cert-manager: 1.20.3 -> 1.21.0
Change-Id: I50161b8cfd621c1b07de87358fe8c14d1b14f711
diff --git a/charts/cert-manager/templates/_helpers.tpl b/charts/cert-manager/templates/_helpers.tpl
index c58adeb..83d844f 100644
--- a/charts/cert-manager/templates/_helpers.tpl
+++ b/charts/cert-manager/templates/_helpers.tpl
@@ -179,7 +179,7 @@
Any changes to this function should also be made in cert-manager, trust-manager, approver-policy, ...
See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
*/}}
-{{- define "image" -}}
+{{- define "cert-manager.image" -}}
{{- /*
Calling convention:
@@ -191,7 +191,7 @@
*/ -}}
{{- if ne (len .) 4 -}}
- {{- fail (printf "ERROR: template \"image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
+ {{- fail (printf "ERROR: template \"cert-manager.image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
{{- end -}}
{{- $image := index . 0 -}}
diff --git a/charts/cert-manager/templates/cainjector-deployment.yaml b/charts/cert-manager/templates/cainjector-deployment.yaml
index 89f6afe..6b097f0 100644
--- a/charts/cert-manager/templates/cainjector-deployment.yaml
+++ b/charts/cert-manager/templates/cainjector-deployment.yaml
@@ -76,7 +76,7 @@
{{- end }}
containers:
- name: {{ .Chart.Name }}-cainjector
- image: "{{ template "image" (tuple .Values.cainjector.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+ image: "{{ template "cert-manager.image" (tuple .Values.cainjector.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
args:
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -151,6 +151,11 @@
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if .Values.cainjector.runtimeClassName }}
+ runtimeClassName: {{ .Values.cainjector.runtimeClassName | quote }}
+ {{- else if .Values.global.runtimeClassName }}
+ runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+ {{- end }}
{{- with .Values.cainjector.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
index 039062d..baf9190 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
@@ -3215,6 +3215,24 @@
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
token:
description: |-
@@ -3253,13 +3271,21 @@
properties:
presented:
description: |-
- presented will be set to true if the challenge values for this challenge
- are currently 'presented'.
- This *does not* imply the self check is passing. Only that the values
- have been 'submitted' for the appropriate challenge mechanism (i.e. the
- DNS01 TXT record has been presented, or the HTTP01 configuration has been
- configured).
+ Presented is true once cert-manager has configured the solver resources
+ needed to expose this challenge's validation material.
+ For example, the DNS01 TXT record has been created, or the HTTP01 solver
+ has been configured to serve the challenge token.
+ This does not imply the self check is passing, that the ACME server has
+ validated the challenge, or that cert-manager has already accepted the
+ challenge with the ACME server.
type: boolean
+ presentedAt:
+ description: |-
+ PresentedAt records when cert-manager first configured the solver
+ resources for this challenge. This is used by the optional delay-based
+ readiness logic.
+ format: date-time
+ type: string
processing:
description: |-
Used to denote whether this challenge should be processed or not.
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
index 59596e7..d64e5d6 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
@@ -79,7 +79,7 @@
duration:
description: |-
Duration is the duration for the not after date for the requested certificate.
- this is set on order creation as pe the ACME spec.
+ This is set on order creation as per the ACME spec.
type: string
ipAddresses:
description: |-
@@ -119,6 +119,15 @@
Profile allows requesting a certificate profile from the ACME server.
Supported profiles are listed by the server's ACME directory URL.
type: string
+ replaces:
+ description: |-
+ Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this
+ Order is intended to replace. When set, cert-manager will include the
+ "replaces" field on the newOrder request to the ACME server if and only
+ if the server advertises ARI support in its directory. The CertID has
+ the form "base64url(AKI).base64url(serial)" and is derived locally from
+ the currently issued leaf certificate.
+ type: string
request:
description: |-
Certificate signing request bytes in DER encoding.
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
index 7ebc08e..c77f7da 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
@@ -286,10 +286,16 @@
`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
(e.g., because of company policy). Please note that the security of the algorithm is not that important
in reality, because the unencrypted certificate and private key are also stored in the Secret.
+ `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026.
+ Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC.
+ The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256.
+ Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher,
+ or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.
enum:
- LegacyRC2
- LegacyDES
- Modern2023
+ - Modern2026
type: string
required:
- create
@@ -502,6 +508,53 @@
Cannot be set if the `renewBefore` field is set.
format: int32
type: integer
+ renewal:
+ description: |-
+ `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is
+ `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`.
+ properties:
+ policy:
+ description: '`policy` must be one of `Disabled`, `RenewBefore`.'
+ enum:
+ - RenewBefore
+ - Disabled
+ type: string
+ windows:
+ description: '`windows` mentions the behavior of when the renewal must happen.'
+ items:
+ description: CertificateRenewalWindows is the definition for renewal windows
+ properties:
+ cron:
+ description: |-
+ `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:
+ * * * * *
+ | | | | |
+ | | | | day of the week (0–6) (Sunday to Saturday;
+ | | | month (1–12) 7 is also Sunday on some systems)
+ | | day of the month (1–31)
+ | hour (0–23)
+ minute (0–59)
+ minLength: 1
+ type: string
+ timezone:
+ description: |-
+ `timezone` is IANA compliant timezone. For example America/Denver.
+ If this field is not set, timezone is treated as UTC.
+ minLength: 1
+ type: string
+ windowDuration:
+ description: |-
+ `windowDuration` is how long the cron definition is active for.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+ pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$
+ type: string
+ required:
+ - cron
+ - windowDuration
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
revisionHistoryLimit:
description: |-
The maximum number of CertificateRequest revisions that are maintained in
@@ -692,6 +745,47 @@
Read-only.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
properties:
+ acme:
+ description: ACME stores information that is fetched from the ACME CA server.
+ properties:
+ ari:
+ description: |-
+ ARI stores the ACME Renewal Information that is fetched from the ACME server
+ in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.
+ properties:
+ explanationURL:
+ description: |-
+ ExplanationURL is a human-readable URL that may explain why the suggested window
+ has its current value.
+ type: string
+ lastChecked:
+ description: LastChecked is the time at which the ACME server was last checked for renewal information.
+ format: date-time
+ type: string
+ lastError:
+ description: LastError is the last error encountered when checking the ACME server for renewal information, if any.
+ type: string
+ nextCheck:
+ description: NextCheck is the time at which the ACME server will next be checked for renewal information.
+ format: date-time
+ type: string
+ suggestedWindow:
+ description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.
+ properties:
+ end:
+ description: End is the end of the suggested renewal window.
+ format: date-time
+ type: string
+ start:
+ description: Start is the start of the suggested renewal window.
+ format: date-time
+ type: string
+ required:
+ - end
+ - start
+ type: object
+ type: object
+ type: object
conditions:
description: |-
List of status conditions to indicate the status of certificates.
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
index f5de226..6b401c4 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
@@ -3328,6 +3328,24 @@
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
type: array
x-kubernetes-list-type: atomic
@@ -3442,6 +3460,62 @@
- roleId
- secretRef
type: object
+ aws:
+ description: |-
+ AWS authenticates with Vault using AWS IAM authentication.
+ This allows authentication using IAM roles for service accounts (IRSA),
+ EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+ properties:
+ iamRoleArn:
+ description: |-
+ The ARN of the AWS IAM role to assume using the Kubernetes service account
+ token. Required when using IRSA (serviceAccountRef is set).
+ This role must have a trust policy that allows the OIDC provider to assume it.
+ type: string
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/aws" will be used.
+ type: string
+ region:
+ description: |-
+ The AWS region to use for authentication. If not specified, the region
+ will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+ variables, falling back to "us-east-1" if not set.
+ type: string
+ role:
+ description: A required field containing the Vault Role to assume when authenticating.
+ minLength: 1
+ type: string
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a web identity
+ token for IRSA (IAM Roles for Service Accounts) authentication.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+ The default audiences are always included in the token.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ vaultHeaderValue:
+ description: |-
+ The Vault header value to include in the STS signing request.
+ This is used to prevent replay attacks.
+ type: string
+ required:
+ - role
+ type: object
clientCertificate:
description: |-
ClientCertificate authenticates with Vault by presenting a client
@@ -3676,6 +3750,46 @@
required:
- apiTokenSecretRef
type: object
+ ngts:
+ description: |-
+ NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+ using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+ properties:
+ credentialsRef:
+ description: |-
+ CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+ Client ID and Client Secret. The secret must contain the keys 'client-id' and
+ 'client-secret'.
+ properties:
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ tokenEndpoint:
+ description: |-
+ TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+ for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+ Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+ type: string
+ tsgID:
+ description: |-
+ TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+ for example "1234567890". The tsg_id: prefix is added automatically.
+ This field is required.
+ type: string
+ url:
+ description: |-
+ URL is the base URL for the NGTS API endpoint.
+ Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+ type: string
+ required:
+ - credentialsRef
+ - tsgID
+ type: object
tpp:
description: |-
TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
@@ -3744,6 +3858,9 @@
required:
- zone
type: object
+ x-kubernetes-validations:
+ - message: exactly one of tpp, cloud, or ngts must be configured
+ rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1'
type: object
status:
description: Status of the ClusterIssuer. This is set and managed automatically.
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
index 68a2dd0..0bb87b7 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
@@ -3327,6 +3327,24 @@
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
type: array
x-kubernetes-list-type: atomic
@@ -3441,6 +3459,62 @@
- roleId
- secretRef
type: object
+ aws:
+ description: |-
+ AWS authenticates with Vault using AWS IAM authentication.
+ This allows authentication using IAM roles for service accounts (IRSA),
+ EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+ properties:
+ iamRoleArn:
+ description: |-
+ The ARN of the AWS IAM role to assume using the Kubernetes service account
+ token. Required when using IRSA (serviceAccountRef is set).
+ This role must have a trust policy that allows the OIDC provider to assume it.
+ type: string
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/aws" will be used.
+ type: string
+ region:
+ description: |-
+ The AWS region to use for authentication. If not specified, the region
+ will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+ variables, falling back to "us-east-1" if not set.
+ type: string
+ role:
+ description: A required field containing the Vault Role to assume when authenticating.
+ minLength: 1
+ type: string
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a web identity
+ token for IRSA (IAM Roles for Service Accounts) authentication.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+ The default audiences are always included in the token.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request a token.
+ type: string
+ required:
+ - name
+ type: object
+ vaultHeaderValue:
+ description: |-
+ The Vault header value to include in the STS signing request.
+ This is used to prevent replay attacks.
+ type: string
+ required:
+ - role
+ type: object
clientCertificate:
description: |-
ClientCertificate authenticates with Vault by presenting a client
@@ -3675,6 +3749,46 @@
required:
- apiTokenSecretRef
type: object
+ ngts:
+ description: |-
+ NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+ using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+ properties:
+ credentialsRef:
+ description: |-
+ CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+ Client ID and Client Secret. The secret must contain the keys 'client-id' and
+ 'client-secret'.
+ properties:
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ tokenEndpoint:
+ description: |-
+ TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+ for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+ Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+ type: string
+ tsgID:
+ description: |-
+ TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+ for example "1234567890". The tsg_id: prefix is added automatically.
+ This field is required.
+ type: string
+ url:
+ description: |-
+ URL is the base URL for the NGTS API endpoint.
+ Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+ type: string
+ required:
+ - credentialsRef
+ - tsgID
+ type: object
tpp:
description: |-
TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
@@ -3743,6 +3857,9 @@
required:
- zone
type: object
+ x-kubernetes-validations:
+ - message: exactly one of tpp, cloud, or ngts must be configured
+ rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1'
type: object
status:
description: Status of the Issuer. This is set and managed automatically.
diff --git a/charts/cert-manager/templates/deployment.yaml b/charts/cert-manager/templates/deployment.yaml
index c4d267a..fa2af6c 100644
--- a/charts/cert-manager/templates/deployment.yaml
+++ b/charts/cert-manager/templates/deployment.yaml
@@ -86,7 +86,7 @@
{{- end }}
containers:
- name: {{ .Chart.Name }}-controller
- image: "{{ template "image" (tuple .Values.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+ image: "{{ template "cert-manager.image" (tuple .Values.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -114,7 +114,7 @@
- --leader-election-retry-period={{ .retryPeriod }}
{{- end }}
{{- end }}
- - --acme-http01-solver-image={{ template "image" (tuple .Values.acmesolver.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}
+ - --acme-http01-solver-image={{ template "cert-manager.image" (tuple .Values.acmesolver.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}
{{- with .Values.extraArgs }}
{{- toYaml . | nindent 10 }}
{{- end }}
@@ -132,6 +132,11 @@
{{- if .Values.featureGates }}
- --feature-gates={{ .Values.featureGates }}
{{- end }}
+ {{- if .Values.global.commonLabels }}
+ {{- range $key, $value := .Values.global.commonLabels }}
+ - --acme-http01-solver-extra-labels={{ $key }}={{ $value }}
+ {{- end }}
+ {{- end }}
{{- if .Values.maxConcurrentChallenges }}
- --max-concurrent-challenges={{ .Values.maxConcurrentChallenges }}
{{- end }}
@@ -147,6 +152,9 @@
{{- if .Values.disableAutoApproval }}
- --controllers=-certificaterequests-approver
{{- end }}
+ {{- with .Values.acmesolver.runtimeClassName }}
+ - --acme-http01-solver-runtime-class-name={{ . | quote }}
+ {{- end }}
ports:
- containerPort: 9402
name: http-metrics
@@ -213,6 +221,11 @@
{{- if .Values.extraContainers }}
{{- toYaml .Values.extraContainers | nindent 8 }}
{{- end }}
+ {{- if .Values.runtimeClassName }}
+ runtimeClassName: {{ .Values.runtimeClassName | quote }}
+ {{- else if .Values.global.runtimeClassName }}
+ runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+ {{- end }}
{{- $nodeSelector := .Values.global.nodeSelector | default dict }}
{{- $nodeSelector = merge $nodeSelector (.Values.nodeSelector | default dict) }}
{{- with $nodeSelector }}
diff --git a/charts/cert-manager/templates/podmonitor.yaml b/charts/cert-manager/templates/podmonitor.yaml
index 72d2dfe..f35f219 100644
--- a/charts/cert-manager/templates/podmonitor.yaml
+++ b/charts/cert-manager/templates/podmonitor.yaml
@@ -53,7 +53,7 @@
{{- end }}
podMetricsEndpoints:
- port: http-metrics
- path: {{ .Values.prometheus.podmonitor.path }}
+ path: /metrics
interval: {{ .Values.prometheus.podmonitor.interval }}
scrapeTimeout: {{ .Values.prometheus.podmonitor.scrapeTimeout }}
honorLabels: {{ .Values.prometheus.podmonitor.honorLabels }}
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index e1a01b9..4910e72 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -45,50 +45,6 @@
---
-{{- if .Values.serviceAccount.create }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
- name: {{ template "cert-manager.fullname" . }}-tokenrequest
- namespace: {{ include "cert-manager.namespace" . }}
- labels:
- app: {{ include "cert-manager.name" . }}
- app.kubernetes.io/name: {{ include "cert-manager.name" . }}
- app.kubernetes.io/instance: {{ .Release.Name }}
- app.kubernetes.io/component: "controller"
- {{- include "labels" . | nindent 4 }}
-rules:
- - apiGroups: [""]
- resources: ["serviceaccounts/token"]
- resourceNames: ["{{ template "cert-manager.serviceAccountName" . }}"]
- verbs: ["create"]
-
----
-
-# grant cert-manager permission to create tokens for the serviceaccount
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: {{ include "cert-manager.fullname" . }}-tokenrequest
- namespace: {{ include "cert-manager.namespace" . }}
- labels:
- app: {{ include "cert-manager.name" . }}
- app.kubernetes.io/name: {{ include "cert-manager.name" . }}
- app.kubernetes.io/instance: {{ .Release.Name }}
- app.kubernetes.io/component: "controller"
- {{- include "labels" . | nindent 4 }}
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: {{ template "cert-manager.fullname" . }}-tokenrequest
-subjects:
- - kind: ServiceAccount
- name: {{ template "cert-manager.serviceAccountName" . }}
- namespace: {{ include "cert-manager.namespace" . }}
-{{- end }}
-
----
-
# Issuer controller role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@@ -515,15 +471,21 @@
resources: ["certificates/status"]
verbs: ["update"]
{{- /*
- Challenge and Order resources are not intended to be created or
- modified directly by users.
+ Challenge and Order resources are not intended to be created by users
+ (GHSA-8rvj-mm4h-c258).
- Challenges: "create" is excluded. "patch" and "update" are retained
- because spec is immutable after creation (ValidateChallengeUpdate)
- and because users need them to remove stuck finalizers
+ Challenges: "create" is excluded because a user-created Challenge with
+ attacker-controlled spec.solver can exfiltrate ClusterIssuer credentials
+ cross-namespace. "patch" and "update" are retained because spec is
+ immutable after creation (ValidateChallengeUpdate) so they cannot change
+ solver config, and because users need them to remove stuck finalizers
(see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
- Orders: "create", "patch", and "update" are excluded.
+ Orders: "create", "patch", and "update" are excluded because a user
+ who can update an Order can change spec.issuerRef to reference a
+ different ClusterIssuer, then delete the Challenge; the Orders
+ controller recreates the Challenge with the attacker-chosen Issuer's
+ solver config, exfiltrating its credentials.
*/}}
- apiGroups: ["acme.cert-manager.io"]
resources: ["challenges"]
diff --git a/charts/cert-manager/templates/service.yaml b/charts/cert-manager/templates/service.yaml
index 360ec64..3dedc68 100644
--- a/charts/cert-manager/templates/service.yaml
+++ b/charts/cert-manager/templates/service.yaml
@@ -28,8 +28,7 @@
ports:
- protocol: TCP
port: 9402
- name: tcp-prometheus-servicemonitor
- targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
+ name: http-metrics
selector:
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
diff --git a/charts/cert-manager/templates/servicemonitor.yaml b/charts/cert-manager/templates/servicemonitor.yaml
index 76f358f..a33df0b 100644
--- a/charts/cert-manager/templates/servicemonitor.yaml
+++ b/charts/cert-manager/templates/servicemonitor.yaml
@@ -54,8 +54,8 @@
- {{ include "cert-manager.namespace" . }}
{{- end }}
endpoints:
- - targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
- path: {{ .Values.prometheus.servicemonitor.path }}
+ - targetPort: http-metrics
+ path: /metrics
{{- if .Values.prometheus.servicemonitor.interval }}
interval: {{ .Values.prometheus.servicemonitor.interval }}
{{- end }}
diff --git a/charts/cert-manager/templates/startupapicheck-job.yaml b/charts/cert-manager/templates/startupapicheck-job.yaml
index 7f1b0ff..0093472 100644
--- a/charts/cert-manager/templates/startupapicheck-job.yaml
+++ b/charts/cert-manager/templates/startupapicheck-job.yaml
@@ -16,6 +16,9 @@
{{- end }}
spec:
backoffLimit: {{ .Values.startupapicheck.backoffLimit }}
+ {{- if hasKey .Values.startupapicheck "ttlSecondsAfterFinished" }}
+ ttlSecondsAfterFinished: {{ .Values.startupapicheck.ttlSecondsAfterFinished }}
+ {{- end }}
template:
metadata:
labels:
@@ -54,7 +57,7 @@
{{- end }}
containers:
- name: {{ .Chart.Name }}-startupapicheck
- image: "{{ template "image" (tuple .Values.startupapicheck.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+ image: "{{ template "cert-manager.image" (tuple .Values.startupapicheck.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
args:
- check
@@ -83,6 +86,11 @@
volumeMounts:
{{- toYaml . | nindent 12 }}
{{- end }}
+ {{- if .Values.startupapicheck.runtimeClassName }}
+ runtimeClassName: {{ .Values.startupapicheck.runtimeClassName | quote }}
+ {{- else if .Values.global.runtimeClassName }}
+ runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+ {{- end }}
{{- $nodeSelector := .Values.global.nodeSelector | default dict }}
{{- $nodeSelector = merge $nodeSelector (.Values.startupapicheck.nodeSelector | default dict) }}
{{- with $nodeSelector }}
diff --git a/charts/cert-manager/templates/webhook-deployment.yaml b/charts/cert-manager/templates/webhook-deployment.yaml
index 66d6ead..cb2425c 100644
--- a/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/charts/cert-manager/templates/webhook-deployment.yaml
@@ -81,7 +81,7 @@
{{- end }}
containers:
- name: {{ .Chart.Name }}-webhook
- image: "{{ template "image" (tuple .Values.webhook.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+ image: "{{ template "cert-manager.image" (tuple .Values.webhook.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
args:
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -204,6 +204,11 @@
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if .Values.webhook.runtimeClassName }}
+ runtimeClassName: {{ .Values.webhook.runtimeClassName | quote }}
+ {{- else if .Values.global.runtimeClassName }}
+ runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+ {{- end }}
{{- with .Values.webhook.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}