feat: API defaults for IssuerRef by erikgb · Pull Request #7414 · cert-manager/cert-manager

erikgb · 2024-11-09T10:13:38Z

Pull Request Motivation

This PR will add the first API defaults to cert-manager APIs. I have personally been motivated to suggest this multiple times, as I think the cert-manager defaults are too "hidden". At least not evident for consumers of cert-manager Go API. PR was triggered by cert-manager/approver-policy#523 (comment).

Since the fields we are adding API defaults belong to a struct with a very "general" name (ObjectReference), I suggest renaming the struct as part of this PR. After discussing this change in our bi-weekly development meeting, I have attempted to make this change non-breaking in the Go API by aliasing the struct type to its current name. ~~I am not sure this will be 100% non-breaking, but I think so.~~ UPDATE: This change will be non-breaking. For now, I have kept the cert-manager use of the deprecated ObjectReference, and it compiles.

Kind

/kind feature

Release Note

Added API defaults to issuer references group (cert-manager.io) and kind (Issuer).

cert-manager-prow · 2024-11-09T10:13:41Z

@erikgb: The label(s) kind/release, kind/note cannot be applied, because the repository doesn't have them.

Details

In response to this:

Pull Request Motivation

POC/WIP PR will be used as input for a discussion about eventually adding API defaults to cert-manager APIs. I have personally been motivated to suggest this multiple times, as I think the cert-manager defaults are too "hidden". At least not evident for consumers of cert-manager Go API. PR was triggered by cert-manager/approver-policy#523 (comment).

Kind

/kind

Release Note
NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cert-manager-prow · 2024-11-09T10:13:42Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

cert-manager-bot · 2025-07-12T15:44:13Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
/lifecycle stale

erikgb · 2025-07-20T15:25:25Z

/test all

erikgb · 2025-07-20T16:32:16Z

/test all

cert-manager-prow · 2025-07-20T16:37:08Z

@erikgb: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cert-manager-master-e2e-v1-32-upgrade	`49b6cd0`	link	true	`/test pull-cert-manager-master-e2e-v1-32-upgrade`
pull-cert-manager-master-e2e-v1-32	`49b6cd0`	link	true	`/test pull-cert-manager-master-e2e-v1-32`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

erikgb · 2025-07-30T19:14:54Z

/remove-lifecycle stale
/kind feature

internal/apis/meta/types.go

pkg/api/util/issuers.go

inteon · 2025-07-31T10:15:41Z

/approve

cert-manager-prow · 2025-07-31T10:15:50Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bashlion, inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: Erik Godding Boye <egboye@gmail.com>

inteon · 2025-08-02T17:14:55Z

/lgtm

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.18.2` -> `v1.19.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.19.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.0) [Compare Source](cert-manager/cert-manager@v1.18.2...v1.19.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues. > 📖 Read the full release notes at cert-manager.io: <https://cert-manager.io/docs/releases/release-notes/release-notes-1.19> Changes since `v1.18.0`: #### Feature - Add IPv6 rules to the default network policy ([#7726](cert-manager/cert-manager#7726), [@jcpunk](https://github.com/jcpunk)) - Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#7818](cert-manager/cert-manager#7818), [@StingRayZA](https://github.com/StingRayZA)) - Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#7795](cert-manager/cert-manager#7795), [@sspreitzer](https://github.com/sspreitzer)) - Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#7866](cert-manager/cert-manager#7866), [@erikgb](https://github.com/erikgb)) - Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#7414](cert-manager/cert-manager#7414), [@erikgb](https://github.com/erikgb)) - Added `certmanager_certificate_challenge_status` Prometheus metric. ([#7736](cert-manager/cert-manager#7736), [@hjoshi123](https://github.com/hjoshi123)) - Added `protocol` field for `rfc2136` DNS01 provider ([#7881](cert-manager/cert-manager#7881), [@hjoshi123](https://github.com/hjoshi123)) - Added experimental field `hostUsers` flag to all pods. Not set by default. ([#7973](cert-manager/cert-manager#7973), [@hjoshi123](https://github.com/hjoshi123)) - Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#7972](cert-manager/cert-manager#7972), [@lunarwhite](https://github.com/lunarwhite)) - The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#8017](cert-manager/cert-manager#8017), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#8072](cert-manager/cert-manager#8072), [@prasad89](https://github.com/prasad89)) - Updated `certificate` metrics to the collector approach. ([#7856](cert-manager/cert-manager#7856), [@hjoshi123](https://github.com/hjoshi123)) #### Bug or Regression - ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#7796](cert-manager/cert-manager#7796), [@hjoshi123](https://github.com/hjoshi123)) - BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#7816](cert-manager/cert-manager#7816), [@kinolaev](https://github.com/kinolaev)) - Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#8021](cert-manager/cert-manager#8021), [@lunarwhite](https://github.com/lunarwhite)) - Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#7961](cert-manager/cert-manager#7961), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#7836](cert-manager/cert-manager#7836), [@inteon](https://github.com/inteon)) - This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#8109](cert-manager/cert-manager#8109), [@mladen-rusev-cyberark](https://github.com/mladen-rusev-cyberark)) - Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#7792](cert-manager/cert-manager#7792), [@wallrj](https://github.com/wallrj)) #### Other (Cleanup or Flake) - Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#7761](cert-manager/cert-manager#7761), [@lunarwhite](https://github.com/lunarwhite)) - Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#7928](cert-manager/cert-manager#7928), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#8003](cert-manager/cert-manager#8003), [@hjoshi123](https://github.com/hjoshi123)) - Update kind images to include the Kubernetes 1.33 node image ([#7786](cert-manager/cert-manager#7786), [@wallrj](https://github.com/wallrj)) - Use `maps.Copy` for cleaner map handling ([#8092](cert-manager/cert-manager#8092), [@quantpoet](https://github.com/quantpoet)) - Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#8059](cert-manager/cert-manager#8059), [@armagankaratosun](https://github.com/armagankaratosun)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1711 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

inteon · 2025-10-09T09:05:02Z

deploy/charts/cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml

                      type: string
                    kind:
-                      description: Kind of the resource being referred to.
+                      default: Issuer


@erikgb turns out that this is a breaking changing, the Issuer value is only the default for the cert-manager.io group, other groups might have other default kinds.

@inteon, but how is this kind default actually applied for other groups? Do you have any references to how this broke someone?

This is applied in-code (same as how cert-manager was doing this before).
This PR is failing because of this: cert-manager/issuer-lib#337

issuerRef: name: test-issuer group: example.com

now defaults to

issuerRef: name: test-issuer kind: Issuer group: example.com

instead of

issuerRef: name: test-issuer kind: ExampleIssuer group: example.com

inteon · 2025-10-09T09:05:27Z

deploy/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml

                      type: string
                    kind:
-                      description: Kind of the resource being referred to.
+                      default: Issuer


see https://github.com/cert-manager/cert-manager/pull/7414/files#r2416079201

wallrj-cyberark · 2025-10-15T15:52:56Z

We reverted this in: https://github.com/cert-manager/cert-manager/releases/tag/v1.19.1

cert-manager-prow bot added release-note-none Denotes a PR that doesn't merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Nov 9, 2024

bashlion approved these changes Jan 3, 2025

View reviewed changes

erikgb force-pushed the issuer-ref-defaults branch from 49b6cd0 to 9cbc13b Compare April 13, 2025 14:50

wallrj mentioned this pull request May 7, 2025

[VC-39805] Change the default privateKey.rotationPolicy to Always #7723

Merged

cert-manager-prow bot added lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jul 12, 2025

erikgb force-pushed the issuer-ref-defaults branch from 9cbc13b to c92b316 Compare July 20, 2025 15:09

cert-manager-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 20, 2025

erikgb force-pushed the issuer-ref-defaults branch from c92b316 to d3da561 Compare July 20, 2025 16:00

cert-manager-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 20, 2025

erikgb force-pushed the issuer-ref-defaults branch from a75d547 to 7c6caff Compare July 20, 2025 16:45

cert-manager-prow bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Jul 30, 2025

cert-manager-prow bot added kind/feature Categorizes issue or PR as related to a new feature. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Jul 30, 2025

erikgb changed the title ~~WIP: feat: API defaults for IssuerRef~~ feat: API defaults for IssuerRef Jul 30, 2025

cert-manager-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 30, 2025

erikgb requested review from ThatsMrTalbot, bashlion and wallrj and removed request for bashlion July 30, 2025 19:15

inteon reviewed Jul 31, 2025

View reviewed changes

internal/apis/meta/types.go Outdated Show resolved Hide resolved

inteon reviewed Jul 31, 2025

View reviewed changes

pkg/api/util/issuers.go Outdated Show resolved Hide resolved

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 31, 2025

feat: API defaults for IssuerRef

236523b

Signed-off-by: Erik Godding Boye <egboye@gmail.com>

erikgb force-pushed the issuer-ref-defaults branch from 678dab2 to 236523b Compare July 31, 2025 16:36

cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Aug 2, 2025

cert-manager-prow bot merged commit cbd6df2 into cert-manager:master Aug 2, 2025
6 checks passed

erikgb mentioned this pull request Aug 3, 2025

Migrate all uses of deprecated ObjectReference #7892

Merged

inteon reviewed Oct 9, 2025

View reviewed changes

inteon mentioned this pull request Oct 9, 2025

Revert breaking change: only default 'kind' when 'group' is cert-manager.io #8157

Closed

erikgb mentioned this pull request Oct 14, 2025

REVERT: API defaults for issuer reference kind and group #8173

Merged

inteon mentioned this pull request Mar 19, 2026

Remove deprecated ObjectReference #8625

Merged

Conversation

erikgb commented Nov 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow bot commented Nov 9, 2024

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow bot commented Nov 9, 2024

Uh oh!

cert-manager-bot commented Jul 12, 2025

Uh oh!

erikgb commented Jul 20, 2025

Uh oh!

erikgb commented Jul 20, 2025

Uh oh!

cert-manager-prow bot commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erikgb commented Jul 30, 2025

Uh oh!

Uh oh!

Uh oh!

inteon commented Jul 31, 2025

Uh oh!

cert-manager-prow bot commented Jul 31, 2025

Uh oh!

inteon commented Aug 2, 2025

Uh oh!

Uh oh!

inteon Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

erikgb Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

inteon Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

inteon Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

inteon Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark commented Oct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

erikgb commented Nov 9, 2024 •

edited

Loading

cert-manager-prow bot commented Jul 20, 2025 •

edited

Loading

erikgb Oct 9, 2025 •

edited

Loading

inteon Oct 9, 2025 •

edited

Loading