[pull] master from cert-manager:master#1066
Open
pull[bot] wants to merge 3715 commits into
Open
Conversation
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
….9.0 Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Fixes #8300 cert-manager's Gateway API shim previously hard-coded HTTPS and TLS as the only accepted Listener protocol types. This prevents users with custom TLS-based protocols (e.g. DTLS for STUNner Gateways) from using cert-manager to manage their certificates. This change introduces a new `gatewayAPI.extraProtocols` field on ControllerConfiguration (both external v1alpha1 and internal types) that allows operators to specify additional protocol strings the shim should treat as TLS-capable. Changes: - Add `GatewayAPIConfig` struct with `ExtraProtocols []string` to both the v1alpha1 and internal ControllerConfiguration types; regenerate deepcopy and conversion code - Expose `--gateway-api-extra-protocols` CLI flag on the controller binary, wired through `IngressShimOptions.GatewayAPIExtraProtocols` - Extract `isTLSProtocol(protocol, extra)` helper in sync.go to replace duplicated inline protocol checks in both the Gateway and ListenerSet branches of buildCertificates - Add unit tests for isTLSProtocol and extra-protocol buildCertificates flows (Gateway and ListenerSet), including passthrough and duplicate built-in cases - Add e2e test case "Creating a Gateway with a custom extra protocol generates a Certificate" in the conformance suite, gated on --gateway-shim-extra-protocols being non-empty - Add --gateway-api-extra-protocols=DTLS to the e2e cluster setup so the new e2e test runs in CI Signed-off-by: Adam Talbot <adamtalbot93@googlemail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: cert-manager-bot <cert-manager-bot@users.noreply.github.com>
[CI] Merge self-upgrade-master into master
fix(deps): update module github.com/cloudflare/cloudflare-go/v6 to v6.9.0 (master)
Improve CAInjector SSA code
Signed-off-by: Artem Muterko <artem@sopho.tech>
…r-spec Fix typo in Order Duration field comment
Signed-off-by: cert-manager-bot <cert-manager-bot@users.noreply.github.com>
[CI] Merge self-upgrade-master into master
Signed-off-by: Hemant Joshi <mail@hjoshi.me>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: cert-manager-bot <cert-manager-bot@users.noreply.github.com>
[CI] Merge self-upgrade-master into master
fix(deps): update module github.com/hashicorp/vault/sdk to v0.25.1 (master)
…ecurity] Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…telemetry.io-otel-sdk-vulnerability chore(deps): update module go.opentelemetry.io/otel/sdk to v1.43.0 [security] (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…x-deps fix(deps): update module golang.org/x/crypto to v0.50.0 (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
chore(deps): update base images (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: cert-manager-bot <cert-manager-bot@users.noreply.github.com>
[CI] Merge self-upgrade-master into master
…b-actions chore(deps): update actions/upload-artifact action to v7.0.1 (master)
…dsAfterFinished feat(helm): add opt-in ttlSecondsAfterFinished for startupapicheck Job
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Migrate upgrade e2e test to Helm OCI
…x-deps fix(deps): update golang.org/x deps to v0.53.0 (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
fix(deps): update cloud go deps (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…onsi-deps fix(deps): update github.com/onsi deps to v2.30.0 (master)
I found this through a warning from Renovate in a repo containing kube manifests; there was an nbsp (U+00A0) in the upstream release version of cert-manager.yaml which got flagged. that one had been generated from a source code comment. I figure that any instances of nbsp's in cert-manager's docs and source are not intentional; so, replace them with spaces. Signed-off-by: Lauri Tirkkonen <lauri@hacktheplanet.fi>
replace non-breaking spaces with spaces
chore(deps): update base images (master)
Transport-level failures (DNS, connection refused, TLS errors) reaching the NGTS OAuth token endpoint were incorrectly reported as `Ready=False reason=AuthFailed`, misleading operators to chase credentials/scope issues during network outages. Fixes VC-54664 Signed-off-by: Maël Valais <mael@vls.dev>
…ssification fix: Correctly classify Venafi NGTS network errors
build-on-tag: let's store GCB logs in a bucket
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…-go-patches fix(deps): update kubernetes go patches to v0.36.2 (master)
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Fix kind image switch
Signed-off-by: Erik Godding Boye <egboye@gmail.com>
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…onsi-deps fix(deps): update github.com/onsi deps (master)
…uler-key Document the conservative ACME challenge scheduler key
Try fixing Renovate for release branches
Signed-off-by: cert-manager-bot <cert-manager-bot@users.noreply.github.com>
[CI] Merge self-upgrade-master into master
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
…odules chore(deps): update makefile modules to 7835ffe (master)
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
Add an optional waitInsteadOfSelfCheck duration to ACME HTTP01 and DNS01 solvers. When set, cert-manager skips its own propagation self-check and instead waits the configured duration after first presentation (recorded in status.presentedAt) before asking the ACME server to validate. - A value of 0 skips the self-check and asks the ACME server to validate immediately, relying on the server's own validation retries (RFC 8555 section 8.2); negative durations are rejected by the webhook. - status.presentedAt is retained on completion so the server-side-apply and legacy status-update paths stay consistent. Fixes #1292 Signed-off-by: Richard Wall <richard@the-moon.net> Co-authored-by: Richard Wall <richard.wall@cyberark.com> Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Richard Wall <richard.wall@cyberark.com>
ACME: add waitInsteadOfSelfCheck per solver
Bound DNS-over-HTTPS response read with io.LimitReader
fix(deps): update cloud go deps (master)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )