home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-08 20:58:17 +10:00
Code Issues Packages Projects Releases Wiki Activity

remove old draft release notes

Browse Source 
this repo isn't the source of truth for release notes, and if these are
drafts anyway they don't need to be kept around

(and they will still be available in git history anyway!)

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
This commit is contained in:
Ashley Davis
2021-11-04 16:42:47 +00:00
parent 922a0a09ff
commit 4bc906ee8d
11 changed files with 0 additions and 1142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
design/release-notes/release-0.1/draft-release-notes.md
-21
View File
@@ -1,21 +0,0 @@
This is the first release of cert-manager. It is currently still not in a production ready state, and features are subject to change.
Notable features:
- *Automated certificate renewal*
- *ACME DNS-01 challenge mechanism*
- CloudDNS
- Route53
- Cloudflare
- *ACME HTTP-01 challenge mechanism*
- Should be compatible with all ingress controllers following ingress spec (GCE & nginx tested)
- *Simple CA based issuance*
- Create an Issuer that references a Secret resource containing a signing keypair, and issue/renew certificates from that.
- *Cluster-wide issuers (aka ClusterIssuer)*
- *Backed by CRDs*
- Events logged to the Kubernetes API
- Status block utilised to store additional state about resources
Please check the [README(https://github.com/jetstack-experimental/cert-manager) for a quick-start guide.
We really value any feedback and contributions to the project. If you'd like to get involved, please open some issues, comment or pick something up and get started!
design/release-notes/release-0.10/draft-release-notes.md
-138
View File
@@ -1,138 +0,0 @@
The v0.10 release comes quick on the heels of v0.9. It continues the work on
the new CertificateRequest resource type, moving us towards a world where
out-of-tree Issuer types are first class citizens.
As a project, we're pushing towards a 'stable' API release and eventually, a
v1.0 release. This release, and the releases to follow over the coming months,
lay the foundation for these milestones. Keep an eye on the releases page over
the coming months for some exciting new developments!
You can get started using the new CertificateRequest controllers by enabling
the `CertificateRequestControllers` feature gate - all Issuer types are now
supported, and your feedback is extremely valuable before we switch the new
implementation to be the default in v0.11!
We've also simplified the way we bootstrap TLS certificates for the 'webhook'
component. Now, instead of creating an Issuer and Certificate resource for the
webhook (requiring you to disable validation on the cert-manager namespace),
we've implemented a dedicated 'webhookbootstrap' controller which will manage
TLS assets for the webhook.
---
This release includes changes from:
* Alejandro Garrido Mota
* Alpha
* Hans Kristian Flaatten
* James Munnelly
* Jonas-Taha El Sesiy
* JoshVanL
* Marcello Romani
* Moritz Johner
* Nicolas Kowenski
* Olaf Klischat
* Vasilis Remmas
* stuart.warren
* zeeZ
## Notable Items
### All Issuer types now supported with CertificateRequests
The CertificateRequest design proposal, first implemented in v0.9, changes the
way we request certificates from Issuers in order to allow out-of-tree Issuer
types.
This required us to refactor and adapt our existing in-tree Issuer types to
follow a similar pattern.
The v0.10 release finishes this refactoring so that all Issuer types now
support the new format.
As the feature is currently still in an 'alpha' state, you must set the
`issuerRef.group` field on your Certificate resources to `certmanager.k8s.io`,
as well as enabling the `CertificateRequestControllers` feature gate on the
`controller` component of cert-manager.
### Simplified webhook TLS bootstrapping
In past releases, we've managed TLS for the webhook component by creating an
internal self signed and CA issuer that is used to mint serving certificates
for the apiserver to authenticate the webhook's identity.
This introduced a number of complexities in our installation process and has
caused trouble for users in the past.
In order to simplify this process and to support running a CRD conversion
webhook in future (to provide seamless migration between API versions), we've
introduced a dedicated `webhookbootstrap` controller that relies on flags and
Secret resources in order to configure TLS for the webhook.
This will mean easier installation as well as future-proofing for our upcoming
plans in future releases.
### KeyUsages on Certificate resources
In order to support a more diverse set of applications, including apps that
require client-auth certificates, a new field `keyUsages` has been added which
accepts a list of usages that must be present on a Certificate.
These will be automatically added when certificates are issued, just like any
other field on the Certificate.
Thanks to Stuart Warren from Ocado for this change!
### Preparation for v1alpha2 and beyond
Over the last few releases, we've been making a number of significant changes
to our API types (i.e. moving ACME configuration from Certificate resources
onto the Issuer resource). This has involved deprecating some old API fields.
In a future release, we'll be removing these deprecated fields altogether,
requiring users to update their manifests to utilise the new way to specify
configuration.
A number of steps have been taken in our own codebase to support this change,
and in a future release, you'll be required to update **all** your manifests for
this new format. Future API revisions (e.g. v1beta1 and v1) will be
automatically converted using a Kubernetes conversion webhook (available in
beta from Kubernetes 1.15 onwards).
## Action Required
No special actions are required as part of this release.
## Changelog
### General
- Add DisableDeprecatedACMECertificates feature gate to disable the old deprecated ACME config format ([#1923](https://github.com/jetstack/cert-manager/pull/1923), [@munnerz](https://github.com/munnerz))
- chart: fix formatting of values table in README.md ([#1936](https://github.com/jetstack/cert-manager/pull/1936), [@Starefossen](https://github.com/Starefossen))
- Add internal API version and implement machinery for defaulting & conversion ([#2002](https://github.com/jetstack/cert-manager/pull/2002), [@munnerz](https://github.com/munnerz))
- Fix concurrent map write panic in certificates controller ([#1980](https://github.com/jetstack/cert-manager/pull/1980), [@munnerz](https://github.com/munnerz))
- cainjector: allow injecting CAs directly from Secret resources ([#1990](https://github.com/jetstack/cert-manager/pull/1990), [@munnerz](https://github.com/munnerz))
- Mark 'spec' and 'status' as non-required fields in CRDs ([#1957](https://github.com/jetstack/cert-manager/pull/1957), [@munnerz](https://github.com/munnerz))
- Add ability to specify key usages and extended key usages in certificates ([#1996](https://github.com/jetstack/cert-manager/pull/1996), [@stuart-warren](https://github.com/stuart-warren))
### ACME Issuer
- Add option to assume role in Route53 DNS01 provider ([#1917](https://github.com/jetstack/cert-manager/pull/1917), [@moolen](https://github.com/moolen))
- Fix documentation for AzureDNS service principal creation ([#1960](https://github.com/jetstack/cert-manager/pull/1960), [@elsesiy](https://github.com/elsesiy))
### Webhook
- Use dedicated controller for webhook TLS bootstrapping ([#1993](https://github.com/jetstack/cert-manager/pull/1993), [@munnerz](https://github.com/munnerz))
### CertificateRequest
- Add ACME CertificateRequest controller implementation ([#1943](https://github.com/jetstack/cert-manager/pull/1943), [@JoshVanL](https://github.com/JoshVanL))
- Add Vault CertificateRequest controller implementation ([#1934](https://github.com/jetstack/cert-manager/pull/1934), [@JoshVanL](https://github.com/JoshVanL))
- Add SelfSigned CertificateRequest controller implementation ([#1906](https://github.com/jetstack/cert-manager/pull/1906), [@JoshVanL](https://github.com/JoshVanL))
- Add Venafi CertificateRequest controller implementation ([#1968](https://github.com/jetstack/cert-manager/pull/1968), [@JoshVanL](https://github.com/JoshVanL))
- Don't validate issuerRef.kind field if issuerRef.group is set in order to support out-of-tree Issuer types ([#1949](https://github.com/jetstack/cert-manager/pull/1949), [@munnerz](https://github.com/munnerz))
- Adds CertificateRequest FailureTime. The Certificate controller will re-try failed CertificateRequests at least one hour after this failed time. ([#1979](https://github.com/jetstack/cert-manager/pull/1979), [@JoshVanL](https://github.com/JoshVanL))
### Monitoring
- Added variable to specify custom namespace where to deploy ServiceMonitor resource ([#1970](https://github.com/jetstack/cert-manager/pull/1970), [@mogaal](https://github.com/mogaal))
- helm: fix labels and add Service for Prometheus ServiceMonitor ([#1942](https://github.com/jetstack/cert-manager/pull/1942), [@Starefossen](https://github.com/Starefossen))
design/release-notes/release-0.11/draft-release-notes.md
-237
View File
@@ -1,237 +0,0 @@
The v0.11 release is a significant milestone for the cert-manager project, and
is full of new features.
