fix(deps): update module github.com/cert-manager/cert-manager to v0.16.1 - abandoned #9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: hjoshi123 <[email protected]>
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
hjoshi123
force-pushed
the
bug/renovate-config
branch
3 times, most recently
from
f52d2ca to
5894b60
Compare
hjoshi123
changed the title
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
hjoshi123
force-pushed
the
bug/renovate-config
branch
5 times, most recently
from
f11ff1f to
b430ab5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.0.0-00010101000000-000000000000->v0.16.1Note: This PR was automatically created by Renovate Bot.
Before merging:
Ensure all tests pass
Review the changelog/release notes of updated dependencies
Check for any breaking changes
Verify cert-manager still builds correctly
Release Notes
cert-manager/cert-manager (github.com/cert-manager/cert-manager)
v0.16.1Compare Source
Changes by Kind
Other (Bug, Cleanup or Flake)
v0.16.0Compare Source
Urgent Upgrade Notes
(No, really, you MUST read this before you upgrade)
Old versions of
kubectlandhelmwill have issues updating the CRD resources once installed. For more info check https://cert-manager.io/docs/installation/upgrading/upgrading-0.15-0.16/Support for AuditSink resources in the
auditregistration.k8s.io/v1alpha1API group has been removed (#3056, @munnerz)Changes by Kind
Feature
status certificate(#3102, @hzhou97)v1beta1API version (#3038, @munnerz)status certificatecommand. (#3090, @hzhou97)Other (Bug, Cleanup or Flake)
O = cert-managerin the Venafi issuer if DN is empty (#2946, @meyskens)kubectl cert-manager convertto not work when conversions need to be performed (#3018, @hzhou97)kubectl explain(#3031, @munnerz)architectureattribute (#3001, @meyskens)v0.16.0-alpha.1Compare Source
Changes by Kind
Feature
status certificatecommand. (#3090, @hzhou97)Other (Bug, Cleanup or Flake)
v0.16.0-alpha.0Compare Source
Urgent Upgrade Notes
(No, really, you MUST read this before you upgrade)
auditregistration.k8s.io/v1alpha1API group has been removed (#3056, @munnerz)Changes by Kind
Feature
v1beta1API version (#3038, @munnerz)Other (Bug, Cleanup or Flake)
kubectl cert-manager convertto not work when conversions need to be performed (#3018, @hzhou97)kubectl explain(#3031, @munnerz)architectureattribute (#3001, @meyskens)v0.15.2Compare Source
Changes by Kind
Other (Bug, Cleanup or Flake)
v0.15.1Compare Source
Changes by Kind
Other (Bug, Cleanup or Flake)
O = cert-managerin the Venafi issuer if DN is empty (#2955, @meyskens)v0.15.0Compare Source
The
v0.15release has a few focus areas:installCRDsoption in the Helm chartAs usual, please read the upgrade notes before upgrading.
Experimental controllers
The Certificate controller is one of the most commonly used controllers in the project.
It represents the 'full lifecycle' of an x509 private key and certificate, including
private key management and renewal.
As the project is maturing, more requirements around this controller are starting to become
apparent in order to implement feature requests such as private key rotation, JKS/PKCS#12
keystores and manual certificate renewal triggering.
This new controller aims to facilitate the above features, as well as make it easier to develop
individual areas of the controller over time and continue to make improvements.
For more information on this we invite you to read our design document.
Using the experimental controllers
We are looking for feedback on the use of these new controllers in different environments.
If you are able to run these in your cluster and report any issues you're seeing that would
be very helpful to the further development of the project.
The experimental controllers are currently feature gated and disabled by default.
You can enable these by the following steps, in the Helm values set:
If you're using the static manifests you need to edit the cert-manager Deployment using
kubectl -n cert-manager edit deploy cert-managerand edit the
argsto include--feature-gates=ExperimentalCertificateControllers=true:Helm chart
installCRDsoptionIt's been a long-standing feature request to bundle our CRD resources as part
of our Helm chart, to make it easier for users installing with Helm to manage
the lifecycle of the CRDs we create.
