Skip to content

Releases: cert-manager/trust-manager

v0.10.0

13 May 14:34
@github-actions github-actions
v0.10.0
4323445
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.10.0 Latest
Latest

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release is be the first trust-manager release that uses Makefile modules. Apart from that change, this release includes a lot of version bumps and some small bug fixes.

What's Changed

  • bump builder go to 1.22 by @SgtCoDFish in #321
  • Allow replicaCount to be set to int or string by @erikgb in #320
  • Also check for correct architectures in trust package build by @SgtCoDFish in #323
  • Helm chart - document and add to schema nameOverride by @DrFaust92 in #330
  • Fix Bundle target print column by @erikgb in #344
  • Simplify managed fields upgrade from CSA to SSA by @erikgb in #319
  • Make Makefiles reusable and automate release process by @inteon in #195

Dependency upgrades

New Contributors

  • @DrFaust92 made their first contribution in #330
  • @github-actions made their first contribution in #348

Full Changelog: v0.9.2...v0.10.0

Contributors

erikgb, SgtCoDFish, and 3 other contributors
Assets 3

v0.10.0-alpha.0

13 May 12:57
@github-actions github-actions
v0.10.0-alpha.0
4323445
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.10.0-alpha.0 Pre-release
Pre-release

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release is an alpha release in preparation for v0.10.0. This release will be the first release that uses Makefile modules. Apart from that change, this release includes a lot of version bumps and some small bug fixes.

What's Changed

  • bump builder go to 1.22 by @SgtCoDFish in #321
  • Allow replicaCount to be set to int or string by @erikgb in #320
  • Also check for correct architectures in trust package build by @SgtCoDFish in #323
  • Helm chart - document and add to schema nameOverride by @DrFaust92 in #330
  • Fix Bundle target print column by @erikgb in #344
  • Simplify managed fields upgrade from CSA to SSA by @erikgb in #319
  • Make Makefiles reusable and automate release process by @inteon in #195

Dependency upgrades

New Contributors

  • @DrFaust92 made their first contribution in #330
  • @github-actions made their first contribution in #348

Full Changelog: v0.9.2...v0.10.0-alpha.0

Contributors

erikgb, SgtCoDFish, and 3 other contributors
Assets 3

v0.9.2

26 Mar 16:16
@SgtCoDFish SgtCoDFish
v0.9.2
This tag was signed with the committer’s verified signature.
SgtCoDFish Ashley Davis
SSH Key Fingerprint: 2/r7Xip8D/TOyjbQBZcd6gKt41j0xlAUYgAvO5tqmb4 Learn about vigilant mode.
b73f5ff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.2

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.9.2 is another small bugfix release for a minor issue in the Helm chart's schema along with a small dependency update to fix a reported CVE. Thanks @DrFaust92 for fixing the schema!

What's Changed

Full Changelog: v0.9.1...v0.9.2

Contributors

SgtCoDFish and DrFaust92
Assets 2

v0.9.1

13 Mar 16:53
@SgtCoDFish SgtCoDFish
v0.9.1
This tag was signed with the committer’s verified signature.
SgtCoDFish Ashley Davis
SSH Key Fingerprint: 2/r7Xip8D/TOyjbQBZcd6gKt41j0xlAUYgAvO5tqmb4 Learn about vigilant mode.
5585cf0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.1

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.9.1 is a small bugfix release for a minor issue in the Helm chart's schema. Thanks to @erikgb and @wallrj for the bugfix!

In addition, unrelated to this specific release, we're looking to rebuild the debian trust package to include the s390x architecture that was added in trust-manager v0.9.0. That will happen outside of the release process for v0.9.1.

What's Changed

Full Changelog: v0.9.0...v0.9.1

Contributors

wallrj, erikgb, and SgtCoDFish
Assets 2

v0.9.0

07 Mar 09:24
@SgtCoDFish SgtCoDFish
v0.9.0
This tag was signed with the committer’s verified signature.
SgtCoDFish Ashley Davis
SSH Key Fingerprint: 2/r7Xip8D/TOyjbQBZcd6gKt41j0xlAUYgAvO5tqmb4 Learn about vigilant mode.
1427bc6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.0

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.9.0 contains a bunch of improvements and once again the awesome trust-manager community played a huge role!

Inclusions to note are:

  • We fixed a bug (#296) which broke passwordless PKCS#12 files when read by Java.
    • It's possible that this could have an effect on non-Java platforms, but in testing it seemed safe for both Go and Java
  • We added support for the s390x architecture for trust-manager!
  • We added a crds.keep option to reduce the risk of losing important data when uninstalling trust-manager
  • We fixed an issue with certificate deduplication when certs were present in multiple sources

As always, please report any issues either here in the repo, in a cert-manager meeting or on Slack!

Happy bundling!

Special Thanks

We'd like to thank the following for their contributions, expertise, time and patience since the last trust-manager release:

In addition, a warm welcome to our latest reviewer @ThatsMrTalbot ! 🎉

What's Changed

New Features

  • 💻 Enable trust manager on s390x by @rishikakedia in #315
  • Helm: Uniformize all label include statements & add labels to pod template by @inteon in #306
  • Add configurable common labels by @justdan96 in #149
  • Add 'crds.keep' options to generated CRDs by @inteon in #288

Bug Fixes and Resilience Improvements

Documentation and Testing

  • docs: updating chart values.yaml for better comment docs by @ditatechwriter in #280
  • Update README.md and Chart.yaml by @inteon in #287
  • Improve OCI image options' Helm README.md documentation by @inteon in #289
  • Fix typo in Chart.yaml icon URL by @inteon in #292
  • test: should test setBundleCondition as it's used by @erikgb in #284

Bumps and Miscellaneous

New Contributors

Full Changelog: v0.8.0...v0.9.0

Contributors

justdan96, wallrj, and 14 other contributors
Assets 2

v0.8.0

19 Jan 15:41
@SgtCoDFish SgtCoDFish
v0.8.0
This tag was signed with the committer’s verified signature.
SgtCoDFish Ashley Davis
SSH Key Fingerprint: 2/r7Xip8D/TOyjbQBZcd6gKt41j0xlAUYgAvO5tqmb4 Learn about vigilant mode.
993ce2b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.8.0

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.8.0 includes a bunch of new features, largely contributed by our awesome community!

Included is an option at startup to filter expired certificates from all bundles and the ability to include Secret and ConfigMap resources via labels.

There are also a bunch of improvements which make trust-manager easier to develop and iterate on, which isn't as exciting as new features but should make it easier for us to provide features going forwards!

Speaking of going forwards, trust-manager is on the road to v1! 🎉 From here, we want to stabilise our API, get our CRDs to v1beta1 and then v1, and bump trust-manager itself to v1. We don't have a timeline currently, but we think it's important to be clear that it's a goal of ours to be rock-solid and stable for everyone to build upon!

Special thanks to @erikgb for his efforts in reviewing, developing and helping in this release - it couldn't have happened without him!

⚠️ Known Issues

When using PKCS#12 targets with empty passwords, a PKCS#12 file will be generated that the Java keytool utility is unable to read. See #296

Read Before Updating

Removal of .status.target

trust-manager v0.8.0 removes the .status.target field from Bundle resources, which had a significant overhead to maintain and wasn't particularly useful as far as we could tell.

If you were previously relying on this field, you should be able to calculate it from the spec of your Bundle. We try to avoid breaking anything generally but we felt like this field was worth the removal.

What's Changed

New Features

  • Add option to filter expired certificates from bundle by @Hoega in #273
  • Add label selector option for Secret and ConfigMap sources by @ocampeau in #258
  • Add support for additional pod annotations/labels by @jaygridley in #116
  • Allow permissions to put the leases in the trust-manager namespace, not the trust namespace by @tspearconquest in #225

Changes

  • Remove .status.target field from Bundle API by @erikgb in #230
  • Encode additional target format just once per bundle reconcile by @erikgb in #241
  • Add dedicated structures for PKCS12 and JKS stores by @arsenalzp in #253
  • fix: Reconcile targets consistently by @erikgb in #260

Changes for trust-manager Developers

New Contributors

Full Changelog: v0.7.0...v0.8.0

Contributors

jaygridley, erikgb, and 6 other contributors
Assets 2

v0.7.1

02 Jan 16:13
@SgtCoDFish SgtCoDFish
v0.7.1
This tag was signed with the committer’s verified signature.
SgtCoDFish Ashley Davis
SSH Key Fingerprint: 2/r7Xip8D/TOyjbQBZcd6gKt41j0xlAUYgAvO5tqmb4 Learn about vigilant mode.
0666e41
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.1

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.7.1 is a patch release fixing a bug in targets including PKCS#12 bundles - see #260 for details. All users are recommended to upgrade to this version from v0.7.0 immediately.

What's Changed

  • Should reconcile targets consistently by @erikgb in #266
  • Allow permissions to put the leases in the trust-manager namespace, not the trust namespace by @jetstack-bot in #263
  • Fix flaky tests by introducing komega by @erikgb in #264
  • Bump versions to fix trivy-reported vulns and prepare for release by @SgtCoDFish in #267

Full Changelog: v0.7.0...v0.7.1

Contributors

erikgb, SgtCoDFish, and jetstack-bot
Assets 2

v0.7.0

30 Oct 12:16
@inteon inteon
v0.7.0
d21e836
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.0

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.7.0 adds a huge variety of changes; chief among them is support for writing trust bundles to Kubernetes Secret resources, as well as support for optionally writing a PKCS#12 trust store to the target.

We also added support for server side apply and made a variety of improvements, tweaks and patches.

What's Changed

  • Add Secret target support

    • feat: support secret as a target by @Jiawei0227 in #193
    • BUGFIX: fix bugs in validation logic for secret target & add tests by @inteon in #212
    • BUGFIX: support switching between target types by @inteon in #211
    • fix: should not have have read access to all secrets when secret targets disabled by @erikgb in #207
    • Cleanup patch functions Secret and ConfigMap targets by @inteon in #210

  • Support PKCS12 truststores

    • Refactor CM binary data reconcile preparing for PKCS#12 support by @erikgb in #162
    • Add support for PKCS12 truststores by @erikgb in #163
    • Add support for PKCS12 truststores (update CRD) by @erikgb in #164

  • Switch to SSA

    • Refactor util functions in preparation for SSA by @inteon in #170
    • Fix BundleStatus go definition in preparation for SSA by @inteon in #173
    • Use SSA by @inteon in #89
    • BUGFIX: fix migration from csa to ssa by @inteon in #178
    • Fix SSA migration field managers by @erikgb in #189
    • fix: add missing RBAC for CSA->SSA migration of bundles/status by @erikgb in #191
    • FIX: For CSA to SSA migration, we need UPDATE permission on the resource (not the sub-resource) by @inteon in #218

  • Helm chart improvements

  • Dependency upgrades:

  • Cleanup, refactor and bugfixes

New Contributors

Thank you to all of the many new contributors for this release - it's awesome to see such a long list of names ❤️

Full Changelog: v0.6.0...v0.7.0

Contributors

erikgb, SgtCoDFish, and 10 other contributors
Assets 2

v0.7.0-alpha.3

26 Oct 12:32
@inteon inteon
v0.7.0-alpha.3
66d0aca
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.0-alpha.3 Pre-release
Pre-release

What's Changed

  • Upgrade go to 1.21 by @inteon in #204
  • Allow configuring of the priorityClass by @WatcherWhale in #176
  • Bump the all group with 1 update by @dependabot in #206
  • Remove patch versions from go directives by @SgtCoDFish in #209
  • Cleanup patch functions Secret and ConfigMap targets by @inteon in #210
  • BUGFIX: fix bugs in validation logic for secret target & add tests by @inteon in #212
  • BUGFIX: support switching between target types by @inteon in #211
  • fix: should not have have read access to all secrets when secret targets disabled by @erikgb in #207
  • Bump release version to v0.7.0-alpha.3 by @inteon in #213

New Contributors

Full Changelog: v0.7.0-alpha.2...v0.7.0-alpha.3

Contributors

erikgb, SgtCoDFish, and 3 other contributors
Assets 2

v0.6.1

25 Oct 08:16
@SgtCoDFish SgtCoDFish
v0.6.1
This tag was signed with the committer’s verified signature.
SgtCoDFish Ashley Davis
SSH Key Fingerprint: 2/r7Xip8D/TOyjbQBZcd6gKt41j0xlAUYgAvO5tqmb4 Learn about vigilant mode.
e229e79
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.6.1

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.6.1 is intended to fix CVE-2023-44487 and CVE-2023-39325, which relate to HTTP/2 servers in Go.

We have no particular reason to think that trust-manager was specifically vulnerable to (or even impacted by) these CVEs, but given their prominence we thought it best to patch them.

What's Changed

Full Changelog: v0.6.0...v0.6.1

Contributors

SgtCoDFish
Assets 2