We are making a number of changes to our CRDs in a backwards incompatible way,
in preparation for moving into `v1beta1` and eventually `v1` in the coming
releases:
* Renaming our API group from `certmanager.k8s.io` to `cert-manager.io`
* Bumping the API version from v1alpha1 to v1alpha2
* Removing fields deprecated in v0.8 (`certificate.spec.acme`,
`issuer.spec.http01` and `issuer.spec.dns01`)
* Renaming annotation prefixes on Ingress & cert-manager resources to use the
new `cert-manager.io` prefix, and in some cases `acme.cert-manager.io`
* Using the `status` subresource for submitting status updates to the API,
first introduced in Kubernetes 1.9.
* Tightening use of common name vs DNS name with ACME certificates
We have also switched to using the new [CertificateRequest] based Certificate
issuance implementation, first introduced in alpha in cert-manager v0.9.
These changes enable exciting new integrations points in cert-manager, enabling
new things like:
* External issuer types, such as the [Smallstep Step Issuer]
* Deeper integrations into Kubernetes, with an experimental [CSI driver] that
can be used to automatically mount signed certificates into pods
* Experimental integration with Istio, allowing you to utilise any of
cert-manager's configured issuer types/CAs with the [node agent]
* Retrieving certificates without giving cert-manager access to your private
keys
This is a really exciting time for cert-manager, as these changes have been
made possible by refining our past decisions around API types, and they will
enable us to push ahead with many new features in the project.
## Important information
With all of these great changes, there is also work to do.
The changes to our CRD resources mean that upgrading requires more manual
intervention than in previous releases.
It's recommended that you backup and completely [uninstall
cert-manager](https://docs.cert-manager.io/en/release-0.11/tasks/uninstall/index.html)
before re-installing the v0.11 release.
You will also need to manually update all your backed up cert-manager resource
types to use the new `apiVersion` setting.
A table of resources and their old and new `apiVersion`s:
| Kind | Old apiVersion | New apiVersion |
|--------------------|-------------------------------|---------------------------------|
| Certificate | `certmanager.k8s.io/v1alpha1` | `cert-manager.io/v1alpha2` |
| Issuer | `certmanager.k8s.io/v1alpha1` | `cert-manager.io/v1alpha2` |
| ClusterIssuer | `certmanager.k8s.io/v1alpha1` | `cert-manager.io/v1alpha2` |
| CertificateRequest | `certmanager.k8s.io/v1alpha1` | `cert-manager.io/v1alpha2` |
| Order | `certmanager.k8s.io/v1alpha1` | `acme.cert-manager.io/v1alpha2` |
| Challenge | `certmanager.k8s.io/v1alpha1` | `acme.cert-manager.io/v1alpha2` |
You must also make sure to update all references to cert-manager in annotations to their
new prefix:
| Annotation | Affected resources | New annotation |
|----------------------------------------------|----------------------------|---------------------------------------------|
| certmanager.k8s.io/acme-http01-edit-in-place | Ingress | acme.cert-manager.io/http01-edit-in-place |
| certmanager.k8s.io/acme-http01-ingress-class | Ingress | acme.cert-manager.io/http01-ingress-class |
| certmanager.k8s.io/issuer | Ingress | cert-manager.io/issuer |
| certmanager.k8s.io/cluster-issuer | Ingress | cert-manager.io/cluster-issuer |
| certmanager.k8s.io/acme-challenge-type | Ingress | REMOVED |
| certmanager.k8s.io/acme-dns01-provider | Ingress | REMOVED |
| certmanager.k8s.io/alt-names | Ingress, Secret | cert-manager.io/alt-names |
| certmanager.k8s.io/ip-sans | Ingress, Secret | cert-manager.io/ip-sans |
| certmanager.k8s.io/common-name | Ingress, Secret | cert-manager.io/common-name |
| certmanager.k8s.io/issuer-name | Ingress, Secret | cert-manager.io/issuer-name |
| | Ingress, Secret | cert-manager.io/issuer-kind |
| | Ingress, Secret | cert-manager.io/issuer-group |
| | Ingress, Secret | cert-manager.io/uri-sans |
| | Certificate | cert-manager.io/issue-temporary-certificate |
| | CertificateRequest | cert-manager.io/private-key-secret-name |
| certmanager.k8s.io/certificate-name | CertificateRequest, Secret | cert-manager.io/certificate-name |
## Contributors
This release has seen code contributions from a number of people in the
community :tada:
* Adam Kunicki
* Alpha
* Brian Hong
* Dan Farrell
* Dig-Doug
* Galo Navarro
* Ingo Gottwald
* James Munnelly
* JoshVanL
* Kevin Lefevre
* Lachlan Cooper
* Michel Blankleder
* Toni Menzel
* Wellington F Silva
* Woz
* dulltz
As always, a big thank you to those opening issues, replying to issues and
helping out in the Slack channel. As well as working in other projects to help
users secure services running on Kubernetes.
## Notable changes
### Renamed API group
Due to new policies in the upstream Kubernetes project, we have renamed the
API group from `certmanager.k8s.io` to `cert-manager.io`.
This is a breaking change to our API surface as mentioned above, but it
is a long time coming. The original `k8s.io` suffix was used when the project
first started as there was not official guidance or information on how
`ThirdPartyResources` should be structured. Now that this area of the
Kubernetes project has evolved further, we're retrospectively changing this to
conform with the new requirements.
### Moving to v1alpha2
When cert-manager first started, we defined our APIs based on what we thought
made sense for end-users.
Over time, through gathering feedback and monitoring the way users are actually
using cert-manager, we've identified some issues with our original API design.
As part of the project moving towards v1, we've identified certain areas of our
APIs that are not fit for purpose.
In order to begin the process of moving towards `v1`, we first deprecated a
number of fields in our `v1alpha1` API. We've now **dropped** these API fields
in `v1alpha2`, in preparation for declaring this new API as `v1beta1` in the
coming releases.
### New CertificateRequest resource type
The activation of `CertificateRequest` controllers are no longer behind a
feature and are now instead enabled by default. This means that when requesting
certificates using the `Certificate` resource the `CertificateRequest` resource
will be used as the default and only way to honour the request. The addition of
this resource introduces the ability for much greater extension points to
cert-manager, notably out-of-tree issuers, istio integrations, and experimental
tooling such as a CSI driver. You can read more about the motivation and design
of this resource in the [enhancement
document](https://github.com/jetstack/cert-manager/blob/master/design/20190708.certificate-request-crd.md).
This change should cause no disruption to how end users interact with
cert-manager, with the exception of debugging now requiring this resource to be
inspected also.
### Support for out-of-tree issuer types
With the graduation of the `CertificateRequest` resource, cert-manager now
supports out-of-tree issuers by default and treats them the same as any other
core issuer. This process is facilitated by the addition of the `group` field on
issuer references inside your `Certificate` and `CertificateRequest` resources.
If you're interested in implementing your own out-of-tree issuer, or if there
is a provider you would like see implemented, feel free to reach out either
through a [GitHub
issue](https://github.com/jetstack/cert-manager/issues/new?template=feature-request.md)
or send us a message in the #cert-manager channel on [Kubernetes
Slack](http://slack.kubernetes.io/)!
### New fields on Certificate resources
This release includes a new field `URISANs` on the `Certificate` resource. With
this, you can specify unique resource identifier URLs as subject alternative
names on your certificates. This addition unblocks development for an istio
integration where mTLS can be configured using cert-manager as the backend and
in turn opens up all cert-manager issuer types as valid certificate providers in
your istio PKI.
### Improved ACME Order controller design
Some users may have noticed issues with the 'Order' resource not automatically
detecting changes to their configure 'solvers' on their Issuer resources.
In v0.11, we've rewritten the ACME Order handling code to:
1) better handle updates to Issuers during an Order
2) improve ACME API usage - we now cache more information about the ACME Order
process in the Kubernetes API, which allows us to act more reliably and
without causing excessive requests to the ACME server.
