Skip to content

Update Helm release trust-manager to v0.8.0

Robby Robo (bot) requested to merge renovate/trust-manager-0.x into main

This MR contains the following updates:

Package Update Change
trust-manager minor 0.5.0 -> v0.8.0

Release Notes

cert-manager/trust-manager (trust-manager)

v0.8.0

Compare Source

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.8.0 includes a bunch of new features, largely contributed by our awesome community!

Included is an option at startup to filter expired certificates from all bundles and the ability to include Secret and ConfigMap resources via labels.

There are also a bunch of improvements which make trust-manager easier to develop and iterate on, which isn't as exciting as new features but should make it easier for us to provide features going forwards!

Speaking of going forwards, trust-manager is on the road to v1! 🎉 From here, we want to stabilise our API, get our CRDs to v1beta1 and then v1, and bump trust-manager itself to v1. We don't have a timeline currently, but we think it's important to be clear that it's a goal of ours to be rock-solid and stable for everyone to build upon!

Special thanks to @​erikgb for his efforts in reviewing, developing and helping in this release - it couldn't have happened without him!

Read Before Updating

Removal of .status.target

trust-manager v0.8.0 removes the .status.target field from Bundle resources, which had a significant overhead to maintain and wasn't particularly useful as far as we could tell.

If you were previously relying on this field, you should be able to calculate it from the spec of your Bundle. We try to avoid breaking anything generally but we felt like this field was worth the removal.

What's Changed

New Features
Changes
Changes for trust-manager Developers

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.7.0...v0.8.0

v0.7.1

Compare Source

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.7.1 is a patch release fixing a bug in targets including PKCS#12 bundles - see #​260 for details. All users are recommended to upgrade to this version from v0.7.0 immediately.

What's Changed

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.7.0...v0.7.1

v0.7.0

Compare Source

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.7.0 adds a huge variety of changes; chief among them is support for writing trust bundles to Kubernetes Secret resources, as well as support for optionally writing a PKCS#12 trust store to the target.

We also added support for server side apply and made a variety of improvements, tweaks and patches.

What's Changed

New Contributors

Thank you to all of the many new contributors for this release - it's awesome to see such a long list of names ❤️

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.6.0...v0.7.0

v0.6.1

Compare Source

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.6.1 is intended to fix CVE-2023-44487 and CVE-2023-39325, which relate to HTTP/2 servers in Go.

We have no particular reason to think that trust-manager was specifically vulnerable to (or even impacted by) these CVEs, but given their prominence we thought it best to patch them.

What's Changed

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.6.0...v0.6.1

v0.6.0

Compare Source

trust-manager is the easiest way to manage security-critical trust bundles in Kubernetes and OpenShift clusters.

v0.6.0 includes a few bug fixes, some dependency bumps and an important quality-of-life fix for users who run approver-policy in their clusters!

approver-policy

trust-manager requires a certificate for its webhook, which is the part which checks if your Bundle resources are valid. Currently, trust-manager's helm chart depends on cert-manager for creating this certificate.

With the "default approver" enabled in cert-manager, this certificate will be auto-approved at install time. But if you're running approver-policy to have fine-grained control over the certificates you issue with cert-manager, you'll have disabled the default approver which in turn will mean that trust-manager "hangs" when you try to install it.

It's possible to manually approve the certificate using cmctl renew but manual steps aren't much fun. Instead, this release allows you to specify the new app.webhook.tls.approverPolicy.enabled Helm flag, which will create a policy permitting approver-policy to approve trust-manager's webhook certificate.

Note that you'll need to set app.webhook.tls.approverPolicy.certManagerNamespace too if you don't have cert-manager installed in the cert-manager namespace!

Validating Webhook Path Change

Updating our version of controller-runtime meant we had to change the URL at which the webhook receives validation requests, since this was changed in controller-runtime itself.

Previously (trust-manager v0.5.0 and earlier) the webhook listened on /validate but it now listens on /validate-trust-cert-manager-io-v1alpha1-bundle.

This shouldn't be a problem if you update your running containers (i.e. updating the Helm image.tag parameter to v0.6.0) at the same time as the helm chart - but it does mean that you cannot run the v0.6.0 Helm chart using the v0.5.0 images, and vice versa.

What's Changed

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.5.0...v0.6.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot. Tell Nogweii if it blows up.

Merge request reports