[pull] master from cert-manager:master - #1066
Open
pull[bot] wants to merge 3974 commits into
Open
Conversation
…odules chore(deps): update makefile modules to 92aeb18 (master)
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
docs: fix broken appendix anchor in gatewayapi-listenerset design
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…odules chore(deps): update makefile modules to 5d90d75 (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…odules chore(deps): update makefile modules to 3968a05 (master)
…-github-actions chore(deps): update misc github actions to v7 (master)
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Make "Base Images" Renovate group consistent
…-brances Disable makefile-modules upgrades on release branches
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Fix various Renovate issues for release branches
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Fix PR title for release branch PRs
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
…-pr-title Revert "Fix PR title for release branch PRs"
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…odules chore(deps): update makefile modules to 6c59e94 (master)
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
…odules chore(deps): update makefile modules to 2439727 (master)
Reject '..' sequences in spec.vault.path and in the auth mount path fields (appRole.path, kubernetes.path, clientCertificate.path, aws.mountPath) during webhook validation. Go's path.Join resolves '..' segments client-side before constructing the HTTP request to Vault, which can silently produce a different URL than the user intended. For the auth mount path fields, '..' can also escape the hard-coded 'auth/' prefix in the URL construction. Also replace filepath.Join with path.Join in the clientCertificate and kubernetes auth code paths. filepath.Join is OS-dependent and not appropriate for URL path construction. Reported-by: jiayuqi7813 Reported-by: kodareef5 Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Remove the Role and RoleBinding that granted the cert-manager controller ServiceAccount permission to create tokens for itself via the TokenRequest API. - Added in #7213 (cert-manager 1.16) to support a "Using the cert-manager ServiceAccount" section in the Route53 docs - That docs section was removed in website#1555 (Oct 2024) when the Route53 page was restructured into Ambient / Non-ambient credentials - No documented flow (Route53 IRSA ambient, Vault Kubernetes auth, or any other issuer) requires the controller to mint tokens for its own ServiceAccount — documented serviceAccountRef examples all use a dedicated, user-created ServiceAccount with its own RBAC Users who rely on the undocumented pattern of pointing serviceAccountRef.name at the controller ServiceAccount should create their own Role and RoleBinding, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount). Reverts #7213 Ref #7212 Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Fix Renovate config for release branches
…odules chore(deps): update makefile modules to 2c4a3b8 (master)
A nil *metav1.Time passed to the structured logger panics in the promoted time.Time.String method (value receiver, nil dereference). klog recovers and renders the field as: notAfter="<panic: runtime error: invalid memory address or nil pointer dereference>" which users have repeatedly mistaken for a cert-manager crash. Wrap the three nullable status timestamps in a nil-safe formatter. Fixes #6799 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Richard Wall <richard@the-moon.net>
kubernetes/kubernetes logs nullable metav1.Time fields the same way: https://github.com/kubernetes/kubernetes/blob/v1.30.0/pkg/controller/controller_utils.go#L954 The helper was added to klog for exactly this Stringer-on-nil-pointer case: kubernetes/klog#393 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Richard Wall <richard@the-moon.net>
…d key The issuing controller acts on a CertificateRequest's terminal state before it checks whether the request's CSR still matches the Certificate's current next private key. When the key is replaced while a request is in flight, the self-signed issuer marks that request Failed with ErrorKeyMatch, and this controller reads the failure first: it bumps the issuance attempts and drops the Issuing condition, so the certificate waits out a backoff for a request that the requestmanager is about to delete and rebuild against the new key. The mismatch check already existed further down and already did the right thing by waiting, it was simply unreachable once the request had reached a terminal state. It now runs before Denied, InvalidRequest and Failed are acted on, since the requestmanager deletes a mismatched request regardless of its condition, so none of those verdicts say anything about the current issuance. A request that fails for a real reason still fails: its CSR matches the current key, so it reaches the failure branch exactly as before. If the underlying problem persists, the rebuilt request fails again with a matching key and issuance is marked failed then. An undecodable CSR cannot reach the moved check either, because RequestMatchesSpec decodes the request earlier in the same function and returns that error. The regressions carry a FailureTime after the Certificate's Issuing transition, so they are not caught by the earlier "failed during a previous issuance" branch and reproduce the timing from the issue. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
owningCertForSecret returns nil when the Secret has no cert-manager.io/certificate-name annotation, and the warning log in exactly that branch passes the nil *types.NamespacedName to the logger, which panics in the promoted value-receiver String method. klog recovers and renders the field as: annotationValue="<panic: runtime error: invalid memory address or nil pointer dereference>" Wrap the value in klog.SafePtr, as in #9117. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Richard Wall <richard@the-moon.net>
logr.Logger.Error always emits regardless of verbosity, so the V(logf.ErrorLevel) call has no effect. It is doubly redundant because logf.ErrorLevel is 0 and V(0) returns the logger unchanged. Behavior is unchanged; the dead call was misleading readers into thinking the error logs were verbosity-gated. Found by running sigs.k8s.io/logtools/logcheck (its verbosity-error check) against the repository. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Richard Wall <richard@the-moon.net>
fix(issuing): do not fail issuance for a request built from a replaced key
Remove no-op verbosity gate on acmechallenges Error logs
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
fix(deps): update module github.com/aws/smithy-go to v1.27.7 (master)
#9118) The previous-issuance guard reads crReadyCond.Reason, but crReadyCond is only checked for nil further down, after the Denied and InvalidRequest branches. A CertificateRequest that carries status.failureTime and has no Ready condition therefore dereferences a nil pointer and takes the controller down. The nil check is added to the guard rather than hoisted, because hoisting would change behaviour: a request that has been denied before an issuer set its Ready condition currently fails issuance, and moving the nil check above the Denied branch would make it wait instead. Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
Fix nil pointer panic placeholders in readiness controller debug log
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…b-actions chore(deps): update misc github actions (master)
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update module github.com/digitalocean/godo to v1.204.0 (master)
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Fix nil pointer panic placeholder in cainjector secret mismatch log
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…onsi-deps fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.1 (master)
…org-x-mod-vulnerability chore(deps): update module golang.org/x/mod to v0.40.0 [security] (master)
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update misc go deps (master)
fix(deps): update cloud go deps (master)
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…odules chore(deps): update makefile modules to b514cb5 (master)
fix(deps): update cloud go deps (master)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )