Skip to content

Update github.com/cert-manager/cert-manager to version 1.18.2 #251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 11, 2025
Merged

Update github.com/cert-manager/cert-manager to version 1.18.2 #251

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b670fa5
Update github.com/cert-manager/cert-manager to version 1.18.2
wallrj-cyberark Jul 11, 2025
601bfde
Add new fields to the internal API types
wallrj-cyberark Jun 20, 2025
566719b
make generate
wallrj-cyberark Jul 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module github.com/cert-manager/cmctl/v2
go 1.24.2

require (
github.com/cert-manager/cert-manager v1.17.4
github.com/cert-manager/cert-manager v1.18.2
github.com/go-logr/logr v1.4.3
github.com/google/gofuzz v1.2.0
github.com/sergi/go-diff v1.4.0
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
Expand Down Expand Up @@ -40,8 +40,8 @@ github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuP
github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
github.com/cert-manager/cert-manager v1.17.4 h1:pQrEur25zR23Mum1Au4jRH2p8eH3wY2v4/QahjPDzKo=
github.com/cert-manager/cert-manager v1.17.4/go.mod h1:zXVCSnEOu6vNDQOPpXrLO8a0iDnKd8uksgXe5s73p+w=
github.com/cert-manager/cert-manager v1.18.2 h1:H2P75ycGcTMauV3gvpkDqLdS3RSXonWF2S49QGA1PZE=
github.com/cert-manager/cert-manager v1.18.2/go.mod h1:icDJx4kG9BCNpGjBvrmsFd99d+lXUvWdkkcrSSQdIiw=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
Expand Down
5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/types_issuer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,11 @@ type ACMEIssuer struct {
// it, it will create an error on the Order.
// Defaults to false.
EnableDurationFeature bool

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
}

// ACMEExternalAccountBinding is a reference to a CA external account of the ACME
Expand Down
5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/types_order.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,11 @@ type OrderSpec struct {
// Duration is the duration for the not after date for the requested certificate.
// this is set on order creation as pe the ACME spec.
Duration *metav1.Duration

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
}

type OrderStatus struct {
Expand Down
4 changes: 4 additions & 0 deletions pkg/convert/internal/apis/acme/v1/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/v1alpha2/types_issuer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,11 @@ type ACMEIssuer struct {
// Defaults to false.
// +optional
EnableDurationFeature bool `json:"enableDurationFeature,omitempty"`

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAIR, the rule is that new fields should be added to the old APIs too so that the field value is not lost when converting between old and new versions. The concept is described here:

I don't think the rule is relevant here, since these conversions are for the cmctl convert tool which only needs to convert from old API types to v1, but I've done it anyway to satisfy the roundtrip tests which attempt to convert between all the supported versions.

}

// ACMEExternalAccountBinding is a reference to a CA external account of the ACME
Expand Down
5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/v1alpha2/types_order.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,11 @@ type OrderSpec struct {
// this is set on order creation as pe the ACME spec.
// +optional
Duration *metav1.Duration `json:"duration,omitempty"`

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
}

type OrderStatus struct {
Expand Down
4 changes: 4 additions & 0 deletions pkg/convert/internal/apis/acme/v1alpha2/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/v1alpha3/types_issuer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,11 @@ type ACMEIssuer struct {
// Defaults to false.
// +optional
EnableDurationFeature bool `json:"enableDurationFeature,omitempty"`

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
}

// ACMEExternalAccountBinding is a reference to a CA external account of the ACME
Expand Down
5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/v1alpha3/types_order.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,11 @@ type OrderSpec struct {
// this is set on order creation as pe the ACME spec.
// +optional
Duration *metav1.Duration `json:"duration,omitempty"`

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
}

type OrderStatus struct {
Expand Down
4 changes: 4 additions & 0 deletions pkg/convert/internal/apis/acme/v1alpha3/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/v1beta1/types_issuer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,11 @@ type ACMEIssuer struct {
// Defaults to false.
// +optional
EnableDurationFeature bool `json:"enableDurationFeature,omitempty"`

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
}

// ACMEExternalAccountBinding is a reference to a CA external account of the ACME
Expand Down
5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/acme/v1beta1/types_order.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,11 @@ type OrderSpec struct {
// this is set on order creation as pe the ACME spec.
// +optional
Duration *metav1.Duration `json:"duration,omitempty"`

// Profile allows requesting a certificate profile from the ACME server.
// Supported profiles are listed by the server's ACME directory URL.
// +optional
Profile string `json:"profile,omitempty"`
}

type OrderStatus struct {
Expand Down
4 changes: 4 additions & 0 deletions pkg/convert/internal/apis/acme/v1beta1/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions pkg/convert/internal/apis/certmanager/types_certificate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,19 @@ const (
PKCS8 PrivateKeyEncoding = "PKCS8"
)

// +kubebuilder:validation:Enum=SHA256WithRSA;SHA384WithRSA;SHA512WithRSA;ECDSAWithSHA256;ECDSAWithSHA384;ECDSAWithSHA512;PureEd25519
type SignatureAlgorithm string

const (
SHA256WithRSA SignatureAlgorithm = "SHA256WithRSA"
SHA384WithRSA SignatureAlgorithm = "SHA384WithRSA"
SHA512WithRSA SignatureAlgorithm = "SHA512WithRSA"
ECDSAWithSHA256 SignatureAlgorithm = "ECDSAWithSHA256"
ECDSAWithSHA384 SignatureAlgorithm = "ECDSAWithSHA384"
ECDSAWithSHA512 SignatureAlgorithm = "ECDSAWithSHA512"
PureEd25519 SignatureAlgorithm = "PureEd25519"
)

// CertificateSpec defines the desired state of Certificate.
//
// NOTE: The specification contains a lot of "requested" certificate attributes, it is
Expand Down Expand Up @@ -236,6 +249,13 @@ type CertificateSpec struct {
// encoding and the rotation policy.
PrivateKey *CertificatePrivateKey

// Signature algorithm to use.
// Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
// Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
// Allowed values for Ed25519 keys: PureEd25519.
// +optional
SignatureAlgorithm SignatureAlgorithm `json:"signatureAlgorithm,omitempty"`

// Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
//
// This option defaults to true, and should only be disabled if the target
Expand Down
5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/certmanager/types_issuer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,11 @@ type VaultIssuer struct {
// Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".
Server string

// ServerName is used to verify the hostname on the returned certificates
// by the Vault server.
// +optional
ServerName string `json:"serverName,omitempty"`

// Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
// "my_pki_mount/sign/my-role-name".
Path string
Expand Down
4 changes: 4 additions & 0 deletions pkg/convert/internal/apis/certmanager/v1/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions pkg/convert/internal/apis/certmanager/v1alpha2/types_certificate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,19 @@ const (
PKCS8 KeyEncoding = "pkcs8"
)

// +kubebuilder:validation:Enum=SHA256WithRSA;SHA384WithRSA;SHA512WithRSA;ECDSAWithSHA256;ECDSAWithSHA384;ECDSAWithSHA512;PureEd25519
type SignatureAlgorithm string

const (
SHA256WithRSA SignatureAlgorithm = "SHA256WithRSA"
SHA384WithRSA SignatureAlgorithm = "SHA384WithRSA"
SHA512WithRSA SignatureAlgorithm = "SHA512WithRSA"
ECDSAWithSHA256 SignatureAlgorithm = "ECDSAWithSHA256"
ECDSAWithSHA384 SignatureAlgorithm = "ECDSAWithSHA384"
ECDSAWithSHA512 SignatureAlgorithm = "ECDSAWithSHA512"
PureEd25519 SignatureAlgorithm = "PureEd25519"
)

// CertificateSpec defines the desired state of Certificate.
type CertificateSpec struct {
// Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
Expand Down Expand Up @@ -255,6 +268,13 @@ type CertificateSpec struct {
// the controller and webhook components.
// +optional
NameConstraints *NameConstraints `json:"nameConstraints,omitempty"`

// Signature algorithm to use.
// Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
// Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
// Allowed values for Ed25519 keys: PureEd25519.
// +optional
SignatureAlgorithm SignatureAlgorithm `json:"signatureAlgorithm,omitempty"`
}

type OtherName struct {
Expand Down
5 changes: 5 additions & 0 deletions pkg/convert/internal/apis/certmanager/v1alpha2/types_issuer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,11 @@ type VaultIssuer struct {
// Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".
Server string `json:"server"`

// ServerName is used to verify the hostname on the returned certificates
// by the Vault server.
// +optional
ServerName string `json:"serverName,omitempty"`

// Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g:
// "my_pki_mount/sign/my-role-name".
Path string `json:"path"`
Expand Down
Loading