Helm: Fix naming format of tokenrequest RBAC resources by lunarwhite · Pull Request #7761 · cert-manager/cert-manager

lunarwhite · 2025-05-19T15:37:34Z

Pull Request Motivation

cert-manager controller tokenrequest RoleBinding name is rendered as cert-manager-cert-manager-tokenrequest, which is less consistent than its corresponding Role name cert-manager-tokenrequest. Meanwhile it would be more accurate to use {{ template "cert-manager.fullname" . }} instead of {{ template "cert-manager.serviceAccountName" . }}

Follow-up #7213

Verification

The renamed RoleBinding cert-manager-tokenrequest was created successfully, meanwhile the orphan RoleBinding cert-manager-cert-manager-tokenrequest was cleaned up automatically.

# Install the latest v1.18.2
$ k get role,rolebinding -n cert-manager
NAME                                                                  CREATED AT
role.rbac.authorization.k8s.io/cert-manager-tokenrequest              2025-08-17T07:20:30Z
role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving   2025-08-17T07:20:30Z

NAME                                                                           ROLE                                        AGE
rolebinding.rbac.authorization.k8s.io/cert-manager-cert-manager-tokenrequest   Role/cert-manager-tokenrequest              2m36s
rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving     Role/cert-manager-webhook:dynamic-serving   2m36s

# Upgrade to the patch version
$ k get role,rolebinding -n cert-manager
NAME                                                                  CREATED AT
role.rbac.authorization.k8s.io/cert-manager-tokenrequest              2025-08-17T07:20:30Z
role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving   2025-08-17T07:20:30Z

NAME                                                                         ROLE                                        AGE
rolebinding.rbac.authorization.k8s.io/cert-manager-tokenrequest              Role/cert-manager-tokenrequest              56s
rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving   Role/cert-manager-webhook:dynamic-serving   8m20s

Kind

/kind cleanup

Release Note

Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency

cert-manager-prow · 2025-05-19T15:37:45Z

Hi @lunarwhite. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

erikgb · 2025-08-17T08:28:02Z

/ok-to-test

erikgb

This looks like a reasonable fix to me. Just checking with the author of the original PR adding this: https://github.com/cert-manager/cert-manager/pull/7213/files#r2280825544

/lgtm
/approve
/hold

ThatsMrTalbot · 2025-08-17T13:18:19Z

This is a better name and renaming a RoleBinding should cause no issues.
/approve

cert-manager-prow · 2025-08-17T13:18:25Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb, ThatsMrTalbot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ThatsMrTalbot,erikgb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

erikgb · 2025-08-17T13:20:06Z

/uhold

Thanks @lunarwhite!

erikgb · 2025-08-17T13:22:36Z

I misspelled the Prow command, and that's good. Can you add a proper release note, @lunarwhite?

lunarwhite · 2025-08-17T13:31:08Z

Thanks for your quick review! Added one release-note text, please feel free to modify it.

erikgb · 2025-08-17T13:37:15Z

Very nice, thanks! 🚀

/unhold

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.18.2` -> `v1.19.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.19.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.0) [Compare Source](cert-manager/cert-manager@v1.18.2...v1.19.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues. > 📖 Read the full release notes at cert-manager.io: <https://cert-manager.io/docs/releases/release-notes/release-notes-1.19> Changes since `v1.18.0`: #### Feature - Add IPv6 rules to the default network policy ([#7726](cert-manager/cert-manager#7726), [@jcpunk](https://github.com/jcpunk)) - Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#7818](cert-manager/cert-manager#7818), [@StingRayZA](https://github.com/StingRayZA)) - Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#7795](cert-manager/cert-manager#7795), [@sspreitzer](https://github.com/sspreitzer)) - Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#7866](cert-manager/cert-manager#7866), [@erikgb](https://github.com/erikgb)) - Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#7414](cert-manager/cert-manager#7414), [@erikgb](https://github.com/erikgb)) - Added `certmanager_certificate_challenge_status` Prometheus metric. ([#7736](cert-manager/cert-manager#7736), [@hjoshi123](https://github.com/hjoshi123)) - Added `protocol` field for `rfc2136` DNS01 provider ([#7881](cert-manager/cert-manager#7881), [@hjoshi123](https://github.com/hjoshi123)) - Added experimental field `hostUsers` flag to all pods. Not set by default. ([#7973](cert-manager/cert-manager#7973), [@hjoshi123](https://github.com/hjoshi123)) - Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#7972](cert-manager/cert-manager#7972), [@lunarwhite](https://github.com/lunarwhite)) - The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#8017](cert-manager/cert-manager#8017), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#8072](cert-manager/cert-manager#8072), [@prasad89](https://github.com/prasad89)) - Updated `certificate` metrics to the collector approach. ([#7856](cert-manager/cert-manager#7856), [@hjoshi123](https://github.com/hjoshi123)) #### Bug or Regression - ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#7796](cert-manager/cert-manager#7796), [@hjoshi123](https://github.com/hjoshi123)) - BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#7816](cert-manager/cert-manager#7816), [@kinolaev](https://github.com/kinolaev)) - Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#8021](cert-manager/cert-manager#8021), [@lunarwhite](https://github.com/lunarwhite)) - Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#7961](cert-manager/cert-manager#7961), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#7836](cert-manager/cert-manager#7836), [@inteon](https://github.com/inteon)) - This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#8109](cert-manager/cert-manager#8109), [@mladen-rusev-cyberark](https://github.com/mladen-rusev-cyberark)) - Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#7792](cert-manager/cert-manager#7792), [@wallrj](https://github.com/wallrj)) #### Other (Cleanup or Flake) - Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#7761](cert-manager/cert-manager#7761), [@lunarwhite](https://github.com/lunarwhite)) - Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#7928](cert-manager/cert-manager#7928), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#8003](cert-manager/cert-manager#8003), [@hjoshi123](https://github.com/hjoshi123)) - Update kind images to include the Kubernetes 1.33 node image ([#7786](cert-manager/cert-manager#7786), [@wallrj](https://github.com/wallrj)) - Use `maps.Copy` for cleaner map handling ([#8092](cert-manager/cert-manager#8092), [@quantpoet](https://github.com/quantpoet)) - Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#8059](cert-manager/cert-manager#8059), [@armagankaratosun](https://github.com/armagankaratosun)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1711 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

wallrj-cyberark · 2025-10-15T16:06:59Z

@lunarwhite We have released this. Please test and feedback: https://github.com/cert-manager/cert-manager/releases/tag/v1.19.1

cert-manager-prow bot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. area/deploy Indicates a PR modifies deployment configuration labels May 19, 2025

Fix naming format of tokenrequest RBAC resources

8a88e7e

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

lunarwhite force-pushed the patch branch from 14403b4 to 8a88e7e Compare August 17, 2025 07:48

cert-manager-prow bot added ok-to-test and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 17, 2025

erikgb mentioned this pull request Aug 17, 2025

Add RBAC for the serviceaccount to create tokens #7213

Merged

erikgb reviewed Aug 17, 2025

View reviewed changes

cert-manager-prow bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Aug 17, 2025

cert-manager-prow bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Aug 17, 2025

cert-manager-prow bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 17, 2025

cert-manager-prow bot merged commit ff887c8 into cert-manager:master Aug 17, 2025
5 of 6 checks passed

lunarwhite deleted the patch branch August 18, 2025 02:02

lunarwhite mentioned this pull request Jan 6, 2026

CM-825: release chore: Upstream bump for v1.19.2 and rebase for v1.19.0 release openshift/cert-manager-operator#358

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Helm: Fix naming format of tokenrequest RBAC resources#7761

Helm: Fix naming format of tokenrequest RBAC resources#7761
cert-manager-prow[bot] merged 1 commit intocert-manager:masterfrom
lunarwhite:patch

lunarwhite commented May 19, 2025 •

edited by wallrj-cyberark

Loading

Uh oh!

cert-manager-prow bot commented May 19, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

erikgb left a comment

Uh oh!

ThatsMrTalbot commented Aug 17, 2025

Uh oh!

cert-manager-prow bot commented Aug 17, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

lunarwhite commented Aug 17, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

Uh oh!

wallrj-cyberark commented Oct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

lunarwhite commented May 19, 2025 • edited by wallrj-cyberark Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

Verification

Kind

Release Note

Uh oh!

cert-manager-prow bot commented May 19, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

ThatsMrTalbot commented Aug 17, 2025

Uh oh!

cert-manager-prow bot commented Aug 17, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

lunarwhite commented Aug 17, 2025

Uh oh!

erikgb commented Aug 17, 2025

Uh oh!

Uh oh!

wallrj-cyberark commented Oct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lunarwhite commented May 19, 2025 •

edited by wallrj-cyberark

Loading