To facilitate this, and to help resolve common deployment issues, we have added
a new
installCRDsoption to the Helm chart which will mean the CRD resourceswill be managed by your regular Helm installation.
This feature is disabled by default, and can be enabled either in your
values.yamlfile or as a flag withhelm install --set installCRDs=true.Support for OpenShift's Operator Lifecycle Manager
cert-manager can now be deployed as a Red Hat Certified OpenShift Operator.
This is done using the cert-manager operator.
More information on this can be found on the OpenShift Installation page.
Improved deployment of the webhook
In order to improve start up time of the webhook pod, as well as improved reliability and operability,
cert-manager
v0.15includes a newDynamicAuthoritystructure in the webhook that is used to manage theCA used to secure the webhook.
Instances of the webhook will keep this CA up to date and use it to generate serving certificates which
are used to secure incoming connections.
This means that the cert-manager-controller component is no longer required to be running in order for webhook startup to succeed.
This also means that users should no longer see long start up times for this pod unless there is a genuine issue/error that needs resolving.
General Availability of JKS and PKCS#12 keystores
v0.14added experimental 'bundle format' support for JKS and PKCS#12.In
v0.15thekeystoregot added to the Certificate spec which makes cert-manageradd an additional keystore in your Certificate's Secret resource.
No additional feature gates need to be set anymore.
For JKS this adds the files:
keystore.jksandtruststore.jksto the targetspec.secretName.For PKCS#12, it adds the file
keystore.p12.kubectl cert-manager tool
kubectl cert-manager is a kubectl plugin that assists with controlling cert-manager inside your
Kubernetes cluster. The kubectl cert-manager binary can be downloaded from the GitHub release page.
In
v0.15the use is currently limited to theconvertandrenewcommands.kubectl cert-manager renewcan be used to manually trigger renewal of your certificates. This required theExperimentalCertificateControllersfeature gate to be set.kubectl cert-manager convertcan be used to convert cert-manager config files between different API versionsif your cluster does not support the conversion webhook (i.e. running the 'legacy' release)
or if you want to upgrade all your local cert-manager configuration files.
Urgent Upgrade Notes
(No, really, you MUST read this before you upgrade)
serverAuthkey usage from set of defaults. If your configured issuer does not automatically set this usage and you do require it, you will need to manually update your Certificate & CertificateRequest resources to contain theserverAuthusage (#2864, @munnerz)Changes by Kind
Feature
certificate.spec.keystoresstanza and allowing configuring JKS and PKCS12 issuing on a per-Certificate basis (#2824, @munnerz)certificate.spec.privateKey.rotationPolicytoAlwaysto enable this functionality. (#2814, @munnerz)cert-manager-ctl convertcommand. (#2758, @JoshVanL)AuditSinkkind inauditregistration.k8s.io/v1alpha1to be a ca injector target. (#2027, @pepov)nameserverfield in RFC2136 providers now supports hostname, FQDN, and IPv6 address in addition to IPv4 address. (#2682, @johanfleury)Design
Documentation
Other (Bug, Cleanup or Flake)
webhookbootstrapcontroller to fail to Update webhook TLS resources in certain cases (#2739, @munnerz)Issuerkind (#2837, @meyskens)per_pageto 100 in Cloudfare API calls (#2856, @sileht)k8s.io/*dependencies tov1.18.0(#2731, @munnerz)--tls-min-versionto allow configuring the minimum allowed TLS version and fix default ciphers list. (#2769, @munnerz)v0.15.0-beta.1Compare Source
Changes by Kind
Other (Bug, Cleanup or Flake)
v0.15.0-beta.0Compare Source
Note: the
cert-manager-ctlbinaries are not included in this release due to a naming conflict. In the next release they will be available under a new name to be installed using KrewUrgent Upgrade Notes
(No, really, you MUST read this before you upgrade)
