home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-25 04:56:15 +10:00
Code Issues Packages Projects Releases Wiki Activity
4,781 Commits 37 Branches 119 Tags
17cd05ecabb8f8d9d100764a7f8ec0aae1490435
Commit Graph
4781 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Maël Valais 17cd05ecab test(issuing): new test: when req mismatches, cert can't be updated 
This new unit test highlights an unexpected behavior of the issuing
controller: the issuing controller is updating the certificate's status
when the certificate request has a failure ("Reason = Failed"), but the
controller might have picked up an out-of-date certificate request.

The consequence is that the issuing controller would set the certificate
to "Issuing = False". That happens when a re-issuance is triggered with
an old failing certificate request.

Signed-off-by: Maël Valais <mael.valais@gmail.com>
 2020-12-06 14:22:02 +01:00
jetstack-botandGitHub 0bcf759a25 Merge pull request #3433 from sorah/vault-issuer-exclude-root 
Handle Vault issuer working as intermediate correctly
 2020-12-03 09:23:14 +01:00
jetstack-botandGitHub fe84c50f7b Merge pull request #3485 from maelvls/bug-spurious-updates-aws 
Strip X-Amzn-RequestId to avoid spurious challenge updates
 2020-12-02 15:42:33 +01:00
Maël Valais 8d8dd02245 dns01-aws: aws-sdk-go already honors the proxy settings 
No need for setting http.DefaultClient manually.

Signed-off-by: Maël Valais <mael.valais@gmail.com>
 2020-12-01 13:26:29 +01:00
jetstack-botandGitHub 6fd14b0241 Merge pull request #3464 from wallrj/3396-renew-before-expiry-duration 
Fix and deprecate the --renew-before-expiration-duration flag
 2020-12-01 12:07:06 +01:00
Maël Valais 8a5748be94 dns01-aws: strip request id from aws errors 
Signed-off-by: Maël Valais <mael.valais@gmail.com>
 2020-12-01 11:11:05 +01:00
Maël Valais cccc0b1d4d dns01-aws: add test that reveals the request id issue 
Signed-off-by: Maël Valais <mael.valais@gmail.com>
 2020-11-30 13:31:12 +01:00
Sorah Fukumori f768afd0a3 vault: change condition precise 
Signed-off-by: Sorah Fukumori <her@sorah.jp>
 2020-11-28 18:13:49 +09:00
Sorah FukumoriandMaartje Eyskens 90c4f9e561 Avoid named return variables 
Co-authored-by: Maartje Eyskens <maartje@eyskens.me>
Signed-off-by: Sorah Fukumori <her@sorah.jp>
 2020-11-28 18:06:49 +09:00
jetstack-botandGitHub 7fbdd64876 Merge pull request #3347 from meyskens/acme-duration 
Add duration into ACME
v1.1.0 		2020-11-24 10:37:01 +01:00
Maartje Eyskens a869c59cb7 Remove internal API tags and annotations 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 13:42:24 +01:00
jetstack-botandGitHub 92f4d7d349 Merge pull request #3384 from meyskens/no-acme-retry 
Disable Go's ACME retry logic
 2020-11-20 11:31:54 +00:00
Maartje Eyskens d705838e83 Implement feedback 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:46:49 +01:00
Maartje Eyskens 66f787ef33 Fix a lost EnableNotAfterDate 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:46:49 +01:00
Maartje Eyskens 9559a71301 Update CRDs 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:46:49 +01:00
Maartje Eyskens b7014c3dbd Fix rename in json too 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:46:49 +01:00
Maartje Eyskens 59048fed64 Rename field 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:46:49 +01:00
Maartje Eyskens 04d88479e4 Pass duration on until ACME order creation 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:46:49 +01:00
Maartje Eyskens 1b33e8029a Fix unit tests 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:46:08 +01:00
Maartje Eyskens 7b6573aa35 Add duration into ACME 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-20 09:45:32 +01:00
Richard Wall 1fc1fa88a0 Prevent instant renewal when the renewBefore value matches the duration 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2020-11-19 15:00:27 +00:00
Richard Wall 95a229cc6e Unit tests for current behaviour 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2020-11-19 13:01:00 +00:00
Richard Wall a33abd2060 Plumb through the flag provided defaultRenewBeforeExpiryDuration 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2020-11-19 12:44:18 +00:00
Richard Wall cc1412b252 Deprecate the --renew-before-expiry-duration flag 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2020-11-19 12:44:18 +00:00
Richard Wall 2b83331a2d Remove unused helper functions 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2020-11-19 12:44:18 +00:00
jetstack-botandGitHub 811b67bb8c Merge pull request #3456 from meyskens/pebble-blocklist 
Add a blocklist to Pebble
 2020-11-19 11:03:53 +00:00
Maartje Eyskens 490f18b5ff Use upstream Pebble again 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-19 10:44:22 +01:00
Maartje Eyskens 61a7333955 Implement feedback 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-17 16:27:16 +01:00
Maartje EyskensGitHubRichard Wall
 		4758efe7da Apply suggestions from code review 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>

Co-authored-by: Richard Wall <wallrj@users.noreply.github.com>
 2020-11-17 16:03:58 +01:00
Maartje Eyskens f7baf25239 Add a blocklist to Pebble 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-13 11:09:31 +01:00
jetstack-botandGitHub 2ae2d1dadc Merge pull request #3443 from invidian/typos 
Fix various typos found by codespell
 2020-11-12 09:50:32 +00:00
Maartje Eyskens 7c5cedf103 Update Bazel 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-10 10:35:11 +01:00
Maartje Eyskens b847c91054 Add boilerplate 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-10 10:32:31 +01:00
Mateusz Gozdek 27fa2f1ec4 Fix various typos found by codespell 
Found by running this command:

codespell -S .git,*.png,go.sum -L keypair,iam,ans,unknwon,tage,ths,creater

Signed-off-by: Mateusz Gozdek <mgozdekof@gmail.com>
 2020-11-07 14:55:13 +01:00
Mateusz Gozdek 8fc98a4422 test/integration/framework: simplify to avoid word "datas" 
As it is being treated as a typo by codespell.

Signed-off-by: Mateusz Gozdek <mgozdekof@gmail.com>
 2020-11-07 14:53:55 +01:00
Maartje Eyskens f6e2d48a42 Add tests 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-06 17:16:56 +01:00
Sorah Fukumori 25fc672b80 vault: use issuing_ca field when no ca_chain available 
Signed-off-by: Sorah Fukumori <her@sorah.jp>
 2020-11-06 05:12:04 +09:00
Sorah Fukumori 69a0816ca1 vault: Handle missing ca_chain just in case 
certutil should ensure CAChain always set...
https://github.com/hashicorp/vault/blob/3298836f6a90d95ff97af33cb2abd1f7269847df/sdk/helper/certutil/types.go

Signed-off-by: Sorah Fukumori <her@sorah.jp>
 2020-11-06 05:12:03 +09:00
Sorah Fukumori 2f70e9d4db vault: extract PEM extraction to a dedicated function 
Signed-off-by: Sorah Fukumori <her@sorah.jp>
 2020-11-06 05:12:03 +09:00
Sorah FukumoriandChris Randles 64a5aecfdd Handle Vault issuer working as intermediate correctly 
This patch changes a certificate issued with Vault issuer as follows:

- `ca.crt`: a root certificate, returned in `ca_chain` from Vault
- `tls.crt`: a leaf certificate, plus intermediate certificates
  if available in `ca_chain`

  i.e. `tls.crt` won't include a root certificate

This is a breaking change; Vault issuer had included an issuing CA as
a chain in `tls.crt`, but after this change it will no longer include a root
certificate when the issuing CA is not an intermediate. For `ca.crt`, it
had included a issuing CA only, which can be an intermediate.

`tls.crt` is not expected to contain a root certificate, as generally
clients must trust root certificates in advance. It is considered
redundant transmitting a root certificate from servers to clients during TLS
handshake. Other issuers, e.g. ACME, behave the same.

This fixes https://github.com/jetstack/cert-manager/issues/2166

This patch is based on https://github.com/jetstack/cert-manager/pull/3340

Co-authored-by: Chris Randles <randles.chris@gmail.com>
Signed-off-by: Sorah Fukumori <her@sorah.jp>
 2020-11-06 05:12:03 +09:00
jetstack-botandGitHub 87989dbfe3 Merge pull request #3436 from meyskens/issue-templates 
Change issue templates to use HTML comments + tip about code blocks
 2020-11-05 15:16:20 +00:00
Maartje Eyskens 2c2717233c Change issue templates to use HTML comments + tip about code blocks 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-11-05 12:28:26 +01:00
jetstack-botandGitHub d4c9a7beb4 Merge pull request #3419 from bettervu/helm-chart/pod_labels_for_all_deployments 
Adds ability to Helm chart to set podLabels for the webhook and cainjector deployments
 2020-11-05 09:06:13 +00:00
Michael Hill 61ab9271c6 Adds ability to set podLabels for the webhook and cainjector deployments 
Signed-off-by: Michael Hill <mhill@betterview.net>
 2020-10-29 17:46:26 -07:00
jetstack-botandGitHub 8127f0ad42 Merge pull request #3417 from meyskens/fix-gdns-log 
Fix missing log in struct
 2020-10-28 17:38:12 +00:00
jetstack-botandGitHub fda1c091e3 Merge pull request #3399 from meyskens/fix-panic-challenge 
Fix a panic when changing the max concurrent challenges
v1.1.0-alpha.1 		2020-10-28 14:16:12 +00:00
Maartje Eyskens ed7b4cca60 Fix missing log in struct 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
 2020-10-28 15:08:37 +01:00
jetstack-botandGitHub 9654b533f4 Merge pull request #3409 from wallrj/api-validation-for-venafi-issuer-config 
Add API validation for Venafi Issuer config
 2020-10-28 09:52:12 +00:00
jetstack-botandGitHub 31f1fce24f Merge pull request #3400 from alrs/alrs-deprecate-session 
pkg/issuer/acme/dns: replace deprecated AWS function
 2020-10-28 09:05:11 +00:00
Richard Wall 885755630c Add API validation for Venafi Issuer config 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2020-10-22 15:04:11 +01:00