bfce543640
Changing SecretRef to be a pointer will break people using the package as a library. I disabled the ability to set the audience and expiry time for security reasons: We decided to generate the audience dynamically instead of letting the user configure it, and we also decided to encode the namespace and issuer name into the audience to remediate the risk of hijacking an existing issuer and service account with a malicious issuer. Regarding the expiration duration of the JWT, it doesn't make sense to let the user configure it since cert-manager will authenticate using the JWT and immediately discard it. We thought that 1 minute would be acceptable, although the Kubernetes API server may return a totally different duration. Signed-off-by: Maël Valais <mael@vls.dev> |
||
|---|---|---|
| .. | ||
| acme | ||
| certmanager | ||
| config/webhook | ||
| meta | ||