Automatically provision and manage TLS certificates in Kubernetes
APACHE-2.0 License
Bot releases are visible (Hide)
Published by jetstack-release-bot 8 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
Release notes
Upgrade notes
Installation instructions
See Breaking changes in v1.12.0 release notes
github.com/containerd/[email protected]
(#6689, @wallrj)Published by jetstack-release-bot 8 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
preferredChain
is configured: see release docs for more info and mitigationsRelease notes
Upgrade notes
Installation instructions
See Breaking changes
in v1.14.0 release notes
v1.14.1
Published by jetstack-release-bot 9 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
⚠️ This version has known issues. Please install
v1.14.2
instead.
v1.14.2
)preferredChain
is configured: see release docs for more info and mitigationsCA
and SelfSigned
issuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.See Breaking changes
in v1.14.0 release notes
v1.14.0
cmctl experimental install
to panic. (#6706, @inteon)Published by jetstack-release-bot 9 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
⚠️ This version has known issues. Please install
v1.14.2
instead.
v1.14.2
)preferredChain
is configured: see release docs for more info and mitigationsCA
and SelfSigned
issuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.v1.14.0
, the Helm chart for this version was found to use the wrong OCI image for the cainjector
Deployment,v1.14.1
.startupapicheck
image in namespaces other than cert-manager.cmctl experimental install
to panic.The startupapicheck job uses a new OCI image called "startupapicheck", instead of the ctl image.
If you run in an environment in which images cannot be pulled, be sure to include the new image.
The KeyUsage and BasicConstraints extensions will now be encoded as critical in the CertificateRequest's CSR blob.
The cert-manager Certificate resource now allows you to configure a subset of "Other Name" SANs,
which are described in the Subject Alternative Name section of RFC 5280 (on page 37).
We specifically support any otherName
type with a UTF-8
value, such as the User Principal Name or sAMAccountName
.
These are useful when issuing unique certificates for authenticating with LDAP systems such as Microsoft Active Directory.
For example you can create certificates with this block in the spec:
otherNames:
- oid: 1.3.6.1.4.1.311.20.2.3 # UPN OID
utf8Value: [email protected]
The feature is still in alpha stage and requires you to enable the OtherName
feature flag in the controller and webhook components.
You can now specify the X.509 v3 Authority Information Accessors extension,
with URLs for certificates issued by the CA issuer.
Users can now use name constraints in CA certificates.
To know more details on name constraints check out RFC section https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
An ongoing security audit of the cert-manager code revealed some weaknesses which we have addressed in this release,
such as using more secure default settings in the HTTP servers that serve metrics, healthz and pprof endpoints.
This will help mitigate denial-of-service attacks against those important services.
All the cert-manager containers are now configured with read only root file system by default,
to prevent unexpected changes to the file system of the OCI image.
And it is now possible to configure the metrics server to use HTTPS rather than HTTP,
so that clients can verify the identity of the metrics server.
The liveness probe of the cert-manager controller Pod is now enabled by default.
There is a new option .spec.keystores.pkcs12.algorithms
to specify encryption and MAC algorithms for PKCS.
Thanks again to all open-source contributors with commits in this release, including:
Thanks also to the following cert-manager maintainers for their contributions during this release:
Equally thanks to everyone who provided feedback, helped users and raised issues on GitHub and Slack and joined our meetings!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
"cluster-autoscaler.kubernetes.io/safe-to-evict": "true"
. You can provide an annotation of "cluster-autoscaler.kubernetes.io/safe-to-evict": "false"
in your podTemplate
if you don't like this. (#6349, @jsoref)otherName
SANS in Certificates (#6404, @SpectralHiss)readOnlyRootFilesystem
by default. (#6453, @wallrj).spec.keystores.pkcs12.algorithms
to specify encryption and MAC algorithms for PKCS#12 keystores. Fixes issues #5957 and #6523. (#6548, @snorwin)readOnlyRootFilesystem: true
(#6462, @wallrj)revisionHistoryLimit
(#6248, @tberreis)spec.namespaceSelector
for webhooks (#6638, @jkroepke).Values.config
is set. (#6357, @ABWassim)GHSA-vgf6-pvf4-34rq
: The webhook server now returns HTTP error 413 (Content Too Large) for requests with body size >= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory.BadConfig
warnings anymore (#6347, @lauraseidler)ReadHeaderTimeout
in all http.Server
instances (#6534, @wallrj)WebSDK CertRequest Module Requested Certificate
or This certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.
. (#6398, @maelvls).Values.webhook.config
is set. (#6360, @ABWassim)otherName
SAN changes in Certificate resources trigger re-issuance. (#6620, @SpectralHiss)startupapicheck
image to quay.io
(#6609, @wallrj)1.21.3
to address CVE-2023-39325
. Also bumps base images. (#6410, @SgtCoDFish)golang.org/x/net v0.15.0 => v0.17.0
as part of addressing CVE-2023-44487
/ CVE-2023-39325
(#6427, @SgtCoDFish)crypto/md5
, a weak cryptographic primitive; using golangci-lint
/ gosec
(G501). (#6581, @wallrj)crypto/sha1
, a weak cryptographic primitive; using golangci-lint
/ gosec
(G505). (#6579, @wallrj)math/rand
instead of crypto/rand
); using golangci-lint
/ gosec
(G404). (#6582, @wallrj)pkg/util.RandStringRunes
and pkg/controller/test.RandStringBytes
. Use k8s.io/apimachinery/pkg/util/rand.String
instead. (#6585, @wallrj)subject.serialNumber
while using a literal certificate subject. This was a mistake and has been fixed. (#6533, @inteon)github.com/emicklei/go-restful/v3
to v3.11.0
because v3.10.2
is labeled as "DO NOT USE". (#6366, @inteon)sets.Set
type in place of the deprecated sets.String
. (#6586, @wallrj)v1.21.6
(#6628, @SgtCoDFish)autorest
dependency (#5452, @phillebaba)Published by jetstack-release-bot 9 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This is the first beta release of cert-manager 1.14, which will be released on January 31 2024.
The startupapicheck job uses a new OCI image called "startupapicheck", instead of the ctl image.
If you run in an environment in which images cannot be pulled, be sure to include the new image.
The KeyUsage and BasicConstraints extensions will now be encoded as critical in the CertificateRequest's CSR blob.
📖 Read the draft cert-manager 1.14 release notes.
v1.14.0-alpha.1
Published by jetstack-release-bot 9 months ago
This is the second pre-release of cert-manager 1.14 which will be released on January 31 2024.
The startupapicheck job uses a new OCI image called "startupapicheck", instead of the ctl image.
If you run in an environment in which images cannot be pulled, be sure to include the new image.
The KeyUsage and BasicConstraints extensions will now be encoded as critical in the CertificateRequest's CSR blob.
📖 Read the draft cert-manager 1.14 release notes.
Thanks again to all open-source contributors with commits in this release, including:
v1.14.0-alpha.0
revisionHistoryLimit
(#6248, @tberreis)otherName
SAN changes in Certificate resources trigger re-issuance. (#6620, @SpectralHiss)startupapicheck
image to quay.io
(#6609, @wallrj)v1.21.6
(#6628, @SgtCoDFish)autorest
dependency (#5452, @phillebaba)github.com/Azure/azure-sdk-for-go/sdk/azcore
: v1.9.1
github.com/Azure/azure-sdk-for-go/sdk/azidentity
: v1.4.0
github.com/Azure/azure-sdk-for-go/sdk/internal
: v1.5.1
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns
: v1.2.0
github.com/AzureAD/microsoft-authentication-library-for-go
: v1.1.1
github.com/dnaeon/go-vcr
: v1.2.0
github.com/golang-jwt/jwt/v5
: v5.0.0
github.com/kylelemons/godebug
: v1.1.0
github.com/montanaflynn/stats
: v0.7.0
github.com/pkg/browser
: 681adbf
Nothing has changed.
github.com/Azure/azure-sdk-for-go
: v68.0.0+incompatible
github.com/Azure/go-autorest/autorest/adal
: v0.9.23
github.com/Azure/go-autorest/autorest/date
: v0.3.0
github.com/Azure/go-autorest/autorest/mocks
: v0.4.2
github.com/Azure/go-autorest/autorest/to
: v0.4.0
github.com/Azure/go-autorest/autorest/validation
: v0.3.1
github.com/Azure/go-autorest/autorest
: v0.11.29
github.com/Azure/go-autorest/logger
: v0.2.1
github.com/Azure/go-autorest/tracing
: v0.6.0
github.com/Azure/go-autorest
: v14.2.0+incompatible
Published by jetstack-release-bot 10 months ago
This is a pre-release of cert-manager 1.14 which will be released on January 31 2024.
quay.io
, so the standard Helm install fails.--set startupapicheck.enabled=false
, to disable the startup API check.The startupapicheck job uses a new OCI image called "startupapicheck", instead of the ctl image.
If you run in an environment in which images cannot be pulled, be sure to include the new image.
The KeyUsage and BasicConstraints extensions will now be encoded as critical in the CertificateRequest's CSR blob.
📖 Read the draft cert-manager 1.14 release notes.
"cluster-autoscaler.kubernetes.io/safe-to-evict": "true"
. You can provide an annotation of "cluster-autoscaler.kubernetes.io/safe-to-evict": "false"
in your podTemplate
if you don't like this. (#6349, @jsoref)otherName
SANS in Certificates (#6404, @SpectralHiss)readOnlyRootFilesystem
by default. (#6453, @wallrj).spec.keystores.pkcs12.algorithms
to specify encryption and MAC algorithms for PKCS#12 keystores. Fixes issues #5957 and #6523. (#6548, @snorwin)readOnlyRootFilesystem: true
(#6462, @wallrj).Values.config
is set. (#6357, @ABWassim)GHSA-vgf6-pvf4-34rq
: The webhook server now returns HTTP error 413 (Content Too Large) for requests with body size >= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory.BadConfig
warnings anymore (#6347, @lauraseidler)ReadHeaderTimeout
in all http.Server
instances (#6534, @wallrj)WebSDK CertRequest Module Requested Certificate
or This certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.
. (#6398, @maelvls).Values.webhook.config
is set. (#6360, @ABWassim)1.21.3
to address CVE-2023-39325
. Also bumps base images. (#6410, @SgtCoDFish)golang.org/x/net v0.15.0 => v0.17.0
as part of addressing CVE-2023-44487
/ CVE-2023-39325
(#6427, @SgtCoDFish)crypto/md5
, a weak cryptographic primitive; using golangci-lint
/ gosec
(G501). (#6581, @wallrj)crypto/sha1
, a weak cryptographic primitive; using golangci-lint
/ gosec
(G505). (#6579, @wallrj)math/rand
instead of crypto/rand
); using golangci-lint
/ gosec
(G404). (#6582, @wallrj)pkg/util.RandStringRunes
and pkg/controller/test.RandStringBytes
. Use k8s.io/apimachinery/pkg/util/rand.String
instead. (#6585, @wallrj)subject.serialNumber
while using a literal certificate subject. This was a mistake and has been fixed. (#6533, @inteon)github.com/emicklei/go-restful/v3
to v3.11.0
because v3.10.2
is labeled as "DO NOT USE". (#6366, @inteon)sets.Set
type in place of the deprecated sets.String
. (#6586, @wallrj)Published by jetstack-release-bot 10 months ago
This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2382
: Denial of service via chunk extensions in net/http
If you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108
: DoS vulnerability in otelgrpc
due to unbound cardinality metrics.An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks,
and these are included in this patch release.
>= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory (#6506, @inteon).ReadHeaderTimeout
in all http.Server
instances (#6539, @wallrj).otel
and docker
to fix: CVE-2023-47108
and GHSA-jq35-85cj-fj4p
(#6513, @inteon).cloud.google.com/go/dataproc/v2
: v2.0.1
cloud.google.com/go/aiplatform
: v1.45.0 → v1.48.0
cloud.google.com/go/analytics
: v0.21.2 → v0.21.3
cloud.google.com/go/baremetalsolution
: v0.5.0 → v1.1.1
cloud.google.com/go/batch
: v0.7.0 → v1.3.1
cloud.google.com/go/beyondcorp
: v0.6.1 → v1.0.0
cloud.google.com/go/bigquery
: v1.52.0 → v1.53.0
cloud.google.com/go/cloudbuild
: v1.10.1 → v1.13.0
cloud.google.com/go/cloudtasks
: v1.11.1 → v1.12.1
cloud.google.com/go/compute
: v1.21.0 → v1.23.0
cloud.google.com/go/contactcenterinsights
: v1.9.1 → v1.10.0
cloud.google.com/go/container
: v1.22.1 → v1.24.0
cloud.google.com/go/datacatalog
: v1.14.1 → v1.16.0
cloud.google.com/go/dataplex
: v1.8.1 → v1.9.0
cloud.google.com/go/datastore
: v1.12.1 → v1.13.0
cloud.google.com/go/datastream
: v1.9.1 → v1.10.0
cloud.google.com/go/deploy
: v1.11.0 → v1.13.0
cloud.google.com/go/dialogflow
: v1.38.0 → v1.40.0
cloud.google.com/go/documentai
: v1.20.0 → v1.22.0
cloud.google.com/go/eventarc
: v1.12.1 → v1.13.0
cloud.google.com/go/firestore
: v1.11.0 → v1.12.0
cloud.google.com/go/gkebackup
: v0.4.0 → v1.3.0
cloud.google.com/go/gkemulticloud
: v0.6.1 → v1.0.0
cloud.google.com/go/kms
: v1.12.1 → v1.15.0
cloud.google.com/go/maps
: v0.7.0 → v1.4.0
cloud.google.com/go/metastore
: v1.11.1 → v1.12.0
cloud.google.com/go/policytroubleshooter
: v1.7.1 → v1.8.0
cloud.google.com/go/pubsub
: v1.32.0 → v1.33.0
cloud.google.com/go/run
: v0.9.0 → v1.2.0
cloud.google.com/go/servicedirectory
: v1.10.1 → v1.11.0
cloud.google.com/go/speech
: v1.17.1 → v1.19.0
cloud.google.com/go/translate
: v1.8.1 → v1.8.2
cloud.google.com/go/video
: v1.17.1 → v1.19.0
cloud.google.com/go/vmwareengine
: v0.4.1 → v1.0.0
cloud.google.com/go
: v0.110.4 → v0.110.7
github.com/felixge/httpsnoop
: v1.0.3 → v1.0.4
github.com/go-logr/logr
: v1.2.4 → v1.3.0
github.com/golang/glog
: v1.1.0 → v1.1.2
github.com/google/go-cmp
: v0.5.9 → v0.6.0
github.com/google/uuid
: v1.3.0 → v1.3.1
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
: v0.45.0 → v0.46.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
: v0.44.0 → v0.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/metric
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/sdk
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/trace
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel
: v1.19.0 → v1.20.0
go.uber.org/goleak
: v1.2.1 → v1.3.0
golang.org/x/oauth2
: v0.10.0 → v0.11.0
golang.org/x/sys
: v0.13.0 → v0.14.0
google.golang.org/genproto/googleapis/api
: 782d3b1 → b8732ec
google.golang.org/genproto/googleapis/rpc
: 782d3b1 → b8732ec
google.golang.org/genproto
: 782d3b1 → b8732ec
google.golang.org/grpc
: v1.58.3 → v1.59.0
cloud.google.com/go/dataproc
: v1.12.0
Published by jetstack-release-bot 10 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
⚠️ Read about the breaking changes in cert-manager 1.13 before you upgrade from a < v1.13 version!
This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2334
: Decryption of malicious PBES2 JWE objects can consume unbounded system resources.If you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108
: DoS vulnerability in otelgrpc
due to unbound cardinality metrics.An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks, and these are included in this patch release.
