home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-20 18:46:03 +10:00
Code Issues Packages Projects Releases Wiki Activity
5,718 Commits 37 Branches 119 Tags
issue-4189
Commit Graph
567 Commits
Author SHA1 Message Date
jetstack-botandGitHub c546f5bbd9 Merge pull request #4190 from inteon/helm_labels 
Remove Helm-specific labels & add version label
 2021-07-13 18:27:03 +01:00
Inteon c7d92681b8 add comments 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-07-13 17:58:28 +02:00
Inteon 0683738458 fix bug & add comment & cleanup 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-07-13 13:41:37 +02:00
Inteon 043bbd283e remove helm-specific labels & add version label 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-07-11 17:42:32 +02:00
irbekrm 160e638c8f Explicitly set webhook match policy to Equivalent 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-07-08 08:16:48 +01:00
irbekrm 3fc6fc62a2 Mutating and validating webhooks only accept v1 resources 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-07-06 07:36:14 +01:00
jetstack-botandGitHub e7a9ec0dab Merge pull request #4178 from maelvls/vault-cabundle-base64 
vault issuer: specify that the caBundle must be base64-encoded
 2021-07-05 20:31:27 +01:00
ulrich giraudandMaël Valais b9c9231305 vault issuer: specify that the caBundle must be base64-encoded 
Signed-off-by: Ulrich GIRAUD <ulrich.giraud@pole-emploi.fr>
Signed-off-by: Maël Valais <mael@vls.dev>
 2021-07-02 20:54:03 +02:00
Inteon f228e6c7be fix command flags + move to experimental + redo uninstall logic 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-07-02 12:58:30 +02:00
jetstack-botandGitHub 02d90248de Merge pull request #4079 from annerajb/support-ed25519 
support-ed25519
 2021-06-15 16:17:53 +01:00
Anner J. BonillaandAshley Davis 9546a357a5 Add support for certificates with ed25519 private keys 
Note that using ed25519 on the public internet is not currently
recommended, since it's not widely supported. You'd likely not be able
to use an Ed25519 cert with an ACME issuer today.

Ed25519 certs might be useful for internal PKI, though - an ed25519 CA
issuer, say - or for testing ed25519 certs before they become more
widely available on the public internet. They're not currently
supported by Vault, Venafi or ACME (Letsencrypt) issuers.

Signed-off-by: Anner J. Bonilla <abonilla@hoyosintegrity.com>
Signed-off-by: Anner J. Bonilla <annerjb@gmail.com>
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-06-14 11:17:35 +01:00
irbekrm 118cfb6029 Remove the defaulting for renewBefore from fuzzer 
We now calculate this default at reneal time

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 15:35:46 +01:00
irbekrm acd0a98bbb Updates DefaultRenewBefore to state that it is deprecated 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 11:52:54 +01:00
jetstack-botandGitHub 528305b5ed Merge pull request #4064 from JoshVanL/certificate-request-issuer-ca 
Certificate Signing Request Issuer CA
 2021-05-28 10:57:11 +01:00
Richard Wall 1f3c3df090 Add ArtifactHUB pre-release annotations to the Helm chart 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-27 13:58:52 +01:00
Richard WallandRichard Wall 8792a17396 Revert "Add ArtifcactHUB pre-release annotation to the Helm chart" 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-27 12:16:06 +01:00
joshvanl 459b5e31b0 RBAC permissions for signing and managing cert-manager 
CertificateSigningRequersts Issuers

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 00:35:58 +01:00
jetstack-botandGitHub 868d2f1637 Merge pull request #4049 from wallrj/artifacthub-annotations 
Add ArtifcactHUB pre-release annotation to the Helm chart
 2021-05-26 16:17:34 +01:00
Richard Wall 2e4ad05c56 Add ArtifcactHUB pre-release annotations to the Helm chart 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-26 13:11:04 +01:00
irbekrm 0478bc5ee2 Updates duration and renewBefore field descriptions 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-25 12:56:55 +01:00
jetstack-botandGitHub c7dade0fc5 Merge pull request #4036 from wallrj/3875-pod-security 
Enable runAsNonRoot by default
 2021-05-21 18:53:26 +01:00
jetstack-botandGitHub 2965b3840d Merge pull request #4009 from EddieHoffman/service-labels 
add service labels to helm chart
 2021-05-21 18:30:26 +01:00
Richard Wall 6cc021328e Only set runAsNonRoot in the default Pod.Spec.SecurityContext 
There's no need to also set it by default on the container.

Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:07:00 +01:00
Ashley Davis 154c34ada7 update old references to replaced/obsolete email addresses 
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-05-20 18:05:02 +01:00
Richard Wall c4ad0fef5c feat: Enable runAsNonRoot by default 
When running kyverno using https://kyverno.io/policies/pod-security/restricted/, some checks failed. This enables more secure policy by default

Signed-off-by: Mike Bryant <mikebryant@bulb.co.uk>
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-20 10:14:06 +01:00
Tamal Saha 1f0e9d4f17 Add seperate rules for leases and configmaps 
Signed-off-by: Tamal Saha <tamal@appscode.com>
 2021-05-17 08:11:20 -07:00
Tamal Saha 6eb8ca3d07 Add RBAC for leases used by updated controller-runtime 
Signed-off-by: Tamal Saha <tamal@appscode.com>
 2021-05-17 08:11:19 -07:00
Tamal Saha b1cb6422e4 Use controller-runtime v0.9.0-beta.0 
Signed-off-by: Tamal Saha <tamal@appscode.com>
 2021-05-17 08:11:19 -07:00
Eddie Hoffman e55c9589b1 add service labels to helm chart 
Signed-off-by: Eddie Hoffman <eddie.hoffman@truelayer.com>
 2021-05-16 13:04:30 +01:00
Maël Valais 39c9c662f7 controller-gen can now update CRDs like before 
The controller-gen tool is quite rude and won't tell you when one of the
CRD manifests cannot be parsed when the option schemapatch is used. As
an example, the following:

  sed -i 's/RFC8555/RFC8556/g' pkg/apis/certmanager/v1/types_issuer.go
  controller-gen schemapatch:manifests=./deploy/crds output:dir=./deploy/crds paths=./pkg/apis/...

should trigger a change in the crd-clusterissuers.yaml:

  @@ -3184,7 +3184,7 @@ spec:
                 type: object
                 properties:
                   acme:
  -                  description: ACME [...] communicate with a RFC8555
  +                  description: ACME [...] communicate with a RFC8556
                     type: object

Unfortunately, controller-gen v0.2.9-0.20200414181213-645d44dca7c0
silently skips faulty CRD manifests. In our case, the CRD had become a
non-YAML file (we need to use some if statements):

  {{- if .Values.webhook.url.host }}
  url: https://{{ .Values.webhook.url.host }}/convert
  {{- else }}
  service:
    name: {{ template "webhook.fullname" . }}
    namespace: {{ .Release.Namespace | quote }}
    path: /convert
  {{- end }}

Two issues can be found (we can use a YAML parser like yq for that):

1. The pipe "|" used in ".Release.Namespace | quote" makes it an invalid
   YAML file. We could rewrite that to

     {{ quote .Release.Namespace }}

  but I decided to go with actual quotes like with the rest of the
  file.

2. The {{ if }}, {{ else }} and {{ end }} are also invalid YAML syntax,
   and one easy workaround is to comment them.

So many workarounds... but it now works!

Signed-off-by: Maël Valais <mael@vls.dev>
 2021-05-11 17:29:06 +02:00
Jake Sanders 79d8d9cb7b Revert "Merge pull request #3724 from inteon/istio-virtualservice-for-http01" 
This reverts commit 80f27739b5, reversing
changes made to 96604d02a3.

