[pull] master from cert-manager:master #1066
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: cert-manager-bot <[email protected]>
[CI] Merge self-upgrade-master into master
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Renovate Bot <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
Co-authored-by: Richard Wall <[email protected]> Signed-off-by: iossifbenbassat123 <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
…y' into venafi-cyberark-context-consistency
Signed-off-by: Iossif Benbassat <[email protected]>
Signed-off-by: Iossif Benbassat <[email protected]>
…b-actions chore(deps): update github/codeql-action action to v4.31.2 (master)
Signed-off-by: Nikola <[email protected]>
Signed-off-by: Renovate Bot <[email protected]>
…onsi-deps fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.2 (master)
Signed-off-by: Erik Godding Boye <[email protected]>
adds logs for cases when acme server return us fatal error
Signed-off-by: cert-manager-bot <[email protected]>
Signed-off-by: Tim Ramlot <[email protected]>
…b-actions chore(deps): update github/codeql-action action to v4.31.9 (master)
fix(deps): update cloud go deps (master)
Signed-off-by: cert-manager-bot <[email protected]>
[CI] Merge self-upgrade-master into master
Signed-off-by: Renovate Bot <[email protected]>
Signed-off-by: Jesper Axelsen <[email protected]>
Signed-off-by: Renovate Bot <[email protected]>
…-sigs-kind-0.x chore(deps): update dependency kubernetes-sigs/kind to v0.31.0 (master)
fix(deps): update cloud go deps (master)
… ingress/gateway-api change should trigger a certificate update Signed-off-by: Eleanor Merry <[email protected]>
Signed-off-by: Eleanor Merry <[email protected]>
Signed-off-by: Eleanor Merry <[email protected]>
Signed-off-by: Renovate Bot <[email protected]>
venafi: Process custom fields annotations on Issuer
… controller (#8312) * Add configurable initial certificate request backoff - Add controller config field for initial certificate request backoff - Add CLI flag to configure the initial backoff duration - Use configured initial delay in trigger controller backoff - Default initial delay is 1h and backoff doubles per failure up to 32h - Update defaults, conversions, controller context, and tests Signed-off-by: Hemant Joshi <[email protected]> Co-authored-by: Richard Wall <[email protected]> Signed-off-by: Richard Wall <[email protected]> * attempt to fix test with default backoff Signed-off-by: hjoshi123 <[email protected]> --------- Signed-off-by: Hemant Joshi <[email protected]> Signed-off-by: Richard Wall <[email protected]> Signed-off-by: hjoshi123 <[email protected]> Co-authored-by: Richard Wall <[email protected]>
* BOT: run 'make upgrade-klone' and 'make generate' Signed-off-by: cert-manager-bot <[email protected]> * fix(deps): update kubernetes go deps to v0.35.0 Signed-off-by: Renovate Bot <[email protected]> * Fix some failing tests Signed-off-by: Erik Godding Boye <[email protected]> * Disable WatchListClient feature gate in tests for now Signed-off-by: Erik Godding Boye <[email protected]> * Partially reverted "Fix some failing tests" This partially reverts commit b340bd0. Signed-off-by: Tim Ramlot <[email protected]> --------- Signed-off-by: cert-manager-bot <[email protected]> Signed-off-by: Renovate Bot <[email protected]> Signed-off-by: Erik Godding Boye <[email protected]> Signed-off-by: Tim Ramlot <[email protected]> Co-authored-by: cert-manager-bot <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Tim Ramlot <[email protected]>
Signed-off-by: cert-manager-bot <[email protected]>
[CI] Merge self-upgrade-master into master
…n-ingresses Add checks for Duration/RenewBefore changes when determining if an ingress/gateway-api change should trigger a certificate update
fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.0 (master)
Signed-off-by: Pat Riehecky <[email protected]>
Signed-off-by: cert-manager-bot <[email protected]>
[CI] Merge self-upgrade-master into master
fix: update helm install NOTES to include GWAPI instructions
Signed-off-by: Hemant Joshi <[email protected]>
fix(ci): adding 1.35 kind version
* adding labels to lease Signed-off-by: hjoshi123 <[email protected]> Signed-off-by: Hemant Joshi <[email protected]> * Update cmd/cainjector/app/controller.go Co-authored-by: Erik Godding Boye <[email protected]> Signed-off-by: Hemant Joshi <[email protected]> --------- Signed-off-by: hjoshi123 <[email protected]> Signed-off-by: Hemant Joshi <[email protected]> Signed-off-by: Hemant Joshi <[email protected]> Co-authored-by: Erik Godding Boye <[email protected]>
Vault's JWT/OIDC authentication requires "bound_audiences" to be set and match at least one of the audiences on the JWT. This is in contrast to Vault's Kubernetes authentication method in which "bound_audiences" is optional. In addition, the "bound_audiences" configuration is static. As "bound_audiences" is required with the JWT/OIDC method, the per-issuer audience generated by cert-manager was difficult to use in common use cases. Either the Vault operator must define new Vault role bindings for every combination of namespace and issuer names, or every issuer must be created with a static issuer defined. Switching from the Kubernetes method to the JWT/OIDC method would also require every issuer to be updated with the audience. This changeset adds the value of the issuer's ".spec.vault.server" to the default audience list. This gives the Vault operator a static value to define for "bound_audiences". Bug: #8218 Signed-off-by: Terin Stock <[email protected]>
feat(vault): add server as default audience
Add unhealthyPodEvictionPolicy to supported PDB options
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )