/6358), [@jetstack-bot](https://togithub.com/jetstack-bot)) ##### Other (Cleanup or Flake) - Upgrade `github.com/emicklei/go-restful/v3` to `v3.11.0` because `v3.10.2` is labeled as "DO NOT USE". ([#6368](https://togithub.com/cert-manager/cert-manager/issues/6368), [@inteon](https://togithub.com/inteon)) - Upgrade Go from 1.20.7 to 1.20.8. ([#6370](https://togithub.com/cert-manager/cert-manager/issues/6370), [@jetstack-bot](https://togithub.com/jetstack-bot)) ### [`v1.13.0`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.0) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.5...v1.13.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This is the 1.13 release of cert-manager! cert-manager 1.13 brings support for DNS over HTTPS, support for loading options from a versioned config file for the cert-manager controller, and more. This release also includes the promotion of the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta. #### Known issues The `StableCertificateRequestName` that was promoted to Beta contains a "name collision" bug: [cert-manager/cert-manager#6342 This will be fixed in v1.13.1. #### Breaking Changes (You MUST read this before you upgrade!) 1. **BREAKING** : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) 2. **Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) 3. **Potentially breaking**: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](https://togithub.com/cert-manager/cert-manager/issues/6182), [@inteon](https://togithub.com/inteon)) #### Community Welcome to these new cert-manager members (more info - [cert-manager/cert-manager#6260): [@jsoref](https://togithub.com/jsoref) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@hawksight](https://togithub.com/hawksight) [@erikgb](https://togithub.com/erikgb) Thanks again to all open-source contributors with commits in this release, including: [@AcidLeroy](https://togithub.com/AcidLeroy) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@lucacome](https://togithub.com/lucacome) [@cypres](https://togithub.com/cypres) [@erikgb](https://togithub.com/erikgb) [@ubergesundheit](https://togithub.com/ubergesundheit) [@jkroepke](https://togithub.com/jkroepke) [@jsoref](https://togithub.com/jsoref) [@gdvalle](https://togithub.com/gdvalle) [@rouke-broersma](https://togithub.com/rouke-broersma) [@schrodit](https://togithub.com/schrodit) [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs) [@arukiidou](https://togithub.com/arukiidou) [@hawksight](https://togithub.com/hawksight) [@Richardds](https://togithub.com/Richardds) [@kahirokunn](https://togithub.com/kahirokunn) Thanks also to the following cert-manager maintainers for their contributions during this release: [@SgtCoDFish](https://togithub.com/SgtCoDFish) [@maelvls](https://togithub.com/maelvls) [@irbekrm](https://togithub.com/irbekrm) [@inteon](https://togithub.com/inteon) Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings! Special thanks to [@AcidLeroy](https://togithub.com/AcidLeroy) for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see [cert-manager/cert-manager#5337) Also, thanks a lot to [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see [cert-manager/cert-manager#5003) Thanks also to the [CNCF](https://www.cncf.io/), which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the [PrivateCA Issuer](https://togithub.com/cert-manager/aws-privateca-issuer). In addition, massive thanks to [Venafi](https://www.venafi.com/) for contributing developer time and resources towards the continued maintenance of cert-manager projects. #### Changes since v1.12.0 ##### Feature - Add support for logging options to webhook config file. ([#6243](https://togithub.com/cert-manager/cert-manager/issues/6243), [@inteon](https://togithub.com/inteon)) - Add view permissions to the well-known (Openshift) user-facing `cluster-reader` aggregated cluster role ([#6241](https://togithub.com/cert-manager/cert-manager/issues/6241), [@erikgb](https://togithub.com/erikgb)) - Certificate Shim: distinguish dns names and ip address in certificate ([#6267](https://togithub.com/cert-manager/cert-manager/issues/6267), [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs)) - Cmctl can now be imported by third parties. ([#6049](https://togithub.com/cert-manager/cert-manager/issues/6049), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - Make `enableServiceLinks` configurable for all Deployments and `startupapicheck` Job in Helm chart. ([#6292](https://togithub.com/cert-manager/cert-manager/issues/6292), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Promoted the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta (enabled by default). ([#6298](https://togithub.com/cert-manager/cert-manager/issues/6298), [@inteon](https://togithub.com/inteon)) - The cert-manager controller options are now configurable using a configuration file. ([#5337](https://togithub.com/cert-manager/cert-manager/issues/5337), [@AcidLeroy](https://togithub.com/AcidLeroy)) - The pki CertificateTemplate functions now perform validation of the CSR blob, making sure we sign a Certificate that matches the IsCA and (Extended)KeyUsages that are defined in the CertificateRequest resource. ([#6199](https://togithub.com/cert-manager/cert-manager/issues/6199), [@inteon](https://togithub.com/inteon)) - \[helm] Add prometheus.servicemonitor.endpointAdditionalProperties to define additional properties on a ServiceMonitor endpoint, e.g. relabelings ([#6110](https://togithub.com/cert-manager/cert-manager/issues/6110), [@jkroepke](https://togithub.com/jkroepke)) ##### Design - DNS over HTTPS (DoH) is now possible for doing the self-checks during the ACME verification. The DNS check method to be used is controlled through the command line flag: `--dns01-recursive-nameservers-only=true` in combination with `--dns01-recursive-nameservers=https://<DoH-endpoint>` (e.g. `https://8.8.8.8/dns-query`). It keeps using DNS lookup as a default method. ([#5003](https://togithub.com/cert-manager/cert-manager/issues/5003), [@FlorianLiebhart](https://togithub.com/FlorianLiebhart)) ##### Bug or Regression - Allow overriding default pdb .minAvailable with .maxUnavailable without setting .minAvailable to null ([#6087](https://togithub.com/cert-manager/cert-manager/issues/6087), [@rouke-broersma](https://togithub.com/rouke-broersma)) - BUGFIX: `cmctl check api --wait 0` exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code ([#6109](https://togithub.com/cert-manager/cert-manager/issues/6109), [@inteon](https://togithub.com/inteon)) - BUGFIX: the issuer and certificate-name annotations on a Secret were incorrectly updated when other fields are changed. ([#6147](https://togithub.com/cert-manager/cert-manager/issues/6147), [@inteon](https://togithub.com/inteon)) - BUGFIX\[cainjector]: 1-character bug was causing invalid log messages and a memory leak ([#6232](https://togithub.com/cert-manager/cert-manager/issues/6232), [@inteon](https://togithub.com/inteon)) - Fix CloudDNS issuers stuck in propagation check, when multiple instances are issuing for the same FQDN ([#6088](https://togithub.com/cert-manager/cert-manager/issues/6088), [@cypres](https://togithub.com/cypres)) - Fix indentation of Webhook NetworkPolicy matchLabels in helm chart. ([#6220](https://togithub.com/cert-manager/cert-manager/issues/6220), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Fixed Cloudflare DNS01 challenge provider race condition when validating multiple domains ([#6191](https://togithub.com/cert-manager/cert-manager/issues/6191), [@Richardds](https://togithub.com/Richardds)) - Fixes a bug where webhook was pulling in controller's feature gates. **⚠️ ⚠️ BREAKING ⚠️ ⚠️** : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. **⚠️Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) - Fixes an issue where cert-manager would incorrectly reject two IP addresses as being unequal when they should have compared equal. This would be most noticeable when using an IPv6 address which doesn't match how Go's `net.IP.String()` function would have printed that address. ([#6293](https://togithub.com/cert-manager/cert-manager/issues/6293), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - We disabled the `enableServiceLinks` option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. ([#6143](https://togithub.com/cert-manager/cert-manager/issues/6143), [@schrodit](https://togithub.com/schrodit)) - **⚠️Potentially breaking**: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](https://togithub.com/cert-manager/cert-manager/issues/6182), [@inteon](https://togithub.com/inteon)) ##### Other (Cleanup or Flake) - A subset of the klogs flags have been deprecated and will be removed in the future. ([#5879](https://togithub.com/cert-manager/cert-manager/issues/5879), [@maelvls](https://togithub.com/maelvls)) - All service links in helm chart deployments have been disabled. ([#6144](https://togithub.com/cert-manager/cert-manager/issues/6144), [@schrodit](https://togithub.com/schrodit)) - Cert-manager will now re-issue a certificate if the public key in the latest CertificateRequest resource linked to a Certificate resource does not match the public key of the key encoded in the Secret linked to that Certificate resource ([#6168](https://togithub.com/cert-manager/cert-manager/issues/6168), [@inteon](https://togithub.com/inteon)) - Chore: When hostNetwork is enabled, dnsPolicy is now set to ClusterFirstWithHostNet. ([#6156](https://togithub.com/cert-manager/cert-manager/issues/6156), [@kahirokunn](https://togithub.com/kahirokunn)) - Cleanup the controller configfile structure by introducing sub-structs. ([#6242](https://togithub.com/cert-manager/cert-manager/issues/6242), [@inteon](https://togithub.com/inteon)) - Don't run API Priority and Fairness controller in webhook's extension apiserver ([#6085](https://togithub.com/cert-manager/cert-manager/issues/6085), [@irbekrm](https://togithub.com/irbekrm)) - Helm: Add apache 2.0 license annotation ([#6225](https://togithub.com/cert-manager/cert-manager/issues/6225), [@arukiidou](https://togithub.com/arukiidou)) - Make apis/acme/v1/ACMEIssuer.PreferredChain optional in JSON serialization. ([#6034](https://togithub.com/cert-manager/cert-manager/issues/6034), [@gdvalle](https://togithub.com/gdvalle)) - The SecretPostIssuancePolicyChain now also makes sure that the `cert-manager.io/common-name`, `cert-manager.io/alt-names`, ... annotations on Secrets are kept at their correct value. ([#6176](https://togithub.com/cert-manager/cert-manager/issues/6176), [@inteon](https://togithub.com/inteon)) - The cmctl logging has been improved and support for json logging has been added. ([#6247](https://togithub.com/cert-manager/cert-manager/issues/6247), [@inteon](https://togithub.com/inteon)) - Updates Kubernetes libraries to `v0.27.2`. ([#6077](https://togithub.com/cert-manager/cert-manager/issues/6077), [@lucacome](https://togithub.com/lucacome)) - Updates Kubernetes libraries to `v0.27.4`. ([#6227](https://togithub.com/cert-manager/cert-manager/issues/6227), [@lucacome](https://togithub.com/lucacome)) - We now only check that the issuer name, kind and group annotations on a Secret match in case those annotations are set. ([#6152](https://togithub.com/cert-manager/cert-manager/issues/6152), [@inteon](https://togithub.com/inteon)) ### [`v1.12.5`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.12.5) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.4...v1.12.5) v1.12.5 contains a backport for a name collision bug that was found in v1.13.0 #### Changes since v1.12.4 ##### Bug or Regression - BUGFIX: fix CertificateRequest name collision bug in StableCertificateRequestName feature. ([#6359](https://togithub.com/cert-manager/cert-manager/issues/6359), [@jetstack-bot](https://togithub.com/jetstack-bot)) ##### Other (Cleanup or Flake) - Updated base images to the latest version. ([#6372](https://togithub.com/cert-manager/cert-manager/issues/6372), [@inteon](https://togithub.com/inteon)) - Upgrade Go from 1.20.7 to 1.20.8. ([#6371](https://togithub.com/cert-manager/cert-manager/issues/6371), [@jetstack-bot](https://togithub.com/jetstack-bot)) ### [`v1.12.4`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.12.4) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.3...v1.12.4) v1.12.4 contains an important security fix that addresses [CVE-2023-29409](https://cve.report/CVE-2023-29409). #### Changes since v1.12.3 - Fixes an issue where cert-manager would incorrectly reject two IP addresses as being unequal when they should hav e compared equal. This would be most noticeable when using an IPv6 address which doesn't match how Go's `net.IP.String()` function would have printed that address. ([#6297](https://togithub.com/cert-manager/cert-manager/issues/6297), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - Use Go 1.20.7 to fix a security issue in Go's `crypto/tls` library. ([#6318](https://togithub.com/cert-manager/cert-manager/issues/6318), [@maelvls](https://togithub.com/maelvls)) </details> <details> <summary>truecharts/charts (clickhouse)</summary> ### [`v7.0.8`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.8) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.7...clickhouse-7.0.8) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.7`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.7) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.6...clickhouse-7.0.7) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.6`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.6) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.5...clickhouse-7.0.6) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.5`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.5) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.4...clickhouse-7.0.5) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.4`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.4) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.3...clickhouse-7.0.4) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.3`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.3) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.2...clickhouse-7.0.3) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.2`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.2) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.1...clickhouse-7.0.2) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). </details> <details> <summary>truecharts/library-charts (common)</summary> ### [`v14.0.6`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.6) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.5...common-14.0.6) Function library for TrueCharts ### [`v14.0.5`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.5) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.4...common-14.0.5) Function library for TrueCharts ### [`v14.0.4`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.4) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.3...common-14.0.4) Function library for TrueCharts ### [`v14.0.3`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.3) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.2...common-14.0.3) Function library for TrueCharts ### [`v14.0.2`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.2) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.1...common-14.0.2) Function library for TrueCharts </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 10pm on tuesday" in timezone Europe/Amsterdam, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://togithub.com/cert-manager/cert-manager) | minor | `v1.12.3` -> `v1.13.1` | | [clickhouse](https://truecharts.org/charts/dependency/clickhouse) ([source](https://togithub.com/truecharts/charts)) | patch | `7.0.1` -> `7.0.9` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.1` -> `14.0.9` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.6` -> `14.0.9` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.3` -> `14.0.9` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.4` -> `14.0.9` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `13.2.1` -> `13.2.2` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.2` -> `14.0.9` | | [common](https://togithub.com/truecharts/apps/tree/master/charts/common) ([source](https://togithub.com/truecharts/library-charts)) | patch | `14.0.8` -> `14.0.9` | | [kube-state-metrics](https://truecharts.org/charts/dependency/kube-state-metrics) ([source](https://togithub.com/truecharts/charts)) | patch | `3.0.22` -> `3.0.23` | | [mariadb](https://truecharts.org/charts/dependency/mariadb) ([source](https://togithub.com/truecharts/charts)) | patch | `9.0.25` -> `9.0.26` | | [node-exporter](https://truecharts.org/charts/dependency/node-exporter) ([source](https://togithub.com/truecharts/charts)) | patch | `3.0.24` -> `3.0.25` | | [redis](https://truecharts.org/charts/dependency/redis) ([source](https://togithub.com/truecharts/charts)) | patch | `8.0.0` -> `8.0.29` | | [redis](https://truecharts.org/charts/dependency/redis) ([source](https://togithub.com/truecharts/charts)) | patch | `8.0.28` -> `8.0.29` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.13.1`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.1) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.13.0...v1.13.1) v1.13.1 contains a bugfix for a name collision bug in the StableCertificateRequestName feature that was enabled by default in v1.13.0. ##### ⚠️ READ https://github.com/cert-manager/cert-manager/releases/tag/v1.13.0 before you upgrade from a < v1.13 version! #### Changes since v1.13.0 ##### Bug or Regression - BUGFIX: fix CertificateRequest name collision bug in StableCertificateRequestName feature. ([#6358](https://togithub.com/cert-manager/cert-manager/issues/6358), [@jetstack-bot](https://togithub.com/jetstack-bot)) ##### Other (Cleanup or Flake) - Upgrade `github.com/emicklei/go-restful/v3` to `v3.11.0` because `v3.10.2` is labeled as "DO NOT USE". ([#6368](https://togithub.com/cert-manager/cert-manager/issues/6368), [@inteon](https://togithub.com/inteon)) - Upgrade Go from 1.20.7 to 1.20.8. ([#6370](https://togithub.com/cert-manager/cert-manager/issues/6370), [@jetstack-bot](https://togithub.com/jetstack-bot)) ### [`v1.13.0`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.0) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.5...v1.13.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This is the 1.13 release of cert-manager! cert-manager 1.13 brings support for DNS over HTTPS, support for loading options from a versioned config file for the cert-manager controller, and more. This release also includes the promotion of the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta. #### Known issues The `StableCertificateRequestName` that was promoted to Beta contains a "name collision" bug: [cert-manager/cert-manager#6342 This will be fixed in v1.13.1. #### Breaking Changes (You MUST read this before you upgrade!) 1. **BREAKING** : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) 2. **Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) 3. **Potentially breaking**: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](https://togithub.com/cert-manager/cert-manager/issues/6182), [@inteon](https://togithub.com/inteon)) #### Community Welcome to these new cert-manager members (more info - [cert-manager/cert-manager#6260): [@jsoref](https://togithub.com/jsoref) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@hawksight](https://togithub.com/hawksight) [@erikgb](https://togithub.com/erikgb) Thanks again to all open-source contributors with commits in this release, including: [@AcidLeroy](https://togithub.com/AcidLeroy) [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) [@lucacome](https://togithub.com/lucacome) [@cypres](https://togithub.com/cypres) [@erikgb](https://togithub.com/erikgb) [@ubergesundheit](https://togithub.com/ubergesundheit) [@jkroepke](https://togithub.com/jkroepke) [@jsoref](https://togithub.com/jsoref) [@gdvalle](https://togithub.com/gdvalle) [@rouke-broersma](https://togithub.com/rouke-broersma) [@schrodit](https://togithub.com/schrodit) [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs) [@arukiidou](https://togithub.com/arukiidou) [@hawksight](https://togithub.com/hawksight) [@Richardds](https://togithub.com/Richardds) [@kahirokunn](https://togithub.com/kahirokunn) Thanks also to the following cert-manager maintainers for their contributions during this release: [@SgtCoDFish](https://togithub.com/SgtCoDFish) [@maelvls](https://togithub.com/maelvls) [@irbekrm](https://togithub.com/irbekrm) [@inteon](https://togithub.com/inteon) Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings! Special thanks to [@AcidLeroy](https://togithub.com/AcidLeroy) for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see [cert-manager/cert-manager#5337) Also, thanks a lot to [@FlorianLiebhart](https://togithub.com/FlorianLiebhart) for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see [cert-manager/cert-manager#5003) Thanks also to the [CNCF](https://www.cncf.io/), which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the [PrivateCA Issuer](https://togithub.com/cert-manager/aws-privateca-issuer). In addition, massive thanks to [Venafi](https://www.venafi.com/) for contributing developer time and resources towards the continued maintenance of cert-manager projects. #### Changes since v1.12.0 ##### Feature - Add support for logging options to webhook config file. ([#6243](https://togithub.com/cert-manager/cert-manager/issues/6243), [@inteon](https://togithub.com/inteon)) - Add view permissions to the well-known (Openshift) user-facing `cluster-reader` aggregated cluster role ([#6241](https://togithub.com/cert-manager/cert-manager/issues/6241), [@erikgb](https://togithub.com/erikgb)) - Certificate Shim: distinguish dns names and ip address in certificate ([#6267](https://togithub.com/cert-manager/cert-manager/issues/6267), [@zhangzhiqiangcs](https://togithub.com/zhangzhiqiangcs)) - Cmctl can now be imported by third parties. ([#6049](https://togithub.com/cert-manager/cert-manager/issues/6049), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - Make `enableServiceLinks` configurable for all Deployments and `startupapicheck` Job in Helm chart. ([#6292](https://togithub.com/cert-manager/cert-manager/issues/6292), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Promoted the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta (enabled by default). ([#6298](https://togithub.com/cert-manager/cert-manager/issues/6298), [@inteon](https://togithub.com/inteon)) - The cert-manager controller options are now configurable using a configuration file. ([#5337](https://togithub.com/cert-manager/cert-manager/issues/5337), [@AcidLeroy](https://togithub.com/AcidLeroy)) - The pki CertificateTemplate functions now perform validation of the CSR blob, making sure we sign a Certificate that matches the IsCA and (Extended)KeyUsages that are defined in the CertificateRequest resource. ([#6199](https://togithub.com/cert-manager/cert-manager/issues/6199), [@inteon](https://togithub.com/inteon)) - \[helm] Add prometheus.servicemonitor.endpointAdditionalProperties to define additional properties on a ServiceMonitor endpoint, e.g. relabelings ([#6110](https://togithub.com/cert-manager/cert-manager/issues/6110), [@jkroepke](https://togithub.com/jkroepke)) ##### Design - DNS over HTTPS (DoH) is now possible for doing the self-checks during the ACME verification. The DNS check method to be used is controlled through the command line flag: `--dns01-recursive-nameservers-only=true` in combination with `--dns01-recursive-nameservers=https://<DoH-endpoint>` (e.g. `https://8.8.8.8/dns-query`). It keeps using DNS lookup as a default method. ([#5003](https://togithub.com/cert-manager/cert-manager/issues/5003), [@FlorianLiebhart](https://togithub.com/FlorianLiebhart)) ##### Bug or Regression - Allow overriding default pdb .minAvailable with .maxUnavailable without setting .minAvailable to null ([#6087](https://togithub.com/cert-manager/cert-manager/issues/6087), [@rouke-broersma](https://togithub.com/rouke-broersma)) - BUGFIX: `cmctl check api --wait 0` exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code ([#6109](https://togithub.com/cert-manager/cert-manager/issues/6109), [@inteon](https://togithub.com/inteon)) - BUGFIX: the issuer and certificate-name annotations on a Secret were incorrectly updated when other fields are changed. ([#6147](https://togithub.com/cert-manager/cert-manager/issues/6147), [@inteon](https://togithub.com/inteon)) - BUGFIX\[cainjector]: 1-character bug was causing invalid log messages and a memory leak ([#6232](https://togithub.com/cert-manager/cert-manager/issues/6232), [@inteon](https://togithub.com/inteon)) - Fix CloudDNS issuers stuck in propagation check, when multiple instances are issuing for the same FQDN ([#6088](https://togithub.com/cert-manager/cert-manager/issues/6088), [@cypres](https://togithub.com/cypres)) - Fix indentation of Webhook NetworkPolicy matchLabels in helm chart. ([#6220](https://togithub.com/cert-manager/cert-manager/issues/6220), [@ubergesundheit](https://togithub.com/ubergesundheit)) - Fixed Cloudflare DNS01 challenge provider race condition when validating multiple domains ([#6191](https://togithub.com/cert-manager/cert-manager/issues/6191), [@Richardds](https://togithub.com/Richardds)) - Fixes a bug where webhook was pulling in controller's feature gates. **⚠️ ⚠️ BREAKING ⚠️ ⚠️** : If you deploy cert-manager using helm and have `.featureGates` value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use `webhook.featureGates` field instead to define features to be enabled on webhook. **⚠️Potentially breaking**: If you were, for some reason, passing cert-manager controller's features to webhook's `--feature-gates` flag, this will now break (unless the webhook actually has a feature by that name). ([#6093](https://togithub.com/cert-manager/cert-manager/issues/6093), [@irbekrm](https://togithub.com/irbekrm)) - Fixes an issue where cert-manager would incorrectly reject two IP addresses as being unequal when they should have compared equal. This would be most noticeable when using an IPv6 address which doesn't match how Go's `net.IP.String()` function would have printed that address. ([#6293](https://togithub.com/cert-manager/cert-manager/issues/6293), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - We disabled the `enableServiceLinks` option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. ([#6143](https://togithub.com/cert-manager/cert-manager/issues/6143), [@schrodit](https://togithub.com/schrodit)) - **⚠️Potentially breaking**: Webhook validation of CertificateRequest resources is stricter now: all KeyUsages and ExtendedKeyUsages must be defined directly in the CertificateRequest resource, the encoded CSR can never contain more usages that defined there. ([#6182](https://togithub.com/cert-manager/cert-manager/issues/6182), [@inteon](https://togithub.com/inteon)) ##### Other (Cleanup or Flake) - A subset of the klogs flags have been deprecated and will be removed in the future. ([#5879](https://togithub.com/cert-manager/cert-manager/issues/5879), [@maelvls](https://togithub.com/maelvls)) - All service links in helm chart deployments have been disabled. ([#6144](https://togithub.com/cert-manager/cert-manager/issues/6144), [@schrodit](https://togithub.com/schrodit)) - Cert-manager will now re-issue a certificate if the public key in the latest CertificateRequest resource linked to a Certificate resource does not match the public key of the key encoded in the Secret linked to that Certificate resource ([#6168](https://togithub.com/cert-manager/cert-manager/issues/6168), [@inteon](https://togithub.com/inteon)) - Chore: When hostNetwork is enabled, dnsPolicy is now set to ClusterFirstWithHostNet. ([#6156](https://togithub.com/cert-manager/cert-manager/issues/6156), [@kahirokunn](https://togithub.com/kahirokunn)) - Cleanup the controller configfile structure by introducing sub-structs. ([#6242](https://togithub.com/cert-manager/cert-manager/issues/6242), [@inteon](https://togithub.com/inteon)) - Don't run API Priority and Fairness controller in webhook's extension apiserver ([#6085](https://togithub.com/cert-manager/cert-manager/issues/6085), [@irbekrm](https://togithub.com/irbekrm)) - Helm: Add apache 2.0 license annotation ([#6225](https://togithub.com/cert-manager/cert-manager/issues/6225), [@arukiidou](https://togithub.com/arukiidou)) - Make apis/acme/v1/ACMEIssuer.PreferredChain optional in JSON serialization. ([#6034](https://togithub.com/cert-manager/cert-manager/issues/6034), [@gdvalle](https://togithub.com/gdvalle)) - The SecretPostIssuancePolicyChain now also makes sure that the `cert-manager.io/common-name`, `cert-manager.io/alt-names`, ... annotations on Secrets are kept at their correct value. ([#6176](https://togithub.com/cert-manager/cert-manager/issues/6176), [@inteon](https://togithub.com/inteon)) - The cmctl logging has been improved and support for json logging has been added. ([#6247](https://togithub.com/cert-manager/cert-manager/issues/6247), [@inteon](https://togithub.com/inteon)) - Updates Kubernetes libraries to `v0.27.2`. ([#6077](https://togithub.com/cert-manager/cert-manager/issues/6077), [@lucacome](https://togithub.com/lucacome)) - Updates Kubernetes libraries to `v0.27.4`. ([#6227](https://togithub.com/cert-manager/cert-manager/issues/6227), [@lucacome](https://togithub.com/lucacome)) - We now only check that the issuer name, kind and group annotations on a Secret match in case those annotations are set. ([#6152](https://togithub.com/cert-manager/cert-manager/issues/6152), [@inteon](https://togithub.com/inteon)) ### [`v1.12.5`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.12.5) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.4...v1.12.5) v1.12.5 contains a backport for a name collision bug that was found in v1.13.0 #### Changes since v1.12.4 ##### Bug or Regression - BUGFIX: fix CertificateRequest name collision bug in StableCertificateRequestName feature. ([#6359](https://togithub.com/cert-manager/cert-manager/issues/6359), [@jetstack-bot](https://togithub.com/jetstack-bot)) ##### Other (Cleanup or Flake) - Updated base images to the latest version. ([#6372](https://togithub.com/cert-manager/cert-manager/issues/6372), [@inteon](https://togithub.com/inteon)) - Upgrade Go from 1.20.7 to 1.20.8. ([#6371](https://togithub.com/cert-manager/cert-manager/issues/6371), [@jetstack-bot](https://togithub.com/jetstack-bot)) ### [`v1.12.4`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.12.4) [Compare Source](https://togithub.com/cert-manager/cert-manager/compare/v1.12.3...v1.12.4) v1.12.4 contains an important security fix that addresses [CVE-2023-29409](https://cve.report/CVE-2023-29409). #### Changes since v1.12.3 - Fixes an issue where cert-manager would incorrectly reject two IP addresses as being unequal when they should have compared equal. This would be most noticeable when using an IPv6 address which doesn't match how Go's `net.IP.String()` function would have printed that address. ([#6297](https://togithub.com/cert-manager/cert-manager/issues/6297), [@SgtCoDFish](https://togithub.com/SgtCoDFish)) - Use Go 1.20.7 to fix a security issue in Go's `crypto/tls` library. ([#6318](https://togithub.com/cert-manager/cert-manager/issues/6318), [@maelvls](https://togithub.com/maelvls)) </details> <details> <summary>truecharts/charts (clickhouse)</summary> ### [`v7.0.9`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.9) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.8...clickhouse-7.0.9) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.8`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.8) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.7...clickhouse-7.0.8) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.7`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.7) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.6...clickhouse-7.0.7) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.6`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.6) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.5...clickhouse-7.0.6) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.5`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.5) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.4...clickhouse-7.0.5) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.4`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.4) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.3...clickhouse-7.0.4) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.3`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.3) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.2...clickhouse-7.0.3) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ### [`v7.0.2`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.2) [Compare Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.1...clickhouse-7.0.2) ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). </details> <details> <summary>truecharts/library-charts (common)</summary> ### [`v14.0.9`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.9) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.8...common-14.0.9) Function library for TrueCharts ### [`v14.0.8`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.8) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.7...common-14.0.8) Function library for TrueCharts ### [`v14.0.7`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.7) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.6...common-14.0.7) Function library for TrueCharts ### [`v14.0.6`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.6) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.5...common-14.0.6) Function library for TrueCharts ### [`v14.0.5`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.5) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.4...common-14.0.5) Function library for TrueCharts ### [`v14.0.4`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.4) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.3...common-14.0.4) Function library for TrueCharts ### [`v14.0.3`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.3) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.2...common-14.0.3) Function library for TrueCharts ### [`v14.0.2`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.0.2) [Compare Source](https://togithub.com/truecharts/library-charts/compare/common-14.0.1...common-14.0.2) Function library for TrueCharts </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 10pm on tuesday" in timezone Europe/Amsterdam, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).  --------- Signed-off-by: TrueCharts-Bot <bot@truecharts.org> Signed-off-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com>

jetstack-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 17, 2022

jetstack-bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 15, 2023

irbekrm mentioned this pull request Mar 9, 2023

Support loading controller configuration from a versioned file #5160

Closed

7 tasks

jetstack-bot removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Mar 9, 2023

AcidLeroy force-pushed the controller-configuration-file branch from 0981a5c to c3a4b41 Compare March 10, 2023 17:48

jetstack-bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. and removed dco-signoff: no Indicates that at least one commit in this pull request is missing the DCO sign-off message. labels Mar 10, 2023

AcidLeroy force-pushed the controller-configuration-file branch 8 times, most recently from 8e3ebe0 to 3992542 Compare March 15, 2023 22:38

AcidLeroy force-pushed the controller-configuration-file branch from 3992542 to 357829f Compare March 17, 2023 23:29

AcidLeroy commented Mar 17, 2023

View reviewed changes

internal/apis/config/controller/fuzzer/fuzzer.go Show resolved Hide resolved

AcidLeroy force-pushed the controller-configuration-file branch from acd1d49 to 282a6d5 Compare July 27, 2023 23:44

inteon reviewed Jul 28, 2023

View reviewed changes

jetstack-bot added lgtm Indicates that a PR is ready to be merged. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Jul 28, 2023

jetstack-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 28, 2023

jetstack-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 31, 2023

jetstack-bot merged commit d233758 into cert-manager:master Jul 31, 2023
6 checks passed

This was referenced Jul 31, 2023

Restructure the controller configfile #6242

Merged

Missing docs for #5337 #6245

Closed

This was referenced Aug 10, 2023

Move logging options to webhook config file #6243

Merged

[BUGFIX] defaulting partial ControllerConfiguration logging options #6276

Merged

ubergesundheit mentioned this pull request Aug 24, 2023

Configurable serviceLinks + Update from upstream giantswarm/cert-manager-app#350

Merged

p-linnane mentioned this pull request Sep 13, 2023

cmctl 1.13.0 Homebrew/homebrew-core#142149

Merged

inteon mentioned this pull request Sep 14, 2023

Introduce config file for cainjector options #6345

Merged

ThomasVitale mentioned this pull request Sep 19, 2023

Support configuring the cert-manager controller via ConfigMap kadras-io/package-for-cert-manager#36

Open

swghosh mentioned this pull request Oct 18, 2023

CM-190: Rebase v1.13 openshift/cert-manager-operator#143

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support loading controller configuration from a versioned file #5337

Support loading controller configuration from a versioned file #5337

AcidLeroy commented Jul 25, 2022 •

edited by inteon

jetstack-bot commented Jul 25, 2022

jetstack-bot commented Feb 15, 2023

irbekrm commented Mar 9, 2023

inteon Jul 28, 2023 •

edited

inteon commented Jul 28, 2023

jetstack-bot commented Jul 28, 2023

inteon commented Jul 31, 2023

inteon commented Jul 31, 2023

inteon commented Jul 31, 2023

Support loading controller configuration from a versioned file #5337

Support loading controller configuration from a versioned file #5337

Conversation

AcidLeroy commented Jul 25, 2022 • edited by inteon

Pull Request Motivation

Checklist

Kind

Release Note

jetstack-bot commented Jul 25, 2022

jetstack-bot commented Feb 15, 2023

irbekrm commented Mar 9, 2023

inteon Jul 28, 2023 • edited

Choose a reason for hiding this comment

inteon commented Jul 28, 2023

jetstack-bot commented Jul 28, 2023

inteon commented Jul 31, 2023

inteon commented Jul 31, 2023

inteon commented Jul 31, 2023

AcidLeroy commented Jul 25, 2022 •

edited by inteon

inteon Jul 28, 2023 •

edited