Signed-off-by: Jake Sanders <i@am.so-aweso.me>
 2021-05-11 14:50:25 +01:00
Jake Sanders 8ca19b26f9 Revert "Merge pull request #3946 from inteon/fix_kubectl_apply" 
This reverts commit c7514d9262, reversing
changes made to 49cbedf262.

Signed-off-by: Jake Sanders <i@am.so-aweso.me>
 2021-05-11 14:50:18 +01:00
Inteon b44e347ce1 remove podTemplate field from ACMEChallengeSolverHTTP01Istio 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-04-30 13:15:01 +02:00
jetstack-botandGitHub 8d794c6bcf Merge pull request #3932 from anton-johansson/also-handle-conversion-webhook-from-outside-the-cluster 
Add support to allow CRD conversion webhooks from outside of the cluster
 2021-04-28 13:24:06 +01:00
jetstack-botandGitHub bc5c5e1a37 Merge pull request #3921 from vshn/fix/helm-values 
Include HTTPS proxy variable in Helm values
 2021-04-28 12:24:06 +01:00
Anton Johansson 96a0859ac7 Add support to allow CRD conversion webhooks from outside of the cluster 
Related to #3876

Signed-off-by: Anton Johansson <hello@anton-johansson.com>
 2021-04-28 12:49:10 +02:00
jetstack-botandGitHub 27d916edfa Merge pull request #3876 from anton-johansson/add-support-for-accessing-the-webhook-from-outside-of-the-cluster 
Add support for accessing the webhook from outside of the cluster
 2021-04-28 11:15:07 +01:00
Inteon 2299e8d8a6 Apply suggestions from code review 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-04-28 09:20:49 +02:00
Inteon 624e2b9e69 add ACME HTTP01 Istio support 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-04-28 09:19:53 +02:00
Tobias Nehrlich 6d6d69a5e5 Include HTTPS proxy variable in Helm values 
The `http_proxy` key was defined twice and is therefore replaced once with the `https_proxy` key.

Signed-off-by: Tobias Nehrlich <tobias.nehrlich@vshn.ch>
 2021-04-26 12:04:04 +02:00
jetstack-botandGitHub b5be5a8730 Merge pull request #3877 from irbekrm/move_crypto_fork 
Use upstream golang/crypto for ACME EAB + move crypto fork to cert-manager org
 2021-04-13 13:28:15 +01:00
irbekrm fc9d966a1c Certificate's revision history limit validated by webhook 
To avoid helm upgrade issues, see https://github.com/jetstack/cert-manager/issues/3880

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-12 14:59:28 +01:00
irbekrm d213b4bfdb Standardize deprecation warnings 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-12 09:38:49 +01:00
Anton Johansson 311c0c9582 Add support for accessing the webhook from outside of the cluster 
This is useful if your control plane is configured in a way where it does not
know anything about the internal cluster network.

Signed-off-by: Anton Johansson <hello@anton-johansson.com>
 2021-04-09 17:15:55 +02:00
irbekrm 09af959071 Issuer's ACME EAB algorithm can no longer be set 
It is hardcoded to HS256 in golang.org/x/crypto

Also, we now use a fork of golang.org/x/crypto
in cert-manager org.

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-09 10:28:19 +01:00
irbekrm 22f6cb18d2 Adds some comments 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-03 15:54:52 +01:00
joshvanl f8b38daa4c Update cert-manager-controller:approve RBAC naming to be more consistent 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00
joshvanl 5b34d9a6cc Change cert-manager-controller approve RBAC resource names to 
':approve-cert-manager-io'

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00
joshvanl 393848ee98 Fix webhook RBAC resource names to use ':subjectaccessreviews' 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00
joshvanl 8048034b0e Adds permissions to approve "issuer.cert-manager.io/*", "clusterissuer.cert-manager.io/*" signers to the cert-manager-controller ServiceAccount 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00