-
Notifications
You must be signed in to change notification settings - Fork 61
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update dependency cert-manager/cert-manager to v1.15.3 #697
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate/cert-manager-cert-manager-1.x
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
b615cae
to
71f4da9
Compare
71f4da9
to
0a1df33
Compare
0a1df33
to
64645b9
Compare
64645b9
to
d56c186
Compare
d56c186
to
c9d8d43
Compare
c9d8d43
to
a4d106f
Compare
a4d106f
to
8ade575
Compare
8ade575
to
5733a36
Compare
5733a36
to
387847b
Compare
387847b
to
6b21534
Compare
6b21534
to
43669c4
Compare
43669c4
to
9494f7f
Compare
9494f7f
to
02b9e05
Compare
02b9e05
to
960fb64
Compare
960fb64
to
fe40dfc
Compare
fe40dfc
to
9340a6d
Compare
9340a6d
to
0cea555
Compare
0cea555
to
7a3bffd
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.11.0
->v1.15.3
Release Notes
cert-manager/cert-manager (cert-manager/cert-manager)
v1.15.3
Compare Source
v1.15.2
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
🔗 See v1.15.0 for more information about cert-manager 1.15 and read-before-upgrade info.
📜 Changes since
v1.15.1
Bug or Regression
route53
: explicitly set theaws-global
STS region which is now required by thegithub.com/aws/aws-sdk-go-v2
library. (#7189,@cert-manager-bot
)grpc-go
to fixGHSA-xr7q-jx4m-x55m
(#7167,@SgtCoDFish
)@cert-manager-bot
)endpointAdditionalProperties
in thePodMonitor
template of the Helm chart (#7191,@inteon
)HTTPRoute
resources (#7186,@cert-manager-bot
)golang
from1.22.3
to1.22.5
(#7165,@github-actions
)v1.15.1
Compare Source
v1.15.0
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.15 promotes several features to beta, including GatewayAPI support (
ExperimentalGatewayAPISupport
), the ability to provide a subject in the Certificate that will be used literally in the CertificateSigningRequest (LiteralCertificateSubject
) and the outputting of additional certificate formats (AdditionalCertificateOutputFormats
).Community
Thanks again to all open-source contributors with commits in this release, including: @Pionerd, @SgtCoDFish, @ThatsMrTalbot, @andrey-dubnik, @bwaldrep, @eplightning, @erikgb, @findnature, @gplessis, @import-shiburin, @inteon, @jkroepke, @lunarwhite, @mangeshhambarde, @pwhitehead-splunk & @rodrigorfk, @wallrj.
Thanks also to the following cert-manager maintainers for their contributions during this release: @SgtCoDFish, @SpectralHiss, @ThatsMrTalbot, @hawksight, @inteon, @maelvls & @wallrj.
Equally thanks to everyone who provided feedback, helped users and raised issues on GitHub and Slack and joined our meetings!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
Changes by Kind
Feature
--enable-gateway-api
flag to enable the integration. (#6961, @ThatsMrTalbot)For example:
cert-manager-certificaterequests-issuer-venafi/v1.15.0+(linux/amd64)+cert-manager/ef068a59008f6ed919b98a7177921ddc9e297200
. (#6865, @wallrj)LiteralCertificateSubject
feature to Beta. (#7030, @inteon)extraObjects
; a list of yaml manifests which will helm will install and uninstall with the cert-manager manifests. (#6424, @gplessis)cert-manager.io/allow-direct-injection
in annotations (#6801, @jkroepke)Design
Bug or Regression
preferredChain
is configured. (#6755, @import-shiburin)disableAutoApproval
andapproveSignerNames
Helm chart options. (#7054, @inteon)Other (Cleanup or Flake)
crds.keep
andcrds.enabled
Helm options can now be used instead of theinstallCRDs
option. (#6760, @inteon)slices
andk8s.io/apimachinery/pkg/util
packages.Removed deprecated CSR functions which have been replaced with other functions in the
pkg/util/pki
package. (#6730, @inteon)cmctl
andkubectl cert-manger
have been moved to the https://github.com/cert-manager/cmctl repo and will be versioned separately starting with cmctl v2.0.0 (#6663, @inteon)pkg/util/pki/ParseSubjectStringToRawDERBytes
function. (#6994, @inteon)--controllers
flag only specifies disabled controllers, the default controllers are now enabled implicitly. (#7054, @inteon)GO-2024-2824
. (#6996, @github-actions[bot])v1.14.7
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.14.6
Bugfixes
Other (Cleanup or Flake)
v1.14.6
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.14.5
Other (Cleanup or Flake)
v1.14.5
Compare Source
v1.14.4
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.14.0 release notes
📜 Changes since v1.14.3
Bug or Regression
cert-manager.io/allow-direct-injection
in annotations (#6809, @jetstack-bot)Other (Cleanup or Flake)
v1.14.3
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.14.0 release notes
📜 Changes since v1.14.2
Bug or Regression
v1.14.2
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
preferredChain
is configured: see release docs for more info and mitigationsℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See
Breaking changes
in v1.14.0 release notes📜 Changes since
v1.14.1
Bug or Regression
Other (Cleanup or Flake)
v1.14.1
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
v1.14.2
)preferredChain
is configured: see release docs for more info and mitigationsCA
andSelfSigned
issuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.🔧 Breaking changes
See
Breaking changes
in v1.14.0 release notesℹ️ Documentation
📜 Changes since
v1.14.0
Bug or Regression
cmctl experimental install
to panic. (#6706, @inteon)v1.14.0
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
v1.14.2
)preferredChain
is configured: see release docs for more info and mitigationsCA
andSelfSigned
issuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.v1.14.0
, the Helm chart for this version was found to use the wrong OCI image for thecainjector
Deployment,which caused the Helm installation to fail.
In order to complete the release, the cert-manager team have manually updated the Helm chart for this version,
which contains all the Helm chart fixes which are in
v1.14.1
.startupapicheck
image in namespaces other than cert-manager.cmctl experimental install
to panic.🔧 Breaking Changes
The startupapicheck job uses a new OCI image called "startupapicheck", instead of the ctl image.
If you run in an environment in which images cannot be pulled, be sure to include the new image.
The KeyUsage and BasicConstraints extensions will now be encoded as critical in the CertificateRequest's CSR blob.
🗺️ Major Themes
New X.509 Features
The cert-manager Certificate resource now allows you to configure a subset of "Other Name" SANs,
which are described in the Subject Alternative Name section of RFC 5280 (on page 37).
We specifically support any
otherName
type with aUTF-8
value, such as the User Principal Name orsAMAccountName
.These are useful when issuing unique certificates for authenticating with LDAP systems such as Microsoft Active Directory.
For example you can create certificates with this block in the spec:
The feature is still in alpha stage and requires you to enable the
OtherName
feature flag in the controller and webhook components.New CA certificate Features
You can now specify the X.509 v3 Authority Information Accessors extension,
with URLs for certificates issued by the CA issuer.
Users can now use name constraints in CA certificates.
To know more details on name constraints check out RFC section https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
Security
An ongoing security audit of the cert-manager code revealed some weaknesses which we have addressed in this release,
such as using more secure default settings in the HTTP servers that serve metrics, healthz and pprof endpoints.
This will help mitigate denial-of-service attacks against those important services.
All the cert-manager containers are now configured with read only root file system by default,
to prevent unexpected changes to the file system of the OCI image.
And it is now possible to configure the metrics server to use HTTPS rather than HTTP,
so that clients can verify the identity of the metrics server.
Other
The liveness probe of the cert-manager controller Pod is now enabled by default.
There is a new option
.spec.keystores.pkcs12.algorithms
to specify encryption and MAC algorithms for PKCS.🤝 Community
Thanks again to all open-source contributors with commits in this release, including:
Thanks also to the following cert-manager maintainers for their contributions during this release:
Equally thanks to everyone who provided feedback, helped users and raised issues on GitHub and Slack and joined our meetings!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
📜 Changes
Feature
"cluster-autoscaler.kubernetes.io/safe-to-evict": "true"
. You can provide an annotation of"cluster-autoscaler.kubernetes.io/safe-to-evict": "false"
in yourpodTemplate
if you don't like this. (#6349, @jsoref)Also, the controller's liveness probe is now enabled by default. (#6328, @inteon)
otherName
SANS in Certificates (#6404, @SpectralHiss)readOnlyRootFilesystem
by default. (#6453, @wallrj).spec.keystores.pkcs12.algorithms
to specify encryption and MAC algorithms for PKCS#12 keystores. Fixes issues #5957 and #6523. (#6548, @snorwin)readOnlyRootFilesystem: true
(#6462, @wallrj)revisionHistoryLimit
(#6248, @tberreis)spec.namespaceSelector
for webhooks (#6638, @jkroepke)Bug or Regression
.Values.config
is set. (#6357, @ABWassim)GHSA-vgf6-pvf4-34rq
: The webhook server now returns HTTP error 413 (Content Too Large) for requests with body size>= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory.The webhook server now returns HTTP error 400 (Bad Request) if the request contains an empty body.
The webhook server now returns HTTP error 500 (Internal Server Error) rather than crashing, if the code panics while handling a request. (#6498, @inteon)
BadConfig
warnings anymore (#6347, @lauraseidler)ReadHeaderTimeout
in allhttp.Server
instances (#6534, @wallrj)WebSDK CertRequest Module Requested Certificate
orThis certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.
. (#6398, @maelvls).Values.webhook.config
is set. (#6360, @ABWassim)otherName
SAN changes in Certificate resources trigger re-issuance. (#6620, @SpectralHiss)startupapicheck
image toquay.io
(#6609, @wallrj)Other (Cleanup or Flake)
1.21.3
to addressCVE-2023-39325
. Also bumps base images. (#6410, @SgtCoDFish)golang.org/x/net v0.15.0 => v0.17.0
as part of addressingCVE-2023-44487
/CVE-2023-39325
(#6427, @SgtCoDFish)crypto/md5
, a weak cryptographic primitive; usinggolangci-lint
/gosec
(G501). (#6581, @wallrj)crypto/sha1
, a weak cryptographic primitive; usinggolangci-lint
/gosec
(G505). (#6579, @wallrj)math/rand
instead ofcrypto/rand
); usinggolangci-lint
/gosec
(G404). (#6582, @wallrj)pkg/util.RandStringRunes
andpkg/controller/test.RandStringBytes
. Usek8s.io/apimachinery/pkg/util/rand.String
instead. (#6585, @wallrj)subject.serialNumber
while using a literal certificate subject. This was a mistake and has been fixed. (#6533, @inteon)github.com/emicklei/go-restful/v3
tov3.11.0
becausev3.10.2
is labeled as "DO NOT USE". (#6366, @inteon)sets.Set
type in place of the deprecatedsets.String
. (#6586, @wallrj)v1.21.6
(#6628, @SgtCoDFish)autorest
dependency (#5452, @phillebaba)v1.13.6
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.6
fixes a bug in the DigitalOcean DNS-01 provider which could cause incorrect DNS records to be deleted when using a domain with a CNAME. Special thanks to @BobyMCbobs for reporting this issue and testing the fix!It also patches CVE-2023-45288.
Known Issues
preferredChain
is configured: see 1.14 release notes for more information.Changes
Bug or Regression
v1.13.5
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.13.0 release notes
📜 Changes since v1.13.4
Bug or Regression
cert-manager.io/allow-direct-injection
in annotations (#6810, @jetstack-bot)Other (Cleanup or Flake)
v1.13.4
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.13.0 release notes
📜 Changes since v1.13.3
Bug or Regression
Other (Cleanup or Flake)
github.com/containerd/[email protected]
(#6684, @wallrj)v1.13.3
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2334
: Decryption of malicious PBES2 JWE objects can consume unbounded system resources.If you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108
: DoS vulnerability inotelgrpc
due to unbound cardinality metrics.An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks, and these are included in this patch release.
Changes
Bug or Regression
>= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory. (#6507, @inteon)ReadHeaderTimeout
in allhttp.Server
instances. (#6538, @wallrj)otel
,docker
, andjose
to fix CVE alerts. See GHSA-8pgv-569h-w5rw, GHSA-jq35-85cj-fj4p, and GHSA-2c7c-3mj9-8fqh. (#6514, @inteon)Dependencies
Added
Nothing has changed.
Changed
cloud.google.com/go/firestore
:v1.11.0 → v1.12.0
cloud.google.com/go
:v0.110.6 → v0.110.7
github.com/felixge/httpsnoop
:v1.0.3 → v1.0.4
github.com/go-jose/go-jose/v3
:v3.0.0 → v3.0.1
github.com/go-logr/logr
:v1.2.4 → v1.3.0
github.com/golang/glog
:v1.1.0 → v1.1.2
github.com/google/go-cmp
:v0.5.9 → v0.6.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
:v0.45.0 → v0.46.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
:v0.44.0 → v0.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/metric
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/sdk
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel/trace
:v1.19.0 → v1.20.0
go.opentelemetry.io/otel
:v1.19.0 → v1.20.0
go.uber.org/goleak
:v1.2.1 → v1.3.0
golang.org/x/sys
:v0.13.0 → v0.14.0
google.golang.org/genproto/googleapis/api
:f966b18 → b8732ec
google.golang.org/genproto
:f966b18 → b8732ec
google.golang.org/grpc
:v1.58.3 → v1.59.0
Removed
Nothing has changed.
v1.13.2
Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.2 fixes some CVE alerts and contains fixes for:
Changes since v1.13.1
Bug or Regression
Configuration
📅 Schedule: Branch creation - "before 4am" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.