cert-manager: 1.17.4 -> 1.18.6
Change-Id: I88cd9d9ef02f81f8fbfa9cce2c164ff093b09b49
diff --git a/charts/cert-manager/templates/NOTES.txt b/charts/cert-manager/templates/NOTES.txt
index 341d101..4d0b4b6 100644
--- a/charts/cert-manager/templates/NOTES.txt
+++ b/charts/cert-manager/templates/NOTES.txt
@@ -1,6 +1,12 @@
{{- if .Values.installCRDs }}
⚠️ WARNING: `installCRDs` is deprecated, use `crds.enabled` instead.
+
{{- end }}
+⚠️ WARNING: New default private key rotation policy for Certificate resources.
+The default private key rotation policy for Certificate resources was
+changed to `Always` in cert-manager >= v1.18.0.
+Learn more in the [1.18 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.18).
+
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
In order to begin issuing certificates, you will need to set up a ClusterIssuer
diff --git a/charts/cert-manager/templates/cainjector-deployment.yaml b/charts/cert-manager/templates/cainjector-deployment.yaml
index dc14ab0..79ba857 100644
--- a/charts/cert-manager/templates/cainjector-deployment.yaml
+++ b/charts/cert-manager/templates/cainjector-deployment.yaml
@@ -138,7 +138,9 @@
{{- end }}
{{- with .Values.cainjector.nodeSelector }}
nodeSelector:
- {{- toYaml . | nindent 8 }}
+ {{- range $key, $value := . }}
+ {{ $key }}: {{ $value | quote }}
+ {{- end }}
{{- end }}
{{- with .Values.cainjector.affinity }}
affinity:
diff --git a/charts/cert-manager/templates/crds.yaml b/charts/cert-manager/templates/crds.yaml
index f5f8ec4..7979a58 100644
--- a/charts/cert-manager/templates/crds.yaml
+++ b/charts/cert-manager/templates/crds.yaml
@@ -408,10 +408,6 @@
description: |-
Defines extra output formats of the private key and signed certificate chain
to be written to this Certificate's target Secret.
-
- This is a Beta Feature enabled by default. It can be disabled with the
- `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
- the controller and webhook components.
type: array
items:
description: |-
@@ -615,7 +611,7 @@
`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
- (eg. because of company policy). Please note that the security of the algorithm is not that important
+ (e.g., because of company policy). Please note that the security of the algorithm is not that important
in reality, because the unencrypted certificate and private key are also stored in the Secret.
type: string
enum:
@@ -768,7 +764,11 @@
to await user intervention.
If set to `Always`, a private key matching the specified requirements
will be generated whenever a re-issuance occurs.
- Default is `Never` for backward compatibility.
+ Default is `Always`.
+ The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+ The new default can be disabled by setting the
+ `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+ the controller component.
type: string
enum:
- Never
@@ -828,8 +828,7 @@
revisions exceeds this number.
If set, revisionHistoryLimit must be a value of `1` or greater.
- If unset (`nil`), revisions will not be garbage collected.
- Default value is `nil`.
+ Default value is `1`.
type: integer
format: int32
secretName:
@@ -858,6 +857,21 @@
type: object
additionalProperties:
type: string
+ signatureAlgorithm:
+ description: |-
+ Signature algorithm to use.
+ Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
+ Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
+ Allowed values for Ed25519 keys: PureEd25519.
+ type: string
+ enum:
+ - SHA256WithRSA
+ - SHA384WithRSA
+ - SHA512WithRSA
+ - ECDSAWithSHA256
+ - ECDSAWithSHA384
+ - ECDSAWithSHA512
+ - PureEd25519
subject:
description: |-
Requested set of X509 certificate subject attributes.
@@ -1187,9 +1201,9 @@
type: string
dnsName:
description: |-
- dnsName is the identifier that this challenge is for, e.g. example.com.
+ dnsName is the identifier that this challenge is for, e.g., example.com.
If the requested DNSName is a 'wildcard', this field MUST be set to the
- non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
+ non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
type: string
issuerRef:
description: |-
@@ -1383,15 +1397,15 @@
type: object
properties:
clientID:
- description: client ID of the managed identity, can not be used at the same time as resourceID
+ description: client ID of the managed identity, cannot be used at the same time as resourceID
type: string
resourceID:
description: |-
- resource ID of the managed identity, can not be used at the same time as clientID
+ resource ID of the managed identity, cannot be used at the same time as clientID
Cannot be used for Azure Managed Service Identity
type: string
tenantID:
- description: tenant ID of the managed identity, can not be used at the same time as resourceID
+ description: tenant ID of the managed identity, cannot be used at the same time as resourceID
type: string
resourceGroupName:
description: resource group the DNS zone is located in
@@ -1700,7 +1714,7 @@
when challenges are processed.
This can contain arbitrary JSON data.
Secret values should not be specified in this stanza.
- If secret values are needed (e.g. credentials for a DNS service), you
+ If secret values are needed (e.g., credentials for a DNS service), you
should use a SecretKeySelector to reference a Secret resource.
For details on the schema of this field, consult the webhook provider
implementation's documentation.
@@ -1716,14 +1730,14 @@
description: |-
The name of the solver to use, as defined in the webhook provider
implementation.
- This will typically be the name of the provider, e.g. 'cloudflare'.
+ This will typically be the name of the provider, e.g., 'cloudflare'.
type: string
http01:
description: |-
Configures cert-manager to attempt to complete authorizations by
performing the HTTP01 challenge flow.
It is not possible to obtain certificates for wildcard domain names
- (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+ (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
type: object
properties:
gatewayHTTPRoute:
@@ -4330,6 +4344,8 @@
kind: ClusterIssuer
listKind: ClusterIssuerList
plural: clusterissuers
+ shortNames:
+ - ciss
singular: clusterissuer
categories:
- cert-manager
@@ -4480,7 +4496,7 @@
PreferredChain is the chain to use if the ACME server outputs multiple.
PreferredChain is no guarantee that this one gets delivered by the ACME
endpoint.
- For example, for Let's Encrypt's DST crosssign you would use:
+ For example, for Let's Encrypt's DST cross-sign you would use:
"DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
This value picks the first certificate bundle in the combined set of
ACME default and alternative chains that has a root-most certificate with
@@ -4509,6 +4525,11 @@
Name of the resource being referred to.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
+ profile:
+ description: |-
+ Profile allows requesting a certificate profile from the ACME server.
+ Supported profiles are listed by the server's ACME directory URL.
+ type: string
server:
description: |-
Server is the URL used to access the ACME server's 'directory' endpoint.
@@ -4699,15 +4720,15 @@
type: object
properties:
clientID:
- description: client ID of the managed identity, can not be used at the same time as resourceID
+ description: client ID of the managed identity, cannot be used at the same time as resourceID
type: string
resourceID:
description: |-
- resource ID of the managed identity, can not be used at the same time as clientID
+ resource ID of the managed identity, cannot be used at the same time as clientID
Cannot be used for Azure Managed Service Identity
type: string
tenantID:
- description: tenant ID of the managed identity, can not be used at the same time as resourceID
+ description: tenant ID of the managed identity, cannot be used at the same time as resourceID
type: string
resourceGroupName:
description: resource group the DNS zone is located in
@@ -5016,7 +5037,7 @@
when challenges are processed.
This can contain arbitrary JSON data.
Secret values should not be specified in this stanza.
- If secret values are needed (e.g. credentials for a DNS service), you
+ If secret values are needed (e.g., credentials for a DNS service), you
should use a SecretKeySelector to reference a Secret resource.
For details on the schema of this field, consult the webhook provider
implementation's documentation.
@@ -5032,14 +5053,14 @@
description: |-
The name of the solver to use, as defined in the webhook provider
implementation.
- This will typically be the name of the provider, e.g. 'cloudflare'.
+ This will typically be the name of the provider, e.g., 'cloudflare'.
type: string
http01:
description: |-
Configures cert-manager to attempt to complete authorizations by
performing the HTTP01 challenge flow.
It is not possible to obtain certificates for wildcard domain names
- (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+ (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
type: object
properties:
gatewayHTTPRoute:
@@ -7852,6 +7873,11 @@
server:
description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
type: string
+ serverName:
+ description: |-
+ ServerName is used to verify the hostname on the returned certificates
+ by the Vault server.
+ type: string
venafi:
description: |-
Venafi configures this issuer to sign certificates using a Venafi TPP
@@ -7888,7 +7914,7 @@
url:
description: |-
URL is the base URL for Venafi Cloud.
- Defaults to "https://api.venafi.cloud/v1".
+ Defaults to "https://api.venafi.cloud/".
type: string
tpp:
description: |-
@@ -8060,6 +8086,8 @@
kind: Issuer
listKind: IssuerList
plural: issuers
+ shortNames:
+ - iss
singular: issuer
categories:
- cert-manager
@@ -8209,7 +8237,7 @@
PreferredChain is the chain to use if the ACME server outputs multiple.
PreferredChain is no guarantee that this one gets delivered by the ACME
endpoint.
- For example, for Let's Encrypt's DST crosssign you would use:
+ For example, for Let's Encrypt's DST cross-sign you would use:
"DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA.
This value picks the first certificate bundle in the combined set of
ACME default and alternative chains that has a root-most certificate with
@@ -8238,6 +8266,11 @@
Name of the resource being referred to.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
+ profile:
+ description: |-
+ Profile allows requesting a certificate profile from the ACME server.
+ Supported profiles are listed by the server's ACME directory URL.
+ type: string
server:
description: |-
Server is the URL used to access the ACME server's 'directory' endpoint.
@@ -8428,15 +8461,15 @@
type: object
properties:
clientID:
- description: client ID of the managed identity, can not be used at the same time as resourceID
+ description: client ID of the managed identity, cannot be used at the same time as resourceID
type: string
resourceID:
description: |-
- resource ID of the managed identity, can not be used at the same time as clientID
+ resource ID of the managed identity, cannot be used at the same time as clientID
Cannot be used for Azure Managed Service Identity
type: string
tenantID:
- description: tenant ID of the managed identity, can not be used at the same time as resourceID
+ description: tenant ID of the managed identity, cannot be used at the same time as resourceID
type: string
resourceGroupName:
description: resource group the DNS zone is located in
@@ -8745,7 +8778,7 @@
when challenges are processed.
This can contain arbitrary JSON data.
Secret values should not be specified in this stanza.
- If secret values are needed (e.g. credentials for a DNS service), you
+ If secret values are needed (e.g., credentials for a DNS service), you
should use a SecretKeySelector to reference a Secret resource.
For details on the schema of this field, consult the webhook provider
implementation's documentation.
@@ -8761,14 +8794,14 @@
description: |-
The name of the solver to use, as defined in the webhook provider
implementation.
- This will typically be the name of the provider, e.g. 'cloudflare'.
+ This will typically be the name of the provider, e.g., 'cloudflare'.
type: string
http01:
description: |-
Configures cert-manager to attempt to complete authorizations by
performing the HTTP01 challenge flow.
It is not possible to obtain certificates for wildcard domain names
- (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+ (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
type: object
properties:
gatewayHTTPRoute:
@@ -11581,6 +11614,11 @@
server:
description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
type: string
+ serverName:
+ description: |-
+ ServerName is used to verify the hostname on the returned certificates
+ by the Vault server.
+ type: string
venafi:
description: |-
Venafi configures this issuer to sign certificates using a Venafi TPP
@@ -11617,7 +11655,7 @@
url:
description: |-
URL is the base URL for Venafi Cloud.
- Defaults to "https://api.venafi.cloud/v1".
+ Defaults to "https://api.venafi.cloud/".
type: string
tpp:
description: |-
@@ -11892,6 +11930,11 @@
name:
description: Name of the resource being referred to.
type: string
+ profile:
+ description: |-
+ Profile allows requesting a certificate profile from the ACME server.
+ Supported profiles are listed by the server's ACME directory URL.
+ type: string
request:
description: |-
Certificate signing request bytes in DER encoding.
@@ -11942,7 +11985,7 @@
type: string
type:
description: |-
- Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
+ Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
'tls-sni-01', etc.
This is the raw value retrieved from the ACME server.
Only 'http-01' and 'dns-01' are supported by cert-manager, other values
diff --git a/charts/cert-manager/templates/deployment.yaml b/charts/cert-manager/templates/deployment.yaml
index 8a4a973..b1af927 100644
--- a/charts/cert-manager/templates/deployment.yaml
+++ b/charts/cert-manager/templates/deployment.yaml
@@ -211,7 +211,9 @@
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
- {{- toYaml . | nindent 8 }}
+ {{- range $key, $value := . }}
+ {{ $key }}: {{ $value | quote }}
+ {{- end }}
{{- end }}
{{- with .Values.affinity }}
affinity:
diff --git a/charts/cert-manager/templates/serviceaccount.yaml b/charts/cert-manager/templates/serviceaccount.yaml
index 698ddef..fac93d0 100644
--- a/charts/cert-manager/templates/serviceaccount.yaml
+++ b/charts/cert-manager/templates/serviceaccount.yaml
@@ -12,7 +12,8 @@
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- range $k, $v := . }}
- {{- printf "%s: %s" (tpl $k $) (tpl $v $) | nindent 4 }}
+ {{- $value := $v | quote }}
+ {{- printf "%s: %s" (tpl $k $) (tpl $value $) | nindent 4 }}
{{- end }}
{{- end }}
labels:
diff --git a/charts/cert-manager/templates/servicemonitor.yaml b/charts/cert-manager/templates/servicemonitor.yaml
index dd1beec..a29f3c6 100644
--- a/charts/cert-manager/templates/servicemonitor.yaml
+++ b/charts/cert-manager/templates/servicemonitor.yaml
@@ -16,7 +16,9 @@
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
{{- include "labels" . | nindent 4 }}
+ {{- if .Values.prometheus.servicemonitor.prometheusInstance }}
prometheus: {{ .Values.prometheus.servicemonitor.prometheusInstance }}
+ {{- end }}
{{- with .Values.prometheus.servicemonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
@@ -54,8 +56,12 @@
endpoints:
- targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
path: {{ .Values.prometheus.servicemonitor.path }}
+ {{- if .Values.prometheus.servicemonitor.interval }}
interval: {{ .Values.prometheus.servicemonitor.interval }}
+ {{- end }}
+ {{- if .Values.prometheus.servicemonitor.scrapeTimeout }}
scrapeTimeout: {{ .Values.prometheus.servicemonitor.scrapeTimeout }}
+ {{- end }}
honorLabels: {{ .Values.prometheus.servicemonitor.honorLabels }}
{{- with .Values.prometheus.servicemonitor.endpointAdditionalProperties }}
{{- toYaml . | nindent 4 }}
diff --git a/charts/cert-manager/templates/startupapicheck-job.yaml b/charts/cert-manager/templates/startupapicheck-job.yaml
index 183cff4..606cc1e 100644
--- a/charts/cert-manager/templates/startupapicheck-job.yaml
+++ b/charts/cert-manager/templates/startupapicheck-job.yaml
@@ -78,7 +78,9 @@
{{- end }}
{{- with .Values.startupapicheck.nodeSelector }}
nodeSelector:
- {{- toYaml . | nindent 8 }}
+ {{- range $key, $value := . }}
+ {{ $key }}: {{ $value | quote }}
+ {{- end }}
{{- end }}
{{- with .Values.startupapicheck.affinity }}
affinity:
diff --git a/charts/cert-manager/templates/webhook-deployment.yaml b/charts/cert-manager/templates/webhook-deployment.yaml
index 857cf35..f237c2d 100644
--- a/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/charts/cert-manager/templates/webhook-deployment.yaml
@@ -137,11 +137,7 @@
livenessProbe:
httpGet:
path: /livez
- {{- if $config.healthzPort }}
- port: {{ $config.healthzPort }}
- {{- else }}
- port: 6080
- {{- end }}
+ port: healthcheck
scheme: HTTP
initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }}
@@ -151,11 +147,7 @@
readinessProbe:
httpGet:
path: /healthz
- {{- if $config.healthzPort }}
- port: {{ $config.healthzPort }}
- {{- else }}
- port: 6080
- {{- end }}
+ port: healthcheck
scheme: HTTP
initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }}
@@ -190,7 +182,9 @@
{{- end }}
{{- with .Values.webhook.nodeSelector }}
nodeSelector:
- {{- toYaml . | nindent 8 }}
+ {{- range $key, $value := . }}
+ {{ $key }}: {{ $value | quote }}
+ {{- end }}
{{- end }}
{{- with .Values.webhook.affinity }}
affinity: