-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(deps): update module github.com/jetstack/cert-manager to v1.14.5 #24
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/github.com-jetstack-cert-manager-1.x
base: master
Could not load branches
Branch not found: {{ refName }}
Could not load tags
Nothing to show
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
October 26, 2021 15:02
2877bc1
to
6c90034
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.5.4
fix(deps): update module github.com/jetstack/cert-manager to v1.6.0
Oct 26, 2021
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
November 1, 2021 15:48
6c90034
to
e65db18
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.6.0
fix(deps): update module github.com/jetstack/cert-manager to v1.6.1
Nov 1, 2021
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
March 7, 2022 13:12
e65db18
to
3d54b64
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.6.1
fix(deps): update module github.com/jetstack/cert-manager to v1.7.1
Mar 7, 2022
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
March 26, 2022 15:12
3d54b64
to
bd5b84a
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.7.1
fix(deps): update module github.com/jetstack/cert-manager to v1.7.2
Mar 26, 2022
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
April 24, 2022 18:05
bd5b84a
to
e632d48
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.7.2
fix(deps): update module github.com/jetstack/cert-manager to v1.8.0
Apr 24, 2022
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: go.sum
|
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
June 18, 2022 17:22
e632d48
to
5a750ed
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.8.0
fix(deps): update module github.com/jetstack/cert-manager to v1.8.1
Jun 18, 2022
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
June 24, 2022 00:13
5a750ed
to
586f3e9
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.8.1
fix(deps): update module github.com/jetstack/cert-manager to v1.8.2
Jun 24, 2022
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
September 25, 2022 19:40
586f3e9
to
356c0dd
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.8.2
fix(deps): update module github.com/jetstack/cert-manager to v1.9.1
Sep 25, 2022
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
November 20, 2022 15:59
356c0dd
to
d48fb84
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.9.1
fix(deps): update module github.com/jetstack/cert-manager to v1.10.1
Nov 20, 2022
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
March 16, 2023 20:03
d48fb84
to
fb3a7a8
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.10.1
fix(deps): update module github.com/jetstack/cert-manager to v1.11.0
Mar 16, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
May 29, 2023 21:45
fb3a7a8
to
da90128
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.11.0
fix(deps): update module github.com/jetstack/cert-manager to v1.12.1
May 29, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
June 17, 2023 08:49
da90128
to
d2f19e5
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.12.1
fix(deps): update module github.com/jetstack/cert-manager to v1.12.2
Jun 17, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
July 27, 2023 05:36
d2f19e5
to
ed3b06f
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.12.2
fix(deps): update module github.com/jetstack/cert-manager to v1.12.3
Jul 27, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
September 2, 2023 05:51
ed3b06f
to
e18a70e
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.12.3
fix(deps): update module github.com/jetstack/cert-manager to v1.12.4
Sep 2, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
September 13, 2023 05:29
e18a70e
to
bc35596
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.12.4
fix(deps): update module github.com/jetstack/cert-manager to v1.13.0
Sep 13, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
September 28, 2023 05:59
bc35596
to
b0e4fb9
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.13.0
fix(deps): update module github.com/jetstack/cert-manager to v1.13.1
Sep 28, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
October 31, 2023 02:33
b0e4fb9
to
0741ee6
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.13.1
fix(deps): update module github.com/jetstack/cert-manager to v1.13.2
Oct 31, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
December 9, 2023 08:59
0741ee6
to
2c46cbd
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.13.2
fix(deps): update module github.com/jetstack/cert-manager to v1.13.3
Dec 9, 2023
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
February 1, 2024 04:51
2c46cbd
to
5395e27
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.13.3
fix(deps): update module github.com/jetstack/cert-manager to v1.14.0
Feb 1, 2024
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
February 3, 2024 01:28
5395e27
to
f485ea4
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.14.0
fix(deps): update module github.com/jetstack/cert-manager to v1.14.1
Feb 3, 2024
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
February 9, 2024 05:04
f485ea4
to
7a86a79
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.14.1
fix(deps): update module github.com/jetstack/cert-manager to v1.14.2
Feb 9, 2024
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
February 24, 2024 11:56
7a86a79
to
cb0d52d
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.14.2
fix(deps): update module github.com/jetstack/cert-manager to v1.14.3
Feb 24, 2024
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
March 9, 2024 08:52
cb0d52d
to
f8cf2d6
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.14.3
fix(deps): update module github.com/jetstack/cert-manager to v1.14.4
Mar 9, 2024
renovate
bot
force-pushed
the
renovate/github.com-jetstack-cert-manager-1.x
branch
from
April 26, 2024 23:47
f8cf2d6
to
3d3e41b
Compare
renovate
bot
changed the title
fix(deps): update module github.com/jetstack/cert-manager to v1.14.4
fix(deps): update module github.com/jetstack/cert-manager to v1.14.5
Apr 26, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.5.3
->v1.14.5
Release Notes
jetstack/cert-manager (github.com/jetstack/cert-manager)
v1.14.5
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.14.5
fixes a bug in the DigitalOcean DNS-01 provider which could cause incorrect DNS records to be deleted when using a domain with a CNAME. Special thanks to @BobyMCbobs for reporting this issue and testing the fix!It also patches CVE-2023-45288.
Known Issues
preferredChain
is configured: see 1.14 release notes for more information.Changes
Bug or Regression
v1.14.4
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.14.0 release notes
📜 Changes since v1.14.3
Bug or Regression
cert-manager.io/allow-direct-injection
in annotations (#6809, @jetstack-bot)Other (Cleanup or Flake)
v1.14.3
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.14.0 release notes
📜 Changes since v1.14.2
Bug or Regression
v1.14.2
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
preferredChain
is configured: see release docs for more info and mitigationsℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See
Breaking changes
in v1.14.0 release notes📜 Changes since
v1.14.1
Bug or Regression
Other (Cleanup or Flake)
v1.14.1
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
v1.14.2
)preferredChain
is configured: see release docs for more info and mitigationsCA
andSelfSigned
issuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.🔧 Breaking changes
See
Breaking changes
in v1.14.0 release notesℹ️ Documentation
📜 Changes since
v1.14.0
Bug or Regression
cmctl experimental install
to panic. (#6706, @inteon)v1.14.0
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
v1.14.2
)preferredChain
is configured: see release docs for more info and mitigationsCA
andSelfSigned
issuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.v1.14.0
, the Helm chart for this version was found to use the wrong OCI image for thecainjector
Deployment,which caused the Helm installation to fail.
In order to complete the release, the cert-manager team have manually updated the Helm chart for this version,
which contains all the Helm chart fixes which are in
v1.14.1
.startupapicheck
image in namespaces other than cert-manager.cmctl experimental install
to panic.🔧 Breaking Changes
The startupapicheck job uses a new OCI image called "startupapicheck", instead of the ctl image.
If you run in an environment in which images cannot be pulled, be sure to include the new image.
The KeyUsage and BasicConstraints extensions will now be encoded as critical in the CertificateRequest's CSR blob.
🗺️ Major Themes
New X.509 Features
The cert-manager Certificate resource now allows you to configure a subset of "Other Name" SANs,
which are described in the Subject Alternative Name section of RFC 5280 (on page 37).
We specifically support any
otherName
type with aUTF-8
value, such as the User Principal Name orsAMAccountName
.These are useful when issuing unique certificates for authenticating with LDAP systems such as Microsoft Active Directory.
For example you can create certificates with this block in the spec:
The feature is still in alpha stage and requires you to enable the
OtherName
feature flag in the controller and webhook components.New CA certificate Features
You can now specify the X.509 v3 Authority Information Accessors extension,
with URLs for certificates issued by the CA issuer.
Users can now use name constraints in CA certificates.
To know more details on name constraints check out RFC section https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
Security
An ongoing security audit of the cert-manager code revealed some weaknesses which we have addressed in this release,
such as using more secure default settings in the HTTP servers that serve metrics, healthz and pprof endpoints.
This will help mitigate denial-of-service attacks against those important services.
All the cert-manager containers are now configured with read only root file system by default,
to prevent unexpected changes to the file system of the OCI image.
And it is now possible to configure the metrics server to use HTTPS rather than HTTP,
so that clients can verify the identity of the metrics server.
Other
The liveness probe of the cert-manager controller Pod is now enabled by default.
