weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
bfce543640
cert-manager/deploy/crds
History
Maël Valais bfce543640 serviceAccountRef: remove aud and exp, secretRef now a pointer 
Changing SecretRef to be a pointer will break people using the package as
a library.

I disabled the ability to set the audience and expiry time for security
reasons:

We decided to generate the audience dynamically instead of letting the
user configure it, and we also decided to encode the namespace and
issuer name into the audience to remediate the risk of hijacking an
existing issuer and service account with a malicious issuer.

Regarding the expiration duration of the JWT, it doesn't make sense to
let the user configure it since cert-manager will authenticate using the
JWT and immediately discard it. We thought that 1 minute would be
acceptable, although the Kubernetes API server may return a totally
different duration.

Signed-off-by: Maël Valais <mael@vls.dev>
2023-02-06 18:28:49 +01:00
..
crd-certificaterequests.yaml apply go fmt for go1.19 2022-08-04 09:51:57 +00:00
crd-certificates.yaml Updating CRDs 2022-12-06 18:54:46 +05:30
crd-challenges.yaml Bump sigs.k8s.io deps 2022-12-21 09:47:41 -08:00
crd-clusterissuers.yaml serviceAccountRef: remove aud and exp, secretRef now a pointer 2023-02-06 18:28:49 +01:00
crd-issuers.yaml serviceAccountRef: remove aud and exp, secretRef now a pointer 2023-02-06 18:28:49 +01:00
crd-orders.yaml Remove leftover cainjector annotations from our CRDs 2022-05-09 17:24:30 +01:00
README.md Remove the legacy release 2020-12-01 16:17:07 +01:00

README.md

CRDs source directory

Warning

: if you are an end-user, you do NOT need to use the files in this directory. These files are for development purposes only.

This directory contains 'source code' used to build our CustomResourceDefinition resources in a way that can be consumed by all our different deployment methods.

This package exposes a number of different Bazel targets:

  • templates: the Helm templates for the CRD manifests
  • crds: the templated CRD manifests (after running helm template)
  • crd.templated: for each CRD type, the one CRD after running helm template
  • templated_files: a filegroup containing all of the individual templated CRD files

Most users should never utilise the files in this directory directly. Instead, Bazel build targets in other packages (i.e. //deploy/manifests, //deploy/charts etc) will be configured to automatically consume the appropriate artifact listed above.