Comparing changes
Open a pull request
Commits on Nov 22, 2022
-
fix x/text vuln and ignore AWS vuln
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5592 from jetstack-bot/cherry-pick-5562-to-releas…
…e-1.10 [release-1.10] Fix x/text vuln and ignore AWS vuln
Commits on Nov 29, 2022
-
Use distinct manifest dirs for signed / unsigned manifests
This avoids a race condition with the `release-manifests` and `release-manifests-signed` targets. When running in parallel, one could execute `rm -rf $(BINDIR)/scratch/manifests` while the other was running. This could also conceivably have led to incorrectly packaged manifests when both were run in parallel. Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
Commits on Dec 7, 2022
-
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5620 from jetstack-bot/cherry-pick-5619-to-releas…
…e-1.10 [release-1.10] Bump go to 1.19.4
-
remove verify-licenses from ci-presubmit
see cert-manager/release#111 Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5622 from jetstack-bot/cherry-pick-5618-to-releas…
…e-1.10 [release-1.10] Remove verify-licenses from ci-presubmit
Commits on Dec 12, 2022
-
bump dep versions to fix trivy-reported vulns
```text { "VulnerabilityID": "CVE-2022-41717", "PkgName": "golang.org/x/net", "InstalledVersion": "v0.0.0-20220921155015-db77216a4ee9", "FixedVersion": "0.4.0", "Layer": { "DiffID": "sha256:629212d4fb1b47585329d1c630cb91f919ddcd6168031a07121953d6c6dbd438" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-41717", "DataSource": { "ID": "go-vulndb", "Name": "The Go Vulnerability Database", "URL": "https://github.com/golang/vulndb" }, "Title": "An attacker can cause excessive memory growth in a Go server accepting ...", "Description": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.", "Severity": "UNKNOWN", "References": [ "https://go.dev/cl/455635", "https://go.dev/cl/455717", "https://go.dev/issue/56350", "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ", "https://pkg.go.dev/vuln/GO-2022-1144" ], "PublishedDate": "2022-12-08T20:15:00Z", "LastModifiedDate": "2022-12-08T22:30:00Z" } ``` Signed-off-by: Ashley Davis <ashley.davis@jetstack.io> -
Merge pull request #5635 from jetstack-bot/cherry-pick-5632-to-releas…
…e-1.10 [release-1.10] Bump dep versions to fix trivy-reported vulns
Commits on Dec 16, 2022
-
bump base images to latest versions
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
enable testing with k8s 1.26 by adding new kind image
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5647 from SgtCoDFish/release-1.10-k8s1.26
[release-1.10] Enable k8s 1.26 tests, bump base images and kind images
Commits on Dec 20, 2022
-
bump version of contour helm chart to 10.0.1
This matches the version used on the master branch at the time of this commit. This version was chosen because it was tested on master. It implies a bump of the underlying version of contour from 1.20 -> 1.23, but it seems better to use a tested version of the chart rather than a previously untested version. This update is required because the previous version was removed from the bitnami helm chart repo. Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5657 from SgtCoDFish/bumpcontour
Bump contour
Commits on Dec 21, 2022
-
Merge pull request #5607 from jetstack-bot/cherry-pick-5605-to-releas…
…e-1.10 [release-1.10] Use distinct manifest dirs for signed / unsigned manifests
Commits on Jan 3, 2023
-
bump helm version to fix CVE-2022-23525
Vuln description: Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions. Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
bump base images to latest versions
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5676 from SgtCoDFish/release-1.10-bumphelm
[release-1.10] Bump helm version to fix CVE-2022-23525
-
Merge pull request #5677 from SgtCoDFish/release-1.10-bumpbase
[release-1.10] Bump distroless base images to latest versions
-
use template when generating tempdir in verify-crds
Due to a bug in controller-gen[1] certain paths are incorrectly split and part of these paths can be interpreted as a numeric literal, which will cause controller-gen to fail. We observe this as occasional test flakes in the "verify-crds" target, when the tmpdir starts with a zero, such as in "/tmp/tmp.0PFqFSHBID" This commit attempts to avoid this bug by specifying a template for the tmpdir we generate when verifying CRDs which doesn't include any "." characters, which seem to be being split incorrectly. [1] kubernetes-sigs/controller-tools#734 Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5682 from jetstack-bot/cherry-pick-5680-to-releas…
…e-1.10 [release-1.10] Use template when generating tempdir in verify-crds
Commits on Jan 4, 2023
-
avoid logging confusing error messages for external issuers
See #5601 When referring to external issuers whose kind is not "Issuer" or "ClusterIssuer" we log an error message thanks to a new check added in a previous PR[1] which should only trigger for SelfSigned issuers. The error previously looked like: ```text "error"="invalid value \"x\" for issuerRef.kind. Must be empty, \"Issuer\" or \"ClusterIssuer\"" ``` After this PR, any CR with an issuer whose group or kind doesn't match what's expected for a built-in issuer will be skipped #5336 Signed-off-by: Ashley Davis <ashley.davis@jetstack.io> WIP: test other issuer kinds Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Merge pull request #5687 from jetstack-bot/cherry-pick-5681-to-releas…
…e-1.10 [release-1.10] Avoid logging confusing error messages for external issuers
Commits on Jan 9, 2023
-
Ensures that only one secrets cache is created for cert-manager contr…
…oller Signed-off-by: irbekrm <irbekrm@gmail.com>
-
Signed-off-by: irbekrm <irbekrm@gmail.com>
-
Code review feedback- better comment
Signed-off-by: irbekrm <irbekrm@gmail.com>
-
Merge pull request #5704 from SgtCoDFish/release-1.10-remove_redundan…
…t_secret_cache [release-1.10] Remove redundant secret cache
-
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
-
Bump containerd to fix reported vuln
Note that cert-manager is not actually vulnerable to CVE-2022-23471 since the affected code is not used. We only depend on containerd via Helm, and helm only uses containerd's "remotes" library which shouldn't be affected by the vuln. This change is intentionally minimal and doesn't use "go get -u=patch" because that command brings in additional changes which wouldn't be suitable for a backport Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
Commits on Jan 10, 2023
-
Merge pull request #5705 from SgtCoDFish/bumpbase
[release-1.10] Bump base images + fix containerd vuln
There are no files selected for viewing