home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-09 05:06:38 +10:00
Code Issues Packages Projects Releases Wiki Activity
5,553 Commits 37 Branches 119 Tags
v1.4.3
Commit Graph
5553 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ashley DavisandGitHub 8b5503ebeb Merge pull request #4319 from jetstack-bot/cherry-pick-4311-to-release-1.4 
[release-1.4] Adds an explicit timeout when pre-checking HTTP-01 challenges
v1.4.3 		2021-08-06 13:31:38 +01:00
Ashley Davisandjetstack-bot 03ea54d559 adds an explicit timeout when pre-checking HTTP-01 challenges 
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-08-06 11:31:15 +00:00
Ashley DavisandGitHub 8ebc6b665d Merge pull request #4315 from SgtCoDFish/helmchartk8scompat-1.4 
[release-1.4] Helm chart k8s compat update
 2021-08-06 11:37:51 +01:00
Ashley Davis 1f1530d13f specify correct version range for cert-manager versions below 1.5 
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-08-05 18:15:10 +01:00
jetstack-botandGitHub d0571cb480 Merge pull request #4278 from SgtCoDFish/cherrypick-memleak-1.4 
[release-1.4] Cherry-pick memory leak fixes into 1.4
v1.4.2 		2021-07-29 17:05:41 +01:00
jetstack-botandGitHub 57cf3fccbd Merge pull request #4275 from jetstack-bot/cherry-pick-4231-to-release-1.4 
[release-1.4] Data race: fix concurrent read and write of secret annotations and certificaterequests
 2021-07-29 15:56:17 +01:00
Maël ValaisandAshley Davis a1ad0e943b memory leak: the afterFunc goroutine now stops properly 
Signed-off-by: Maël Valais <mael@vls.dev>
 2021-07-29 15:46:46 +01:00
Maël ValaisandAshley Davis 6fad252d1f memory leak: add unit test to show scheduler leaking goroutines 
Signed-off-by: Maël Valais <mael@vls.dev>
 2021-07-29 15:46:30 +01:00
jetstack-botandGitHub e288f46a1b Merge pull request #4272 from jetstack-bot/cherry-pick-4261-to-release-1.4 
[release-1.4] CA chain fix without root
 2021-07-29 15:31:17 +01:00
Maël Valaisandjetstack-bot 08196bb28c data race: fix certificate requests in cache being mutated 
Signed-off-by: Maël Valais <mael@vls.dev>
 2021-07-29 09:15:26 +00:00
Maël Valaisandjetstack-bot 41a88bdb1a data race: fix concurrent read and write of secret annotations 
This bug can be reproduced using "go run -race" and by creating many
Certificates and renewing them continuously. With 5000 Certificate
objects, a data race is found in less than a minute.

Signed-off-by: Maël Valais <mael@vls.dev>
 2021-07-29 09:15:26 +00:00
Ashley Davisandjetstack-bot d50d4fbd69 handle individual certs in ParseSingleCertificateChain 
roots are handled differently because they're their own CAs

also adds test cases for each of:

- a lone leaf
- a lone intermediate
- a lone root

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-07-28 16:19:16 +00:00
Wilson Júniorjetstack-botJosh Van Leeuwen
 		9af0532fd8 Improve ParseSingleCertificateChain when no root is present 
Fixes when the certificate chain does not have a root CA,
in which case the chain should contain all available intermediates
and ca.crt should contain the rootmost certificate.

Co-authored-by: Josh Van Leeuwen <joshua.vanleeuwen@jetstack.io>
Signed-off-by: Wilson Júnior <wilsonpjunior@gmail.com>
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-07-28 16:19:16 +00:00
jetstack-botandGitHub f970eca762 Merge pull request #4238 from jetstack-bot/cherry-pick-4237-to-release-1.4 
[release-1.4] Fix check for self-signed certs in EncodeX509Chain
v1.4.1 		2021-07-21 18:35:20 +01:00
Ashley Davisandjetstack-bot c686a2f69a fix check for self-signed certs in EncodeX509Chain 
see also https://github.com/jetstack/cert-manager/issues/4142

EncodeX509Chain checked for self-signed certs by comparing the subject
and issuer of the cert in question, which is invalid since it's
perfectly fine for those to match.

the correct behavior is to use cert.CheckSignatureFrom(cert). this bug
was exposed in 1.4 when ParseSingleCertificateChain started using
EncodeX509Chain in the critical path of several issuers; when end-users
had leaf certificates with subjects matching their issuer's subject, the
bug was triggered.

includes newly written tests for EncodeX509Chain and a test for
ParseSingleCertificateChain

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2021-07-21 16:50:07 +00:00
jetstack-botandGitHub 655e63122c Merge pull request #4123 from JoshVanL/release-1.4-e2e-disable-csr-feature-gate 
Disable running e2e tests for CertificateSigningRequests if feature gate not enabled
 2021-06-19 14:26:19 +01:00
joshvanl 160444a827 Disable running e2e tests for CertificateSigningRequests if feature gate 
is not enabled

