[pull] master from cert-manager:master - #1066
Open
pull[bot] wants to merge 4010 commits into
Open
Conversation
Clarify gosec suppressions in ACME reachability test
…uest-rbac Remove default tokenrequest RBAC from Helm chart
feat(acme): adding implementation of ari
…o an int overflow Signed-off-by: Adam Talbot <adamtalbot93@googlemail.com>
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
* feature: process annotation `cert-manager.io/alt-names` Add additional `dnsNames` to `Certificate` resources generated from `Ingress`, `Gateway` and `ListenerSet` Signed-off-by: Jens Hausherr <jens.hausherr@pflege.de> * feature: Add IP-SANs from annotation `cert-manager.io/ip-sans` Adds IP SAns from annotations on `Ingress`, `Gateway` and `ListenerSet` resources Signed-off-by: Jens Hausherr <jens.hausherr@pflege.de> * Add test for ip-sans annotation processing Signed-off-by: Jens Hausherr <jens.hausherr@pflege.de> * Remove func util.SplitOrNil Signed-off-by: Jens Hausherr <jens.hausherr@pflege.de> --------- Signed-off-by: Jens Hausherr <jens.hausherr@pflege.de>
…validation-8937 fix: validation for certificates was failing for long durations due to an int overflow
… [security] Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…onsi-deps fix(deps): update module github.com/onsi/gomega to v1.42.1 (master)
…e.sslmate.com-src-go-pkcs12-vulnerability fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.2 [security] (master)
…-cloudflare-cloudflare-go-v6-7.x fix(deps): update module github.com/cloudflare/cloudflare-go/v6 to v7 (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…odules chore(deps): update makefile modules to fb0281c (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…odules chore(deps): update makefile modules to 72b0d34 (master)
The one-shot renewal timer in startRenewalWatcher uses Go's monotonic clock (CLOCK_MONOTONIC), which does not advance during system suspend (S3/S4) or VM live migration. When the system resumes, the timer deadline has not yet been reached, so the webhook serving certificate is never renewed — even though wall-clock time has advanced past the renewal moment. Add a periodic ticker that polls time.Now() against the wall-clock renewal deadline. Because time.Now() uses CLOCK_REALTIME for comparisons with wall-clock timestamps (such as certificate NotAfter), the ticker detects the missed renewal and triggers certificate renewal. The goroutine now returns after the first send and wraps sends in select/ctx.Done() to prevent goroutine leaks. An early return when renewalAt is the zero value prevents a spurious signal before the first certificate is issued. Signed-off-by: Nikola <peac36@abv.bg> Co-authored-by: Nikola <peac36@abv.bg> Co-authored-by: Richard Wall <richard.wall@cyberark.com> Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Remove Challenge `create` and Order `create`, `patch`, `update` from the `cert-manager-edit` aggregate ClusterRole. - A user-created Challenge with attacker-controlled spec.solver can exfiltrate ClusterIssuer credentials cross-namespace. - A user who can update an Order can change spec.issuerRef to reference a different ClusterIssuer, triggering credential exfiltration when the controller recreates the Challenge. - Challenge `patch`/`update` are retained because spec is immutable after creation (ValidateChallengeUpdate) and users need them to remove stuck finalizers (#3851, #3870). This change was already shipped in v1.19.6 and v1.20.3 via #8940 and #8941 respectively. This PR brings it to master. Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Defence in depth for GHSA-8rvj-mm4h-c258, complementing the RBAC fix in #8958. Webhook validation: - ValidateChallenge: reject Challenges lacking a controller owner reference to an Order. - ValidateOrderSpecUpdate: reject any Order spec mutation after creation. Controller hardening: - Order controller verifies both ownership AND exact spec equivalence for same-name Challenges. Mismatched Challenges are deleted and recreated. - Set gateway parentRef Group explicitly to match the CRD OpenAPI default, preventing a nil-vs-populated mismatch in spec comparison (#7890, #8518, #8619). Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Harden ACME Challenge and Order validation (GHSA-8rvj-mm4h-c258)
…odules chore(deps): update makefile modules to c9f456a (master)
…)" Signed-off-by: Richard Wall <richard.wall@cyberark.com>
Renew webhook serving certificate after system suspend
Cleanup Helm metrics path and port
…-c258 Revert "Harden ACME Challenge and Order validation (GHSA-8rvj-mm4h-c258)"
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…odules chore(deps): update makefile modules to 24aa843 (master)
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update module github.com/aws/smithy-go to v1.27.8 (master)
fix(deps): update module github.com/stretchr/testify to v1.12.0 (master)
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Lower Cloudflare DNS01 challenge record TTL from 120 to 60 seconds
fix(deps): update cloud go deps (master)