>= 3MiB
. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory. (#6507, @inteon)ReadHeaderTimeout
in all http.Server
instances. (#6538, @wallrj)otel
, docker
, and jose
to fix CVE alerts. See https://github.com/advisories/GHSA-8pgv-569h-w5rw, https://github.com/advisories/GHSA-jq35-85cj-fj4p, and https://github.com/advisories/GHSA-2c7c-3mj9-8fqh. (#6514, @inteon)Nothing has changed.
cloud.google.com/go/firestore
: v1.11.0 → v1.12.0
cloud.google.com/go
: v0.110.6 → v0.110.7
github.com/felixge/httpsnoop
: v1.0.3 → v1.0.4
github.com/go-jose/go-jose/v3
: v3.0.0 → v3.0.1
github.com/go-logr/logr
: v1.2.4 → v1.3.0
github.com/golang/glog
: v1.1.0 → v1.1.2
github.com/google/go-cmp
: v0.5.9 → v0.6.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
: v0.45.0 → v0.46.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
: v0.44.0 → v0.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/metric
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/sdk
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel/trace
: v1.19.0 → v1.20.0
go.opentelemetry.io/otel
: v1.19.0 → v1.20.0
go.uber.org/goleak
: v1.2.1 → v1.3.0
golang.org/x/sys
: v0.13.0 → v0.14.0
google.golang.org/genproto/googleapis/api
: f966b18 → b8732ec
google.golang.org/genproto
: f966b18 → b8732ec
google.golang.org/grpc
: v1.58.3 → v1.59.0
Nothing has changed.
Published by jetstack-release-bot 12 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.2 fixes some CVE alerts and contains fixes for:
WebSDK CertRequest Module Requested Certificate
or This certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.
. (#6402, @jetstack-bot)Published by jetstack-release-bot 12 months ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.6 fixes some CVE alerts and a Venafi issuer bug
WebSDK CertRequest Module Requested Certificate
or This certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.
. (#6401, @jetstack-bot)If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see https://github.com/cert-manager/cert-manager/pull/6406).
This problem was resolved in v1.13.2, but the fix cannot be backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to v1.13.2.
Published by jetstack-release-bot about 1 year ago
v1.12.5 contains a backport for a name collision bug that was found in v1.13.0
Published by jetstack-release-bot about 1 year ago
v1.13.1 contains a bugfix for a name collision bug in the StableCertificateRequestName feature that was enabled by default in v1.13.0.
github.com/emicklei/go-restful/v3
to v3.11.0
because v3.10.2
is labeled as "DO NOT USE". (#6368, @inteon)Published by jetstack-release-bot about 1 year ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This is the 1.13 release of cert-manager!
cert-manager 1.13 brings support for DNS over HTTPS, support for loading options from a versioned
config file for the cert-manager controller, and more. This release also includes the promotion of
the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta.
The StableCertificateRequestName
that was promoted to Beta contains a "name collision" bug: https://github.com/cert-manager/cert-manager/issues/6342
This will be fixed in v1.13.1.
.featureGates
value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use webhook.featureGates
field instead to define features to be enabled on webhook. (#6093, @irbekrm)--feature-gates
flag, this will now break (unless the webhook actually has a feature by that name). (#6093, @irbekrm)Welcome to these new cert-manager members (more info - https://github.com/cert-manager/cert-manager/pull/6260):
@jsoref
@FlorianLiebhart
@hawksight
@erikgb
Thanks again to all open-source contributors with commits in this release, including:
@AcidLeroy
@FlorianLiebhart
@lucacome
@cypres
@erikgb
@ubergesundheit
@jkroepke
@jsoref
@gdvalle
@rouke-broersma
@schrodit
@zhangzhiqiangcs
@arukiidou
@hawksight
@Richardds
@kahirokunn
Thanks also to the following cert-manager maintainers for their contributions during this release:
@SgtCoDFish
@maelvls
@irbekrm
@inteon
Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings!
Special thanks to @AcidLeroy for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see https://github.com/cert-manager/cert-manager/pull/5337)
Also, thanks a lot to @FlorianLiebhart for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see https://github.com/cert-manager/cert-manager/pull/5003)
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
cluster-reader
aggregated cluster role (#6241, @erikgb)enableServiceLinks
configurable for all Deployments and startupapicheck
Job in Helm chart. (#6292, @ubergesundheit)--dns01-recursive-nameservers-only=true
in combination with --dns01-recursive-nameservers=https://<DoH-endpoint>
(e.g. https://8.8.8.8/dns-query
). It keeps using DNS lookup as a default method. (#5003, @FlorianLiebhart)cmctl check api --wait 0
exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code (#6109, @inteon).featureGates
value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use webhook.featureGates
field instead to define features to be enabled on webhook.--feature-gates
flag, this will now break (unless the webhook actually has a feature by that name). (#6093, @irbekrm)net.IP.String()
function would have printed that address. (#6293, @SgtCoDFish)enableServiceLinks
option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. (#6143, @schrodit)cert-manager.io/common-name
, cert-manager.io/alt-names
, ... annotations on Secrets are kept at their correct value. (#6176, @inteon)v0.27.2
. (#6077, @lucacome)v0.27.4
. (#6227, @lucacome)Published by jetstack-release-bot about 1 year ago
v1.12.4 contains an important security fix that addresses CVE-2023-29409.
net.IP.Str ing()
function would have printed that address. (#6297, @SgtCoDFish)crypto/tls
library. (#6318, @maelvls)Published by jetstack-release-bot about 1 year ago
v1.11.5 contains an important security fix that addresses CVE-2023-29409.
crypto/tls
library. (#6317, @maelvls)Published by jetstack-release-bot about 1 year ago
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
Welcome to the first beta of the coming 1.13 release of cert-manager!
🌟 This version is a pre-release version intended for testing. It might not be suitable for production uses.
cluster-reader
aggregated cluster role (#6241, @erikgb)enableServiceLinks
configurable for all Deployments and startupapicheck
Job in Helm chart. (#6292, @ubergesundheit)net.IP.String()
function would have printed that address. (#6293, @SgtCoDFish)cert-manager.io/common-name
, cert-manager.io/alt-names
, ... annotations on Secrets are kept at their correct value. (#6176, @inteon)v0.27.4
. (#6227, @lucacome)Published by jetstack-release-bot about 1 year ago
Published by jetstack-release-bot over 1 year ago
Welcome to the first alpha of the coming 1.13 release! In this release, you will be able to test the new DNS-over-HTTPS feature.
This new feature, developed by @FlorianLiebhart, allows you to use cert-manager's Let's Encrypt issuer even when UDP port 53 isn't open on egress. DNS-over-HTTPS allows you to use the environment variable HTTPS_PROXY
in the cert-manager controller deployment so that cert-manager can work over a proxy, working around the egress limitations!
That We will soon update the documentation of cert-manager to explain the use-cases and how to set it up. More info is available in the design document at https://hackmd.io/@maelvls/cert-manager-dns-01-using-dns-over-https. A massive thank you to @FlorianLiebhart for his hard work: this work was started one year ago! 🎉
🌟 This version is a pre-release version intended for testing. It might not be suitable for production uses.
--dns01-recursive-nameservers-only=true
in combination with --dns01-recursive-nameservers=https://<DoH-endpoint>
(e.g. https://8.8.8.8/dns-query
). It keeps using DNS lookup as a default method. The design document is visible here: https://hackmd.io/@maelvls/cert-manager-dns-01-using-dns-over-https (#5003, @FlorianLiebhart)cmctl check api --wait 0
exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code (#6109, @inteon).featureGates
value set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Use webhook.featureGates
field instead to define features to be enabled on webhook.--feature-gates
flag, this will now break (unless the webhook actually has a feature by that name). (#6093, @irbekrm)v0.27.2
. (#6077, @lucacome)enableServiceLinks
option for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. (#6143, @schrodit)Published by jetstack-release-bot over 1 year ago