feat(acme): Add default feature gate for ACME HTTP01 Ingress pathType Exact by sspreitzer · Pull Request #7795 · cert-manager/cert-manager

sspreitzer · 2025-06-11T10:25:56Z

Pull Request Motivation

With the release of cert-manager version 1.18.1 the pathType changes from ImplementationSpecific to Exact. This PR implements the feature gate ACMEHTTP01IngressPathTypeExact.

ACMEHTTP01IngressPathTypeExact changes the default pathType for ACME HTTP01 Ingress based challenges to Exact. This security feature ensures that the challenge path (which is an exact path) is not misinterpreted as a regular expression or some other Ingress specific (ImplementationSpecific) parsing. This allows HTTP01 challenges to be solved when using standards compliant Ingress controllers such as Cilium. The old default ImplementationSpecific can be reinstated by disabling this feature gate. You may need to disable the feature for compatibility with ingress-nginx. See version 1.18 release notes.

Kind

/kind feature

Release Note

Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers.

cert-manager-prow · 2025-06-11T10:25:58Z

@sspreitzer: The label(s) kind/release, kind/note cannot be applied, because the repository doesn't have them.

Details

In response to this:

Pull Request Motivation

Kind

/kind

Release Note
NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cert-manager-prow · 2025-06-11T10:26:06Z

Hi @sspreitzer. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sspreitzer · 2025-06-11T10:52:32Z

/kind feature

sspreitzer · 2025-06-11T18:27:52Z

@wallrj Please have a look. There could be some parts missing, eg. tests and e2e tests. If they should be part of this PR.

wallrj · 2025-06-12T13:18:13Z

/ok-to-test

@sspreitzer I expect the E2E tests will fail since #7792.

Upgrade ingress-nginx in E2E tests #7792

I'll figure out how to work around that.

wallrj · 2025-06-13T17:12:19Z

I think what we need to do is --set config.strict-path-validation=false here:

cert-manager/make/e2e-setup.mk

Lines 369 to 388 in 12cad36

    
           e2e-setup-ingressnginx: $(call image-tar,ingressnginx) load-$(call image-tar,ingressnginx) | $(NEEDS_HELM) 
        
           	@$(eval TAG=$(shell tar xfO $< manifest.json | jq '.[0].RepoTags[0]' -r | cut -d: -f2)) 
        
           	$(HELM) repo add ingress-nginx --force-update https://kubernetes.github.io/ingress-nginx >/dev/null 
        
           	$(HELM) upgrade \ 
        
           		--install \ 
        
           		--wait \ 
        
           		--version 4.12.3 \ 
        
           		--namespace ingress-nginx \ 
        
           		--create-namespace \ 
        
           		--set controller.image.tag=$(TAG) \ 
        
           		--set controller.image.registry=registry.k8s.io \ 
        
           		--set controller.image.digest= \ 
        
           		--set controller.image.pullPolicy=Never \ 
        
           		--set controller.service.clusterIP=${SERVICE_IP_PREFIX}.15 \ 
        
           		--set controller.service.type=ClusterIP \ 
        
           		--set controller.config.no-tls-redirect-locations= \ 
        
           		--set admissionWebhooks.enabled=true \ 
        
           		--set controller.admissionWebhooks.enabled=true \ 
        
           		--set controller.watchIngressWithoutClass=true \ 
        
           		ingress-nginx ingress-nginx/ingress-nginx >/dev/null

https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type

And then, ideally, figure out how we can set that to true if the new feature gate is disabled.
Because we run the E2E tests periodically with all the features disabled.

cert-manager/make/e2e-setup.mk

Line 228 in 12cad36

    
           FEATURE_GATES ?= ExperimentalCertificateSigningRequestControllers=true,ExperimentalGatewayAPISupport=true,ServerSideApply=true,LiteralCertificateSubject=true,UseCertificateRequestBasicConstraints=true,NameConstraints=true,OtherNames=true

If you want to try running some of the E2E tests rather than the whole suite, you can do this:

make e2e-setup
make e2e GINKGO_FOCUS='ACME HTTP01 Issuer \(Ingress\)'

If you want to test the updated code on a real cluster (with cilium installed), you can publish the images to a public registry and deploy to the current cluster in your kubeconfig, as follows:

[VC-39805] Change the default privateKey.rotationPolicy to Always #7723 (comment)
Fix AWS Route53 error detection for not-found errors during deletion #7690 (see the E2E testing section in the PR description)

Signed-off-by: Sascha Spreitzer <sascha@spreitzer.ch>

sspreitzer · 2025-06-14T11:28:55Z

/test pull-cert-manager-master-e2e-v1-33-upgrade

sspreitzer · 2025-06-15T08:57:31Z

make/e2e-setup.mk

 		--set controller.service.clusterIP=${SERVICE_IP_PREFIX}.15 \
 		--set controller.service.type=ClusterIP \
 		--set controller.config.no-tls-redirect-locations= \
+		--set-string controller.config.strict-validate-path-type=false \


Disabled ingress-nginx's URL path validation for the end to end tests. The validation violates several RFCs used by cert-manager, eg. URL & well-known, #3985, #8615.

I added an explanatory note, in #7809

Documentation related to the ACMEHTTP01IngressPathTypeExact feature #7809

sspreitzer · 2025-06-15T09:09:14Z

@wallrj I believe we are good to go.

Regarding the end to end testing idea of testing cert-manager with a disabled feature, that will be removed in the future:

Feature disablement is not tested with any feature at the moment. (As far as I can tell/see.)
It does not make sense to end-to-end test features disablements, as they will be removed in the future and are not part of the future expected deterministic behaviour of the software.
GA Feature disablements come as a backwards aid, but not as a reliable future option switch and they will be removed in an upcoming release.

Regarding adding cilium ingress as an end-to-test scenario, I would prefer creating an other PR for that implementation.

Insofar, I believe we are ready to merge this contribution. Is the release note sufficient or shall we add some more context?

atalakey4work · 2025-06-15T12:06:07Z

Due to this change, NGINX Ingress Controller v1.12.3 admission validation web hook is throwing the below error which is preventing the ingress creation:

admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: ingress contains invalid paths: path /.well-known/acme-challenge/TOKEN cannot be used with pathType Exact

sspreitzer · 2025-06-15T13:03:59Z

@atalakey4work please read: https://cert-manager.io/docs/releases/release-notes/release-notes-1.18#acme-http01-challenge-paths-are-rejected-by-the-ingress-nginx-validating-webhook

atalakey4work · 2025-06-16T04:56:48Z

@sspreitzer thank you for sharing. It is clear that this bug needs to be resolved by ingress Nginx maintainers.

Copilot

Pull Request Overview

This PR adds a feature gate (ACMEHTTP01IngressPathTypeExact) to control whether ACME HTTP01 Ingress challenge solvers default to pathType Exact or ImplementationSpecific. It introduces new unit tests in the ingress_test.go file, updates ingress creation logic in ingress.go, tweaks e2e test configuration in make/e2e-setup.mk, and adds the new feature flag in the internal/controller/feature/features.go file.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/issuer/acme/http/ingress_test.go	Added tests to validate Ingress pathType behavior based on the feature gate
pkg/issuer/acme/http/ingress.go	Updated Ingress creation logic to select the correct pathType
make/e2e-setup.mk	Added configuration to disable strict path type validation for e2e tests
internal/controller/feature/features.go	Added and documented the new ACMEHTTP01IngressPathTypeExact feature flag

Comments suppressed due to low confidence (1)

internal/controller/feature/features.go:181

There appears to be an extra backtick in the documentation comment. Consider changing pathType`` to pathType` for clarity and consistency.

// `ACMEHTTP01IngressPathTypeExact` changes the default `pathType`` for ACME

wallrj

Thanks @sspreitzer

This looks good enough to me.
Let's merge it and tomorrow
I didn't mean that you should add automated cilium tests. I just meant that you should do a manual E2E test to verity that cert-manager HTTP01 can now be used with the cilium ingress.

Similarly, I'll go through the https://cert-manager.io/docs/tutorials/acme/nginx-ingress/ tutorial to see for myself that disabling the feature gate allows me to use ingress-nginx 4.12....we'll need to add a note to that tutorial.

There's a tiny typo in the feature gate docs which we can address in an another PR.

And I want to update this section in the helm chart before we release 1.18.1, with this and another new feature gate.

cert-manager/deploy/charts/cert-manager/values.yaml

Lines 237 to 253 in 12cad36

    
           #    # Feature gates as of v1.18.0. Listed with their default values. 
        
           #    # See https://cert-manager.io/docs/cli/controller/ 
        
           #    featureGates: 
        
           #      AdditionalCertificateOutputFormats: true # GA - default=true 
        
           #      AllAlpha: false # ALPHA - default=false 
        
           #      AllBeta: false # BETA - default=false 
        
           #      ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false 
        
           #      ExperimentalGatewayAPISupport: true # BETA - default=true 
        
           #      LiteralCertificateSubject: true # BETA - default=true 
        
           #      NameConstraints: true # BETA - default=true 
        
           #      OtherNames: false # ALPHA - default=false 
        
           #      SecretsFilteredCaching: true # BETA - default=true 
        
           #      ServerSideApply: false # ALPHA - default=false 
        
           #      StableCertificateRequestName: true # BETA - default=true 
        
           #      UseCertificateRequestBasicConstraints: false # ALPHA - default=false 
        
           #      UseDomainQualifiedFinalizer: true # GA - default=true 
        
           #      ValidateCAA: false # ALPHA - default=false

And I'll need to update the cert-manager documentation with this new featuregate.

/approve
/lgtm

internal/controller/feature/features.go

cert-manager-prow · 2025-06-16T06:54:39Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

wallrj · 2025-06-16T07:27:09Z

/cherry-pick release-1.18

cert-manager-bot · 2025-06-16T07:27:45Z

@wallrj: #7795 failed to apply on top of branch "release-1.18":

Applying: feat(acme): Add default feature gate to set Ingress pathType to Exact
Using index info to reconstruct a base tree...
M	make/e2e-setup.mk
M	pkg/issuer/acme/http/ingress_test.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/issuer/acme/http/ingress_test.go
Auto-merging make/e2e-setup.mk
CONFLICT (content): Merge conflict in make/e2e-setup.mk
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 feat(acme): Add default feature gate to set Ingress pathType to Exact

Details

In response to this:

/cherry-pick release-1.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

wallrj · 2025-06-17T13:59:30Z

/cherry-pick release-1.18

cert-manager-bot · 2025-06-17T14:00:08Z

@wallrj: new pull request created: #7810

Details

In response to this:

/cherry-pick release-1.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

wallrj · 2025-06-17T15:36:22Z

Testing

I temporarily re-enabled the ingress-nginx strict-validate-path feature

_bin/tools/helm upgrade \
                                                                 --install \
                                                                 --wait \
                                                                 --version 4.12.3 \
                                                                 --namespace ingress-nginx \
                                                                 --create-namespace \
                                                                 --set controller.image.tag=v1.12.3 \
                                                                 --set controller.image.registry=registry.k8s.io \
                                                                 --set controller.image.digest= \
                                                                 --set controller.image.pullPolicy=Never \
                                                                 --set controller.service.clusterIP=10.0.0.15 \
                                                                 --set controller.service.type=ClusterIP \
                                                                 --set controller.config.no-tls-redirect-locations= \
                                                                 --set-string controller.config.strict-validate-path-type=true \
                                                                 --set admissionWebhooks.enabled=true \
                                                                 --set controller.admissionWebhooks.enabled=true \
                                                                 --set controller.watchIngressWithoutClass=true \
                                                                 ingress-nginx ingress-nginx/ingress-nginx

Observed the E2E tests fail:

make e2e GINKGO_FOCUS='ACME HTTP01 Issuer \(Ingress\)'

kubectl logs -n ingress-nginx deployments/ingress-nginx-controller controller --follow
...

E0617 15:18:17.498281 11 main.go:96] "invalid ingress configuration" err="ingress contains invalid paths: path /.well-known/acme-challenge/x__34KyXMhSW2HcazsO3wipzzuqlvN_nz8vmUzdKjWg cannot be used with pathType Exact" ingress="e2e-tests-certificatesigningrequests-6lpmf/cm-acme-http-solver-5v428"

$ kubectl  -n cert-manager logs deployments/cert-manager --follow
...

W0617 15:18:17.501566 1 warnings.go:70] path /.well-known/acme-challenge/x__34KyXMhSW2HcazsO3wipzzuqlvN_nz8vmUzdKjWg cannot be used with pathType Exact
E0617 15:18:17.501845 1 controller.go:157] "re-queuing item due to error processing" err="admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: ingress contains invalid paths: path /.well-known/acme-challenge/x__34KyXMhSW2HcazsO3wipzzuqlvN_nz8vmUzdKjWg cannot be used with pathType Exact" logger="cert-manager.controller"

Verified that I can disable the ACMEHTTP01IngressPathTypeExact feature.
Here I modified the Helm values which are used in the E2E tests.

acmesolver:
  image:
    repository: cert-manager-acmesolver-amd64
    tag: v1.18.0-17-g379f43e3de2237
cainjector:
  extraArgs:
  - --feature-gates=ServerSideApply=true
  image:
    repository: cert-manager-cainjector-amd64
    tag: v1.18.0-17-g379f43e3de2237
crds:
  enabled: true
dns01RecursiveNameservers: 10.0.0.16:53
dns01RecursiveNameserversOnly: true
extraArgs:
- --kube-api-qps=9000
- --kube-api-burst=9000
- --concurrent-workers=200
- --enable-gateway-api
featureGates: ExperimentalCertificateSigningRequestControllers=true,ExperimentalGatewayAPISupport=true,ServerSideApply=true,LiteralCertificateSubject=true,UseCertificateRequestBasicConstraints=true,NameConstraints=true,OtherNames=true,ACMEHTTP01IngressPathTypeExact=false
image:
  repository: cert-manager-controller-amd64
  tag: v1.18.0-17-g379f43e3de2237
startupapicheck:
  image:
    repository: cert-manager-startupapicheck-amd64
    tag: v1.18.0-17-g379f43e3de2237
webhook:
  featureGates: LiteralCertificateSubject=true,NameConstraints=true,OtherNames=true
  image:
    repository: cert-manager-webhook-amd64
    tag: v1.18.0-17-g379f43e3de2237

$ kubectl  -n cert-manager logs deployments/cert-manager --follow
...

W0617 15:26:16.280677 1 feature_gate.go:354] Setting GA feature gate ACMEHTTP01IngressPathTypeExact=false. It will be removed in a future release.

Now the E2E tests pass:

$make e2e GINKGO_FOCUS='ACME HTTP01 Issuer \(Ingress\)'
...
[Conformance] Certificates with External Account Binding CertificateSigningRequest with issuer type ACME HTTP01 Issuer (Ingress) should issue an ECDSA certificate for a single distinct DNS Name
/home/richard/projects/cert-manager/cert-manager/test/e2e/suite/conformance/certificatesigningrequests/suite.go:149
  STEP: Creating a kubernetes client @ 06/17/25 16:34:37.863
  STEP: Creating an API extensions client @ 06/17/25 16:34:37.864
  STEP: Creating a cert manager client @ 06/17/25 16:34:37.864
  STEP: Creating a controller-runtime client @ 06/17/25 16:34:37.864
  STEP: Creating a gateway-api client @ 06/17/25 16:34:37.864
  STEP: Building a namespace api object @ 06/17/25 16:34:37.864
  STEP: Using the namespace e2e-tests-certificatesigningrequests-rmw6f @ 06/17/25 16:34:37.866
  STEP: Building a ResourceQuota api object @ 06/17/25 16:34:37.866
  STEP: Creating an issuer resource @ 06/17/25 16:34:37.874
  STEP: Creating an ACME HTTP01 Issuer @ 06/17/25 16:34:37.877
  STEP: Waiting for acme HTTP01 Issuer to be Ready @ 06/17/25 16:34:37.887
  Jun 17 16:34:37.889: INFO: Expected Issuer acme-issuer-http01-4c9r5 condition Ready=True but it has: []
  Jun 17 16:34:38.392: INFO: Expected Issuer acme-issuer-http01-4c9r5 condition Ready=True but it has: [] (took 0s)
  STEP: Creating a CertificateSigningRequest @ 06/17/25 16:34:38.392
  STEP: Approving CertificateSigningRequest @ 06/17/25 16:34:38.397
  STEP: Waiting for the CertificateSigningRequest to be issued... @ 06/17/25 16:34:38.402
  Jun 17 16:34:38.402: INFO: Waiting for CertificateSigningRequest e2e-conformance-cq797qll7z to be ready
  Jun 17 16:34:43.402: INFO: Waiting for CertificateSigningRequest e2e-conformance-cq797qll7z to be ready
  Jun 17 16:34:51.779: INFO: Waiting for CertificateSigningRequest e2e-conformance-cq797qll7z to be ready
  Jun 17 16:34:59.778: INFO: Waiting for CertificateSigningRequest e2e-conformance-cq797qll7z to be ready
  Jun 17 16:35:02.781: INFO: Waiting for CertificateSigningRequest e2e-conformance-cq797qll7z to be ready (took 22s)
  STEP: Validating the issued CertificateSigningRequest... @ 06/17/25 16:35:02.781
  STEP: Cleaning up the issuer resource @ 06/17/25 16:35:02.791
  STEP: Deleting test namespace @ 06/17/25 16:35:02.795
• [22.560 seconds]

wallrj · 2025-06-17T15:47:47Z

Also checked that I can disable the feature via the config file

# values.yaml
config:
  featureGates:
    # Disable the use of Exact PathType in Ingress resources, to work around a bug in ingress-nginx
    # https://github.com/kubernetes/ingress-nginx/issues/11176
    ACMEHTTP01IngressPathTypeExact: false

helm upgrade -n cert-manager cert-manager _bin/cert-manager.tgz --values values.yaml

$ kubectl  -n cert-manager logs deployments/cert-manager --follow
W0617 15:42:25.514056       1 feature_gate.go:354] Setting GA feature gate ACMEHTTP01IngressPathTypeExact=false. It will be removed in a future release.

wallrj · 2025-06-17T15:53:10Z

internal/controller/feature/features.go

 	OtherNames:                                       {Default: false, PreRelease: featuregate.Alpha},
 	UseDomainQualifiedFinalizer:                      {Default: true, PreRelease: featuregate.GA},
 	DefaultPrivateKeyRotationPolicyAlways:            {Default: true, PreRelease: featuregate.Beta},
+	ACMEHTTP01IngressPathTypeExact:                   {Default: true, PreRelease: featuregate.GA},


This should be featuregate.Beta, like DefaultPrivateKeyRotationPolicyAlways above it.
It'll cause it to be turned on by default, but won't show a warning in the logs if you disable it.

Change ACMEHTTP01IngressPathTypeExact feature to beta #7813

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.18.2` -> `v1.19.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.19.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.0) [Compare Source](cert-manager/cert-manager@v1.18.2...v1.19.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues. > 📖 Read the full release notes at cert-manager.io: <https://cert-manager.io/docs/releases/release-notes/release-notes-1.19> Changes since `v1.18.0`: #### Feature - Add IPv6 rules to the default network policy ([#7726](cert-manager/cert-manager#7726), [@jcpunk](https://github.com/jcpunk)) - Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#7818](cert-manager/cert-manager#7818), [@StingRayZA](https://github.com/StingRayZA)) - Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#7795](cert-manager/cert-manager#7795), [@sspreitzer](https://github.com/sspreitzer)) - Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#7866](cert-manager/cert-manager#7866), [@erikgb](https://github.com/erikgb)) - Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#7414](cert-manager/cert-manager#7414), [@erikgb](https://github.com/erikgb)) - Added `certmanager_certificate_challenge_status` Prometheus metric. ([#7736](cert-manager/cert-manager#7736), [@hjoshi123](https://github.com/hjoshi123)) - Added `protocol` field for `rfc2136` DNS01 provider ([#7881](cert-manager/cert-manager#7881), [@hjoshi123](https://github.com/hjoshi123)) - Added experimental field `hostUsers` flag to all pods. Not set by default. ([#7973](cert-manager/cert-manager#7973), [@hjoshi123](https://github.com/hjoshi123)) - Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#7972](cert-manager/cert-manager#7972), [@lunarwhite](https://github.com/lunarwhite)) - The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#8017](cert-manager/cert-manager#8017), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#8072](cert-manager/cert-manager#8072), [@prasad89](https://github.com/prasad89)) - Updated `certificate` metrics to the collector approach. ([#7856](cert-manager/cert-manager#7856), [@hjoshi123](https://github.com/hjoshi123)) #### Bug or Regression - ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#7796](cert-manager/cert-manager#7796), [@hjoshi123](https://github.com/hjoshi123)) - BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#7816](cert-manager/cert-manager#7816), [@kinolaev](https://github.com/kinolaev)) - Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#8021](cert-manager/cert-manager#8021), [@lunarwhite](https://github.com/lunarwhite)) - Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#7961](cert-manager/cert-manager#7961), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#7836](cert-manager/cert-manager#7836), [@inteon](https://github.com/inteon)) - This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#8109](cert-manager/cert-manager#8109), [@mladen-rusev-cyberark](https://github.com/mladen-rusev-cyberark)) - Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#7792](cert-manager/cert-manager#7792), [@wallrj](https://github.com/wallrj)) #### Other (Cleanup or Flake) - Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#7761](cert-manager/cert-manager#7761), [@lunarwhite](https://github.com/lunarwhite)) - Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#7928](cert-manager/cert-manager#7928), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#8003](cert-manager/cert-manager#8003), [@hjoshi123](https://github.com/hjoshi123)) - Update kind images to include the Kubernetes 1.33 node image ([#7786](cert-manager/cert-manager#7786), [@wallrj](https://github.com/wallrj)) - Use `maps.Copy` for cleaner map handling ([#8092](cert-manager/cert-manager#8092), [@quantpoet](https://github.com/quantpoet)) - Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#8059](cert-manager/cert-manager#8059), [@armagankaratosun](https://github.com/armagankaratosun)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1711 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

cert-manager-prow bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jun 11, 2025

sspreitzer changed the title ~~feat(acme): Add feature gate to set ACME HTTP01 Ingress pathType to ImplementationSpecific~~ WIP: feat(acme): Add feature gate to set ACME HTTP01 Ingress pathType to ImplementationSpecific Jun 11, 2025

cert-manager-prow bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Jun 11, 2025

cert-manager-prow bot added kind/feature Categorizes issue or PR as related to a new feature. and removed needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Jun 11, 2025

sspreitzer force-pushed the feat/feature-gate-acme-ingress-implementationspecific branch from 903746d to ba9be37 Compare June 11, 2025 11:31

cert-manager-prow bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jun 11, 2025

sspreitzer changed the title ~~WIP: feat(acme): Add feature gate to set ACME HTTP01 Ingress pathType to ImplementationSpecific~~ WIP: feat(acme): Add default feature gate for ACME HTTP01 Ingress pathType Exact Jun 11, 2025

sspreitzer force-pushed the feat/feature-gate-acme-ingress-implementationspecific branch from ba9be37 to efecd30 Compare June 11, 2025 17:26

cert-manager-prow bot added area/acme Indicates a PR directly modifies the ACME Issuer code area/acme/http01 Indicates a PR modifies ACME HTTP01 provider code labels Jun 11, 2025

sspreitzer force-pushed the feat/feature-gate-acme-ingress-implementationspecific branch 2 times, most recently from c31df7f to 7a09b82 Compare June 11, 2025 18:25

cert-manager-prow bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 11, 2025

sspreitzer changed the title ~~WIP: feat(acme): Add default feature gate for ACME HTTP01 Ingress pathType Exact~~ feat(acme): Add default feature gate for ACME HTTP01 Ingress pathType Exact Jun 11, 2025

sspreitzer marked this pull request as ready for review June 11, 2025 18:26

cert-manager-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 11, 2025

feat(acme): Add default feature gate to set Ingress pathType to Exact

965c1b4

Signed-off-by: Sascha Spreitzer <sascha@spreitzer.ch>

sspreitzer force-pushed the feat/feature-gate-acme-ingress-implementationspecific branch from ec4ceca to 965c1b4 Compare June 14, 2025 11:10

sspreitzer commented Jun 15, 2025

View reviewed changes

wallrj linked an issue Jun 16, 2025 that may be closed by this pull request

[release-1.18] ACME + HTTP01 + Ingress-Nginx: "Error: Path cannot be used with pathType Exact" when strict-validate-path-type is enabled #7791

Closed

wallrj requested a review from Copilot June 16, 2025 06:38

Copilot AI reviewed Jun 16, 2025

View reviewed changes

wallrj approved these changes Jun 16, 2025

View reviewed changes

internal/controller/feature/features.go Show resolved Hide resolved

cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Jun 16, 2025

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 16, 2025

cert-manager-prow bot merged commit b41655d into cert-manager:master Jun 16, 2025
6 checks passed

wallrj mentioned this pull request Jun 17, 2025

Documentation related to the ACMEHTTP01IngressPathTypeExact feature #7809

Merged

cert-manager-bot mentioned this pull request Jun 17, 2025

[release-1.18] feat(acme): Add default feature gate for ACME HTTP01 Ingress pathType Exact #7810

Merged

wallrj reviewed Jun 17, 2025

View reviewed changes

This was referenced Jun 17, 2025

Change ACMEHTTP01IngressPathTypeExact feature to beta #7813

Merged

fix(acme): Use ImplementationSpecific pathType until next breaking-change release #7793

Merged

Release notes for cert-manager v1.18.1 cert-manager/website#1720

Merged

	# # Feature gates as of v1.18.0. Listed with their default values.
	# # See https://cert-manager.io/docs/cli/controller/
	# featureGates:
	# AdditionalCertificateOutputFormats: true # GA - default=true
	# AllAlpha: false # ALPHA - default=false
	# AllBeta: false # BETA - default=false
	# ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
	# ExperimentalGatewayAPISupport: true # BETA - default=true
	# LiteralCertificateSubject: true # BETA - default=true
	# NameConstraints: true # BETA - default=true
	# OtherNames: false # ALPHA - default=false
	# SecretsFilteredCaching: true # BETA - default=true
	# ServerSideApply: false # ALPHA - default=false
	# StableCertificateRequestName: true # BETA - default=true
	# UseCertificateRequestBasicConstraints: false # ALPHA - default=false
	# UseDomainQualifiedFinalizer: true # GA - default=true
	# ValidateCAA: false # ALPHA - default=false

Conversation

sspreitzer commented Jun 11, 2025 • edited by wallrj-cyberark Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow bot commented Jun 11, 2025

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow bot commented Jun 11, 2025

Uh oh!

sspreitzer commented Jun 11, 2025

Uh oh!

sspreitzer commented Jun 11, 2025

Uh oh!

wallrj commented Jun 12, 2025

Uh oh!

wallrj commented Jun 13, 2025

Uh oh!

sspreitzer commented Jun 14, 2025

Uh oh!

sspreitzer Jun 15, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

sspreitzer commented Jun 15, 2025

Uh oh!

atalakey4work commented Jun 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sspreitzer commented Jun 15, 2025

Uh oh!

atalakey4work commented Jun 16, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

wallrj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cert-manager-prow bot commented Jun 16, 2025

Uh oh!

Uh oh!

wallrj commented Jun 16, 2025

Uh oh!

cert-manager-bot commented Jun 16, 2025

Uh oh!

wallrj commented Jun 17, 2025

Uh oh!

cert-manager-bot commented Jun 17, 2025

Uh oh!

wallrj commented Jun 17, 2025

Testing

Uh oh!

wallrj commented Jun 17, 2025

Uh oh!

wallrj Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sspreitzer commented Jun 11, 2025 •

edited by wallrj-cyberark

Loading

atalakey4work commented Jun 15, 2025 •

edited

Loading

wallrj Jun 17, 2025 •

edited

Loading