…security] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…ity] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* shim: validate annotation values in translateAnnotations (fixes #9145) Signed-off-by: Mehrdad Biukian Naeini <mehrdad.biu@mtnirancell.ir> * shim: trim and validate annotation values; reject boundary durations (#9145) Signed-off-by: Mehrdad Biukian Naeini <mehrdad.biu@mtnirancell.ir> * shim: align annotation validation with webhook (bounds, email, empty checks) Signed-off-by: Mehrdad Biukian Naeini <mehrdad.biu@mtnirancell.ir> * Update pkg/controller/certificate-shim/helper.go Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> * Apply suggestion from @hjoshi123 Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> * Update pkg/controller/certificate-shim/helper.go Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> * Update pkg/controller/certificate-shim/helper.go Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> --------- Signed-off-by: Mehrdad Biukian Naeini <mehrdad.biu@mtnirancell.ir> Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> Co-authored-by: Mehrdad Biukian Naeini <mehrdad.biu@mtnirancell.ir> Co-authored-by: Hemant Joshi <mail2hemantjoshi@pm.me>
Use server-side apply to trigger issuance in flaky private key rotation tests
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
….io-etcd-client-pkg-v3-vulnerability chore(deps): update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [security] (master)
…com-google-cel-go-vulnerability chore(deps): update module github.com/google/cel-go to v0.30.0 [security] (master)
Mechanical changes produced by golangci-lint v2.13.0 --fix, whose newer modernize analyzer rewrites errors.As to errors.AsType and prefix-only strings.Split to strings.Cut. No hand edits in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Richard Wall <richard@the-moon.net>
golangci-lint v2.13.0's staticcheck reports SA1019 for these; none have
an automatic fix:
- Replace metav1.FieldsV1{Raw: ...} literals with metav1.NewFieldsV1, as
direct access to the Raw field is deprecated in apimachinery v0.36.
CI reported only three of these because of golangci-lint's default
max-same-issues cap; all 55 are converted.
- Drop the deprecated DualStack dialer field in the Venafi client; Fast
Fallback has been the default since Go 1.12.
- Add nolint:staticcheck to the two test sites which intentionally set
the deprecated ACME EAB keyAlgorithm field.
Also replace a prefix-only strings.SplitN with strings.Cut in the
test/integration module, which 'make fix-golangci-lint' does not reach.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Richard Wall <richard@the-moon.net>
…odules chore(deps): update makefile modules to 7c9c959 (master)
…t-tagging fix: encode directoryName SANs with explicit tagging
* fix: search 9 years in cron Next for leap-day schedules Feb 29 can be eight years apart around a non-leap century year, so the five-year horizon returned the zero time for specs such as 0 0 29 2 *. Signed-off-by: wieghx <gudemail1991@gmail.com> * fix: use standard Apache header on cron Next tests The new spec_test.go is original, not copied from robfig/cron. The previous skip_license_check / robfig attribution was copied from the vendored files in this directory by mistake. Signed-off-by: wieghx <gudemail1991@gmail.com> * fix: add year to Apache boilerplate on cron Next tests boilersuite requires Copyright YEAR; the yearless header failed verify-boilerplate with "does not start with expected template type". Signed-off-by: wieghx <gudemail1991@gmail.com> --------- Signed-off-by: wieghx <gudemail1991@gmail.com>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…odules chore(deps): update makefile modules to ca8dd5c (master)
Signed-off-by: Ashley Davis <ashdavis@paloaltonetworks.com>
* adding secret issuer checks Signed-off-by: hjoshi123 <mail@hjoshi.me> Signed-off-by: Hemant Joshi <mail@hjoshi.me> * adding tests for isssuer check Signed-off-by: hjoshi123 <mail@hjoshi.me> Signed-off-by: Hemant Joshi <mail@hjoshi.me> --------- Signed-off-by: hjoshi123 <mail@hjoshi.me> Signed-off-by: Hemant Joshi <mail@hjoshi.me>
* Record a Warning event when CSR generation fails createNewCertificateRequest already handles the CertificateRequest-creation failure case by recording a Warning event via the reasonRequestFailed reason, but the earlier CSR-generation failure (pki.GenerateCSR) a few lines above it only logs the error and returns nil, so it's silently swallowed. A Certificate that hits this path gets stuck at Issuing=True/Ready=False indefinitely, since no CertificateRequest is ever created to clear the condition, with no Event or condition change to signal anything is wrong - the only trace is a controller log line. This mirrors the existing pattern for the sibling failure case a few lines below, so the fix is independent of what causes GenerateCSR to fail (e.g. a malformed nameConstraints IP range, added as the regression test here). Signed-off-by: yogeshbendre <07.yogesh@gmail.com> * fix: match event message wording to log line (will not retry) Signed-off-by: yogeshbendre <07.yogesh@gmail.com> --------- Signed-off-by: yogeshbendre <07.yogesh@gmail.com>
Add a priority=1 (wide-only) print column showing .status.notAfter so operators can see certificate expiration dates with kubectl get cert -o wide without resorting to -o yaml or jsonpath. Closes #4927 Signed-off-by: Brandon Palm <bpalm@redhat.com>
Signed-off-by: Yuedong Wu <dwcn22@outlook.com>
fix: Reject invalid CIDRs in Certificate `nameConstraints` at admission time
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…odules chore(deps): update makefile modules to 4dc1d67 (master)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )