weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
7,901 Commits 45 Branches 0 Tags 96 MiB
a819025a4b
Commit Graph

3146 Commits

Author SHA1 Message Date
Tim Ramlot
90f84b9c40
remove VCert fork dependency replace statement 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-07-10 11:26:16 +02:00
jetstack-bot
843deed22f
Merge pull request #6199 from inteon/add_validation_to_pki 
Add validation to pki CertificateTemplate functions
 2023-07-07 09:32:14 +02:00
Tim Ramlot
5ba29272c0
add validation to pki CertificateTemplate function 
and add support for add DontAllowInsecureCSRUsageDefinition featuregate
to use old behavior in controller

Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-07-05 13:04:21 +02:00
jetstack-bot
914944c020
Merge pull request #6176 from inteon/reconcile_managed_annotations_and_labels 
Reconcile when managed annotations/ labels are out-of-sync
 2023-07-04 11:55:29 +02:00
jetstack-bot
e66a92ac52
Merge pull request #6182 from inteon/stricter_certificaterequest_csr_webhook_validation 
BUGFIX: Stricter CertificateRequest CSR webhook validation
 2023-06-29 18:10:43 +02:00
Richard Boldiš
2b2ada9491 fix: handle multiple cloudflare dns-01 challenges for the same FQDN 
Signed-off-by: Richard Boldiš <richard@boldis.dev>
 2023-06-27 18:13:35 +02:00
Tim Ramlot
3938c75850
improve (Extended)KeyUsage parsing to be more consistent 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-26 10:06:55 +02:00
Tim Ramlot
a9339849e5
improve label and annotation checks 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-23 17:05:42 +02:00
jetstack-bot
4d1486bbfc
Merge pull request #6168 from inteon/add_public_key_match 
Add SecretPublicKeysDiffersFromCurrentCertificateRequest check
 2023-06-23 16:55:40 +02:00
Tim Ramlot
02b008fe6d
improve documentation of ParseSingleCertificateChain 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-22 12:46:08 +02:00
Tim Ramlot
19377b43b1
fix feedback from @wallrj 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-21 15:31:20 +02:00
jetstack-bot
529893556b
Merge pull request #6154 from inteon/fix_basic_constraints_alpha_feature 
BUGFIX: I incidentally removed the feature gate check that enables the UseCertificateRequestBasicConstraints feature
 2023-06-21 14:01:26 +02:00
Tim Ramlot
82499eb75b
fix failing TestNewReadinessPolicyChain test 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-20 19:06:02 +02:00
jetstack-bot
716bd301a1
Merge pull request #5003 from FlorianLiebhart/DNS-over-https-check 
Implement the DNS-over-HTTPS check
 2023-06-20 18:04:54 +02:00
Florian Liebhart
b47c5a1361 update documentation on the DNSQuery function 
Signed-off-by: Florian Liebhart <flo.liebhart@gmail.com>
 2023-06-20 10:36:27 +02:00
Florian Liebhart
ae27bfb0d6 write some unit tests for CAA Validation 
Signed-off-by: Florian Liebhart <flo.liebhart@gmail.com>
 2023-06-19 16:27:00 +02:00
Florian Liebhart
9ddf2bab90 remove HTTPS endpoint for default nameservers; remove DNS-over-TLS 
Signed-off-by: Florian Liebhart <flo.liebhart@gmail.com>
 2023-06-19 16:06:39 +02:00
Tim Ramlot
3a29635c66
add support for DoH and DoT 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-19 15:59:40 +02:00
Florian Liebhart
894e1f99d6 fix error for dns endpoint propagation 
Signed-off-by: Florian Liebhart <flo.liebhart@gmail.com>
 2023-06-19 15:32:01 +02:00
Florian Liebhart
a934bbf462 Make the DNS-Over-HTTPS Json endpoint configurable 
Signed-off-by: Florian Liebhart <flo.liebhart@gmail.com>
 2023-06-19 15:32:01 +02:00
Florian Liebhart
857d0aef9e Add logging for the DNS over HTTPS selfcheck 
Signed-off-by: Florian Liebhart <flo.liebhart@gmail.com>
 2023-06-19 15:32:01 +02:00
Florian Liebhart
fa2f063c28 rebase master 
Signed-off-by: Florian Liebhart <flo.liebhart@gmail.com>
 2023-06-19 15:32:01 +02:00
Tim Ramlot
bdb685d62e
ip address is missing from error message 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-14 21:32:13 +02:00
Tim Ramlot
9000a06956
BUGFIX: we incidentally removed the feature gate check that enables the UseCertificateRequestBasicConstraints feature 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-14 21:31:25 +02:00
Tim Ramlot
fe4f4e4aa6
re-add TODO comment and make the message more clear 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-14 14:51:39 +02:00
Tim Ramlot
8ddf016b00
fix a bug that caused the issuer-ref and certificate-name annotations on Secrets to be correct when being updated. 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-06-13 16:54:32 +02:00
schrodit
53a5a95d9f Add enableServiceLink to test pod definition 
Signed-off-by: schrodit <mail@timschrodi.tech>
 2023-06-12 09:54:37 +02:00
schrodit
c9559882c4 Remove service links from http solver pod 
Signed-off-by: schrodit <mail@timschrodi.tech>
 2023-06-12 09:26:22 +02:00
cui fliter
4723347260 fix function name in comments 
Signed-off-by: cui fliter <imcusg@gmail.com>
 2023-06-07 17:17:07 +08:00
jetstack-bot
f8940ab5c4
Merge pull request #6125 from irbekrm/explain_fao 
Document what fao stands for in the controller.cert-manager.io/fao label
 2023-06-06 14:09:45 +02:00
irbekrm
f4dc243b77 Document what fao stands for in the controller.cert-manager.io/fao label 
Signed-off-by: irbekrm <irbekrm@gmail.com>
 2023-06-02 13:45:10 +01:00
Hans Arnholm
501581ad06
issuer: acme: clouddns: Only clean up own records 
If running multiple certmanagers they can race against each other

Signed-off-by: Hans Arnholm <hans@arnholm.dk>
 2023-06-01 10:15:54 +02:00
jetstack-bot
c5e6bf39d6
Merge pull request #6054 from inteon/correct_versions 
Use Version 3 for *x509.Certificate
 2023-05-26 13:57:32 +01:00
irbekrm
b1a59164e0 Don't import controller's feature gate setup into a shared library 
To prevent controller's feature gates from overwriting other component's feature gates

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2023-05-23 12:01:30 +01:00
irbekrm
524998abdf Don't run API Priority and Fairness controller in webhook extension apiserver 
Because it is not needed and can cause issues with older versions of kube

Signed-off-by: irbekrm <irbekrm@gmail.com>
 2023-05-22 12:53:15 +01:00
jetstack-bot
529497f150
Merge pull request #6034 from gdvalle/patch-1 
apis/acme/v1: ACMEIssuer: set omitempty on optional field
 2023-05-18 11:14:39 +01:00
jetstack-bot
022292832f
Merge pull request #6032 from inteon/fix_acme_bugs 
Fix small bugs and make small improvements in ACME code
 2023-05-12 15:19:41 +01:00
Tim Ramlot
e7530880ce
use Version 3 for all Certificates and Version 0 for all CertificateRequests 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-11 10:21:55 +02:00
Tim Ramlot
20599d1d35
remove CertificateTemplateAddKeyUsages 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-10 19:22:49 +02:00
Tim Ramlot
0cf0f80b40
switch to non-deprecated functions in source code 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-10 19:22:49 +02:00
Tim Ramlot
1c2662af82
cleanup CSR & CertificateTemplate util code 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-10 19:22:49 +02:00
jetstack-bot
308c1472aa
Merge pull request #6031 from inteon/remove_deprecated_3 
Replace deprecated wait.PollUntil and wait.Poll
 2023-05-10 17:52:54 +01:00
Ashley Davis
209c252005
Move webhook testing package to core module 
This package was used by at least one external importer [1] and so the
change to make the webhook live in a separate package caused an issue
which @irbekrm reported on slack. [2]

This PR moves the webhook testing code into the core cert-manager module
so it'll be importable anywhere (albeit under a new name). This change
also requires moving the webhook options into the core cert-manager
module since they're required by the webhook testing logic.

[1] 268cd2fdba/test/env/env.go (L25)

[2] https://kubernetes.slack.com/archives/CDEQJ0Q8M/p1683650224483169

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
 2023-05-09 18:40:03 +01:00
Tim Ramlot
e08a13496d
replace deprecated wait.PollUntil() and wait.Poll() 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-09 17:47:53 +02:00
Tim Ramlot
7d0178f27d
fix small bugs and make small improvements 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-09 15:22:21 +02:00
Greg
662900a1d3
apis/acme/v1: ACMEIssuer: set omitempty on optional field 
This field is marked optional in the API docs, but is required when serializing JSON. Make it optional to match.

Signed-off-by: Greg <gdvalle@users.noreply.github.com>
 2023-05-07 09:52:13 -05:00
Tim Ramlot
d656b2d9da
replace deprecated PollImmediateUntil with PollUntilContextCancel 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-07 10:15:46 +02:00
Tim Ramlot
dc12a5d0a0
revert setting flags for logging tests 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-05 18:08:29 +02:00
Tim Ramlot
8747adf629
fix feedback 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-05 18:08:29 +02:00
Tim Ramlot
f0871eb6b8
further standardise logging across components 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
 2023-05-05 18:08:29 +02:00