### No longer generating 'temporary certificates' by default
Previously, we have issued a temporary certificate when a `Certificate` resource
targeting an ACME issuer has been created. This would later be overridden once
the real signed certificate has been issued. The reason for this behaviour was
to facilitate compatibility with ingress-gce however, many users have had trouble
with this in the past and has led to lots of confusion - namely where
applications would need restarting to take on the signed certificate rather than
the temporary.
In this release, no temporary certificates will be created unless explicitly
requested. This can be done using the annotation
`"cert-manager.io/issue-temporary-certificate": "true` on `Certificate`
resources.
We've additionally changed the behaviour of ingress-shim to now add this new
annotation to `Certificate` resources if
`"acme.cert-manager.io/http01-edit-in-place"` is present on the Ingress
resource.
## Changelog
## Action Required
- Rename `certmanager.k8s.io` API group to `cert-manager.io` ([#2096](https://github.com/jetstack/cert-manager/pull/2096), [@munnerz](https://github.com/munnerz))
- Move Order and Challenge resources to the acme.cert-manager.io API group ([#2093](https://github.com/jetstack/cert-manager/pull/2093), [@munnerz](https://github.com/munnerz))
- Move v1alpha1 API to v1alpha2 ([#2087](https://github.com/jetstack/cert-manager/pull/2087), [@munnerz](https://github.com/munnerz))
- Allow controlling whether temporary certificates are issued using a new annotation "certmanager.k8s.io/issue-temporary-certificate"
on Certificate resources. Previously, when an ACME certificate was requested, a temporary certificate would be issued in order
to improve compatibility with ingress-gce. ingress-shim has been updated to automatically set this annotation on managed Certificate
resources when using the 'edit-in-place' annotation, but users that have manually created their Certificate resources will need to
manually add the new annotation to their Certificate resources. ([#2089](https://github.com/jetstack/cert-manager/pull/2089), [@munnerz](https://github.com/munnerz))
## Other Notable Changes
- Change the default leader election namespace to 'kube-system' instead of the same namespace as the cert-manager pod, to avoid multiple copies of cert-manager accidentally being run at once ([#2155](https://github.com/jetstack/cert-manager/pull/2155), [@munnerz](https://github.com/munnerz))
- Adds `URISANs` field to `Certificate.Spec` resource. ([#2085](https://github.com/jetstack/cert-manager/pull/2085), [@JoshVanL](https://github.com/JoshVanL))
- Move status to a CRD Subresource ([#2097](https://github.com/jetstack/cert-manager/pull/2097), [@JoshVanL](https://github.com/JoshVanL))
- Enables supporting out of tree issuers with ingress annotations ([#2105](https://github.com/jetstack/cert-manager/pull/2105), [@JoshVanL](https://github.com/JoshVanL))
- Bump Kubernetes dependencies to 1.16.0 ([#2095](https://github.com/jetstack/cert-manager/pull/2095), [@munnerz](https://github.com/munnerz))
- Adds Certificate conformance suite ([#2034](https://github.com/jetstack/cert-manager/pull/2034), [@JoshVanL](https://github.com/JoshVanL))
- Build using Go 1.13.1 ([#2114](https://github.com/jetstack/cert-manager/pull/2114), [@munnerz](https://github.com/munnerz))
- Adds Kubernetes authentication type for Vault Issue ([#2040](https://github.com/jetstack/cert-manager/pull/2040), [@JoshVanL](https://github.com/JoshVanL))
- Service account annotation support in Helm chart ([#2086](https://github.com/jetstack/cert-manager/pull/2086), [@serialx](https://github.com/serialx))
- Update AWS Go SDK to 1.24.1 to support IAM Roles for Service Accounts ([#2083](https://github.com/jetstack/cert-manager/pull/2083), [@serialx](https://github.com/serialx))
- Remove deprecated API fields and functionality ([#2082](https://github.com/jetstack/cert-manager/pull/2082), [@munnerz](https://github.com/munnerz))
- Update `hack/ci/run-dev-kind.sh` script to use the right path of cert-manager charts. ([#2074](https://github.com/jetstack/cert-manager/pull/2074), [@srvaroa](https://github.com/srvaroa))
- Simplify, improve and rewrite the acmeorders controller ([#2041](https://github.com/jetstack/cert-manager/pull/2041), [@munnerz](https://github.com/munnerz))
design/release-notes/release-0.2/draft-release-notes.md
-14
View File
@@ -1,14 +0,0 @@
## Changelog since v0.1.0
### Action Required
- Move to 'jetstack' organisation. Action required: this will require updating your existing deployments to point to the new image repository, as new tags will not be pushed to the old 'jetstackexperimental/cert-manager-controllerrepository. Ahelm upgrade` should take care of this. (#145, @munnerz)
- Set the Kubernetes secret type to TLS. Action required: this will cause renewals of existing certificates to fail. You must delete certificates that have been previously produced by cert-manager else cert-manager may enter a renewal loop when saving the new certificates. Alternatively, you may specify a new secret to store your certificate in and manually update your ingress resource/applications to reference the new secret. (#172, @munnerz)
### Other notable changes
- No longer support ClusterIssuer resources when cert-manager is running with --namespace flag set (#179, @munnerz)
- Overcome 'registration already exists for provider key' errors in ACME provider by auto-detecting lost ACME registration URIs (#171, @munnerz)
- Fix checking for invalid data in issuer secrets (#170, @munnerz)
- Fix bug in ACME HTTP01 solver causing self-check to return true before paths have propagated (#166, @munnerz)
- Fix panic if the secret named in an ACME issuer exists but contains invalid data (or no data) (#165, @munnerz)
- Ensure 5 consecutive HTTP01 self-checks pass before issuing ACME certificate (#156, @munnerz)
- Fix race condition in ACME HTTP01 solver when validating multiple domains (#155, @munnerz)
- Consistently use glog throughout (#126, @munnerz)
design/release-notes/release-0.3/draft-release-notes.md
-124
View File
@@ -1,124 +0,0 @@
# Highlights
This is a big feature filled release of cert-manager, and the first since moving to a
more frequent release model.
There's been a huge uptick in community contributions to the project, and this release
comprises the combined effort of 38 code contributors and hundreds of users reporting
issues, feature requests and bug reports!
There's quite a few big headline points, so we'll get straight in:
## ACMEv2 and Let's Encrypt wildcard certificates
This release of cert-manager brings the long-awaited ACMEv2 support, and with it, Let's Encrypt
wildcard certificates!
This allows you to request certificates for wildcard domains, e.g. \*.example.com, which can be used
to secure many different subdomains of your domain!
The introduction of ACMEv2 is a *breaking change*. Please read the notes below in the *Action Required*
section for details on how to handle your existing ACME Issuers whilst upgrading from v0.2.x.
## Alpha support for Hashicorp Vault
This release introduces initial support for Hashicorp Vault as an Issuer backend! Initially, this includes support for authenticating via AppRole and static token.
The support for this Issuer is classed as 'alpha' - feedback is invaluable at this stage of development, so we are getting it out there in a tagged release to gather usage info.
More information on configuring a Vault Issuer can be found in the Vault Issuer docs.
## readthedocs.io documentation site
Whilst this note applies to the v0.2.x release series also, it is worth noting.
We have now moved to readthedocs.io and reStructuredText for our documentation.
This should hopefully make it easier for external collaborators to make quick edits
to our documentation, and should provide more structure.
We'd like to take the time to thank all those that have opened issues or opened pull requests against
our documentation - it's a difficult thing to get right, but it's imperative our documentation is
clear for new users adopting the project.
## New ACME DNS01 providers
When cert-manager was first released, only CloudDNS and Cloudflare DNS01 providers were
supported when solving ACME challenges.
As new users, each using their own DNS providers, have adopted the project; there has been
a flurry of contributions adding support for the variety of providers out there.
With this release, we support the following DNS providers when solving ACME DNS01 challenges:
- Akamai FastDNS (#322, @twz123)
- Amazon Route53
- Azure DNS (#246, @mwieczorek)
- Cloudflare
- Google CloudDNS
There are pull requests in flight to add support for:
- DNSPod (#486, @hemslo)
- DNSimple (#483, @marc-sensenich)
- DigitalOcean (#345, @dl00)
- INWX (#336, @steigr)
- RFC2136 (#245, @simonfuhrer)
# Changelog
## Action Required
Please check the 'upgrading from 0.2 to 0.3' guide in the Administrative Tasks section of the docs here before upgrading.
- Supporting resources for ClusterIssuer's (e.g. signing CA certificates, or ACME account private keys) will now be stored in the same namespace as cert-manager, instead of kube-system in previous versions (#329, @munnerz):
*Action required*: you will need to ensure to properly manually migrate these referenced resources across into the deployment namespace of cert-manager, else cert-manager may not be able to find account private keys or signing CA certificates.
- Use ConfigMaps for leader election (#327, @mikebryant):
- *Action required*: Before upgrading, scale the cert-manager Deployment to 0, to avoid two controllers attempting to operate on the same resources
- Remove support for ACMEv1 in favour of ACMEv2 (#309, @munnerz):
*Action required*: As this release drops support for ACMEv1, all Issuer resources that use ACMEv1 endpoints (e.g. existing Let's Encrypt Issuers) will need updating to use equivalent ACMEv2 endpoints. (TODO: link to docs guide)
- Remove ingress-shim and link it into cert-manager itself (#502, @munnerz)
*Action required*: You must change your 'helm install' command to use the new --ingressShim.defaultIssuerName, --ingressShim.defaultIssuerKind options when upgrading as --ingressShim.extraArgs has been removed.
- Add certmanager.k8s.io/acme-http01-edit-in-place annotation and change ingress-shim to set 'ingressClass' on ACME Certificate resources by default. (#493, @munnerz)
*Action required*: This is a potentially breaking change for users of ingress controllers that map a single IP address to a single Ingress resource, such as the GCE ingress controller. These users will need to add the following annotation to their ingress: certmanager.k8s.io/acme-http01-edit-in-place: "true".
## Other notable changes
### ACME Issuer
- Add ACME DNS-01 provider for Akamai FastDNS (#322, @twz123)
- Add a meaningful user agent to the ACME client to help diagnosing abusive traffic patterns (#422, @jsha)
- Issuers using the AWS Route53 solver may attempt to find credentials using the environment, EC2 IAM Role, and other sources available to the cert-manager controller. This behavior is on by default for cluster issuers and off by default for issuers. This behavior may be enabled or disabled for all issuers or cluster issuers using the --issuer-ambient-credentials and --cluster-issuer-ambient-credentials flags on the cert-manager controller. (#363, @euank)
- Add limits to http validation pod (#408, @kragniz)
- The ACME dns01 solver now trims excess whitespace from AWS credentials (#391, @euank)
- ACME DNS-01 challenge mechanism for Azure DNS (#246, @mwieczorek)
- Fix panic when ACME server returns an error other than HTTP Status Conflict during registration (#237, @munnerz)
### CA Issuer
- Add the Key Encipherment purpose to CA Issuer generated certificates (#488, @bradleybluebean)
- Bundle CA certificate with issued certificates (#317, @radhus)
### Vault Issuer
- Add experimental support for Hashicorp Vault issuers (#292, @vdesjardins)
- ingress-shim
- ingress-shim now reconfigures certificates (#386, @kragniz)
- ingress-shim will only sync Ingress resources with kubernetes.io/tls-acme annotation if the value of that annotation is true. (#325, @wmedlar)
### Docs
- Rewrite documentation and publish on readthedocs (#428, @munnerz)
- Document the minimum necessary permissions for using cert-manager with Route53 (#359, @wmedlar)
- Improve deployment documentation (#264, @munnerz)
### Helm
- Add clusterResourceNamespace option to Helm chart (#547, @munnerz)
- Enhance Helm chart in-line with best practices (#229, @unguiculus):
- Add support for node affinity and tolerations in Helm chart (#350, @kiall)
- Add podAnnotations to Helm chart (#387, @etiennetremel)
- Add Certificate CRD shortnames cert and certs. This is configurable in the Helm Chart with certificateResourceShortNames. (#312, @Mikulas)
- Remove default resource requests in Helm chart. Improve post-deployment informational messages. (#290, @munnerz)
- End-to-end testing now covers the helm chart for cert-manager on Kubernetes 1.7-1.9 (#216, @munnerz)
### Other
- Produce a single static manifest instead of a directory when generating deployment manifests (#574, @munnerz)
- Use cert-manager deployment namespace by default for leader election (#548, @munnerz)
- Removed --namespace flag (#433, @kragniz)
- Run cert-manager container as a non root user (#415, @tettaji)
- TLS secrets are now annotated with information about the certificate (#388, @kragniz)
- The static deployment manifests now automatically deploy into the 'cert-manager' namespace by default (#330, @munnerz)
- Rename Event types to be prefixed 'Err' instead of 'Error' for brevity (#332, @munnerz)
- Clearer event logging when issuing a certificate for the first time (#331, @munnerz)
- Provide static deployment manifests as an alternative to a Helm chart based deployment (#276, @munnerz)
- Update existing secrets instead of replacing in order to preserve annotations/labels (#221, @munnerz)
- Update to Go 1.9 (#200, @euank)
### Bugfixes
- Fix a race condition in the package responsible for scheduling renewals (#218, @munnerz)
- Fix a bug that caused ACME certificates to not be automatically renewed (#215, @munnerz)
- Fix a bug in checking certificate validity and improve validation of dnsNames and commonName (#183, @munnerz)
- Fix bugs when checking validity of certificate resources (#184, @munnerz)
design/release-notes/release-0.4/draft-release-notes.md
-94
View File
@@ -1,94 +0,0 @@
This is the next feature release of cert-manager, containing a number of additions
that have been in the works for a while now.
As you will notice from the release notes below, we are seeing a lot more community
contributions to the project which is brilliant! smile
A massive thank you to everyone involved in making this release a reality.
We have moved to a more regular minor-release schedule, and aim to cut new feature
releases monthly. That means the next minor release (v0.5) is scheduled for
around the 11th August.
# Highlights
## Resource validation for Issuers, ClusterIssuers and Certificates
A common pain point for users has been around submitting invalid resources to the
API, which cannot be handled or processed.
Other Kubernetes API types handle this well by applying 'validation' before the
resource is persisted or operated upon, and up until now we have not supported this.
When submitting your resources to the Kubernetes apiserver, they will now be validated
and if invalid, cert-manager will inform you of why and how they are invalid and
suspend processing of that resource.
In the next release, this validation will be turned into a 'ValidatingWebhookConfiguration'
which will allow us to prevent these resources being persisted into the API in
the first place, similar to all other Kubernetes resource types.
Due to some limitations with the current release of Helm, we have been unable to
support this webhook operation mode in the v0.4 release of cert-manager.
However, releasing validation this way allows us to pilot the new validation rules
we have in place and it allows you to get started with it immediately!
## Added reference documentation for API types
Regularly, users ask us "what can I specify on my resources". In the past, we have
had to recommend users check out our source code (namely types.go) in order to
find out what can and cannot be specified.
Digging through source code is no longer required! As part of our documentation
publishing process, we now generate reference API documentation (similar to the
upstream Kubernetes project!). This is available under the
'Reference documentation -> API documentation' section of our docs site!
## Better support for 'split horizon' DNS environments with ACME DNS01 challenges
A number of users have noticed that when running cert-manager with DNS01 challenges
in split-horizon DNS environments (using the ACME issuer), the self check stage
of the validation process failed as the 'internal' DNS resolvers were used to
check for challenge record propagation.
We have added a new flag, --dns01-self-check-nameservers, that allows users to specify
custom recursive DNS servers to use for performing DNS01 self checks.
In these environments, this flag can be set to some external nameserver list that
will be used for DNS01 resolution, e.g. 8.8.8.8:53,8.8.4.4:53.
## Self-signed Issuers
We recently merged support for 'self signed' issuers. This allows users to create
the basis for a completely cert-manager managed PKI by 'self signing' certificates.
This can be useful when debugging, or once cert-manager also supports setting the
isCA bit on a Certificate, for creating a self signed root CA!
Read up on how to get started with this new issuer type in the documentation.
# Changelog
## Action Required
- Check the acme issuer has the 'HTTP01' challenge type configured if in use. (#629, @groner)
ACME http01 validation is no longer attempted using an
Issuer/ClusterIssuer with no ACME http01 config. Note that the minimal
http01: {} config IS sufficient.
If you rely on ACME http01 validation, you should check your issuers to make
sure http01 validation is explicitly enabled as in previous release, this was
not verified!
## Other notable changes
### ACME Issuer
- Add --dns01-nameservers flag for setting nameservers for DNS01 check (#710, @kragniz)
- Fix bugs affecting eTLD and CNAMEs during DNS zone resolution (#582, @ThatWasBrilliant)
- Run acmesolver container as non-root user (#585, @klausenbusk)
- Support for ACME HTTP01 validations when using istio-ingress with a mTLS enabled mesh (#622, @munnerz)
### Vault Issuer
- Configurable Vault appRole authentication path using the attribute is spec.vault.auth.authPath in the issuer. (#612, @vdesjardins)
### Self-signed Issuer
- Add 'self signed' Issuer type (#637, @munnerz)
### Docs
- Add reference documentation for API types (#644, @munnerz)
### Helm
- Added configuration variables to set http_proxy, https_proxy and no_proxy environment variables in Helm chart. (#680, @fllaca)
- added option to set additional environment variable values to the helm chart (#556, @nazarewk)
### Other
- Add certmanager.k8s.io/certificate-name label to secrets. (#719, @kragniz)
- Add resource validation at start of sync loops, and mark resources as not Ready when invalid (#682, @munnerz)
- To disable ingress-shim, you can now set this flag: --controllers=issuers,clusterissuers,certificates (#717, @kragniz)
design/release-notes/release-0.5/draft-release-notes.md
-47
View File
@@ -1,47 +0,0 @@
# Highlights
## Resource validation webhook
Following the v0.4.0 release, we have now added a 'validating webhook' for our API resources. This will help prevent invalid configurations being submitted to the API server.
This feature is disabled by default.
Information on enabling the new webhook component can be found in the Resource Validation Webhook document.
## New Certificate options
A number of new fields have been added to the Certificate resource type:
- keyAlgorithm - support alternative private key algorithms (e.g. rsa or ecdsa) for generated certificates.
- keySize - allow specifying an alternative key bit size
- isCA - allows generating certificates with the 'signing' usage set
- organization - allows specifying values for the 'O' field of Certificates (for supported providers)
New fields like this make cert-manager more useful for applications beyond just securing Ingress, as well as allowing users to continue meeting their security requirements for x509 certificates.
## New ACME DNS providers
This release includes two new DNS provides for the ACME Issuer:
- acme-dns
- RFC2136
These additions should help more users begin using cert-manager with their chosen DNS provider, without having to delegate to an alternate provider that is supported tada
# Changelog
## General
- Add renew-before-expiry-duration option to configure how long before expiration a certificate should be attempted to be renewed (#801, @munnerz)
- Add validation webhooks for API types (#478, @munnerz)
- Add extended issuer-specific validation to certificates at runtime (#761, @kragniz)
## API changes
- Adds new fields: "keyAlgorithm", "keySize" onto CertificateSpec to allow specifying algorithm (rsa, ecdsa) and key size to use when generating TLS keys (#722, @badie)
- Add isCA field to Certificates (#658, @munnerz)
- Add "organization" field to certificate objects (#838, @Queuecumber)
## CA Issuer
- Don't bundle the CA certificate when using the self signed issuer (#811, @munnerz)
## ACME
- Fix issue that could cause Certificates to fail renewal (#800, @munnerz)
- Add acme-dns as a dns01 provider (#787, @Queuecumber)
- [jjo] fix panic from acmedns.go constructor failure (#858, @jjo)
- Fix cloudflare provider failing on cleanup if no record is found (#849, @frankh)
- Fixed Route53 cleanup errors for already deleted records. (#746, @euank)
- Add support for delegating DNS-01 challenges using CNAME records. (#670, @gurvindersingh)
- Fix a race that could cause ACME orders to fail despite them being in a 'valid' state (#764, @munnerz)
- Fix cleanup of Google Cloud DNS hosted zone for dns-01 challenge records (#754, @kragniz)
- Fix issue causing existing Ingresses to not be cleaned up properly after HTTP01 challenges in some cases (#831, @munnerz)
- Allow metadata server authentication for Google Cloud DNS (#664, @rpahli)
- Add RFC2136 DNS Provider (#661, @splashx)
design/release-notes/release-0.6/draft-release-notes.md
-99
View File
@@ -1,99 +0,0 @@
The long-awaited v0.6 release is here! This release includes a huge number of improvements, bug fixes and new features.
We've made a big focus on the ACME implementation, as well as improving the general user-experience when requesting certificates.
We've exposed new x509 certificate fields via the Certificate resource type, as well as improving support for these options across all Issuer types.
As of the v0.6 release being cut, we've also reached a huge 99 code contributors! This is incredible to see, and we're thankful to all those who have contributed in all forms over the last couple of years!
Read on to get some of the highlights, as well as the full list of note-worthy changes below!
# Highlights
## Introducing ACME 'Order' and 'Challenge' CRDs
This release of cert-manager refactors how ACME certificates are handled significantly.
This should result in:
Fewer API calls to ACME servers - information about orders and challenges is now stored within the Kubernetes API
Better behaviour with regards to rate limits
A cleaner surface for debugging issues - we can now provide more context and information through the Events API as well as the 'status' field on our API types
This is largely an internal change, but with far reaching benefits.
For more details, check out the details in the pull request (#788).
We are keen to hear feedback on this new design, so please create issues including the /area provider-acme text in order to report feedback/problems.
## Improved handling of ACME rate limits
After extensive testing, we've found in the most extreme cases a 100x reduction in ACME API client calls.
This is a massive difference, and helps reduce the load that instances of cert-manager put on services like Let's Encrypt.
As a result, we strongly recommend all users upgrade to the v0.6 release as soon as possible!
## Prometheus metrics for the ACME client
In order to support the API client testing above, we've also added support for Prometheus metrics into our ACME client.
This means you can now start instrumenting cert-manager's own usage of ACME APIs, in order to detect issues and understand behaviour before it becomes a problem.
The metrics are broken down by path, status code and a number of other labels.
## Validating resource webhook enabled by default
In order to provide a better experience out of the box, we've now enabled the validating webhook component by default.
This means that when you submit resources to the API server, they will be checked for misconfigurations before they are persisted to the API, meaning configuration errors are surfaced immediately, and in some cases alongside steps that can be taken to remediate the errors.
## ECDSA keys supported for ACME certificates
It's now possible to create ECDSA private keys when issuing certificates from ACME servers. You can configure the key type and key size using certificate.spec.keyAlgorithm and certificate.spec.keySize respectively.
## Scalability improvements
As part of our validation for this release, we've been able to test cert-manager in larger deployment configurations.
This includes running with an ACME issuer with 6k+ domain names, showing that our client usage remains sensible and cert-manager itself does not begin to strain.
Off the back of this scale testing, we've also got numerous scale-related improvements triaged for the next minor release, v0.7.
# Action Required
There is only one PR that changes previous behaviour in this release.
Between v0.4.0 and v0.5.0, we introduced support for following CNAME records when presenting DNS01 challenges. This inadvertently broke DNS01 challenge solving when a user used a CNAME record at the route of their DNS zone (i.e. on Route53 when using an Amazon ELB).
This change reverts the default behaviour to support this kind of setup without additional changes, and instead introduces a new cnameStrategy field on ACME Issuer resources. You can set this field to Follow to restore the behaviour introduced in v0.5.0.
This note only affects the ACME Issuer type.
# Changelog
## General
- Bump Go version to 1.11 (#1050, @munnerz)
- Removed the Git commit hash from the version string in non canary builds (#997) (#1021, @Nalum)
- Include ca.crt in created secrets for Issuers that support it (vault, ca and selfsigned) (#848, @Queuecumber)
- Added RBAC permissions for user facing roles to access Certificates and Issuers. (#902, @fuel-wlightning)
- Add global.priorityClassName option to Helm chart (#1190, @Art3mK)
- Add --namespace option to limit scope to a single namespace (#1188, @kragniz)
- Print more useful information about Certificate, Order and Challenge resources when running kubectl get (#1194, @munnerz)
## ACME Issuer
- Introduce ACME 'Order' and 'Challenge' resource types & re-implement ACME Issuer to be completely driven by CRDs (#788, @munnerz)
- ACTION REQUIRED: Fix ACME issues relating to wildcard CNAME records and add a 'cnameStrategy' field to the ACME Issuer DNS01 provider config. (#1136, @munnerz)
- Added certmanager.k8s.io/acme-http01-ingress-class annotation to ingress-shim (#1006, @kinolaev)
- Make http01 solver serviceType configurable, so one can use ClusterIP instead of the previously hardcoded type NodePort. NodePort still remains as default. (#924, @arnisoph)
- Revised Cert Issuer Docs for DNS01 challenge and added a doc for AzureDNS (#915, @damienwebdev)
- Make http01 solver pod resource request/limits configurable (#923, @arnisoph)
- Allow ECDSA keys for ACME certificates (#937, @acoshift)
- RFC2136 provider: fixes a minor bug where dns01 nameserver key has value with no port (#908, @splashx)
- Add ACME HTTP client prometheus metrics (#1226, @munnerz)
- Reduce usage of ACME 'new-acct' endpoint (#1227, @munnerz)
- Disable TLS verification when self-checking (#1221, @DanielMorsing)
- Adds new flag --dns01-recursive-nameservers-only=[true|false] that defaults to false. When true, cert-manager will only ever query the configured DNS resolvers to perform the ACME DNS01 self check. This is useful in DNS constrained environments, where access to authoritative nameservers is restricted. Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers. (#1184, @tlmiller)
- Retain Challenge resources when an Order has entered a failed state to make debugging easier (#1197, @munnerz)
- Increase back-off time between ACME order attempts on failure from 5m to 1h (#1195, @munnerz)
- Add 'reason' field when an order/challenge gets marked invalid (#1192, @DanielMorsing)
- Add DigitalOcean DNS Provider (#972, @aslafy-z)
## CA Issuer
- Update CA Issuer status condition usage (#961, @munnerz)
- It is now possible to include a certificate chain in the secret for the ca Issuer. This will then be propagated to generated certificates. (#1077, @mikebryant)
## Vault Issuer
- A new field caBundle added to the Vault Issuer configures a CA certificate used to validate the connection to the Vault Server. (#911, @vdesjardins)
## Bugfixes
- Increase time between retries for failing issuers and clusterissuers (#981, @munnerz)
- Fix concurrent map write race condition in ACME solver (#1033, @munnerz)
- Fix bug when updating ACME server URL on an existing Issuer resource (#1230, @munnerz)
- Fix issuing a certificate into a pre-existing secret resource (#1217, @munnerz)
- Fix affinity and tolerations declaration (#1209, @GuillaumeSmaha)
design/release-notes/release-0.7/draft-release-notes.md
-81
View File
@@ -1,81 +0,0 @@
## Action Required
The Helm chart rbac.create option has moved to be global.rbac.create.
Users of the Helm chart will need to update their install overrides to use
the new format.
The Helm chart has now moved to be hosted on charts.jetstack.io, and
exposed via the Helm Hub. This allows us to make
and test changes to the Helm chart more easily, and better manage versioning.
## Highlights
### Venafi Issuer type
This release introduces a new issuer type for Venafi Cloud and Venafi Trust
Protection Platform.
The Venafi adapter will be built out over the coming months to improve the
integration and expose more of the Venafi platform's advanced functionality.
### New cainjector controller
This release introduces support for injecting CA bundles into Kubernetes
{Validating,Mutating}WebhookConfiguration & APIService resources.
You can utilise the new controller by adding the certmanager.k8s.io/inject-ca-from
annotation to your webhook and APIService resources.
This was needed in order to improve our own deployment of the 'webhook'
component as part of this release.
### Improved webhook deployment
The v0.6 release utilised an additional ca-sync CronJob resource that allowed
us to secure the webhook component automatically using cert-manager itself.
Thanks to the new cainjector controller described above, we have now removed
this CronJob altogether in favour of using the far more reliable controller.
### Experimental ARM support
Support for ARM was adding as part of this release (#1212). We do not currently
have automated testing using ARM platforms, so this feature is still marked
experimental.
To utilise the new ARM support, you'll need to update your manifests and append
the architecture to the image name (i.e. quay.io/jetstack/cert-manager-controller-arm64:v0.7.0).
### Easier debugging of failing ACME challenges
The introduction of the Challenge resource in the last release has allowed us
to provide better means for debugging failures.
In the v0.7.0 release, if a self check or ACME validation is failing for some
reason, this information will be displayed when running kubectl get and
kubectl describe.
### Changelog since v0.6.0
- Add Venafi Cloud & TPP issuer type (#1250, @munnerz)
- cainjector: add support for injecting apiserver CA (#1420, @munnerz)
- Generate temporary self signed certificate whilst waiting for issuer to issue certificate (#1392, @munnerz)
- Added kubeprod as an alternative way to deploy cert-manager to the documentation (#1421, @arapulido)
- Use new cainjector controller for webhook APIService resource (#1415, @munnerz)
- Adds a controller for injecting CA data into webhooks and APIServices (#1398, @DirectXMan12)
- Bump Kubernetes dependencies to v1.13 (#1268, @munnerz)
- Use charts.jetstack.io instead of the helm/charts repository to publish Helm chart (#1377, @munnerz)
- Recreate dead solver pods during self-check (#1388, @DanielMorsing)
- Improve RFC2136 DNS01 provider documentation (#944, @briantopping)
- Add more information to Google CloudDNS guide (#1295, @wwwil)
- Add validation schema to CRD resources (#1322, @munnerz)
- Fire additional events when syncing ACME certificates fails (#1327, @munnerz)
- Publish arm32 and arm64 images for all cert-manager components (#1212, @munnerz)
- Extend ACME self check to check CAA records (#1325, @DanielMorsing)
- Bump Kubernetes apimachinery dependencies to v1.10.12 (#1344, @munnerz)
- Increase acmesolver default cpu resource limit to 100m (#1335, @munnerz)
- Fix potential race when updating secret resource (#1318, @munnerz)
- Fix bug causing certificates to be re-issued endlessly in certain edge cases (#1280, @munnerz)
- Fix bug when specify certificate keyAlgorithm without an explicit keySize (#1309, @munnerz)
- Bump Go version to 1.11.5 (#1304, @munnerz)
- Fix typo in SelfSigned Issuer in webhook deployment manifests (#1294, @munnerz)
- Add IP Address in CSR (#1128, @lrolaz)
- Allow to use PKCS#8 encoded private keys in CA issuers. (#1191, @chr-fritz)
- Add webhook troubleshooting guide (#1288, @munnerz)
- Overhaul documentation and add additional content (#1279, @munnerz)
- Increase x509 certificate duration from 90d to 1y for webhook component certificates (#1276, @munnerz)
- Fix bug where --dns01-recursive-nameservers flag was not respected when looking up the zone to update for a DNS01 challenge (#1266, @munnerz)
- Reuse acme clients to limit use of nonce/directory/accounts endpoints (#1265, @DanielMorsing)
- Surface self-check errors in challenge resource (#1244, @DanielMorsing)
design/release-notes/release-0.8/draft-release-notes.md
-97
View File
@@ -1,97 +0,0 @@
Following on from the v0.7.x releases and a series of pre-release candidates,
cert-manager v0.8.0 is available at last!
This release packs in a tonne of stability improvements, as well as a whole load
of new features grinning
As part of this release, we're updating our API format in order to better
support the 1.0 release, which we hope to reach within the next few months.
This has been accomplished in a backwards-compatible for now, to make the
upgrade process easier, especially for users that manage large numbers of
certificate resources.
As well as the new release, we've also finally created a project logo!
For those of you who are attending KubeCon EU, we'll be handing out stickers
at the Jetstack booth from tomorrow onwards!
## Action required
The deployment manifests have now moved from being a part of our GitHub
repository and are now published alongside each image tag. Please double
check the installation guide for more information on where the manifests
can now be found. This change does not affect the Helm chart!
## New ACME configuration format
As part of stabilising our API surface, we've made a change to the way
you configure your ACME based certificates.
Instead of Certificate resources containing an extra certificate.spec.acme
field, which is only relevant for ACME certificates, the configuration has now
moved over to the Issuer resource instead. More details on this change can be
found in the upgrade notes.
## OpenShift installation instructions
In order to make it easier for users to run cert-manager on platforms other
than Kubernetes, we've improved our OpenShift support, including an official
installation guide for users of OpenShift.
If you use OpenShift in your organisation, check out the getting started section
for more information on how to get up and running!
## Webhook based ACME DNS01 solver
Over the last year and a half, we've had more than 15 pull requests to add new
ACME DNS01 providers to our codebase. It's been brilliant to see such vibrant
community involvement, however it's become infeasible for us to continue to
accept, test and maintain such a rapidly growing matrix of providers.
As a result, we've put together a new 'webhook' DNS01 solver type.
This allows you to create and install your own DNS01 providers without having
to make changes in cert-manager itself.
You can see an example repository to get started building your own over in the
cert-manager-webhook-example repo on GitHub.
This is a new and experimental feature, however we're excited to see the community
move to this new model of extending cert-manager.
## Switch to structured logging
As the project has grown, we've also increased the verbosity and frequency of our log messages.
Over time, this has become difficult to manage and work with, and so with the v0.8 release
we have begun the process of switching over our codebase to structured logging.
This should make it far easier to index, search and grep through log messages that cert-manager
emits.
Your feedback here is really valuable, so please open issues and comment on Slack if you
have any issues!
## Changelog
- make email address an optional field in ACME issuers (#1483, @DanielMorsing)
- Fix bug when handling resources that have lastTransitionTime set to null (#1628, @munnerz)
- Allow Openshift to install cert-manager chart (#1395, @JGodin-C2C)
- Update documentation for new 'solvers' field (#1623, @munnerz)
- Fix issue where ingress-shim would not clear old configuration when migrating to the new 'solvers' field (#1620, @munnerz)
- Add new issuer.spec.acme.solvers field that replaces certificate.spec.acme'in order to make all certificate resources portable between issuer types. The previously syntax is still supported to allow easy migration to the new configuration format. (#1450, @munnerz)
- Fixes additionalPrinterColumn formatting for Certificate resources (#1616, @munnerz)
- Fix update loop in certificates controller and add additional debug logging (#1602, @munnerz)
- Automatically retry expired Challenge resources (#1603, @munnerz)
- Build under MacOS. (#1601, @michaelfig)
- Disable the CAA check by default, and introduce a new --feature-gates=ValidateCAA=true option to enable it (#1585, @munnerz)
- Improve error handling when ACME challenges fail to Present or CleanUp (#1597, @munnerz)
- Add static label for solver identification to allow usage of custom service (#1575, @christianhuening)
- Fix issues running the cainjector controller on Kubernetes 1.9 (#1579, @munnerz)
- Fix upgrade bug where lastTransitionTime may be set to nil, rendering cert-manager inoperable without manual intervention (#1576, @munnerz)
- Add webhook based DNS01 provider (#1563, @munnerz)
- Add DNS01 provider conformance test suite (#1562, @munnerz)
- fix typo in the deployment template (#1546, @cpanato)
- Automatically generate LICENSES file (#1549, @munnerz)
- Switch to go modules for dependency management (#1523, @munnerz)
- Bump to use Go 1.12 (#1429, @munnerz)
- use authoritative nameservers for CAA checks (#1521, @DanielMorsing)
- Update certificate if issuer changes (#1512, @lentzi90)
- also whitelist ipv6 (#1497, @mdonoughe)
- Set default acmesolver image based on arch (#1494, @lentzi90)
- Improve logging in ACME HTTP01 solver (#1474, @munnerz)
- Run metrics server on cert-manager instances that have not been elected as leader (#1482, @kragniz)
- Switch to structured logging using logr (#1409, @munnerz)
- fixing the quickstart documentation to use the new helm chart repo charts.jetstack.io (#1468, @BradErz)
- Removes need for hostedZoneName to be specified. Uses discovered DNS zone name instead. (#1466, @logicfox)
design/release-notes/release-0.9/draft-release-notes.md
-190
View File
@@ -1,190 +0,0 @@
The v0.9 release is one of our biggest yet, packed with new features and bug
fixes!
The introduction of the new CertificateRequest resource type is significant as
it is a step towards where we want to be for 1.0, defining an API specification
for Certificates and allowing anyone to implement their own issuers and CAs as
first class citizens.
This release includes changes from:
* Aaron Gershman
* Aled James
* Artem Yarmoluk
* Carlos Panato
* Chris Abiad
* Christopher Abiad
* Crystal-Chun
* Dan
* Dobes Vandermeer
* Hans Kristian Flaatten
* Hays Clark
* Ivan Wallis
* James Munnelly
* Joshua Van Leeuwen
* Kevin Woo
* Lachlan Cooper
* Louis Taylor
* Michael Cristina
* Michael Tsang
* PirateBread
* Qiu Yu
* Sergej Nikolaev
* Solly Ross
* Stefan Kolb
* Steven Tobias
* Stuart Hu
* Till Wiese
* kfoozminus
## Notable Items
### New CertificateRequest Resource
A new resource has been introduced - `CertificateRequest` - that is used to
request certificates using a raw x509 certificate signing request. This resource
is not typically used by humans but rather by other controllers or services. For
example, the `Certificate` controller will now create a `CertificateRequest`
resource to resolve its own Spec.
Controllers to resolve `CertificateRequest`s are currently disabled by default
and enabled via the feature gate `CertificateRequestControllers`. This feature
is currently in Alpha and only the CA issuer has been implemented.
This resource is going to enable out of tree, external issuer controllers to
resolve requests. Other issuer implementations and details on how to develop an
out of tree issuer will follow in later releases. You can read more on the
motivations and road map in the [enhancement
proposal](https://github.com/jetstack/cert-manager/blob/master/design/20190708.certificate-request-crd.md)
or how this resource is used in the
[docs](https://docs.cert-manager.io/en/release-0.9/reference/certificaterequests.html).
### DNS Zones support for ACME challenge solver selector
A list of DNS zones can now be added to the ACME challenge solver selector. The
most specific DNS zone match specified here will take precedence over other DNS
zone matches, so a solver specifying `sys.example.com` will be selected over one
specifying `example.com` for the domain `www.sys.example.com`. If multiple
solvers match with the same dnsZones value, the solver with the most matching
labels in matchLabels will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
### Certificate Readiness Prometheus Metrics
Cert-manager now exposes Prometheus metrics on Certificate ready statuses as
`certmanager_certificate_ready_status`. This is useful for monitoring
Certificate resources to ensure they have a `Ready=True` status.
### Prometheus Operator ServiceMonitor
Support has been added to include a Prometheus ServiceMonitor for cert-manager
in the helm chart. This enables monitoring of cert-manager when in conjunction
with the [Prometheus Operator](https://github.com/coreos/prometheus-operator).
This is disabled by default but can be enabled via the helm configuration.
### ACMEv2 POST-as-GET
We have now switched to use the new POST-as-GET feature that was introduced
into the latest version of the ACME spec a few months ago.
If you are running your own ACME server, please ensure it supports POST-as-GET
as we no longer supported the old behaviour.
### ACME Issuer Solver Pod Template
The ACME Solver Pod Spec now exposes a template that can be used to change
metadata about that pod. Currently, a template will expose labels, annotations,
node selector, tolerations, and affinity. This is useful when running
cert-manager in multi-arch clusters, or when you run workloads across different
types of nodes and need to restrict where the acmesolver pod runs.
## Action Required
### Length limit for Common Names
Common names with a character length of over 63 will be rejected during
validation. This is due to the upper limit being detailed in RFC 5280.
### Distroless Cert-Manager Base Images
For each container, cert-manager ships with the base image
'gcr.io/distroless/static' which is a minimal image that includes no binaries.
Users who want to debug from within the cert-manager pod will need to attach an
additional container with their debug utilities to the pod's namespace.
### CSRs in Order Resources now PEM Encoded
CSRs in Order resources have previously been incorrectly DER encoded due to an
error in implementation. This has now been corrected to PEM encoding. Current
orders that were created with a previous version of cert-manager will fail to
validate and so will be recreated. This should resume the order normally.
## Changelog
### General
- Reduce cert-manager's RBAC permissions ([#1658](https://github.com/jetstack/cert-manager/pull/1658), [@munnerz](https://github.com/munnerz))
- commented-out extraArg for enable-certificate-owner-ref ([#1828](https://github.com/jetstack/cert-manager/pull/1828), [@aegershman](https://github.com/aegershman))
- Validate that Certificates in a namespace have unique `secretName` ([#1689](https://github.com/jetstack/cert-manager/pull/1689), [@cheukwing](https://github.com/cheukwing))
- Feature addition: Support for PKCS&#35;8 keys. ([#1308](https://github.com/jetstack/cert-manager/pull/1308), [@Crystal-Chun](https://github.com/Crystal-Chun))
- Add the removal of certificates when no longer required by the owner ingress ([#1705](https://github.com/jetstack/cert-manager/pull/1705), [@cheukwing](https://github.com/cheukwing))
- Fix bug causing ECDSA certificates to be issued using 2048-bit RSA private keys ([#1757](https://github.com/jetstack/cert-manager/pull/1757), [@munnerz](https://github.com/munnerz))
- Updated the labels in the helm charts to use the newer ones. ([#1769](https://github.com/jetstack/cert-manager/pull/1769), [@cpanato](https://github.com/cpanato))
- Allow disabling issuing temporary certificates with feature flag `--feature-gates=IssueTemporaryCertificate=false` ([#1764](https://github.com/jetstack/cert-manager/pull/1764), [@gordonbondon](https://github.com/gordonbondon))
- Switch to using distroless for base images ([#1663](https://github.com/jetstack/cert-manager/pull/1663), [@munnerz](https://github.com/munnerz))
- Limit length for CommonName to 63 bytes ([#1818](https://github.com/jetstack/cert-manager/pull/1818), [@cheukwing](https://github.com/cheukwing))
### ACME Issuer
- Properly encode the CSR field on Order resources as PEM data instead of DER ([#1884](https://github.com/jetstack/cert-manager/pull/1884), [@munnerz](https://github.com/munnerz))
- Fire informational Event if an ACME solver cannot be chosen for a domain on an Order ([#1856](https://github.com/jetstack/cert-manager/pull/1856), [@munnerz](https://github.com/munnerz))
- Fix bug with auto-generated Order names being longer than 63 characters ([#1765](https://github.com/jetstack/cert-manager/pull/1765), [@cheukwing](https://github.com/cheukwing))
- Fix a panic when a misconfigured Issuer is used for HTTP01 challenge solving ([#1758](https://github.com/jetstack/cert-manager/pull/1758), [@munnerz](https://github.com/munnerz))
- Fix a bug where the logic to select a solver would always return the last solver and may return the wrong kind of solver for the challenge that it returned. ([#1717](https://github.com/jetstack/cert-manager/pull/1717), [@dobesv](https://github.com/dobesv))
- Fix indentation on ACME setup examples ([#1785](https://github.com/jetstack/cert-manager/pull/1785), [@lachlancooper](https://github.com/lachlancooper))
- Fix a the logic to select the most specific solver from an issuer if multiple matched ([#1715](https://github.com/jetstack/cert-manager/pull/1715), [@dobesv](https://github.com/dobesv))
- Adds support for `nodeSelector` and `tolerations` in `podTemplate.spec` ([#1803](https://github.com/jetstack/cert-manager/pull/1803), [@cheukwing](https://github.com/cheukwing))
- support azure non-public regions ([#1830](https://github.com/jetstack/cert-manager/pull/1830), [@stuarthu](https://github.com/stuarthu))
- Fix issue causing challenge controller to attempt to list Secrets across all namespaces even when --namespace is specified ([#1849](https://github.com/jetstack/cert-manager/pull/1849), [@munnerz](https://github.com/munnerz))
- Adds the handling of updates to the `spec.acme.email` field in Issuers ([#1763](https://github.com/jetstack/cert-manager/pull/1763), [@cheukwing](https://github.com/cheukwing))
- Fix issue with private managed-zone being picked in CloudDNS ([#1704](https://github.com/jetstack/cert-manager/pull/1704), [@cheukwing](https://github.com/cheukwing))
- Expose pod template for the ACME issuer solver pod ([#1749](https://github.com/jetstack/cert-manager/pull/1749), [@JoshVanL](https://github.com/JoshVanL))
- Ingress skips updating Certificate resource if already exists and not owned ([#1670](https://github.com/jetstack/cert-manager/pull/1670), [@cheukwing](https://github.com/cheukwing))
- Add support for ACMEv2 POST-as-GET ([#1648](https://github.com/jetstack/cert-manager/pull/1648), [@munnerz](https://github.com/munnerz))
- Fix incorrect handling of `issuewild` tag when verifying CAA ([#1777](https://github.com/jetstack/cert-manager/pull/1777), [@cheukwing](https://github.com/cheukwing))
- Add support for selecting ACME challenge solver to use by specifying 'dnsZones' in the selector ([#1806](https://github.com/jetstack/cert-manager/pull/1806), [@munnerz](https://github.com/munnerz))
- Use proxy environment variables in self-check request ([#1850](https://github.com/jetstack/cert-manager/pull/1850), [@kinolaev](https://github.com/kinolaev))
### Venafi Issuer
- Venafi: use vCert v4.1.0 ([#1827](https://github.com/jetstack/cert-manager/pull/1827), [@munnerz](https://github.com/munnerz))
- Bump Venafi vcert dependency to latest version ([#1754](https://github.com/jetstack/cert-manager/pull/1754), [@munnerz](https://github.com/munnerz))
### Webhook
- cert-manager-webhook secret exists in cert-manager ns ([#1791](https://github.com/jetstack/cert-manager/pull/1791), [@jetstack-bot](https://github.com/jetstack-bot))
- Support CRD conversion webhooks in the CA injector controller. ([#1505](https://github.com/jetstack/cert-manager/pull/1505), [@DirectXMan12](https://github.com/DirectXMan12))
### CA Issuer
- Adds CSR signing to CA issuer ([#1835](https://github.com/jetstack/cert-manager/pull/1835), [@JoshVanL](https://github.com/JoshVanL))
### CertificateRequest
- Adds CertificateRequest resource ([#1789](https://github.com/jetstack/cert-manager/pull/1789), [@JoshVanL](https://github.com/JoshVanL))
- Adds CA issuer controller to resolve CertificateRequests where CA is the issuer reference ([#1836](https://github.com/jetstack/cert-manager/pull/1836), [@JoshVanL](https://github.com/JoshVanL))
- Adds Sign interface to Issuers ([#1807](https://github.com/jetstack/cert-manager/pull/1807), [@JoshVanL](https://github.com/JoshVanL))
- Adds `group` to `issuerRef` in `CertificateRequest` resources to distinguish resource ownership of incoming CertificateRequests so enabling full external issuer support. ([#1860](https://github.com/jetstack/cert-manager/pull/1860), [@JoshVanL](https://github.com/JoshVanL))
### Documentation
- Adds Design and Proposals page to website docs ([#1876](https://github.com/jetstack/cert-manager/pull/1876), [@JoshVanL](https://github.com/JoshVanL))
- Adds CertificateRequest proposal ([#1866](https://github.com/jetstack/cert-manager/pull/1866), [@JoshVanL](https://github.com/JoshVanL))
### Monitoring
- Prometheus metrics for deleted Certificates are cleaned up ([#1681](https://github.com/jetstack/cert-manager/pull/1681), [@cheukwing](https://github.com/cheukwing))
- Adds `ControllerSyncCallCount` prometheus metric to count sync calls from each controller ([#1692](https://github.com/jetstack/cert-manager/pull/1692), [@cheukwing](https://github.com/cheukwing))
- Add support for Prometheus Operator ServiceMonitor object in Helm Chart ([#1761](https://github.com/jetstack/cert-manager/pull/1761), [@Starefossen](https://github.com/Starefossen))
- Add Prometheus metrics for tracking Certificate readiness ([#1811](https://github.com/jetstack/cert-manager/pull/1811), [@cheukwing](https://github.com/cheukwing))