There is a new option
.spec.keystores.pkcs12.algorithms
to specify encryption and MAC algorithms for PKCS.🤝 Community
Thanks again to all open-source contributors with commits in this release, including:
Thanks also to the following cert-manager maintainers for their contributions during this release:
Equally thanks to everyone who provided feedback, helped users and raised issues on GitHub and Slack and joined our meetings!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
📜 Changes
Feature
"cluster-autoscaler.kubernetes.io/safe-to-evict": "true"
. You can provide an annotation of"cluster-autoscaler.kubernetes.io/safe-to-evict": "false"
in yourpodTemplate
if you don't like this. (#6349, @jsoref)Also, the controller's liveness probe is now enabled by default. (#6328, @inteon)
otherName
SANS in Certificates (#6404, @SpectralHiss)readOnlyRootFilesystem
by default. (#6453, @wallrj).spec.keystores.pkcs12.algorithms
to specify encryption and MAC algorithms for PKCS#12 keystores. Fixes issues #5957 and #6523. (#6548, @snorwin)readOnlyRootFilesystem: true
(#6462, @wallrj)revisionHistoryLimit
(#6248, @tberreis)spec.namespaceSelector
for webhooks (#6638, @jkroepke)Bug or Regression
.Values.config
is set. (#6357, @ABWassim)GHSA-vgf6-pvf4-34rq
: The webhook server now returns HTTP error 413 (Content Too Large) for requests with body size>= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory.The webhook server now returns HTTP error 400 (Bad Request) if the request contains an empty body.
The webhook server now returns HTTP error 500 (Internal Server Error) rather than crashing, if the code panics while handling a request. (#6498, @inteon)
BadConfig
warnings anymore (#6347, @lauraseidler)ReadHeaderTimeout
in allhttp.Server
instances (#6534, @wallrj)WebSDK CertRequest Module Requested Certificate
orThis certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.
. (#6398, @maelvls).Values.webhook.config
is set. (#6360, @ABWassim)otherName
SAN changes in Certificate resources trigger re-issuance. (#6620, @SpectralHiss)startupapicheck
image toquay.io
(#6609, @wallrj)Other (Cleanup or Flake)
1.21.3
to addressCVE-2023-39325
. Also bumps base images. (#6410, @SgtCoDFish)golang.org/x/net v0.15.0 => v0.17.0
as part of addressingCVE-2023-44487
/CVE-2023-39325
(#6427, @SgtCoDFish)crypto/md5
, a weak cryptographic primitive; usinggolangci-lint
/gosec
(G501). (#6581, @wallrj)crypto/sha1
, a weak cryptographic primitive; usinggolangci-lint
/gosec
(G505). (#6579, @wallrj)math/rand
instead ofcrypto/rand
); usinggolangci-lint
/gosec
(G404). (#6582, @wallrj)pkg/util.RandStringRunes
andpkg/controller/test.RandStringBytes
. Usek8s.io/apimachinery/pkg/util/rand.String
instead. (#6585, @wallrj)subject.serialNumber
while using a literal certificate subject. This was a mistake and has been fixed. (#6533, @inteon)github.com/emicklei/go-restful/v3
tov3.11.0
becausev3.10.2
is labeled as "DO NOT USE". (#6366, @inteon)sets.Set
type in place of the deprecatedsets.String
. (#6586, @wallrj)v1.21.6
(#6628, @SgtCoDFish)autorest
dependency (#5452, @phillebaba)v1.13.6
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.6
fixes a bug in the DigitalOcean DNS-01 provider which could cause incorrect DNS records to be deleted when using a domain with a CNAME. Special thanks to @BobyMCbobs for reporting this issue and testing the fix!It also patches CVE-2023-45288.
Known Issues
preferredChain
is configured: see 1.14 release notes for more information.Changes
Bug or Regression
v1.13.5
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.13.0 release notes
📜 Changes since v1.13.4
Bug or Regression
cert-manager.io/allow-direct-injection
in annotations (#6810, @jetstack-bot)Other (Cleanup or Flake)
v1.13.4
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.13.0 release notes
📜 Changes since v1.13.3
Bug or Regression
Other (Cleanup or Flake)
github.com/containerd/containerd@v1.7.12
(#6684, @wallrj)v1.13.3
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2334
: Decryption of malicious PBES2 JWE objects can consume unbounded system resources.If you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108
: DoS vulnerability inotelgrpc
due to unbound cardinality metrics.An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks, and these are included in this patch release.
Changes
Bug or Regression
>= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory. (#6507, @inteon)ReadHeaderTimeout
in allhttp.Server
instances. (#6538, @wallrj)otel
,docker
, andjose
to fix CVE alerts. See GHSA-8pgv-569h-w5rw, GHSA-jq35-85cj-fj4p, and GHSA-2c7c-3mj9-8fqh. (#6514, @inteon)Dependencies
Added
Nothing has changed.
Changed
cloud.google.com/go/firestore
:v1.11.0 → v1.12.0
cloud.google.com/go
:v0.110.6 → v0.110.7
github.com/felixge/httpsnoop
:v1.0.3 → v1.0.4
github.com/go-jose/go-jose/v3
:v3.0.0 → v3.0.1
github.com/go-logr/logr
:v1.2.4 → v1.3.0
github.com/golang/glog
:v1.1.0 → v1.1.2
github.com/google/go-cmp
:v0.5.9 → v0.6.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
:v0.45.0 → v0.46.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
:v0.44.0 → v0.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/metric
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/sdk
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/trace
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel
:v1.19.0 → v1.20.0
go.uber.org/goleak
:v1.2.1 → v1.3.0
golang.org/x/sys
:v0.13.0 → v0.14.0
google.golang.org/genproto/googleapis/api
:f966b18 → b8732ec
google.golang.org/genproto
:f966b18 → b8732ec
google.golang.org/grpc
:v1.58.3 → v1.59.0
Removed
Nothing has changed.
v1.13.2
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.2 fixes some CVE alerts and contains fixes for:
Changes since v1.13.1
Bug or Regression
WebSDK CertRequest Module Requested Certificate
orThis certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.
. (#6402, @maelvls)Other (Cleanup or Flake)
v1.13.1
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.1 contains a bugfix for a name collision bug in the StableCertificateRequestName feature that was enabled by default in v1.13.0.
Changes since v1.13.0
Bug or Regression
Other (Cleanup or Flake)
github.com/emicklei/go-restful/v3
tov3.11.0
becausev3.10.2
is labeled as "DO NOT USE". (#6368, @inteon)v1.13.0
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This is the 1.13 release of cert-manager!
cert-manager 1.13 brings support for DNS over HTTPS, support for loading options from a versioned
config file for the cert-manager controller, and more. This release also includes the promotion of
the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta.
Known issues
The
StableCertificateRequestName
that was promoted to Beta contains a "name collision" bug: https://github.com/cert-manager/cert-manager/issues/6342This is fixed in v1.13.1+
Breaking Changes (You MUST read this before you upgrade!)
.featureGates
value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Usewebhook.featureGates
field instead to define features to be enabled on webhook. (#6093, @irbekrm)--feature-gates
flag, this will now break (unless the webhook actually has a feature by that name). (#6093, @irbekrm)Community
Welcome to these new cert-manager members (more info - https://github.com/cert-manager/cert-manager/pull/6260):
@jsoref
@FlorianLiebhart
@hawksight
@erikgb
Thanks again to all open-source contributors with commits in this release, including:
@AcidLeroy
@FlorianLiebhart
@lucacome
@cypres
@erikgb
@ubergesundheit
@jkroepke
@jsoref
@gdvalle
@rouke-broersma
@schrodit
@zhangzhiqiangcs
@arukiidou
@hawksight
@Richardds
@kahirokunn
Thanks also to the following cert-manager maintainers for their contributions during this release:
@SgtCoDFish
@maelvls
@irbekrm
@inteon
Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings!
Special thanks to @AcidLeroy for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see https://github.com/cert-manager/cert-manager/pull/5337)
Also, thanks a lot to @FlorianLiebhart for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see https://github.com/cert-manager/cert-manager/pull/5003)
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
Changes since v1.12.0
Feature
cluster-reader
aggregated cluster role (#6241, @erikgb)enableServiceLinks
configurable for all Deployments andstartupapicheck
Job in Helm chart. (#6292, @ubergesundheit)Design
The DNS check method to be used is controlled through the command line flag:
--dns01-recursive-nameservers-only=true
in combination with--dns01-recursive-nameservers=https://<DoH-endpoint>
(e.g.https://8.8.8.8/dns-query
). It keeps using DNS lookup as a default method. (#5003, @FlorianLiebhart)Bug or Regression
cmctl check api --wait 0
exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code (#6109, @inteon).featureGates
value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Usewebhook.featureGates
field instead to define features to be enabled on webhook.--feature-gates
flag, this will now break (unless the webhook actually has a feature by that name). (#6093, @irbekrm)net.IP.String()
function would have printed that address. (#6293, @SgtCoDFish)enableServiceLinks
option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. (#6143, @schrodit)Other (Cleanup or Flake)
cert-manager.io/common-name
,cert-manager.io/alt-names
, ... annotations on Secrets are kept at their correct value. (#6176, @inteon)v0.27.2
. (#6077, @lucacome)v0.27.4
. (#6227, @lucacome)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.