serverAuthkey usage from set of defaults. If your configured issuer does not automatically set this usage and you do require it, you will need to manually update your Certificate & CertificateRequest resources to contain theserverAuthusage (#2864, @munnerz)Changes by Kind
Feature
cert-manager-ctl convertcommand. (#2758, @JoshVanL)Other (Bug, Cleanup or Flake)
v0.15.0-alpha.2Compare Source
Changes by Kind
Feature
Other (Bug, Cleanup or Flake)
v0.15.0-alpha.1Compare Source
Changes by Kind
Feature
certificate.spec.keystoresstanza and allowing configuring JKS and PKCS12 issuing on a per-Certificate basis (#2824, @munnerz)certificate.spec.privateKey.rotationPolicytoAlwaysto enable this functionality. (#2814, @munnerz)AuditSinkkind inauditregistration.k8s.io/v1alpha1to be a ca injector target. (#2027, @pepov)Other (Bug, Cleanup or Flake)
v0.15.0-alpha.0Compare Source
Changes by Kind
Feature
nameserverfield in RFC2136 providers now supports hostname, FQDN, and IPv6 address in addition to IPv4 address. (#2682, @johanfleury)Documentation
Other (Bug, Cleanup or Flake)
webhookbootstrapcontroller to fail to Update webhook TLS resources in certain cases (#2739, @munnerz)k8s.io/*dependencies tov1.18.0(#2731, @munnerz)--tls-min-versionto allow configuring the minimum allowed TLS version and fix default ciphers list. (#2769, @munnerz)v0.14.3Compare Source
Changes by Kind
Other (Bug, Cleanup or Flake)
Issuerkind (#2838, @meyskens)per_pageto 100 in Cloudfare API calls (#2859, @sileht)v0.14.2Compare Source
Changes by Kind
Other (Bug, Cleanup or Flake)
v0.14.1Compare Source
Changes by Kind
Documentation
Other (Bug, Cleanup or Flake)
webhookbootstrapcontroller to fail to Update webhook TLS resources in certain cases (#2742, @munnerz)retry-afterheader, causing cert-manager to not process new orders or challenges. (#2729, @JoshVanL)v0.14.0Compare Source
The
v0.14release has a few focus areas:CustomResourceDefinitionconversionAs usual, please read the upgrade notes before upgrading.
Webhook changes
The webhook component is now required.
The webhook will be automatically enabled by the
v0.14manifests, so no additional action is required.If you have issues running the webhook in your environment, we'd like to hear from you! We are aware of issues relating to firewall rules from the Kubernetes API server to the webhook pod(s) - we would like to gather together a corpus of configuration snippets that can be used to ensure the webhook is successfully deployed in these environments too.
This change is required in order to support the upcoming changes to our API versions, as we introduce
v1alpha3,v1beta1andv1over the coming months!Improving our deployment and release process
After reports of various issues installing on older Kubernetes and OpenShift versions, we've taken some time to revise our installation manifests.
There are now two 'variants' to choose from, 'standard' and the 'legacy', with a simple way to know which to use:
cert-manager.yamlcert-manager.yamlcert-manager-legacy.yamlcert-manager-legacy.yamlPlease be sure to read the upgrade guide for more information on how to upgrade from a previous release.
CustomResourceDefinitionconversion webhook +v1alpha3API versionAs part of the effort to mature our API, we are releasing the
v1alpha3API version. This contains a number of small changes, notably moving some fields to thesubjectstanza on the Certificate resource to be more consistent with how certain options are specified.With this we have enabled the 'conversion webhook', which enables API clients to utilize both the
v1alpha2andv1alpha3APIs simultaneously, similar to other core resources in Kubernetes.Thanks to this conversion webhook, this upgrade and future upgrades after it should be seamless. The ability to make these kinds of changes to our API will enable the
v1beta1API version to be released in a seamless manner in an upcoming release too.More information on the webhook can be found in the concepts section.
Support for Kubernetes 1.11 and OpenShift 3.11
We've had a number of users who are using OpenShift 3.11 & Kubernetes 1.11 reach out requesting support with installation. In this release, we've expanded the range of Kubernetes versions we support to once again include 1.11, as well as adding support for OpenShift 3.11.
A big thanks to
@meyskensfor putting this together!Experimental 'bundle format' support (JKS and PKCS#12)
One of our top feature requests has been for support for JKS and PKCS#12 bundle files as an output from Certificate resources.
In this release, we've added experimental support for both of these bundle formats. This can currently only be configured globally with flags provided to the
cert-managerpod (--experimental-issue-jksand--experimental-issue-pkcs12). The password used for this bundle must also be configured using the flags--experimental-jks-passwordand--experimental-pkcs12-keystore-passwordrespectively.In the next release, we are aiming to provide native support for these bundle format types as part of the Certificate resource configuration. We have added these flags now in order to gather feedback on the way this feature works, and help guide how this feature should work in future.
Extended support for Venafi features
Users of the Venafi issuer often need to set custom metadata on their certificate requests in order to better associate each request with different business areas, or in order to validate & authorize whether a request should be signed.
In this release, we've added support for setting custom metadata by adding the
venafi.cert-manager.io/custom-fieldsannotation onCertificateandCertificateRequestresources. If using the Venafi TPP integration, version 19.2 or greater is required.Urgent Upgrade Notes
(No, really, you MUST read this before you upgrade)
@munnerz)Changes by Kind
Feature
--experimental-issue-jksflag to enable JKS bundle generation in generated Secret resources. This flag will be replaced with native support for JKS bundles in future and is currently an experimental feature. If enabled, the--experimental-jks-passwordflag must also be set to the password used to encrypt JKS bundles. (#2647,@munnerz)--experimental-issue-pkcs12flag to enable PKCS12 bundle generation in generated Secret resources. This flag will be replaced with native support for PKCS12 bundles in future and is currently an experimental feature. If enabled, the--experimental-pkcs12-keystore-passwordflag must also be set to the password used to encrypt PKCS12 bundles. (#2643,@munnerz)venafi.cert-manager.io/custom-fieldsannotation for Venafi custom fields (#2573,@meyskens)emailSANsfield to Certificate resource (#2597,@meyskens)--tls-cipher-suitescommand line flag to the webhook binary with sensible defaults (#2562,@willthames)@meyskens)v1alpha3(#2563,@munnerz)@JoshVanL)00-crds.yamlfile with a manifest file published as part of the release (#2665,@munnerz)Other (Bug, Cleanup or Flake)
Venafi/vcertdependency to support custom fields in Venafi TPP 19.2 (#2663,@munnerz)GroupVersionKindset onOwnerReferenceof resources created by HTTP01 challenge solver, causing HTTP01 validations to fail on OpenShift 4 (#2546,@munnerz)@munnerz)spec.tls[].hostsentries refer to the same Secret name but a different set of hosts (#2611,@munnerz)@munnerz)cainjector.enabled=Falseoverride being ignored by the Helm Chart (#2544,@gtaylor)@munnerz)RoleBindingthe leader election namespace instead of hard-codedkube-system(#2621,@travisghansen)openshiftandno-webhookmanifest variants with a "legacy" variant (#2648,@meyskens)@munnerz)@munnerz)Other Changes
//build/release-tarstargets for generating release artifacts (#2556,@munnerz)@munnerz)isOpenShiftfrom Helm chart (#2642,@meyskens)webhook.enabledvariable in Helm chart as the webhook now is a required component (#2649,@meyskens)v0.14.0-alpha.1Compare Source
Upgrade Notes
(No, really, you MUST read this before you upgrade)
Changes by Kind
Other (Bug, Cleanup or Flake)
v0.14.0-alpha.0Compare Source
Changes by Kind
Feature
--experimental-issue-jksflag to enable JKS bundle generation in generated Secret resources. This flag will be replaced with native support for JKS bundles in future and is currently an experimental feature. If enabled, the--experimental-jks-passwordflag must also be set to the password used to encrypt JKS bundles. (#2647, @munnerz)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.