home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-09 05:06:38 +10:00
Code Issues Packages Projects Releases Wiki Activity
5,549 Commits 37 Branches 119 Tags
v1.4.2
Commit Graph
556 Commits
Author SHA1 Message Date
irbekrm 118cfb6029 Remove the defaulting for renewBefore from fuzzer 
We now calculate this default at reneal time

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 15:35:46 +01:00
irbekrm acd0a98bbb Updates DefaultRenewBefore to state that it is deprecated 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 11:52:54 +01:00
jetstack-botandGitHub 528305b5ed Merge pull request #4064 from JoshVanL/certificate-request-issuer-ca 
Certificate Signing Request Issuer CA
 2021-05-28 10:57:11 +01:00
Richard Wall 1f3c3df090 Add ArtifactHUB pre-release annotations to the Helm chart 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-27 13:58:52 +01:00
Richard WallandRichard Wall 8792a17396 Revert "Add ArtifcactHUB pre-release annotation to the Helm chart" 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-27 12:16:06 +01:00
joshvanl 459b5e31b0 RBAC permissions for signing and managing cert-manager 
CertificateSigningRequersts Issuers

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 00:35:58 +01:00
jetstack-botandGitHub 868d2f1637 Merge pull request #4049 from wallrj/artifacthub-annotations 
Add ArtifcactHUB pre-release annotation to the Helm chart
 2021-05-26 16:17:34 +01:00
Richard Wall 2e4ad05c56 Add ArtifcactHUB pre-release annotations to the Helm chart 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-26 13:11:04 +01:00
irbekrm 0478bc5ee2 Updates duration and renewBefore field descriptions 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-05-25 12:56:55 +01:00
jetstack-botandGitHub c7dade0fc5 Merge pull request #4036 from wallrj/3875-pod-security 
Enable runAsNonRoot by default
 2021-05-21 18:53:26 +01:00
jetstack-botandGitHub 2965b3840d Merge pull request #4009 from EddieHoffman/service-labels 
add service labels to helm chart
 2021-05-21 18:30:26 +01:00
Richard Wall 6cc021328e Only set runAsNonRoot in the default Pod.Spec.SecurityContext 
There's no need to also set it by default on the container.

Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-21 15:07:00 +01:00
Ashley Davis 154c34ada7 update old references to replaced/obsolete email addresses 
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-05-20 18:05:02 +01:00
Richard Wall c4ad0fef5c feat: Enable runAsNonRoot by default 
When running kyverno using https://kyverno.io/policies/pod-security/restricted/, some checks failed. This enables more secure policy by default

Signed-off-by: Mike Bryant <mikebryant@bulb.co.uk>
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-20 10:14:06 +01:00
Tamal Saha 1f0e9d4f17 Add seperate rules for leases and configmaps 
Signed-off-by: Tamal Saha <tamal@appscode.com>
 2021-05-17 08:11:20 -07:00
Tamal Saha 6eb8ca3d07 Add RBAC for leases used by updated controller-runtime 
Signed-off-by: Tamal Saha <tamal@appscode.com>
 2021-05-17 08:11:19 -07:00
Tamal Saha b1cb6422e4 Use controller-runtime v0.9.0-beta.0 
Signed-off-by: Tamal Saha <tamal@appscode.com>
 2021-05-17 08:11:19 -07:00
Eddie Hoffman e55c9589b1 add service labels to helm chart 
Signed-off-by: Eddie Hoffman <eddie.hoffman@truelayer.com>
 2021-05-16 13:04:30 +01:00
Maël Valais 39c9c662f7 controller-gen can now update CRDs like before 
The controller-gen tool is quite rude and won't tell you when one of the
CRD manifests cannot be parsed when the option schemapatch is used. As
an example, the following:

  sed -i 's/RFC8555/RFC8556/g' pkg/apis/certmanager/v1/types_issuer.go
  controller-gen schemapatch:manifests=./deploy/crds output:dir=./deploy/crds paths=./pkg/apis/...

should trigger a change in the crd-clusterissuers.yaml:

  @@ -3184,7 +3184,7 @@ spec:
                 type: object
                 properties:
                   acme:
  -                  description: ACME [...] communicate with a RFC8555
  +                  description: ACME [...] communicate with a RFC8556
                     type: object

Unfortunately, controller-gen v0.2.9-0.20200414181213-645d44dca7c0
silently skips faulty CRD manifests. In our case, the CRD had become a
non-YAML file (we need to use some if statements):

  {{- if .Values.webhook.url.host }}
  url: https://{{ .Values.webhook.url.host }}/convert
  {{- else }}
  service:
    name: {{ template "webhook.fullname" . }}
    namespace: {{ .Release.Namespace | quote }}
    path: /convert
  {{- end }}

Two issues can be found (we can use a YAML parser like yq for that):

1. The pipe "|" used in ".Release.Namespace | quote" makes it an invalid
   YAML file. We could rewrite that to

     {{ quote .Release.Namespace }}

  but I decided to go with actual quotes like with the rest of the
  file.

2. The {{ if }}, {{ else }} and {{ end }} are also invalid YAML syntax,
   and one easy workaround is to comment them.

So many workarounds... but it now works!

Signed-off-by: Maël Valais <mael@vls.dev>
 2021-05-11 17:29:06 +02:00
Jake Sanders 79d8d9cb7b Revert "Merge pull request #3724 from inteon/istio-virtualservice-for-http01" 
This reverts commit 80f27739b5, reversing
changes made to 96604d02a3.

Signed-off-by: Jake Sanders <i@am.so-aweso.me>
 2021-05-11 14:50:25 +01:00
Jake Sanders 8ca19b26f9 Revert "Merge pull request #3946 from inteon/fix_kubectl_apply" 
This reverts commit c7514d9262, reversing
changes made to 49cbedf262.

Signed-off-by: Jake Sanders <i@am.so-aweso.me>
 2021-05-11 14:50:18 +01:00
Inteon b44e347ce1 remove podTemplate field from ACMEChallengeSolverHTTP01Istio 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-04-30 13:15:01 +02:00
jetstack-botandGitHub 8d794c6bcf Merge pull request #3932 from anton-johansson/also-handle-conversion-webhook-from-outside-the-cluster 
Add support to allow CRD conversion webhooks from outside of the cluster
 2021-04-28 13:24:06 +01:00
jetstack-botandGitHub bc5c5e1a37 Merge pull request #3921 from vshn/fix/helm-values 
Include HTTPS proxy variable in Helm values
 2021-04-28 12:24:06 +01:00
Anton Johansson 96a0859ac7 Add support to allow CRD conversion webhooks from outside of the cluster 
Related to #3876

Signed-off-by: Anton Johansson <hello@anton-johansson.com>
 2021-04-28 12:49:10 +02:00
jetstack-botandGitHub 27d916edfa Merge pull request #3876 from anton-johansson/add-support-for-accessing-the-webhook-from-outside-of-the-cluster 
Add support for accessing the webhook from outside of the cluster
 2021-04-28 11:15:07 +01:00
Inteon 2299e8d8a6 Apply suggestions from code review 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-04-28 09:20:49 +02:00
Inteon 624e2b9e69 add ACME HTTP01 Istio support 
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
 2021-04-28 09:19:53 +02:00
Tobias Nehrlich 6d6d69a5e5 Include HTTPS proxy variable in Helm values 
The `http_proxy` key was defined twice and is therefore replaced once with the `https_proxy` key.

Signed-off-by: Tobias Nehrlich <tobias.nehrlich@vshn.ch>
 2021-04-26 12:04:04 +02:00
jetstack-botandGitHub b5be5a8730 Merge pull request #3877 from irbekrm/move_crypto_fork 
Use upstream golang/crypto for ACME EAB + move crypto fork to cert-manager org
 2021-04-13 13:28:15 +01:00
irbekrm fc9d966a1c Certificate's revision history limit validated by webhook 
To avoid helm upgrade issues, see https://github.com/jetstack/cert-manager/issues/3880

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-12 14:59:28 +01:00
irbekrm d213b4bfdb Standardize deprecation warnings 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-12 09:38:49 +01:00
Anton Johansson 311c0c9582 Add support for accessing the webhook from outside of the cluster 
This is useful if your control plane is configured in a way where it does not
know anything about the internal cluster network.

Signed-off-by: Anton Johansson <hello@anton-johansson.com>
 2021-04-09 17:15:55 +02:00
irbekrm 09af959071 Issuer's ACME EAB algorithm can no longer be set 
It is hardcoded to HS256 in golang.org/x/crypto

Also, we now use a fork of golang.org/x/crypto
in cert-manager org.

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-09 10:28:19 +01:00
irbekrm 22f6cb18d2 Adds some comments 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-04-03 15:54:52 +01:00
joshvanl f8b38daa4c Update cert-manager-controller:approve RBAC naming to be more consistent 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00
joshvanl 5b34d9a6cc Change cert-manager-controller approve RBAC resource names to 
':approve-cert-manager-io'

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00
joshvanl 393848ee98 Fix webhook RBAC resource names to use ':subjectaccessreviews' 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00
joshvanl 8048034b0e Adds permissions to approve "issuer.cert-manager.io/*", "clusterissuer.cert-manager.io/*" signers to the cert-manager-controller ServiceAccount 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 17:26:28 +00:00
joshvanl 6ef840972c Change controller options to return a set of enabled controllers, and 
log enabled controllers on start

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 11:28:01 +00:00
joshvanl 0382c9d8b2 Adds a cert-manager-controller flag to disable controllers, for example, 
the certificaterequests-approver

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-26 11:28:01 +00:00
jetstack-botandGitHub a8c75fab1a Merge pull request #3773 from JoshVanL/certificate-revision-history-limit 
Certificate revision history limit
 2021-03-26 11:13:58 +00:00
jetstack-botandGitHub dffbf391db Merge pull request #3733 from jakexks/renewBefore 
Clarify the default values for the renewBefore and duration fields
 2021-03-24 10:53:46 +00:00
joshvanl 59ca6ca850 Move CertificateRequest revisionHistoryLimit validation to OpenAPI 
validation

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-23 15:58:14 +00:00
joshvanl 72904ca2c1 Updates CertificateRequest printColumn with a new Denied column 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-17 13:10:39 +00:00
joshvanl fb54272d17 Adds Approved condition status as additionalPrinterColumn for pretty 
printing

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-17 13:10:39 +00:00
jetstack-botandGitHub fedea03a16 Merge pull request #3774 from JoshVanL/kubectl-get-cr-username 
Add Requestor to kubectl output, moves Issuer name from wide to default outpt
 2021-03-15 18:00:15 +00:00
joshvanl d2b98828b3 Adds Username to kubectl get output, moves issuer name from wide to 
default

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-15 16:52:51 +00:00
joshvanl e6ece1f36b Updates Issuer CRDs with new ObservedGeneration field 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-15 15:06:22 +00:00
joshvanl 7146f9702d Adds revisionHistoryLimit field to CRD 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-03-15 14:54:35 +00:00