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-19 13:43:13 +01:00
jetstack-botandGitHub 5e2a6883c1 Merge pull request #4092 from irbekrm/renew_override 
Remove the default renewBefore value
v1.4.0-beta.1 v1.4.0 		2021-06-11 16:23:49 +01:00
irbekrm 118cfb6029 Remove the defaulting for renewBefore from fuzzer 
We now calculate this default at reneal time

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 15:35:46 +01:00
jetstack-botandGitHub fa40ccdff5 Merge pull request #4090 from JoshVanL/e2e-conformance-vault-check-chain 
Check certificate chain for Vault Issuer in E2E
 2021-06-11 12:29:49 +01:00
irbekrm acd0a98bbb Updates DefaultRenewBefore to state that it is deprecated 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 11:52:54 +01:00
irbekrm 67f14240eb Update renewBefore descriptions 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 10:32:36 +01:00
irbekrm e6b748047d Remove the default renewBefore value 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2021-06-11 10:03:12 +01:00
joshvanl 35aaf00395 Check certificate chain for Vault Issuer 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-10 20:25:31 +01:00
jetstack-botandGitHub 3242b83b12 Merge pull request #4081 from JoshVanL/certificate-signing-request-ca-e2e 
Certificate Signing Request CA e2e
 2021-06-09 13:13:30 +01:00
joshvanl 6dc95cc63c Adds comment that the kube CSR e2e tests require the feature gate to 
pass

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-09 11:42:02 +01:00
joshvanl 9ef5fef3a1 Changes kube CSR CA e2e tests to be more readable and improve validation 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-09 11:36:21 +01:00
jetstack-botandGitHub 4f2f0075a9 Merge pull request #4056 from RinkiyaKeDad/del_framework.go 
deleting test/e2e/framework/config/framework.go
 2021-06-09 11:09:30 +01:00
joshvanl abdd1f54fa Fix CA CertificateSigningRequest controller to return potential error 
from updating failed status

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-07 17:48:49 +01:00
joshvanl 590e01f3d0 Add ExperimentalCertificateSigningRequestControllers=true as default 
experimental controller to enable in devel/addon/cert-manager/install.md

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-07 17:34:39 +01:00
joshvanl 5a64222475 Adds CA Issuer CertificateSigningRequest e2e test 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-07 15:32:54 +01:00
joshvanl d4fd4f9acc Move determining Issuer resource Kind into CSR/util 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-07 15:27:43 +01:00
jetstack-botandGitHub 5875c828c6 Merge pull request #4074 from JoshVanL/certificate-request-acme-revert-ca.crt 
Reverts ACME issuer from forming a chain bundle and populating the ca.crt
 2021-06-04 16:10:23 +01:00
RinkiyaKeDad 438a0fff13 removed nil line 
Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
 2021-06-04 13:10:04 +05:30
RinkiyaKeDad 662bc5030c removed more stuff 
Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
 2021-06-03 12:37:27 +05:30
joshvanl 1678d0833e Reverts ACME issuer from forming a chain bundle and populating the 
ca.crt

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-06-02 12:21:50 +01:00
jetstack-botandGitHub 528305b5ed Merge pull request #4064 from JoshVanL/certificate-request-issuer-ca 
Certificate Signing Request Issuer CA
v1.4.0-beta.0 		2021-05-28 10:57:11 +01:00
joshvanl 36bd7a459c Changes CSR util signername to use if statements rather than switch 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-28 10:34:43 +01:00
joshvanl acc5431f1b Fix signernames to allow clusterissuers with dots in name 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-28 10:13:00 +01:00
joshvanl 9e1b0342d0 Updates with review comments 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 18:48:50 +01:00
jetstack-botandGitHub 5632379132 Merge pull request #4067 from wallrj/artifacthub-annotations-2 
Add ArtifactHUB pre-release annotations to the Helm chart
 2021-05-27 16:27:14 +01:00
Richard Wall 1f3c3df090 Add ArtifactHUB pre-release annotations to the Helm chart 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-27 13:58:52 +01:00
jetstack-botandGitHub a80198c03d Merge pull request #4065 from jetstack/revert-4049-artifacthub-annotations 
Revert "Add ArtifcactHUB pre-release annotation to the Helm chart"
 2021-05-27 13:02:34 +01:00
Richard WallandRichard Wall 8792a17396 Revert "Add ArtifcactHUB pre-release annotation to the Helm chart" 
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
 2021-05-27 12:16:06 +01:00
joshvanl 60d5974115 Moves CertificateSigningRequest controller to feature gate flag 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 12:00:56 +01:00
joshvanl e014b6655d Use ca.crt with the CertificateSigningRequest CA controller 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 10:49:21 +01:00
joshvanl 459b5e31b0 RBAC permissions for signing and managing cert-manager 
CertificateSigningRequersts Issuers

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 00:35:58 +01:00
joshvanl 62dee4783e Adds CertificateSigningRequest CA Issuer controller as optional 
controller

Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 00:32:24 +01:00
joshvanl 3b74c34089 Adds CertificateSigningRequest CA Issuer controller 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 00:25:02 +01:00
joshvanl c5c206cace Adds base CertificateSigningRequest cert-manager controller 
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
 2021-05-27 00:23:50 +01:00