home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-26 21:46:06 +10:00
Code Issues Packages Projects Releases Wiki Activity
5,492 Commits 37 Branches 119 Tags
90bc65bbd2d15b71233d66b416a3676a7bbb112c
Commit Graph
5492 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
RinkiyaKeDad 90bc65bbd2 deleted framework.go 
Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
 2021-05-25 12:08:25 +05:30
jetstack-botandGitHub c7dade0fc5 Merge pull request #4036 from wallrj/3875-pod-security 
Enable runAsNonRoot by default
 2021-05-21 18:53:26 +01:00
jetstack-botandGitHub 7eb301f74c Merge pull request #4021 from irbekrm/deprecate_apis 
Deprecates old APIs
 2021-05-21 18:30:32 +01:00
jetstack-botandGitHub 2965b3840d Merge pull request #4009 from EddieHoffman/service-labels 
add service labels to helm chart
 2021-05-21 18:30:26 +01:00
jetstack-botandGitHub efd8b7a076 Merge pull request #3866 from jandersen-plaid/jandersen-plaid-make-orders-unique-to-controlling-cr 
Hash orders with the issuing certificate request to ensure unique hash
 2021-05-21 17:34:25 +01:00
Richard Wall 6873aa73e8 Hard code the Kyverno version 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 17:18:23 +01:00
Richard Wall 767b281d8a Use a cert-manager NS specific Kyverno policy 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 17:18:23 +01:00
jandersen-plaidJack AndersenAshley Davis
 		b5fe7ecdca Update pkg/controller/certificaterequests/acme/acme.go 
Co-authored-by: Ashley Davis <SgtCoDFish@users.noreply.github.com>
Signed-off-by: Jack Andersen <jandersen@plaid.com>
 2021-05-21 12:08:22 -04:00
jandersen-plaidJack AndersenAshley Davis
 		cd1d8a2788 Update pkg/controller/certificaterequests/acme/acme_test.go 
Co-authored-by: Ashley Davis <SgtCoDFish@users.noreply.github.com>
Signed-off-by: Jack Andersen <jandersen@plaid.com>
 2021-05-21 12:08:07 -04:00
jandersen-plaidJack AndersenAshley Davis
 		ed88ce6030 Update pkg/controller/certificaterequests/acme/acme_test.go 
Co-authored-by: Ashley Davis <SgtCoDFish@users.noreply.github.com>
Signed-off-by: Jack Andersen <jandersen@plaid.com>
 2021-05-21 12:07:40 -04:00
jetstack-botandGitHub b73b222439 Merge pull request #4043 from kevgrig/issue4042 
Issue #4042: Support make clean target
 2021-05-21 17:02:26 +01:00
Kevin Grigorenko 8974f6d8f4 Issue #4042: Add help for make clean target 
Signed-off-by: Kevin Grigorenko <kevin@myplaceonline.com>
 2021-05-21 08:31:03 -07:00
jetstack-botandGitHub 9837ccdc1f Merge pull request #4046 from wallrj/upgrade-ingress-nginx 
Upgrade ingress-nginx Helm Chart and Docker image
 2021-05-21 16:26:25 +01:00
Richard Wall 7254659317 Remove obsolete comment 
The NET_BIND_SERVICE privilege is only needed when binding to privileged ports.

Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:11:21 +01:00
Richard Wall a28bff3d63 Add comments explaining why we configure Kyverno to ignore certain E2E test namespaces 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:07:00 +01:00
Richard Wall 194714fd75 Clarify the Kyverno install script documentation 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:07:00 +01:00
Richard Wall 4d94b57cb1 Remove unused Bazel import in the Kyverno BUILD file 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:07:00 +01:00
Richard Wall 72f6d4b68d Remove unused Kustomization.yaml patches 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:07:00 +01:00
Richard Wall 6cc021328e Only set runAsNonRoot in the default Pod.Spec.SecurityContext 
There's no need to also set it by default on the container.

Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:07:00 +01:00
Richard Wall d26caf578d Use runAsNonRoot on the HTTP01 solver 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:05:18 +01:00
Richard Wall 98757aa850 Configure Kyverno to ignore resources in E2E test namespaces 
Because I couldn't quite get the Vault server running as non-root

Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:05:18 +01:00
Richard Wall 8cca467e75 Configure Kyverno to ignore some E2E components which cant be configured non-root 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:05:18 +01:00
Richard Wall 63b7d7f453 Upgrade ingress-nginx Helm Chart and Docker image 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:01:34 +01:00
jetstack-botandGitHub d7571d3eaa Merge pull request #4037 from SgtCoDFish/staticparty-ash 
Static Analysis Fixes from Static Analysis Party
 2021-05-21 13:38:25 +01:00
jetstack-botandGitHub c1d7dcf8b5 Merge pull request #4007 from edglynes/3904_v2_API 
Update Aka issuer to use v2 API
 2021-05-21 12:34:25 +01:00
Ashley Davis 219a620871 static analysis fixes 
pkg/ctl/scheme.go:17:1: package comment should be of the form "Package ctl ..."
pkg/issuer/acme/dns/acmedns/acmedns.go:43:2: var accountJson should be accountJSON
pkg/issuer/acme/dns/acmedns/acmedns.go:50:43: func parameter accountJson should be accountJSON
pkg/controller/certificates/trigger/policies/policies.go:57:1: comment on exported type Chain should be of the form "Chain ..." (with optional leading article)
pkg/controller/ingress-shim/sync.go:36:2: package "github.com/jetstack/cert-manager/pkg/logs" is being imported more than once (ST1019)
pkg/controller/ingress-shim/sync.go:37:2: other import of "github.com/jetstack/cert-manager/pkg/logs"

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-05-21 12:04:11 +01:00
Ashley Davis 333af8fd94 further static check fixes 
pkg/internal/apis/certmanager/validation/certificate_for_issuer_test.go:34:2 deadcode `defaultTestCrtName` is unused
pkg/issuer/acme/dns/rfc2136/provider_test.go:42:23 errcheck Error return value of `server.Shutdown` is not checked
pkg/issuer/acme/dns/rfc2136/provider_test.go:77:23 errcheck Error return value of `server.Shutdown` is not checked
pkg/issuer/vault/setup.go:37:2 deadcode `messageVaultHealthCheckFailed` is unused
pkg/issuer/venafi/client/request.go:143:5 gosimple S1023: redundant break statement
pkg/logs/logs.go:68:8 errcheck Error return value of `fs.Set` is not checked

the following fixes introduce a panic when the returned error is
non-nil, which could be a breaking change but was deemed to be worth it
pkg/webhook/server/server.go:58:30 errcheck Error return value is not checked
pkg/webhook/server/server.go:59:25 errcheck Error return value is not checked

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-05-21 12:04:05 +01:00
Ashley Davis c67c2c4f47 static analysis: pkg/controller 
fixes the following issues:

pkg/controller/acmeorders/util.go:84:6 deadcode `hashChallenge` is unused
pkg/controller/certificaterequests/approver/approver.go:72:14 staticcheck SA4021: x = append(y) is equivalent to x = y
pkg/controller/certificaterequests/vault/vault_test.go:535:21 errcheck Error return value of `controller.Register` is not checked
pkg/controller/certificates/trigger/policies/policies.go:121:26 gosimple S1039: unnecessary use of fmt.Sprintf
pkg/controller/clusterissuers/sync_test.go:55:12 errcheck Error return value of `c.Register` is not checked
pkg/controller/ingress-shim/sync.go:301:2 gosimple S1005: unnecessary assignment to the blank identifier

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-05-21 12:03:47 +01:00
irbekrmandAshley Davis e1dff85cad Feedback from code review 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-21 12:03:47 +01:00
irbekrmandAshley Davis 17728b8437 Handle cert renewal when renewalBefore slightly less than cert duration correctly 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-21 12:03:47 +01:00
jetstack-botandGitHub 966dd0d89f Merge pull request #4040 from irbekrm/3897_fix_cert_renewal 
Handle cert renewal correctly
 2021-05-21 11:22:25 +01:00
irbekrm 6aad7507b9 Feedback from code review 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-21 10:51:14 +01:00
jetstack-botandGitHub 7a872d826f Merge pull request #4034 from irbekrm/3894_test_vault_ca 
e2e Vault intermediate CA optionally configured with root
 2021-05-21 10:18:25 +01:00
Kevin Grigorenko 52eec2543d Issue #4042: Support make clean target 
Signed-off-by: Kevin Grigorenko <kevin@myplaceonline.com>
 2021-05-20 20:38:14 -07:00
irbekrm f2933be499 ECDSA instead of RSA keys generated for test Vault CA's root and intermediate 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-20 21:48:09 +01:00
jetstack-botandGitHub 75e29c2ef1 Merge pull request #4039 from SgtCoDFish/update-base-image 
Update distroless/static base images to latest version
 2021-05-20 21:28:57 +01:00
irbekrm a357d3d3e3 Handle cert renewal when renewalBefore slightly less than cert duration correctly 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-20 20:23:25 +01:00
jetstack-botandGitHub bfd81b264b Merge pull request #4038 from SgtCoDFish/4025-remove-refs 
Update old references to replaced/obsolete email addresses
 2021-05-20 18:36:57 +01:00
Ashley Davis 1adadc83e0 update distroless/static base images to latest version 
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-05-20 18:33:03 +01:00
Ashley Davis 154c34ada7 update old references to replaced/obsolete email addresses 
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-05-20 18:05:02 +01:00
Richard Wall 87f487841b Run Pebble with runAsNonRoot 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-20 17:53:37 +01:00
Richard Wall 1f16fcc72b Install Bind before Kyverno because it does not meet the Pod security policy 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-20 17:53:37 +01:00
irbekrm 6c4d819d1d Determine requested API version from RequestKind (code review feedback) 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-20 15:29:51 +01:00
Richard Wall 6ad0ef19e0 Have sample-webhook listen on a non-priveleged port 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-20 13:20:56 +01:00
irbekrm 63342c1d5e Check that Vault certs' CA contains root cert if expected 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-20 13:05:38 +01:00
irbekrm 0ebce264f1 Allow to optionally configure Vault intermediate PKI with root CA 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-20 13:05:26 +01:00
Richard Wall 8e382034c1 Run the sample-webhook process as a non-root user in the Docker image 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-20 12:38:52 +01:00
irbekrm ef627a13b6 Adds a few comments 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-20 11:31:01 +01:00
jetstack-botandGitHub e30dae687a Merge pull request #3860 from jsoref/spelling-commitment 
Deprecate UsageContentCommittment and improve public comments
 2021-05-20 11:09:52 +01:00
Richard Wall 7d02b40514 Enable runAsNonRoot on the sample-webhook Deployment 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-20 10:20:18 +01:00